killmbr | hxxp://github malware

Analysis

user interaction
yes
max time kernel
180s
max time network
220s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/09/2026, 00:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

Reason

Machine shutdown

General

Target
http://github malware
Sample260930-a2gtfaba93

Score

10^/10

bootkit discovery killmbr persistence ransomware trojan upx wiper

Malware Config

Signatures

Family: KillMBR
KillMBR is a trojan that attempts to overwrite the Master Boot Record.
wiper trojan killmbr

Detects KillMBR 1 IoCs

resource	yara_rule
behavioral1/files/0x001000000001c5fe-1631.dat	family_killmbr

Downloads MZ/PE file 1 IoCs

flow	pid	Process
179	5544	msedge.exe

Executes dropped EXE 11 IoCs

pid	Process
2928	FlashKiller.exe
4352	Nostart.exe
4816	Nostart.exe
5824	MEMZ.exe
4132	MEMZ.exe
1476	MEMZ.exe
3464	MEMZ.exe
5028	MEMZ.exe
1656	MEMZ.exe
4916	MEMZ.exe
4856	VeryFun.exe

Contacts third-party web service commonly abused for C2 1 TTPs 6 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
174	raw.githubusercontent.com
175	raw.githubusercontent.com
176	raw.githubusercontent.com
177	raw.githubusercontent.com
178	raw.githubusercontent.com
179	raw.githubusercontent.com

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	MEMZ.exe

AutoIT Executable 9 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral1/memory/1140-1709-0x0000000000D00000-0x0000000000E9C000-memory.dmp	autoit_exe
behavioral1/memory/4864-1714-0x0000000000F70000-0x0000000001064000-memory.dmp	autoit_exe
behavioral1/memory/1624-1727-0x0000000001180000-0x000000000128C000-memory.dmp	autoit_exe
behavioral1/memory/4856-1744-0x0000000000540000-0x0000000000B7D000-memory.dmp	autoit_exe
behavioral1/memory/4856-1745-0x0000000000540000-0x0000000000B7D000-memory.dmp	autoit_exe
behavioral1/memory/6136-1748-0x0000000000D00000-0x0000000000E0C000-memory.dmp	autoit_exe
behavioral1/memory/4856-1789-0x0000000000540000-0x0000000000B7D000-memory.dmp	autoit_exe
behavioral1/memory/5416-1813-0x0000000001210000-0x000000000131C000-memory.dmp	autoit_exe
behavioral1/memory/4856-1814-0x0000000000540000-0x0000000000B7D000-memory.dmp	autoit_exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 4856 set thread context of 1140	4856	VeryFun.exe	156
PID 4856 set thread context of 4864	4856	VeryFun.exe	157

UPX packed file 21 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x0009000000006994-1679.dat	upx
behavioral1/memory/4856-1705-0x0000000000540000-0x0000000000B7D000-memory.dmp	upx
behavioral1/memory/1140-1707-0x0000000000D00000-0x0000000000E9C000-memory.dmp	upx
behavioral1/memory/1140-1708-0x0000000000D00000-0x0000000000E9C000-memory.dmp	upx
behavioral1/memory/1140-1709-0x0000000000D00000-0x0000000000E9C000-memory.dmp	upx
behavioral1/memory/4864-1710-0x0000000000F70000-0x0000000001064000-memory.dmp	upx
behavioral1/memory/4864-1714-0x0000000000F70000-0x0000000001064000-memory.dmp	upx
behavioral1/memory/4864-1713-0x0000000000F70000-0x0000000001064000-memory.dmp	upx
behavioral1/memory/1624-1725-0x0000000001180000-0x000000000128C000-memory.dmp	upx
behavioral1/memory/1624-1726-0x0000000001180000-0x000000000128C000-memory.dmp	upx
behavioral1/memory/1624-1727-0x0000000001180000-0x000000000128C000-memory.dmp	upx
behavioral1/memory/4856-1744-0x0000000000540000-0x0000000000B7D000-memory.dmp	upx
behavioral1/memory/4856-1745-0x0000000000540000-0x0000000000B7D000-memory.dmp	upx
behavioral1/memory/6136-1746-0x0000000000D00000-0x0000000000E0C000-memory.dmp	upx
behavioral1/memory/6136-1747-0x0000000000D00000-0x0000000000E0C000-memory.dmp	upx
behavioral1/memory/6136-1748-0x0000000000D00000-0x0000000000E0C000-memory.dmp	upx
behavioral1/memory/4856-1789-0x0000000000540000-0x0000000000B7D000-memory.dmp	upx
behavioral1/memory/5416-1811-0x0000000001210000-0x000000000131C000-memory.dmp	upx
behavioral1/memory/5416-1813-0x0000000001210000-0x000000000131C000-memory.dmp	upx
behavioral1/memory/5416-1812-0x0000000001210000-0x000000000131C000-memory.dmp	upx
behavioral1/memory/4856-1814-0x0000000000540000-0x0000000000B7D000-memory.dmp	upx

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System.ini	VeryFun.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5376	2928	WerFault.exe	129

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FlashKiller.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nostart.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nostart.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MEMZ.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MEMZ.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VeryFun.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5544	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	MEMZ.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-461973139-3212354679-1508698038-1000\{BD1B5A49-EF57-4107-A8F1-8BF75F71684D}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4792	msedge.exe
4792	msedge.exe
4132	MEMZ.exe
4132	MEMZ.exe
4132	MEMZ.exe
1476	MEMZ.exe
4132	MEMZ.exe
1476	MEMZ.exe
3464	MEMZ.exe
1476	MEMZ.exe
1476	MEMZ.exe
3464	MEMZ.exe
4132	MEMZ.exe
4132	MEMZ.exe
3464	MEMZ.exe
3464	MEMZ.exe
1476	MEMZ.exe
1476	MEMZ.exe
4132	MEMZ.exe
4132	MEMZ.exe
4132	MEMZ.exe
4132	MEMZ.exe
1476	MEMZ.exe
1476	MEMZ.exe
3464	MEMZ.exe
3464	MEMZ.exe
5028	MEMZ.exe
5028	MEMZ.exe
4132	MEMZ.exe
1656	MEMZ.exe
4132	MEMZ.exe
1656	MEMZ.exe
1476	MEMZ.exe
1476	MEMZ.exe
5028	MEMZ.exe
5028	MEMZ.exe
3464	MEMZ.exe
3464	MEMZ.exe
5028	MEMZ.exe
1476	MEMZ.exe
1476	MEMZ.exe
5028	MEMZ.exe
4132	MEMZ.exe
1656	MEMZ.exe
1656	MEMZ.exe
4132	MEMZ.exe
4132	MEMZ.exe
1656	MEMZ.exe
1656	MEMZ.exe
4132	MEMZ.exe
5028	MEMZ.exe
5028	MEMZ.exe
1476	MEMZ.exe
1476	MEMZ.exe
3464	MEMZ.exe
3464	MEMZ.exe
1476	MEMZ.exe
1476	MEMZ.exe
5028	MEMZ.exe
5028	MEMZ.exe
4132	MEMZ.exe
4132	MEMZ.exe
1656	MEMZ.exe
1656	MEMZ.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 18 IoCs

pid	Process
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4856	VeryFun.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe

Suspicious use of SendNotifyMessage 18 IoCs

pid	Process
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
4864	cmd.exe
4864	cmd.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5096 wrote to memory of 4688	5096	msedge.exe	91
PID 5096 wrote to memory of 5428	5096	msedge.exe	92
PID 5096 wrote to memory of 5544	5096	msedge.exe	93
PID 5096 wrote to memory of 5428	5096	msedge.exe	92
PID 5096 wrote to memory of 5428	5096	msedge.exe	92
PID 5096 wrote to memory of 4524	5096	msedge.exe	94
PID 5096 wrote to memory of 4524	5096	msedge.exe	94
PID 5096 wrote to memory of 2132	5096	msedge.exe	96
PID 5096 wrote to memory of 4864	5096	msedge.exe	97
PID 5096 wrote to memory of 2132	5096	msedge.exe	96
PID 5096 wrote to memory of 2132	5096	msedge.exe	96
PID 5096 wrote to memory of 4864	5096	msedge.exe	97
PID 5096 wrote to memory of 4864	5096	msedge.exe	97
PID 5096 wrote to memory of 2000	5096	msedge.exe	99
PID 5096 wrote to memory of 5592	5096	msedge.exe	98
PID 5096 wrote to memory of 2000	5096	msedge.exe	99
PID 5096 wrote to memory of 2000	5096	msedge.exe	99
PID 5096 wrote to memory of 5592	5096	msedge.exe	98
PID 5096 wrote to memory of 5592	5096	msedge.exe	98
PID 5096 wrote to memory of 3384	5096	msedge.exe	100
PID 5096 wrote to memory of 3384	5096	msedge.exe	100
PID 5096 wrote to memory of 3384	5096	msedge.exe	100
PID 5096 wrote to memory of 3284	5096	msedge.exe	102
PID 5096 wrote to memory of 3284	5096	msedge.exe	102
PID 5096 wrote to memory of 3284	5096	msedge.exe	102
PID 5096 wrote to memory of 2656	5096	msedge.exe	104
PID 5096 wrote to memory of 4300	5096	msedge.exe	105
PID 5096 wrote to memory of 1020	5096	msedge.exe	106
PID 5096 wrote to memory of 4300	5096	msedge.exe	105
PID 5096 wrote to memory of 1020	5096	msedge.exe	106
PID 5096 wrote to memory of 2876	5096	msedge.exe	109
PID 5096 wrote to memory of 2876	5096	msedge.exe	109
PID 5096 wrote to memory of 2876	5096	msedge.exe	109
PID 5096 wrote to memory of 3124	5096	msedge.exe	112
PID 5096 wrote to memory of 3868	5096	msedge.exe	113
PID 5096 wrote to memory of 4640	5096	msedge.exe	114
PID 5096 wrote to memory of 4904	5096	msedge.exe	115
PID 5096 wrote to memory of 4904	5096	msedge.exe	115
PID 5096 wrote to memory of 4904	5096	msedge.exe	115
PID 5096 wrote to memory of 1032	5096	msedge.exe	116
PID 5096 wrote to memory of 1032	5096	msedge.exe	116
PID 5096 wrote to memory of 1032	5096	msedge.exe	116
PID 5096 wrote to memory of 4436	5096	msedge.exe	117
PID 5096 wrote to memory of 4436	5096	msedge.exe	117
PID 5096 wrote to memory of 5036	5096	msedge.exe	118
PID 5096 wrote to memory of 5036	5096	msedge.exe	118
PID 5096 wrote to memory of 5036	5096	msedge.exe	118
PID 5096 wrote to memory of 2104	5096	msedge.exe	119
PID 5096 wrote to memory of 2104	5096	msedge.exe	119
PID 5096 wrote to memory of 960	5096	msedge.exe	121
PID 5096 wrote to memory of 960	5096	msedge.exe	121
PID 5096 wrote to memory of 960	5096	msedge.exe	121
PID 5096 wrote to memory of 3312	5096	msedge.exe	122
PID 5096 wrote to memory of 3312	5096	msedge.exe	122
PID 5096 wrote to memory of 3312	5096	msedge.exe	122
PID 5096 wrote to memory of 5980	5096	msedge.exe	123
PID 5096 wrote to memory of 5980	5096	msedge.exe	123
PID 5096 wrote to memory of 5980	5096	msedge.exe	123
PID 5096 wrote to memory of 5036	5096	msedge.exe	124
PID 5096 wrote to memory of 3672	5096	msedge.exe	125
PID 5096 wrote to memory of 1440	5096	msedge.exe	126
PID 5096 wrote to memory of 3672	5096	msedge.exe	125
PID 5096 wrote to memory of 5036	5096	msedge.exe	124
PID 5096 wrote to memory of 5036	5096	msedge.exe	124

