hxxps://killl4d2movement[.]netlify[.]app/DDOS/NyanDDoS[.]exe

Analysis

user interaction
yes
max time kernel
1318s
max time network
1056s
platform
windows10-2004_x64
resource
win10v2004-20260911-es
resource tags

arch:x64arch:x86image:win10v2004-20260911-eslocale:es-esos:windows10-2004-x64systemwindows
submitted
02/11/2026, 21:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://killl4d2movement.netlify.app/DDOS/NyanDDoS.exe
Sample261102-1vnaraxsd1

Score

8^/10

discovery

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
18	4772	msedge.exe

Executes dropped EXE 1 IoCs

pid	Process
4904	NyanDDoS.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NyanDDoS.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4772	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 8 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-240542094-4193773837-3211495583-1000\{7875B465-BD10-4280-96C5-7AF3774BD075}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
6472	msedge.exe
6472	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2912	msedge.exe
2912	msedge.exe
2912	msedge.exe
2912	msedge.exe
2912	msedge.exe
2912	msedge.exe

Suspicious use of FindShellTrayWindow 42 IoCs

pid	Process
2912	msedge.exe
2912	msedge.exe
2912	msedge.exe
2912	msedge.exe
2912	msedge.exe
2912	msedge.exe
2912	msedge.exe
2912	msedge.exe
2912	msedge.exe
2912	msedge.exe
2912	msedge.exe
2912	msedge.exe
2912	msedge.exe
2912	msedge.exe
2912	msedge.exe
2912	msedge.exe
2912	msedge.exe
2912	msedge.exe
2912	msedge.exe
2912	msedge.exe
2912	msedge.exe
2912	msedge.exe
2912	msedge.exe
2912	msedge.exe
2912	msedge.exe
2912	msedge.exe
2912	msedge.exe
2912	msedge.exe
2912	msedge.exe
2912	msedge.exe
2912	msedge.exe
2912	msedge.exe
2912	msedge.exe
2912	msedge.exe
2912	msedge.exe
2912	msedge.exe
2912	msedge.exe
2912	msedge.exe
2912	msedge.exe
2912	msedge.exe
2912	msedge.exe
2912	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2912	msedge.exe
2912	msedge.exe
2912	msedge.exe
2912	msedge.exe
2912	msedge.exe
2912	msedge.exe
2912	msedge.exe
2912	msedge.exe
2912	msedge.exe
2912	msedge.exe
2912	msedge.exe
2912	msedge.exe
2912	msedge.exe
2912	msedge.exe
2912	msedge.exe
2912	msedge.exe
2912	msedge.exe
2912	msedge.exe
2912	msedge.exe
2912	msedge.exe
2912	msedge.exe
2912	msedge.exe
2912	msedge.exe
2912	msedge.exe
2912	msedge.exe
2912	msedge.exe
2912	msedge.exe
2912	msedge.exe
2912	msedge.exe
2912	msedge.exe
2912	msedge.exe
2912	msedge.exe