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://github malware
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x288,0x7ff981f9c188,0x7ff981f9c194,0x7ff981f9c1a0
  2⤵
  PID:4688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1576,i,10982900495186080629,18344637334950424350,262144 --field-trial-handle=2356,i,13507624372109143227,11332345905854253957,262144 --variations-seed-version --mojo-platform-channel-handle=2360 /prefetch:2
  2⤵
  PID:5428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1776,i,17429450192781282176,8878184483054242311,524288 --field-trial-handle=2356,i,13507624372109143227,11332345905854253957,262144 --variations-seed-version --mojo-platform-channel-handle=2392 /prefetch:11
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:5544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2208,i,5809010096765269727,14050150135696362726,524288 --field-trial-handle=2356,i,13507624372109143227,11332345905854253957,262144 --variations-seed-version --mojo-platform-channel-handle=2576 /prefetch:13
  2⤵
  PID:4524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3652,i,12836752544687114446,9287767323567021675,2097152 --field-trial-handle=2356,i,13507624372109143227,11332345905854253957,262144 --variations-seed-version --mojo-platform-channel-handle=3744 /prefetch:1
  2⤵
  PID:2132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3656,i,16888729138143194873,10518609048038935369,2097152 --field-trial-handle=2356,i,13507624372109143227,11332345905854253957,262144 --variations-seed-version --mojo-platform-channel-handle=3748 /prefetch:1
  2⤵
  PID:4864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4176,i,17656536196499321013,924520038207841987,2097152 --field-trial-handle=2356,i,13507624372109143227,11332345905854253957,262144 --variations-seed-version --mojo-platform-channel-handle=4476 /prefetch:1
  2⤵
  PID:5592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4348,i,14305526257926843900,12959499876752329704,2097152 --field-trial-handle=2356,i,13507624372109143227,11332345905854253957,262144 --variations-seed-version --mojo-platform-channel-handle=4664 /prefetch:9
  2⤵
  PID:2000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3880,i,6847678083286848335,13372542041465569517,2097152 --field-trial-handle=2356,i,13507624372109143227,11332345905854253957,262144 --variations-seed-version --mojo-platform-channel-handle=3816 /prefetch:1
  2⤵
  PID:3384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5304,i,17466649839034870946,9676427307003021757,2097152 --field-trial-handle=2356,i,13507624372109143227,11332345905854253957,262144 --variations-seed-version --mojo-platform-channel-handle=5340 /prefetch:1
  2⤵
  PID:3284
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5864,i,6003854646704995250,10037141705811462067,524288 --field-trial-handle=2356,i,13507624372109143227,11332345905854253957,262144 --variations-seed-version --mojo-platform-channel-handle=5880 /prefetch:14
  2⤵
  PID:5788
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5864,i,6003854646704995250,10037141705811462067,524288 --field-trial-handle=2356,i,13507624372109143227,11332345905854253957,262144 --variations-seed-version --mojo-platform-channel-handle=5880 /prefetch:14
  2⤵
  PID:2656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3832,i,3190624186698844579,901251646290892087,524288 --field-trial-handle=2356,i,13507624372109143227,11332345905854253957,262144 --variations-seed-version --mojo-platform-channel-handle=3828 /prefetch:14
  2⤵
  PID:4300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3824,i,10393382757430563026,3604627403099658441,524288 --field-trial-handle=2356,i,13507624372109143227,11332345905854253957,262144 --variations-seed-version --mojo-platform-channel-handle=6324 /prefetch:14
  2⤵
  PID:1020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6488,i,446963765639120945,6303684788797344230,2097152 --field-trial-handle=2356,i,13507624372109143227,11332345905854253957,262144 --variations-seed-version --mojo-platform-channel-handle=6516 /prefetch:1
  2⤵
  PID:2876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4764,i,15307490035892563144,16328975024842007366,524288 --field-trial-handle=2356,i,13507624372109143227,11332345905854253957,262144 --variations-seed-version --mojo-platform-channel-handle=4872 /prefetch:14
  2⤵
  PID:3124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5136,i,8374651121270919564,15034304694829470838,524288 --field-trial-handle=2356,i,13507624372109143227,11332345905854253957,262144 --variations-seed-version --mojo-platform-channel-handle=4664 /prefetch:14
  2⤵
  PID:3868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5132,i,2307986673387207983,17993994591671661880,524288 --field-trial-handle=2356,i,13507624372109143227,11332345905854253957,262144 --variations-seed-version --mojo-platform-channel-handle=4748 /prefetch:14
  2⤵
  PID:4640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=3392,i,14196072288183431494,12320162532620826005,2097152 --field-trial-handle=2356,i,13507624372109143227,11332345905854253957,262144 --variations-seed-version --mojo-platform-channel-handle=2488 /prefetch:1
  2⤵
  PID:4904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=6548,i,17275954436848942324,8047575621869869202,2097152 --field-trial-handle=2356,i,13507624372109143227,11332345905854253957,262144 --variations-seed-version --mojo-platform-channel-handle=6524 /prefetch:1
  2⤵
  PID:1032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6412,i,3593028987164162776,2594403102167699765,524288 --field-trial-handle=2356,i,13507624372109143227,11332345905854253957,262144 --variations-seed-version --mojo-platform-channel-handle=5448 /prefetch:14
  2⤵
  PID:4436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=6744,i,12609203286682571251,8053972251636335111,2097152 --field-trial-handle=2356,i,13507624372109143227,11332345905854253957,262144 --variations-seed-version --mojo-platform-channel-handle=4468 /prefetch:1
  2⤵
  PID:5036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=600,i,2306284174225849497,5102868949683131638,524288 --field-trial-handle=2356,i,13507624372109143227,11332345905854253957,262144 --variations-seed-version --mojo-platform-channel-handle=6860 /prefetch:14
  2⤵
  PID:2104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=6020,i,13430443734726492199,12390813066947405762,2097152 --field-trial-handle=2356,i,13507624372109143227,11332345905854253957,262144 --variations-seed-version --mojo-platform-channel-handle=6024 /prefetch:1
  2⤵
  PID:960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=6760,i,12986797658950666044,3464912149599274503,2097152 --field-trial-handle=2356,i,13507624372109143227,11332345905854253957,262144 --variations-seed-version --mojo-platform-channel-handle=5396 /prefetch:1
  2⤵
  PID:3312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=6812,i,14901572778057366895,11300212778980609719,2097152 --field-trial-handle=2356,i,13507624372109143227,11332345905854253957,262144 --variations-seed-version --mojo-platform-channel-handle=6432 /prefetch:1
  2⤵
  PID:5980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=7652,i,10014086938864260625,13973548420012427397,2097152 --field-trial-handle=2356,i,13507624372109143227,11332345905854253957,262144 --variations-seed-version --mojo-platform-channel-handle=7676 /prefetch:1
  2⤵
  PID:5036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7640,i,18206909644915124890,16481208321005421175,524288 --field-trial-handle=2356,i,13507624372109143227,11332345905854253957,262144 --variations-seed-version --mojo-platform-channel-handle=7656 /prefetch:14
  2⤵
  PID:3672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7644,i,1948512274589272757,3347594095438766652,524288 --field-trial-handle=2356,i,13507624372109143227,11332345905854253957,262144 --variations-seed-version --mojo-platform-channel-handle=7528 /prefetch:14
  2⤵
  PID:1440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8112,i,14855424239816331204,5827627743644709822,524288 --field-trial-handle=2356,i,13507624372109143227,11332345905854253957,262144 --variations-seed-version --mojo-platform-channel-handle=8096 /prefetch:14
  2⤵
  PID:4996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=7364,i,3975758334369061899,6221239551658203999,262144 --field-trial-handle=2356,i,13507624372109143227,11332345905854253957,262144 --variations-seed-version --mojo-platform-channel-handle=7336 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --always-read-main-dll --metrics-shmem-handle=3760,i,682342812664946115,18246929665296279961,2097152 --field-trial-handle=2356,i,13507624372109143227,11332345905854253957,262144 --variations-seed-version --mojo-platform-channel-handle=7204 /prefetch:1
  2⤵
  PID:3076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7876,i,9023786514768667191,12383423458609673761,524288 --field-trial-handle=2356,i,13507624372109143227,11332345905854253957,262144 --variations-seed-version --mojo-platform-channel-handle=5440 /prefetch:14
  2⤵
  PID:4820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7780,i,9295687704294397218,13115617025424372353,524288 --field-trial-handle=2356,i,13507624372109143227,11332345905854253957,262144 --variations-seed-version --mojo-platform-channel-handle=7520 /prefetch:14
  2⤵
  PID:5860
- C:\Users\Admin\Downloads\Nostart.exe
  "C:\Users\Admin\Downloads\Nostart.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --always-read-main-dll --metrics-shmem-handle=7384,i,12931884248370095996,5025031151505688759,2097152 --field-trial-handle=2356,i,13507624372109143227,11332345905854253957,262144 --variations-seed-version --mojo-platform-channel-handle=7328 /prefetch:1
  2⤵
  PID:5072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7468,i,1341224555738378654,18080882287890573342,524288 --field-trial-handle=2356,i,13507624372109143227,11332345905854253957,262144 --variations-seed-version --mojo-platform-channel-handle=5836 /prefetch:14
  2⤵
  PID:2504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7972,i,864743949518048552,13858693142461264249,524288 --field-trial-handle=2356,i,13507624372109143227,11332345905854253957,262144 --variations-seed-version --mojo-platform-channel-handle=8328 /prefetch:14
  2⤵
  PID:2668
- C:\Users\Admin\Downloads\MEMZ.exe
  "C:\Users\Admin\Downloads\MEMZ.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  PID:5824
- - C:\Users\Admin\Downloads\MEMZ.exe
    "C:\Users\Admin\Downloads\MEMZ.exe" /watchdog
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:4132
- - C:\Users\Admin\Downloads\MEMZ.exe
    "C:\Users\Admin\Downloads\MEMZ.exe" /watchdog
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:1476
- - C:\Users\Admin\Downloads\MEMZ.exe
    "C:\Users\Admin\Downloads\MEMZ.exe" /watchdog
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:3464
- - C:\Users\Admin\Downloads\MEMZ.exe
    "C:\Users\Admin\Downloads\MEMZ.exe" /watchdog
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:5028
- - C:\Users\Admin\Downloads\MEMZ.exe
    "C:\Users\Admin\Downloads\MEMZ.exe" /watchdog
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:1656
- - C:\Users\Admin\Downloads\MEMZ.exe
    "C:\Users\Admin\Downloads\MEMZ.exe" /main
    3⤵
    - Executes dropped EXE
    - Writes to the Master Boot Record (MBR)
    - System Location Discovery: System Language Discovery
    PID:4916
  - - C:\Windows\SysWOW64\notepad.exe
      "C:\Windows\System32\notepad.exe" \note.txt
      4⤵
      System Location Discovery: System Language Discovery
      PID:4960
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=how+2+remove+a+virus
      4⤵
      PID:5840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --always-read-main-dll --metrics-shmem-handle=3708,i,4875120079727123946,12279569061573285537,2097152 --field-trial-handle=2356,i,13507624372109143227,11332345905854253957,262144 --variations-seed-version --mojo-platform-channel-handle=7852 /prefetch:1
  2⤵
  PID:4620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6316,i,12621350546472785701,7970240601062996149,524288 --field-trial-handle=2356,i,13507624372109143227,11332345905854253957,262144 --variations-seed-version --mojo-platform-channel-handle=6312 /prefetch:14
  2⤵
  PID:3736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6216,i,12418841584231034626,11124259124456391932,524288 --field-trial-handle=2356,i,13507624372109143227,11332345905854253957,262144 --variations-seed-version --mojo-platform-channel-handle=5404 /prefetch:14
  2⤵
  PID:2064
- C:\Users\Admin\Downloads\VeryFun.exe
  "C:\Users\Admin\Downloads\VeryFun.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:4856
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1140
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of SendNotifyMessage
    PID:4864
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe"
    3⤵
    PID:1624
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe"
    3⤵
    PID:6136
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe"
    3⤵
    PID:4300
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe"
    3⤵
    PID:8
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe"
    3⤵
    PID:5416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3852,i,11615340773618087502,1397441562050706620,524288 --field-trial-handle=2356,i,13507624372109143227,11332345905854253957,262144 --variations-seed-version --mojo-platform-channel-handle=8492 /prefetch:14
  2⤵
  PID:1512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8380,i,16792129212084531403,3236882369105793211,524288 --field-trial-handle=2356,i,13507624372109143227,11332345905854253957,262144 --variations-seed-version --mojo-platform-channel-handle=8376 /prefetch:14
  2⤵
  PID:2804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8600,i,10979204517382020420,2866413604734778715,524288 --field-trial-handle=2356,i,13507624372109143227,11332345905854253957,262144 --variations-seed-version --mojo-platform-channel-handle=8608 /prefetch:14
  2⤵
  PID:2648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --always-read-main-dll --metrics-shmem-handle=7844,i,3668989190847632863,13954984374679191675,2097152 --field-trial-handle=2356,i,13507624372109143227,11332345905854253957,262144 --variations-seed-version --mojo-platform-channel-handle=6812 /prefetch:1
  2⤵
  PID:2372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --always-read-main-dll --metrics-shmem-handle=6800,i,11177599069696367862,16747911618017377945,2097152 --field-trial-handle=2356,i,13507624372109143227,11332345905854253957,262144 --variations-seed-version --mojo-platform-channel-handle=7700 /prefetch:1
  2⤵
  PID:2336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --always-read-main-dll --metrics-shmem-handle=7412,i,7811982638994034183,12034464638184332345,2097152 --field-trial-handle=2356,i,13507624372109143227,11332345905854253957,262144 --variations-seed-version --mojo-platform-channel-handle=7428 /prefetch:1
  2⤵
  PID:3232