Suspicious use of WriteProcessMemory 48 IoCs

description	pid	Process	procid_target
PID 2912 wrote to memory of 3864	2912	msedge.exe	84
PID 2912 wrote to memory of 4772	2912	msedge.exe	85
PID 2912 wrote to memory of 4604	2912	msedge.exe	86
PID 2912 wrote to memory of 4604	2912	msedge.exe	86
PID 2912 wrote to memory of 4604	2912	msedge.exe	86
PID 2912 wrote to memory of 3112	2912	msedge.exe	87
PID 2912 wrote to memory of 3112	2912	msedge.exe	87
PID 2912 wrote to memory of 1168	2912	msedge.exe	88
PID 2912 wrote to memory of 1168	2912	msedge.exe	88
PID 2912 wrote to memory of 1168	2912	msedge.exe	88
PID 2912 wrote to memory of 3196	2912	msedge.exe	89
PID 2912 wrote to memory of 3196	2912	msedge.exe	89
PID 2912 wrote to memory of 3196	2912	msedge.exe	89
PID 2912 wrote to memory of 4624	2912	msedge.exe	91
PID 2912 wrote to memory of 4912	2912	msedge.exe	92
PID 2912 wrote to memory of 4624	2912	msedge.exe	91
PID 2912 wrote to memory of 4624	2912	msedge.exe	91
PID 2912 wrote to memory of 4912	2912	msedge.exe	92
PID 2912 wrote to memory of 4912	2912	msedge.exe	92
PID 2912 wrote to memory of 2668	2912	msedge.exe	96
PID 2912 wrote to memory of 2668	2912	msedge.exe	96
PID 2912 wrote to memory of 1936	2912	msedge.exe	97
PID 2912 wrote to memory of 1936	2912	msedge.exe	97
PID 2912 wrote to memory of 4448	2912	msedge.exe	98
PID 2912 wrote to memory of 4944	2912	msedge.exe	99
PID 2912 wrote to memory of 4448	2912	msedge.exe	98
PID 2912 wrote to memory of 4944	2912	msedge.exe	99
PID 2912 wrote to memory of 4944	2912	msedge.exe	99
PID 2912 wrote to memory of 4480	2912	msedge.exe	100
PID 2912 wrote to memory of 4532	2912	msedge.exe	101
PID 2912 wrote to memory of 4532	2912	msedge.exe	101
PID 2912 wrote to memory of 1720	2912	msedge.exe	103
PID 2912 wrote to memory of 2996	2912	msedge.exe	115
PID 2912 wrote to memory of 3508	2912	msedge.exe	116
PID 2912 wrote to memory of 1720	2912	msedge.exe	117
PID 2912 wrote to memory of 6040	2912	msedge.exe	119
PID 2912 wrote to memory of 6040	2912	msedge.exe	119
PID 2912 wrote to memory of 6472	2912	msedge.exe	120
PID 2912 wrote to memory of 2908	2912	msedge.exe	121
PID 2912 wrote to memory of 2692	2912	msedge.exe	122
PID 2912 wrote to memory of 2908	2912	msedge.exe	121
PID 2912 wrote to memory of 2692	2912	msedge.exe	122
PID 2912 wrote to memory of 4028	2912	msedge.exe	123
PID 2912 wrote to memory of 4028	2912	msedge.exe	123
PID 2912 wrote to memory of 2868	2912	msedge.exe	124
PID 2912 wrote to memory of 2868	2912	msedge.exe	124
PID 2912 wrote to memory of 7020	2912	msedge.exe	125
PID 2912 wrote to memory of 7020	2912	msedge.exe	125