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5032

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3756

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:2972

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3804

C:\Users\Admin\Downloads\FlashKiller.exe
"C:\Users\Admin\Downloads\FlashKiller.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2928
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2928 -s 284
  2⤵
  - Program crash
  PID:5376

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 2928 -ip 2928
1⤵
PID:3192

C:\Users\Admin\Downloads\Nostart.exe
"C:\Users\Admin\Downloads\Nostart.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4816

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x0000000000000504 0x0000000000000508
1⤵
PID:2568

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
PID:5136

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 4fc7dcf7387fe20ebfe8604da12039dc01420b7c4f9203598cac361fa8e97926
MD5 c3187641f7a33614939d03f0d43ad5e0
SHA1 82b3d0d3fa3092b29b9c8b55ce9fb9bba31c9c23
SHA512 ac0b9a042b5883e5cb0458cdeae19e251d85b3b88bb576dec24d66444085275504065eccb22c8674162977df0a0d2f69723a5923be85a9c5ea85f46af2ce9edc
TLSH
T13FD02B3176B99CA1D193103900C286A014BAB000EC0501843A2280050C40109133120A
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2faa1b1440ef2e1a669881f74143ac7857706d1524c89e682f713c8f3d38ab23
MD5 6a131a77b0edda45a2895a3d33a867a0
SHA1 2be1a2b3794fa396138562716cc7e4a4f17caa66
SHA512 20cb3d576349a78e3fec9e8b5e0726835f04e7dd74bb2a15edba4417611cdd35bc2d2525fdae7879e8d01d4643f26df1c05a44fb125105ad0bcee8ccd0257571
TLSH
T1F6D02B3176B99CA1D193103D00C386A014BAB0009C0501843B22C0050C401091330206
MD5 SHA1 SHA512 TLSH

Submit Download

7a076746-b277-4db8-b8d4-05ce96479129.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\7a076746-b277-4db8-b8d4-05ce96479129.tmp
Size 17KB
SHA256 535af2153b4ae3b6fcf60e903aae7947b8ab10cbc6df90ef908eae942e24da7b
MD5 d42dea5b782ed5ff0610d596dd354f85
SHA1 7bcf1d228887f19ff4806c1ad9d24ffd2a24f1da
SHA512 1493d4166de8815604670bc14ad4f6a52b3ea89327522f155318f78ed2c614316d9b06416cf6f9696111fee8458cbd5edced2a96f62952d67a03081871e516d9
SSDEEP 384:sxRtGmzv/fs8ksNQbJZ34i/5Q1E/SNp1QULJC:sxGmzv/fs8GbJWi/5vQpDLA
TLSH
T15A72C6529924A97B8CCBD519FE357F12E7F9002398855E4CB6FCC92C04EA6EE2207C57
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_000041

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000041
Size 70KB
SHA256 9e1826cb1fbbbc5112fdf133ebfbd13884530c05d90af402d9360eb4968e2cf7
MD5 a8bfc2117dc2bb93a10bdcfaaa7e96ac
SHA1 b429907ed6b1a51b2b8fdb54d7fabc8b97ec1d16
SHA512 74767b4f2133ab3d7641669f667e8c035e5e4617c2cf2a0e61c1fc4d21aa3acd6f47bee8e23a1bbb6a3a27cc024046ad42c0e86830e4ff73a1f68dae2383c74d
SSDEEP 1536:4c/a+uOhY49frHz3ylizadM0GS+HJcdoTOxO37+feBeysLnkSDsJhhjQHZLQZY://tBhD7yli+60GS+Hm+CxO37+woLnHsu
TLSH
T1516302E3508E7BDA022B78851C1937FEF0811306C6D3CB476EDA5B1E689B27BE751109
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000042

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000042
Size 417KB
SHA256 2a13f157806bd2083eaed91e534af6a89490233e69dabcad37664cc1121764e4
MD5 c1c170a1ce64b59884e60f2344a22a4e
SHA1 61c14d8f5fddf53dcab660c90e3e754ad074b48a
SHA512 2fa7dd1512c1e3265cfb8890d130e2b8bf53296e467bb54bd018e4491f8ef3b39c83c1d9a16584188fb6c868b97c38352b48af8d4402bcdf7acace6e05879a82
SSDEEP 12288:FX2/fOpN9bjHHD9Y4B0NrAfC8miUUwee9WOlCvRrbTXumvXi:Fm/fwbbHJmxAfxPUU9CWCCJX7zvS
TLSH
T15E9423A3F302EECA998A7CCEBBC75C854E14347C68CCE697416B584147B87990696C3F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 61dc1e3dc9e38076e4cccd3bc502b7ea5e9b644e9af134b651791dab65d56d4e
MD5 c6adb38ef471212d338bb2573a2b7838
SHA1 bda7dcd6daf5fb8b843f67b03697ed44da05abc9
SHA512 9d94642d1988556e4bf1148a9a7059c54e6078fb02dd7b61d66785e85294768e439ca54bc24d19360bd5a7463522defd9b9a8f44635d9c79c4ba5a1fb8a824c7
TLSH
T13741728496B57295FFB93A75C9C176873AF08A81E5C3AE530594CDB98F093D883D4304
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 7KB
SHA256 88edcb1e89315f0cb66d486952106820e51d83a8130f3f827854b074d5f02722
MD5 b078b4cb9f76076a705133625f3b5a33
SHA1 45ae0af3c164932065f1426c2f556d3dcf7bf68a
SHA512 1bc41b6478536c340a44edd741ffe059109ce96c87e9cfa503cd289bf0418a025090ec54e92b15a09b877fe760711638371a85ae2775b048669566f510429263
SSDEEP 96:UIoJpgJZFHuoYBMi23hTc4LtI8WPVOUAxuPX237/oONyrIJM:UIoJpgBvWixLLBxuPXEsOvM
TLSH
T172F16F5094E571C2FBED32FF89D728AE7DB5E68140830E8B015A8F763EF77815192298
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 5KB
SHA256 14e5df7a126a398c0fe522b835941d1a7ba16fc86259749ff4b18fbf077c9a77
MD5 1a6f096096a823c30ae251ce9e00a5c5
SHA1 b459e4b07003595ef77884f02a0ca5b79198c190
SHA512 d56fe84fb9edbbefe035143884e1530df825ca91b942874b3c5a6612b36fcfc2db199bedab56c4cd08fd98896cb227375da3544cf944037dbee4bff1defd90d9
SSDEEP 96:DlOEu57ET2ani0FdjhnIzBwBc5GORu/6GHftjEGgAzi:Doz57daimdjhnI1kc57U/6G/tj/gAzi
TLSH
T12EB1BEF3C3E9826DD91156F0AA186F1BCE1C0956436C3C5A85D4AF1BA3F24B1E141BCE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 6KB
SHA256 a71959f3f27c2256fcd70fa6ee160d46f28755b95ab2b4c7aeafcc5cbe86dec0
MD5 0f0b3c324000bca0379c19cf816afd1b
SHA1 25bcbdf9b57728dff22e7b913a9f005a1c9bb1d0
SHA512 fc0e7cf7972058754f140f0e0cc28a5629b857d4f20f3619f901a5db1c198b8b905decfad81d5e6d3a780aec4f3d0b0b29f47910b759bfb4a1f00ac9adc1ef4a
SSDEEP 192:Doz57ePIm7aimdjhnI1c57U/6G/t0gigDvImUGmBmOmDmtiBmgme:Doz57ePIm7aimd5I1c57U/6G/t0gigDv
TLSH
T19EE1CCF3C3E5826DDA1195F0AA18AF1BCF1C0455836C7C5A85E4AE1BE3F2871E141B9E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 209B
SHA256 4c7a88c53b081c66282eca8c02e461b55205ae36899904d0331f8619952e9d29
MD5 26d7241139b2848847f12abadfbf1150
SHA1 5f37a4037f00e0871ea368938ce32f75480d427d
SHA512 0cbc0fc6eb65df0b7f446fd466a2f395433c089a882e50fa92ce9b6d312ea28d649ae871dd1d7ce859af0e16ecd6b807ba5e36f71d2bcc8e0421620e4b2c06e5
TLSH
T173D02263130871BAADBD6EAA806ABDCFCFAF00601802EED620D09898463196C454B280
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 f762cf5ce3a211b1008a0fd02756057a3ad13932d7d591d9e2b4c4db2d97565d
MD5 a8f654d7fdac22d3600f240e7e7b90d4
SHA1 80373bc04adb8308e384f2d5c3da54494f845978
SHA512 1264189131e592a45744158c8dcc01ed8411e1fdc2e0622f4511045c589f6f1c9856e5b579cdb7643cf98de1d5bdc102626d6a8def89cd2cc36dea93254298fc
SSDEEP 192:sxRURebv/fs8ksNQyYh+zoA8pw0/g6+WNhET/Y2Q4Np+GTIgDJJ:sxRUev/fs8ksNQbjJ/5m/FNp1/
TLSH
T17A42A715AD64A97B4CCBD21DFA657F53E2F95032A0D41E48B6FC8A2C04E76CD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 f11732e5d16b95f465b23a54c49af1217c068732f5e1dff927dec3a40670f3fc
MD5 f8c1d42c914d4a2d06fbad0d25601b2f
SHA1 df482e9f78e91ca9fa3330137d1d935861b2720a
SHA512 d9756a81bc325f3c236304d70cac13f74f44078b01ca82caf0e57dd72709f415eba65e12d7a56404c25d1dafd8d1a21ec3142e3501296df1b74b698dc9f8bf55
SSDEEP 192:sxRTRebv/fs8ksnQyYh+zoA8pw0/g6+WNIY284Np+GTIgIJ:sxRTev/fs8ksnQbjJ/5IhNp1s
TLSH
T1CA329505AD68A97B4CCBD21DFA657F53D2FD5032A4941E48B6FC9A2C04E76DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 4c463b0690c284f7741125b20315ee34e656d04b1366146933873a3f11ae8768
MD5 f3f25ca0ca2c59fbebff0f56d3bbad08
SHA1 c771e629d0761deb2eb9e8fc1b531d137c8bbb96
SHA512 557fc31b62dfb56eaddb416d81a98365278bd08e325cdfe79e5b98c67005c5f031b14cff5dae1f49d950c7e27590399183afcb7fd7e0500cd2cb5baaca653702
SSDEEP 384:sxRcGmzv/fs8ksNQbsZ3L/5Q1E/SNp1QULJC:sIGmzv/fs8GbsB/5vQpDLA
TLSH
T17972D6429924A97B8CCBD519FA357F52E7FD002398855E4CB6FCC92C04EA6EE2207C17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 abb5af1dd0518ec3222deebaa1f480450d505a400f8f797a8d322447d22393a7
MD5 a0c9781866b1e0c9209643f90759dc59
SHA1 4272c13a5ac72aa8e3dc1ec778b8ffb3aa6230af
SHA512 28c1b8af2c4944d356ea24209894aed2cb60c425818df55d4b1f8ed312cb91c4aaf63e949250fe5440141b837e4c9ef3fd52604c7896f52a920954f58dc275cd
SSDEEP 192:sxRURebv/fs8ksRQyYh+zoA8pw0/g6+WNIY284Np+GTIgD3J:sxRUev/fs8ksRQbjJ/5IhNp1F
TLSH
T16B329515AD68A97B4CCBD21DFA697F53D2FD5032A0D41E48B6FC9A2C04E76DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 fd39cb803ad61db9944eabb9b2bbf2a1aab2b305fd7f4b6d21d58f43b87a787c
MD5 ac83e06cfd7c8575a0a24d41c19ea7ae
SHA1 eed5cdfea644eaff0986d45c380420e94de449ab
SHA512 1fb935f5e16b05377ea74b9a1035103ee2c71bbe53c7aff0cd7b5c0f703465b41a85cd47429464796ee751d6561ea7363996723ad4bfa8168e4699e62da96622
SSDEEP 192:sxRcReGOv/fs8ksNQyYhyLGbyFoA8pJf0/g6+WNhETqsb/Y244Np+GTIgDJJ:sxRcLOv/fs8ksNQbAZM2/5m1/1Np1/
TLSH
T17752D705A964A97B5CDBD21DFA257B53E2FD1033A4C45E4CB6FC8A2C04E66DE2207C0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 17KB
SHA256 1d72281989f1d774e6477ce7f33e91cd2bc3e06080b0432fd60c75d7128e6b86
MD5 a0e8da94a389a4b5f58dc80ea1de72f1
SHA1 11d0bac3af9920a4cf94c3c79ba6e70e6b847758
SHA512 37d4185d76cab9ab0f6c583751d5cb1b395ad0b60f525d06c2a94f5e0b470627addb3c876acef41e2521d369e06d4558a32e48887aee5c16a04d92e46e0c7c6d
SSDEEP 384:sxRtGmWv/fs8ksNQbIZ34i/5QH1E/8Np1BULJC:sxGmWv/fs8GbIWi/5rCpILA
TLSH
T16982B6429924A97B8CCBD519FE357F52E7FD002398855E4CB6FCC92C04EA6EE2207857
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 23KB
SHA256 8a26abe42f33cb65027e9dc2dbb56d1ce6796c0083514be685019872e3e380d5
MD5 145f5887b2de1572f3ddf42091c41751
SHA1 12e23cd9e6241efb2ff00cd04f0a8245a54cea9a