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://killl4d2movement.netlify.app/DDOS/NyanDDoS.exe
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2f0,0x7ffd24dbc188,0x7ffd24dbc194,0x7ffd24dbc1a0
  2⤵
  PID:3864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=es --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1836,i,9632010234683615059,17964839296191120176,524288 --field-trial-handle=2248,i,13253177445437999162,3079669390042304664,262144 --variations-seed-version --mojo-platform-channel-handle=2280 /prefetch:3
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:4772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1668,i,17855770419422500911,1091159390213904386,262144 --field-trial-handle=2248,i,13253177445437999162,3079669390042304664,262144 --variations-seed-version --mojo-platform-channel-handle=2244 /prefetch:2
  2⤵
  PID:4604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=es --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2616,i,14679457965802269604,10716853295945946109,524288 --field-trial-handle=2248,i,13253177445437999162,3079669390042304664,262144 --variations-seed-version --mojo-platform-channel-handle=2696 /prefetch:8
  2⤵
  PID:3112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3420,i,5914610335268263175,1182958065387657863,2097152 --field-trial-handle=2248,i,13253177445437999162,3079669390042304664,262144 --variations-seed-version --mojo-platform-channel-handle=3448 /prefetch:1
  2⤵
  PID:1168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3440,i,6455428834831936945,10485126298457032276,2097152 --field-trial-handle=2248,i,13253177445437999162,3079669390042304664,262144 --variations-seed-version --mojo-platform-channel-handle=3468 /prefetch:1
  2⤵
  PID:3196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4228,i,103677722175762640,5327888556046032723,2097152 --field-trial-handle=2248,i,13253177445437999162,3079669390042304664,262144 --variations-seed-version --mojo-platform-channel-handle=4244 /prefetch:1
  2⤵
  PID:4624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4248,i,7296676578368334850,2022502368071623470,2097152 --field-trial-handle=2248,i,13253177445437999162,3079669390042304664,262144 --variations-seed-version --mojo-platform-channel-handle=4312 /prefetch:2
  2⤵
  PID:4912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=es --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5104,i,7215031253871680150,16406639045859911109,524288 --field-trial-handle=2248,i,13253177445437999162,3079669390042304664,262144 --variations-seed-version --mojo-platform-channel-handle=5124 /prefetch:8
  2⤵
  PID:2668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=es --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5112,i,9002875592815292817,14677433532640652827,524288 --field-trial-handle=2248,i,13253177445437999162,3079669390042304664,262144 --variations-seed-version --mojo-platform-channel-handle=5188 /prefetch:8
  2⤵
  PID:1936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=es --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5724,i,8496905094942001330,3966074259367486235,524288 --field-trial-handle=2248,i,13253177445437999162,3079669390042304664,262144 --variations-seed-version --mojo-platform-channel-handle=5740 /prefetch:8
  2⤵
  PID:4448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5736,i,10463609509463848234,3894944457901862333,2097152 --field-trial-handle=2248,i,13253177445437999162,3079669390042304664,262144 --variations-seed-version --mojo-platform-channel-handle=5764 /prefetch:1
  2⤵
  PID:4944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=es --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5096,i,7164368550453040822,6824580108260301635,524288 --field-trial-handle=2248,i,13253177445437999162,3079669390042304664,262144 --variations-seed-version --mojo-platform-channel-handle=6056 /prefetch:8
  2⤵
  PID:4480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=es --service-sandbox-type=icon_reader --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6176,i,14975428740813715807,17641169563856406596,524288 --field-trial-handle=2248,i,13253177445437999162,3079669390042304664,262144 --variations-seed-version --mojo-platform-channel-handle=6204 /prefetch:8
  2⤵
  PID:4532
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=es --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6556,i,12254689705942476393,13398310945112080559,524288 --field-trial-handle=2248,i,13253177445437999162,3079669390042304664,262144 --variations-seed-version --mojo-platform-channel-handle=6652 /prefetch:8
  2⤵
  PID:4216
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=es --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6556,i,12254689705942476393,13398310945112080559,524288 --field-trial-handle=2248,i,13253177445437999162,3079669390042304664,262144 --variations-seed-version --mojo-platform-channel-handle=6652 /prefetch:8
  2⤵
  PID:1720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=es --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4828,i,10703290619546993405,7964036799330911909,524288 --field-trial-handle=2248,i,13253177445437999162,3079669390042304664,262144 --variations-seed-version --mojo-platform-channel-handle=6648 /prefetch:8
  2⤵
  PID:2996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=es --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4840,i,14294286726170114658,15150847993839865150,524288 --field-trial-handle=2248,i,13253177445437999162,3079669390042304664,262144 --variations-seed-version --mojo-platform-channel-handle=4324 /prefetch:8
  2⤵
  PID:3508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=es --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5032,i,13227081442639462327,3182957772525425265,524288 --field-trial-handle=2248,i,13253177445437999162,3079669390042304664,262144 --variations-seed-version --mojo-platform-channel-handle=4344 /prefetch:8
  2⤵
  PID:1720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=es --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5980,i,7384955753823864244,9633158924287942568,524288 --field-trial-handle=2248,i,13253177445437999162,3079669390042304664,262144 --variations-seed-version --mojo-platform-channel-handle=5988 /prefetch:8
  2⤵
  PID:6040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6316,i,17699742839422667956,9076144132880408311,262144 --field-trial-handle=2248,i,13253177445437999162,3079669390042304664,262144 --variations-seed-version --mojo-platform-channel-handle=6264 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:6472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=es --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5008,i,16607216100446983716,4866494259745023794,524288 --field-trial-handle=2248,i,13253177445437999162,3079669390042304664,262144 --variations-seed-version --mojo-platform-channel-handle=1044 /prefetch:8
  2⤵
  PID:2908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=es --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5584,i,7493407925497033727,4552106005438776086,524288 --field-trial-handle=2248,i,13253177445437999162,3079669390042304664,262144 --variations-seed-version --mojo-platform-channel-handle=5596 /prefetch:8
  2⤵
  PID:2692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=es --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4292,i,10677379094376943223,13909845220301402081,524288 --field-trial-handle=2248,i,13253177445437999162,3079669390042304664,262144 --variations-seed-version --mojo-platform-channel-handle=5240 /prefetch:8
  2⤵
  PID:4028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=es --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5664,i,15386554322653078470,15867204294239809232,524288 --field-trial-handle=2248,i,13253177445437999162,3079669390042304664,262144 --variations-seed-version --mojo-platform-channel-handle=6528 /prefetch:8
  2⤵
  PID:2868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=es --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5664,i,14785416652109183446,13312088699003209950,524288 --field-trial-handle=2248,i,13253177445437999162,3079669390042304664,262144 --variations-seed-version --mojo-platform-channel-handle=4452 /prefetch:8
  2⤵
  PID:7020