SHA512 0c5d5f1c763baa495ae27d651f13526e747c3c5d2fa8d7614404448124054f0a0725557cf5ae25786f1a056691a177ef04f14df611add51e6de437f3393f8c6f
SSDEEP 384:LbnaaCTfCtgp/FfvDKhOObJ+UoAYDCx9TuqZz0VfUCh7xbog/OVPH9NvRWBroHr3:L7aaCDWgptfvD8F1+UoAYDCx9Tuqh0Va
TLSH
T1D6B2EA2F644CCB7E8FD00A9DAC596F977E9802C796588D4047FE984C02C7BEA911E4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\2352507c-c79e-48c7-9ef4-18eb3273ad79\index-dir\the-real-index
Size 72B
SHA256 416f4daf8d6dc298662ae04f2075ca47a57ac0bbc4dee3e9d312e67b0bf00132
MD5 4ecd50e2dfc1423c3f0eecd3c9b9c63a
SHA1 ff89206f762e9fdb41c8b32869dfbb9d355ed671
SHA512 0af61ed8e18033ea32eedee400ec2cd4f96dcce7502e9a59042107b2555a769873a558cd9ae7b8d3e73b5f2fc06efe4346d6cd47f53ece1840781fe21a3b12d1
TLSH
T1BDA0021502C04239D14263F62997C1D56320CD500A11134781980B45DC50D995D41A1F
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a788d.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\2352507c-c79e-48c7-9ef4-18eb3273ad79\index-dir\the-real-index~RFe5a788d.TMP
Size 72B
SHA256 16c48a93bcf4f7a504d5d69bf203970089898d9bb49e3c6c91ff919ae4ad43d4
MD5 8e4d35a808220b9cec5ba20263ce4aee
SHA1 8fd6b645d1600b65fe57727c655dec4a4d1e9bb3
SHA512 c80c364543f529bf3b2445e93601643f1e11ce0a14ddbfd568033fd8b620ffccedfa2ed2a5fe9d0323f78c4f9e904308fdab4a3f2e6362d46afa1c924ee115fe
TLSH
T12BA002600F821005D45252B119D2A2616310D8521280130784E35448CC725484D4110C
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\ca3c23a5-0b45-49bd-9fac-532a302f4fc7\index-dir\temp-index
Size 3KB
SHA256 5ff75841ec29858e8e61debaa7259c30a8ee3f08210241bfc85c687456483e9c
MD5 3ceed7c3f5fa0654cf92c3825e75fbc8
SHA1 1309c2dbd7190c08486a6fd6e90499e884d4a4c6
SHA512 379a030c937e4ecce4a8ec7ea9537ec63f62b9f4efa046b612a45c3478e3b3eaa4575cd9977ceac5cf76d27134f74fb60cdf4c4f7b68bdef11f4bc54eddc0eb0
TLSH
T18851C74F4E431B5EED9CAAB105B6041A37B43ADC2B980E1764FDD638F883B391D98658
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\ca3c23a5-0b45-49bd-9fac-532a302f4fc7\index-dir\the-real-index
Size 72B
SHA256 740550632b1afbe0641fcfb37c4378aa2f20b73b9abdafa8637965d3904b1789
MD5 f5cef7ad6b78ec50b8d4fc9a62273bae
SHA1 8ef705dad3d9b8ed3f32912cfe4122b939798f05
SHA512 97d531d64db7dd3ae15d78d0c235f1056f6e807b26ce20c3adb78f9a15d99907b3f4a4df6686bbeb02556c11bbb53968906a5287662dc89b45e1afc4aa39754a
TLSH
T12EA002501AC16958E8651770141209F152456D581070823741F58088EEF26DA4285204
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a224e.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\ca3c23a5-0b45-49bd-9fac-532a302f4fc7\index-dir\the-real-index~RFe5a224e.TMP
Size 72B
SHA256 b84bfb7db8e682fe802dc2fb008e25c3de1737a3713d642991996c9967ce8888
MD5 26ef85ea33bfc58f8380308b0803ec94
SHA1 5ae361776351547a85e248e7f1a817403439bfcc
SHA512 22c3859cb320aa1a478df0885c70687667a00495bb6eda7b9af13aad84d882c35436ea0dfb189c25cbacf85c8781c774be8282ce679efae3a461a42b812e30cb
TLSH
T1F3A0025057C06989DC611374140306B213008C1014B0833740F2818DDDE21D547C61C0
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 f504a3a5dbb8a0c0177954fef6a4d39a6de788ff12cc26e02f4166716ba004be
MD5 4ff7f0c5b8e9a3606d3c6ed2f7e25abe
SHA1 ea58dd358fd273dc6bbe5c6898b1b6c2c6c60039
SHA512 7b276c917b028d2f8290f792d5a665094d1a05ca034ed2a6f84c1b9da84daa52fb9d7566c74f36372de34df4fdac875495e648c8208b8d71eab93c73e43182a8
TLSH
T18EE0C0FB79FA1410FAAB97D6243161A401463D10C944ECCF60F7D3CF70617203442C22
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 68ad8150147dcf1fab8956da8ff68f152d54b20cbe753be54d6dec1c1676c5b5
MD5 24917e0dddfd5f4688c73c2473bff9fc
SHA1 7278543241289421a40943e3d685184d11b52a2b
SHA512 4ccdb89367d6ac8a5835e98021bc2a3ae8529fa948ce8e71f4ce2c2e4f81e1a0c7eda07188d3b5c9493e85fab94e2af1e21b4f8d0a9b9e83722ad17374455e28
TLSH
T1E4A00264C9429091CA6522F4267242EC3321DE9C850526DD80ED768EDF523724591C88
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a76e7.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5a76e7.TMP
Size 48B
SHA256 318e924f550bd8f5b40d430396500cf895575700c205c3a4e155bea24ea22a87
MD5 c43aaaf3eb61bea9f4ded85e538fcf46
SHA1 4d2e9057ae9a730ff1498b36d7332f41ad5eaa69
SHA512 a1919a62c301eee2dfcb02eba562490f36bd865e1a176c8b1a4be0f440bcf24ad263ef7a9e6088393c0b0d24e7f184a727c35e9442331ba413195138710b2809
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 3ef466519cb0fddb2691df0262b4fe4e240239f3040b0ac7e5f04c371c447910
MD5 b7a9b71077aef16a5dd1c052ad0a1185
SHA1 65643587ed54ead00ef996556d213526eb326229
SHA512 3f2ea723692243a76c8f9f5347b47fd1e00d367a7b9c075800752035229b9cde13fabb53d0da318d3d3ac49ecb84d11c65e13c659b5fc248cf4a8a7a78904c0e
SSDEEP 48:KsgIzKxSU/yUGBq2MYUkkYXPIXekKiBK0kOW0R3MW5yxyIfKrC0nz:KsgQKxSOGvyKAE2SywKrCIz
TLSH
T1E0919C51717E064039BE29C99074CB3B524236F33018EA7A3FBD14F58A6BE156EBD8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5a5b7f.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5a5b7f.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 b6c46075d3ec2e7027a05ac4c566e3e2fbd3c045fc3a26e985a27f46a2d9fff0
MD5 c28b472e037fed224aeb0e3b82a63ee4
SHA1 02ed61a81bb96c39cbdea467bad38d49936c2a3c
SHA512 c8d894613eae5906cd6f94696ea2c90943431025e461f97e32941d291cb0e4fb575c48a26e707cd020ea321dd5e6e42a2a239400edb0a617bf3089f0b8712383
SSDEEP 768:0Bx3Gosgm1VXwvKDmGA5b65Q92RQMPb4hYGHWkw5:0Bx3GcqAF65dQ7hYUjw5
TLSH
T1EFF2CF72DCA0EEB39CF9A2C17657B2056FF88123D1CC869099D9BF1D05879DA031792B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 c4d78090bd600c27122275144b3f69b21685053b6cbeef52e53079fe2fbd04b2
MD5 c4813c5ddc05a86897d7d1ee10ff5b10
SHA1 02d22cc309578246656cf0665c27a8881d37bede
SHA512 ae90b52f33f09ee66d89ac5214af4c49b18fb4d1be2de0e4952556baf10fefe48f9fb3b59d13d5a988fecd795e42813d01d9a1c92338246a7a7467c2e640a3c5
SSDEEP 768:3x3b5sgm1VXwvKDmGA5b65Q92RQMPb4hYGHWkw5:3x3b7qAF65dQ7hYUjw5
TLSH
T192F2BF72DCA0EEB39CF992C17657B2056FF88123D1CC869098D9BF1D05879DA031782B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 43KB
SHA256 8392697d7e36738f803ec7cb1bfb0a703ddaaf1ecb338e48ba782be2ea1339a7
MD5 82fc3a846aec7256b2f5fa59c9876f9f
SHA1 cacd1b74da5308b5a2b2f5fe8cfeb1501e576339
SHA512 fbca766556a2ce03bdb0e93981b09a435db5493292b347a316eddcb7f8d6643e8634c4ed4d1164d6393758b1ab5d754a04fe3b8b3f1a63af38c3dc53e5f8f29c
SSDEEP 768:sgFEa53mwgSjekI1wgm1VXw0DmGA5b65Q92RQMPb4hYGHWkw5:sDa53p7AF65dQ7hYUjw5
TLSH
T1AA137CF28CD399B7D8AD5783677E6E05AEBCC153B088958077C8690DCD865BFC306816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 e76a34c6e0ef40e9b6c4fe7d159320a6e96805d02d314c467fb20e373332d635
MD5 7d6f5c800df6283a52b7c8403e3732d0
SHA1 15ee8323c47a95e4242dea1e878e059f98008e91
SHA512 511efebe783c1847cbf8074b5f6ea3ef40f3417e025eba2c047e483afa193ceb9ec115b663b6eb9fd8c462fe9ceafd236a11a1f82cd6f8d53702f68bb4566cca
SSDEEP 768:sgFPy3mwgSzwgm1VXwwDmGA5b65Q92RQMPb4hYGHWkw5:siy3piAF65dQ7hYUjw5
TLSH
T15A03B073DCA0DEB7ACB996C1B6567205AFF88163C1C9D690A6D86E1D01875DE030BC2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 43KB
SHA256 fa8f6c0e8b8fee056a1dfc5b4c4172352ad23b91ba39ace793e242b156a7e3f1
MD5 481be5e30024e7c600ba0097d5586bd9
SHA1 296a465ed7ebd43d97315b244ce65fa9060ad4b6
SHA512 7a00bd31eb24dfca07e22c08414d937015c42a73668ef3d81e2d92618230e0591b452e54878559aa4e70ce561f651fec68b6640d8ece72c268d2cca0fe38a85b
SSDEEP 768:sgFr033wgzNekI1wgm1VXw3DmGA5b65Q92RQMPb4hYGHWkw5:sK03ZQAF65dQ7hYUjw5
TLSH
T1F2137CF28CD399B7D8AD5783677E6E05AEBCC153B088918077D8690CCD865BFC30681A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 43KB
SHA256 0b3957efb77b1aaf430fc748b9b9d99260552621e6d31dc911e9cb78352e5eab
MD5 36fe27b633b8931b324ded24ec071a0a
SHA1 c8faca0bae6a990458bffa45b3f8ba58c08b2cdd
SHA512 ea42b4b30fa0df79dc4f4e38391638f799b496fca33c08551bc621ae04fd5445c54fe5737051ebfee2ad71f13f36fb0f42d1290f6a8ff2b1545f63b363f24082
SSDEEP 768:sgFzw33wgz7ekIsggm1VXwVDmGA5b65Q92RQMPb4hYGHWkw5:sqw3ZDAF65dQ7hYUjw5
TLSH
T13B137CF28CD399B7D8AD5783677E6E05AEBCC153B088958077D8690CCD865BFC30681A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 37KB
SHA256 b38e5034da09469f58a2b7f3d11374c42a74a183f2923612c0f533d60afb4411
MD5 817765b114d3a75fddfc4587ed663c7a
SHA1 f01038a7f5ccf4dd7aaacf367705d1d8f8bed029
SHA512 71b4e93c524bce844d0ca0d62bd810f8e02dc17d80e52c16b264c3e423dcc3c68271a0687d064005ab0e06a5bf068f4bc4cd5aa335927ff9a17c38f6de79a918
SSDEEP 768:sgFQb3xwgivwgm1VXwpDmGA5b65Q92RQMPb4hYGHWkw5:sTb3SJAF65dQ7hYUjw5
TLSH
T11403B073DCA0DEB7ACF996C1B6567205AFF84163C1C8D290A6D9AE1D01875DE0307C2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 63ceee25bf5becf20b935957a12459442579d34dadb3f26ad547a3fbdc0d9ab9
MD5 91bf85a3b59931f270e9cc0bd04589ed
SHA1 a474cdff44475a1b9f13d7f13bb9aa049761e703
SHA512 dad8770dbee5f12eef6e93ee17619cb8a75a49b2d51d97bf589115c065ef4654cc2c642b245967139d31b72bdbad5c49a8b2efc4f280ad4a5e3390db985dff80
SSDEEP 768:sgFHy3mwgSOwgm1VXwBDmGA5b65Q92RQMPb4hYGHWkw5:swy3pOAF65dQ7hYUjw5
TLSH
T1A003C073DC90DEB7ACB996C1B6567205AFF84163C1CCD690A6D8AE1D01875DE0307C2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 f5362a918fc9795b61c6a108f030e1d7d8eefabf90b174f159e701e7d39fe18f
MD5 46086cedf43b3f6e1f03db8c29300aac
SHA1 88d185186df054dadbb5ded310fac8cb126724bf
SHA512 9931c810e81a0e81e82e5816e903051952c7c08ca9cd6ce2d864e4f4cab0c4c1819833d5e5d24c68b8ba2b6e85c8625dc92183a45afb6e4ba17f02d400f1384d
SSDEEP 768:U/UxvxjgC+B38yCMgm1VXYtDmGA5b65Q92RQMPbDFj0O:BZj3+B3N63AF65dQ8FQO
TLSH
T1D103C036EC94BEB7DCF95280364BB35AAFF84463D0C856A049ED6E1D06C768D430B85B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 3d33ea8faadaad0adbaf397aabcc0447c6c5f72a378f43923a1135dcbb8b74e3
MD5 ec193ec26ffdf62e73b3baaee893ef16
SHA1 5fc681c526cbad2db842191fcdd425d27748a3fd
SHA512 2212db3d6fbe75100e645629af011fc1746efff6d254009a81a1afd0d54dd730b44fcc5b06935420583be82fad46c372338cfa20f2aa48329cead64a067e8dce
TLSH
T197E002015110447FD13D033100C3557035F1462007E3054FDA10157518533075B38FC4
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 bfb182ad75475a3d6163a5513a44870ac17991cf32e3fc10a592204198149a1d
MD5 ac80177eb182a5f7ff477ab61109e1d0
SHA1 2b75054e27c060f70b732aa8c538761a5d81bf9d
SHA512 adb8b4372e7ed84bf37a90038446d0bb5cf615336eb31fe2d3c0b414380c5ac8c3e096bffd96a1e09f8d182397fef9a048889b6bfd0757029088363f69af2837
TLSH
T16EE001015210442FD139033100C3567036F1862007A3068B9A2016651C533065B38AC4
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 7436e5e88e0e7e624c0fc46089697080b57f189e349cf43852dfbc4e455198ff
MD5 96efef51a70405a2aa3f2289cd45b47e
SHA1 f1ef292fadfc3c555410b56906ba7c1978cdd326
SHA512 a010742714f52b47a3eecd403131d11b7512caf4a7b1570ef9c48408625fe64568890502207db1f3b5504794e8714f1d189f72180eeb8821ea70387b3fa238db
TLSH
T16AE00042931048AFD569033504D76B31BBF68A2907A7168B9A201A796C627526E28EC4
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 016189fd6932828e8e798d66ff96665e5e129b2d66af54a3148b16ff97bcaff2
MD5 e4cf870cc500b9efb048bfa4d6fb4e62
SHA1 37485ce72b2c787fd1f32d10ffb04acf9a9b983e
SHA512 2e7782a70fe6b7c94c68d3d263f37efeee2bcdbea5913ad5ffc4d685d9fc09cd303d513b51ac1390c4ffb077d874d3827f388c7cef1636ff8e9e790f6d757155
TLSH
T15EE009015310442FD139033100C75B7037F1C62107A3078B9A2116751C633066B38EC4
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 3b3451c286d813ea40064890d2ca477d53189d768fffbd2fbc1a99133a0e547b
MD5 c24631c0a2c23e8b7920b11ba64833c3
SHA1 6612a4182997848c30f15679f8b094fbc37dbea1
SHA512 2599667c5b4062b5c2c503462815ac0fb3195a22bdfbe7bb67643eee1047afb7d70b1a40e61117f8a3d37fdb012e097c9af636805560218082abb8264e187aa1
TLSH
T1B3E009029310446FD17D033504D767317BF6CA2507E7078B9A201A752C533525F38FC4
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 9178817bf67a94cdbc19818fec47bbaca47e7e7e849fbd3c2eca8334a6759132
MD5 787f4d331fdda1a30dbd37fdfa4367af
SHA1 b30429249be7f514c4a220fd7b1e82ffc2728692
SHA512 e0813294c6422ac4d7195d2b1e2fb0992635ca1c940bac2c8005d7e263595f80cf316f25c30da9cf18cc81c9ae15fbc92dd9d3684934b1e603b09580f64f445b
TLSH
T1D8E009029310446FD17D033100D7573177F6CA2507E7078B9A201A751C533525F38EC4
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe5aa25c.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe5aa25c.TMP
Size 392B
SHA256 1d0945064bedbd2fd49e66136cee089f89d74e81cb3714f177488579d81cf3ef
MD5 16d44808069a91d0e5ec8143b51f9845
SHA1 1f3be17d97d5f2818cead821b209b49a56718ccf
SHA512 6fb61ae2e2578f0ce6f61ec3a62a7da3d29517725f76606d14a8454a695b0d93c52067dff4127087e21b3c50a11c0028de1f125ab4dc6a9a86c50d577a62a3b5
TLSH
T1C4E002011110446AC129033100C3556025E1462002A2014FDA10156508123075B38AC4
MD5 SHA1 SHA512 TLSH