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3912

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:372

C:\Users\Admin\Downloads\NyanDDoS.exe
"C:\Users\Admin\Downloads\NyanDDoS.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4904

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

12301123-bea8-4eb7-85ac-01768177d0ad.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\12301123-bea8-4eb7-85ac-01768177d0ad.tmp
Size 21KB
SHA256 0026287063ce49eac4f9d5e1070ed44a96ba4f19afb44c18162fa09960695970
MD5 37b6d9e0e704d80a93fb31dac370b594
SHA1 6cecd8715e0f02a5cf7433d5bc6a5acd02a2682d
SHA512 9bc1d69506a0555167cd06e0e022b49011b5b987a6d97ad9b2fce7b4ef3b2ed837e00fa10e154ca8e8f5c578675df6ae342bb5d9a176ff7c4b62bac51a18a8fc
SSDEEP 384:F67FvQkUSvOPsNt8TUNTUlIlHL4ZB5QHX58Es8iWXtXH7vBEX+FLIIlh:8FxuYwgKJuadWtXH75EX+VLz
TLSH
T106A27C32A8989D3F5DB2AA44F20A3613DEB19057DAC5AF90E7DD4A1C00CB2DC234BD16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3684916d-d40f-4a1f-bf55-92e74a080c8c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\3684916d-d40f-4a1f-bf55-92e74a080c8c.tmp
Size 8KB
SHA256 3ce5e358dbf5000c5346f076ba7ff5cbb185883a9aefb80036430a3977f8b908
MD5 00b872443dd275c294707b7f2326af0c
SHA1 e266154a58a0fe84b0763e674c03250f8c9f3c75
SHA512 70f7283b99a4f48e166d8e2578dc55f51ba67c3467bb82074a5544983412495dcb77fafe2b863c550ee5d3bf544919bc58331e85238ababb671d6a1a0b6f45fe
SSDEEP 192:9ONW6wlDTQmiUycVMQ4X58gZcjzork6SWX27dveqqPU6:9ONW6kFUQ4X58Es8iWXhXU6
TLSH
T1D1121835E468AC2B5DE2A549B1873503AFB5512BEB496F90C6EC1A2C00DF6AD234BD13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5b943750-4898-4c77-9a5c-b2e190a8536d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\5b943750-4898-4c77-9a5c-b2e190a8536d.tmp
Size 18KB
SHA256 c9f2187c5792fb680fd69e2e465d4c9526ed0f20e273a7d1ede2b8dca63b9c37
MD5 6ab2fd5f2b5f65ae6dc0c8e12da758ea
SHA1 abd312c9ae77ddf6375a5dbcdf406f32240281b0
SHA512 4249145aa9c9beb3e7c6625f48f11fcf5ae61aa70f1f46e7c0f42dfb8c521167cff8819d0c9edb5c59691463180ac4ded22b7c6bf9a5064822504253b9a739c4
SSDEEP 384:FQkUSvUsNTHL4ZB5QHX58Es8iWX8XH7vBEX+FLIIlh:fUhJuadW8XH75EX+VLz
TLSH
T131827D31B4686D3B4DB2A105F24A3553DFB4905BEAC92F90DAED4B1C01CB2DD234B926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

871eb201-179d-4790-ab67-b670b876ccb5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\871eb201-179d-4790-ab67-b670b876ccb5.tmp
Size 18KB
SHA256 95537ab66d7675865d7867b2b812c1e4664aa71a66fa4bef57d2146b54d031db
MD5 12fdc8201c4cfd14ae6d808acdfb9b15
SHA1 2fd7283d9054b3e042777090838f7330f5683d07
SHA512 1b0b70635ec5acf5ad4dfcfc3166b67d6a73b3dd82b3dc1094431ebd9d63bcd9092bf6eb1bf11644c8f56390d964104506738acaefe1fa7a5a99d96e6f394427
SSDEEP 384:pQkUSvUsNT2L4ZB5QHX58Es8iWX8XH7vBEX+FLIIlh:LUeJuadW8XH75EX+VLz
TLSH
T1C4827D31B4686D3B4DB2A105F14A3953DFB4905BEAC92F90DAED5B1C01CB2ED234BD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 58b461967016818ce2213ba739aa830e079c4747cc98baea5feaffc8b09c915d
MD5 8800a672498272bad98dd79644e30101
SHA1 14a42c33d6271869cc680cadc5ae061e7092e3ae
SHA512 a17f90c73859841f3e0a3211d7f8d1027a7f8ec3a4ef87ddc96b1a39e0b52bc65decb3dd694a7092e22f06f2124864535e2e8632387dd42184abe2d3e22d7e12
TLSH
T135D022F2F32200E8C8C02A3C20030B080208C8000C833220C832C0C23ECCBC0A88F08C
MD5 SHA1 SHA512 TLSH

Submit Download

01b5af50-693f-4bfb-aec2-9e540cede354.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\01b5af50-693f-4bfb-aec2-9e540cede354.tmp
Size 10KB
SHA256 c69796994b879b3f7acab0c96b651aa74a5dd12b04930e6005c44e6840b1c2ad
MD5 acc5745e32f6d7ffbd395c031f0d7b07
SHA1 ff1c673107a44e18b22a85e803f63edaacdbf22e
SHA512 102fba659ad8c7d2b1eac2b020ba4c0c7672fe221e8309c3a58bb24823eb89180b504cb8b451ccf5d42898d08722f3b864249425a32f020b10367b316f09ec38
SSDEEP 192:sxZqLnQ/fNsJrqIupLHW6+WNGYrMvzuIg5wJ:sxZqLQ/fNsJrqLHbGIa
TLSH
T13222C9526E38A93B8CC7D20DBB15BF53E6F9503291941E48EAFC861C05E7ADD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

39bbbf42-aa5d-4b90-a967-0c8ae24117f3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\39bbbf42-aa5d-4b90-a967-0c8ae24117f3.tmp
Size 9KB
SHA256 a654cc8de2e77cf490bb457f5f11586f579352aff2184112713b008f61e467cd
MD5 5647672cae116cd3e5cfe301bdf0ae58
SHA1 561d3ad220c0fcd7efd958e49f865cbc4248e378
SHA512 883f4339ed8d4b6a03b5089d82031ba50bd14ab0c3696db01b499776fb7242d80a3a9756e8c3df84d32cf5314a3ef9b35c189ae8d87d441301d3ccd9cac46c2c
SSDEEP 192:sxZqLnQ/fNsEkqIupJHW6+WNGYr1cguIgrJ:sxZqLQ/fNsEkqJHbGL9
TLSH
T1ED12A6516E28A93B8CC7D20DBB19BF53E6F9503295951E48EAFC861C05E6ADD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

734b398e-5311-4be7-bcdb-3f0ac4351a0f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\734b398e-5311-4be7-bcdb-3f0ac4351a0f.tmp
Size 27KB
SHA256 beae65bbfe7bd154f6fbe945eac229c063b9bb0a53fbb2ceda2973a0e915c2a7
MD5 f58c8b5375f17fd125fd51c203fb6119
SHA1 ef9902f0fa7218a76ea86065ee9a6e84585e2a83
SHA512 df34be6c3d86d82845440bb4d10db52bf91b1b7334856a6422cdf48d09364bd891cacdd1047e62418513ef551a055a029ed36e3618117f38b74bbccc92824c3e
SSDEEP 768:wXy4J/DWvbtBh8F1+UoAYDCx9Tuqh0VfUC9xbog/OVCiLlc2TbjroRkQ:wXy4J/DWvbtBhu1jajiLm0bQCQ
TLSH
T126C20B3B684CCA7E4FC00A9DED5E6FDB3E9802C796948D4047FA994C02C77EA51264DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

87fb86f3-cc43-4c4e-a6f2-33bdcd681446.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\87fb86f3-cc43-4c4e-a6f2-33bdcd681446.tmp
Size 9KB
SHA256 6bd779bd15168a1436cb07b59abe5db48be673cae8aad2c9248cdfa40fbd4f04
MD5 a762e91428a25e349c6b453047ad0c67
SHA1 3404440d6b51b8fdd53dfccb311b7aca63104b28
SHA512 68a82906c128920dabc1586137542313ef7e6bf26225ae283c787c79b74f5ef679f672687fdf673e9c0c2a2cc0dd6fc6bba39dbe10194ca1a1870b406d8fbb4b
SSDEEP 192:sxZqLnQ/fNsJrqIupJHW6+WNGYrAQguIg5wJ:sxZqLQ/fNsJrqJHbGOa
TLSH
T13A22C8516E28A97B8CC7E20DBB15BF53E6F9503291951E48EAFC861C05E7ADD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

920cda81-d098-488c-9590-3c5be37de0f9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\920cda81-d098-488c-9590-3c5be37de0f9.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG
Size 331B
SHA256 35eb01d8476535966b9572e37eaded334ac62a878a363470478e28191ceba72e
MD5 be3633aae9b9e9b0eaba7758bb578200
SHA1 4a121a57b00e90f018318d28f1057abbfd46f877
SHA512 4b62f8afde808bae8f40b0934dd05d2bb0c9a32c51cfbd478cc54a3d2dee98d31e363a60d84e8bd3096f0fcca8123b514f9d7aaa5907cc30ef3fd5f180969e57
TLSH
T1AFE020A545C9C31D93057487419CBB8FA190361FA7C0790F1744C4447003440F3F9570
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG
Size 331B
SHA256 0b19d901fbb982ff5f36e84e4017579fdb958cb1df2fa5c889563e047ad80aaf
MD5 ece29ab174a8bc555305a31609563504
SHA1 2f3c2d35f1b6675f7975b889b3a187b2adcf923f
SHA512 c9f8e79e81c773eb976dc2840c161912e9c2caf9992451701b7f24bd25238c03b9741778a66cdfaaf83b37db317bae75976828d9a1c73e166d90c3fbeaa116b6
TLSH
T195E07DA504C8C32FA32A644B03ECE78CC3C0361BE3C0AE6E3784C4847092454F2D76B0
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 d58179d2f8c849383cea0eb78ab935c550ea27c5de55da2fed8030661b061c31
MD5 3d0a10bcc4a1a1830778b27c5e3fb3ef
SHA1 6ebe7d9ac229c73429fce6a33fbba2c836c99a9b
SHA512 1c788b575848f784b355449390c9f374398da990e4864cb930c9f183bfb8a99b5bf98a75fe0ab277ecfacc2e1cb4a1abcfb0f68443b2f4ebf4a579085df5c028
TLSH
T1E0E078D908D4D35D5315644701DC57CDC180362BF3C0A9CD1B80D4C47341040FAC5771
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 2KB
SHA256 49954af3b9172b06a4ec688e264a9e0d26cd3d8e5f593ac21f19e9ff34b3ff25
MD5 2660b8e9bed3018eff052658f342c04a
SHA1 61bf0dccc001e0cda8ab8b0d434512aecb546a14
SHA512 6c7c07bdc857df8cd87c61c9421848ca14f36519a3ec7907682253ba136ef7ecb14e7d6675cdc2129cc44becc9dcb4ab01816529b798e423874271ff547da925
TLSH
T1CE51B881B96350D4EF5CCF31E1FC358776B4D5B8AA932F420094D9B9DBCE3A841C0054
MD5 SHA1 SHA512 TLSH

Submit Download

11220810-a5a8-433e-b6fc-3aac22d020e1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\11220810-a5a8-433e-b6fc-3aac22d020e1.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

05d231d9-8ce1-4c8b-a0c9-7829f23194dc.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\05d231d9-8ce1-4c8b-a0c9-7829f23194dc.tmp
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

0adccb62-6233-4145-a0fb-cdb690e75730.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\0adccb62-6233-4145-a0fb-cdb690e75730.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

223edb15-cbe8-4ec0-911d-980523364255.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\223edb15-cbe8-4ec0-911d-980523364255.tmp
Size 833B
SHA256 dbb501b5deeba9c2ec1b41526694f6744c6f62f19640c2c3aaf15b946a68294c
MD5 933b4ebac63c4903aca6be9287d902a7
SHA1 3c51f2c3eaad6f3d4cdbc9993cd69ee7c792fd53
SHA512 7062c4cbbf7ad461341dfe281bd4e5be46142c4057136eb7e33a8390733d39370fec7bf9e0cb439b7dcf7adfcb370b4cf8a19faffcbdbe78df6953e916678523
TLSH
T14C01CEF387E5557EC92112F09A287E1BCF1D0506431C3C1686D4AF1793E3025E445DAF
MD5 SHA1 SHA512 TLSH

Submit Download

42bf7745-396f-418d-be9e-af7d5e1fae0e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\42bf7745-396f-418d-be9e-af7d5e1fae0e.tmp
Size 638B
SHA256 2932d9a6d3a9796460239a6c5a8558602e67d53c05ef951a212c7a16542f8774
MD5 6bb12c6f8affad009b4c8ca581cc3b9b
SHA1 0b4d5a5a4937fa6b02ee5fe136171a7d0b883456
SHA512 a2b4d1ef410553bde07cf3a3284fc4583c4c49d47119f1756bcf0a128aa9c3ae98505da8edbe0b8f23e90fbc4d8a3230fd58274f771bfc3c720ddfe58704428b
TLSH
T185F049B383E069BE8A1152F09A18BE1BCF690506831C385686D06E27D3E3465E404D5B
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 b0b363bbe5aa3dc5e9a57347d914ce983ef92f23d22c34d5c428c0ba15d22e6b
MD5 a0ffbb884df50a375a18d5208e547c97
SHA1 28c667d283900eefb5e59f6893f7569af320467c
SHA512 ddfa5b2123e864ad3aba4db648e696d4617fe73a2f425c40565cd5a6ae176d135c09a37bac83ff096e58223da8491a2c76f1b441731512f020809b1e2a00739d
SSDEEP 96:KIDCKs0+qS8KrKy6feDfNlluvV81t/uK1btxupX/khC:E53fT+
TLSH
T13291325170BE065438BD294E81F5976A924232737118E97B7FBC48A38E67E142EFCCC9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b86cbdb7-acaf-45a9-a803-924fa6827f18.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\b86cbdb7-acaf-45a9-a803-924fa6827f18.tmp
Size 9KB
SHA256 660222067c8debb2f7af6eba00b842cfd86876afa8384b7123051b2aea20f557
MD5 9d5c06ea9e4eb99d160ecf76ac7e7c31
SHA1 de12f16b3188311b6eab5be718eaec2caa208f7d
SHA512 e7621434cce311853806664082ba5ff969349cf779f3d5053dae34e85ea7db2df7a4e708134df567bcf289627fc19a05e1143d7837c1611a7571207cb631c38d
SSDEEP 192:sxZqLnQ/fNsJkqIupJHW6+WNGYr1cguIg5aJ:sxZqLQ/fNsJkqJHbGLA
TLSH
T17E22A6526E38A93B8CC7D20DBB15BF53E6F9503295951E48EAFC861C05E6ADD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bdb572e1-9eb7-4874-b14b-c35e1635105c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\bdb572e1-9eb7-4874-b14b-c35e1635105c.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

b9019268-21e9-414f-9776-001ecea673bd.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\b9019268-21e9-414f-9776-001ecea673bd.tmp
Size 8KB
SHA256 8f60443ce347dd6e43a6aa46b37a5b32564490c304968da0066e8cd1c90ed3d8
MD5 be7992d5e5def3334572bbb4e7f9c70c
SHA1 7a9dc1ceea542818e5a86f82fb994af1e5b43d4a
SHA512 2c84ad1bcd718dcad639e7c6605069ff3a58b459faba60e1ff87578043ff9c05e0eca169e72789376bc539e66dbbe0dae92fe95198f053561818bbcf007b6d48
SSDEEP 192:1ONw6wlDgQmiUy6VMW4X58gZcjzork6SHDl2h9U6:1ONw6kgoW4X58Es8iBo9U6
TLSH
T1D102E834B8687C7B9EF2AE09F58726139FE5102BEA552F94CAE81A2C00D765C1347927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e9c24072-2162-4865-9dee-3926e2ec4c26.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\e9c24072-2162-4865-9dee-3926e2ec4c26.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 381798e9a328999b3804ec9867309d823b29055f8e8976b45c5591b2d9b2ab51
MD5 adef70ead46615ff5bce159ecbc1000a
SHA1 a0a46b9a0fff9084888595712822687a49d008c1
SHA512 c6494f9e9a9831d3512e476319f284f18b12522e532f5c7584a88a5b18e6bd6c647cd0240407a8a930c91235aa562769cc7c789149cf02b2e4bc70129ccadd26
TLSH
T18D412D58B7E91154F3B36E5AAFF7A86E487B79372E06D45E00110E4E0676B00C861737
MD5 SHA1 SHA512 TLSH

Submit Download

NyanDDoS.exe.crdownload

Path C:\Users\Admin\Downloads\NyanDDoS.exe.crdownload
Size 1.0MB
SHA256 b990cb67ed4e182319908c7969833db566027daf6c2256159f3b0ce19f50c0bc
MD5 53a0aa0858192ccd185d71d5ed3ebb6c
SHA1 bb5717204e5f7cd9ab8d148fc3c47619abcdde2b
SHA512 59806bd345d30a51196014ac388222710285f7bc95ee1f98a9b7dad085d963937eae9eefd962e06d6c9f7c17ccfa032dabc5798708fa8d0c14d960a3d34c24ce
SSDEEP 12288:8vi/J/42t+qJKIk/J/42t+qJ9NYYOrGJ/42t+qJ:8vi/i2DJ2/i2DJvti2DJ
TLSH
T18435B282454A4206