Submit Download

2c685890-509c-4267-99ed-fca3b313e775.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\2c685890-509c-4267-99ed-fca3b313e775.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

FlashKiller.exe

Path C:\Users\Admin\Downloads\FlashKiller.exe
Size 4KB
SHA256 353df4f186c06a626373b0978d15ec6357510fd0d4ac54b63217b37142ab52d3
MD5 331973644859575a72f7b08ba0447f2a
SHA1 869a4f0c48ed46b8fe107c0368d5206bc8b2efb5
SHA512 402662eb4d47af234b3e5fbba10c6d77bdfdb9ff8ecfdd9d204f0264b64ea97fc3b5c54469f537173a26c72b3733550854749649d649bc0153c8fe3faacc50a1
TLSH
T1C581546387400FB2DC541E7B32F314A565FB493067F53A001EC0844CD10BA180D7CEE4
MD5 SHA1 SHA512 TLSH

Submit Download

MEMZ.exe

Path C:\Users\Admin\Downloads\MEMZ.exe
Size 14KB
SHA256 a3d5715a81f2fbeb5f76c88c9c21eeee87142909716472f911ff6950c790c24d
MD5 19dbec50735b5f2a72d4199c4e184960
SHA1 6fed7732f7cb6f59743795b2ab154a3676f4c822
SHA512 aa8a6bbb1ec516d5d5acf8be6863a4c6c5d754cee12b3d374c3a6acb393376806edc422f0ffb661c210e5b9485da88521e4a0956a4b7b08a5467cfaacd90591d
SSDEEP 192:sIvxdXSQeWSg9JJS/lcIEiwqZKBkDFR43xWTM3LHn8f26gyr6yfFCj3r:sMVSaSEglcIqq3agmLc+6gyWqFCj
TLSH
T180624BCFBE204417D8F0C57530659234DFBACABA1B968EDF9CF91E529AC4C072823265
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Nostart.exe.crdownload

Path C:\Users\Admin\Downloads\Nostart.exe.crdownload
Size 233KB
SHA256 2f10f1384f3513f573a88e1771c740a973a5a304387e23aa4bf310794532fa8e
MD5 20fa439e1f64c8234d21c4bc102d25f8
SHA1 ba6fc1d9ba968c8328a567db74ef03eee9da97d8
SHA512 19e9d62a852293ffa99a412ba8fa5dd0336a7753af4975e06cd53c02ee6f0058485160f8f8a64a8bca19d88eb426a4a2785885c02a494f33f2b6e383204a7f39
SSDEEP 3072:iwHcAxExO4fY0Jg8KXXSRZCavlSEEH9FZYlChQRp2Fgw/y2VRSjfoP4iylvAP9ly:xd8kAZCa9YHu8hQRCz/xJSloP9l
TLSH
T1EA345D72F2D14C37D1631B7C9C5B97A89C2ABE103D28AC5567E51D4C9E39382B9283E3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VeryFun.exe.crdownload

Path C:\Users\Admin\Downloads\VeryFun.exe.crdownload
Size 3.0MB
SHA256 8b04fda4bee1806587657da6c6147d3e949aa7d11be1eefb8cd6ef0dba76d387
MD5 ef7b3c31bc127e64627edd8b89b2ae54
SHA1 310d606ec2f130013cc9d2f38a9cc13a2a34794a
SHA512 a11eadf40024faeb2cc111b8feee1b855701b3b3f3c828d2da0ae93880897c70c15a0ee3aeb91874e5829b1100e0abafec020e0bf1e82f2b8235e9cc3d289be5
SSDEEP 49152:wshda+bFz6dmTTfO0JBhybeUXzELz/RkxI6Zxkxur4E5IReTD5GKHmDVJPY8:Js/4ibecELz/RkO6LF4hRq5GKHmBBY
TLSH
T19CE533E5A5769077EA8DA3F885D009F80D37F8266FA427451387FB17BC20A12DA0397D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

note.txt

Path C:\note.txt
Size 218B
SHA256 8e9f20f6864c66576536c0b866c6ffdcf11397db67fe120e972e244c3c022270
MD5 afa6955439b8d516721231029fb9ca1b
SHA1 087a043cc123c0c0df2ffadcf8e71e3ac86bbae9
SHA512 5da21a31fbc4e8250dffed30f66b896bdf007ac91948140334fe36a3f010e1bac3e70a07e9f3eb9da8633189091fd5cadcabbaacd3e01da0fe7ae28a11b3dddf
TLSH
T1C3D0A719040784251C7052D17145A5A09B70562D77F626EB74DC690C212700F0B37C9A
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1140-1715-0x0000000010000000-0x0000000010013000-memory.dmp

Download

memory/1140-1718-0x0000000010000000-0x0000000010013000-memory.dmp

Download

memory/1140-1707-0x0000000000D00000-0x0000000000E9C000-memory.dmp

Download

memory/1140-1708-0x0000000000D00000-0x0000000000E9C000-memory.dmp

Download

memory/1140-1709-0x0000000000D00000-0x0000000000E9C000-memory.dmp

Download

memory/1140-1717-0x0000000010000000-0x0000000010013000-memory.dmp

Download

memory/1624-1725-0x0000000001180000-0x000000000128C000-memory.dmp

Download

memory/1624-1726-0x0000000001180000-0x000000000128C000-memory.dmp

Download

memory/1624-1727-0x0000000001180000-0x000000000128C000-memory.dmp

Download

memory/2656-165-0x0000016594720000-0x0000016594ADB000-memory.dmp

Download

memory/2928-1523-0x0000000000400000-0x0000000000404000-memory.dmp

Download

memory/4352-1600-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/4816-1618-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/4816-1816-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/4856-1745-0x0000000000540000-0x0000000000B7D000-memory.dmp

Download

memory/4856-1744-0x0000000000540000-0x0000000000B7D000-memory.dmp

Download

memory/4856-1705-0x0000000000540000-0x0000000000B7D000-memory.dmp

Download

memory/4856-1814-0x0000000000540000-0x0000000000B7D000-memory.dmp

Download

memory/4856-1789-0x0000000000540000-0x0000000000B7D000-memory.dmp

Download

memory/4864-1713-0x0000000000F70000-0x0000000001064000-memory.dmp

Download

memory/4864-1714-0x0000000000F70000-0x0000000001064000-memory.dmp

Download

memory/4864-1710-0x0000000000F70000-0x0000000001064000-memory.dmp

Download

memory/5136-1753-0x000002443E210000-0x000002443E211000-memory.dmp

Download

memory/5136-1763-0x000002443E210000-0x000002443E211000-memory.dmp

Download

memory/5136-1755-0x000002443E210000-0x000002443E211000-memory.dmp

Download

memory/5136-1761-0x000002443E210000-0x000002443E211000-memory.dmp

Download

memory/5136-1764-0x000002443E210000-0x000002443E211000-memory.dmp

Download

memory/5136-1760-0x000002443E210000-0x000002443E211000-memory.dmp

Download

memory/5136-1762-0x000002443E210000-0x000002443E211000-memory.dmp

Download

memory/5136-1759-0x000002443E210000-0x000002443E211000-memory.dmp

Download

memory/5416-1811-0x0000000001210000-0x000000000131C000-memory.dmp

Download

memory/5416-1813-0x0000000001210000-0x000000000131C000-memory.dmp

Download

memory/5416-1812-0x0000000001210000-0x000000000131C000-memory.dmp

Download

memory/6136-1748-0x0000000000D00000-0x0000000000E0C000-memory.dmp

Download

memory/6136-1747-0x0000000000D00000-0x0000000000E0C000-memory.dmp

Download

memory/6136-1746-0x0000000000D00000-0x0000000000E0C000-memory.dmp

Download

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads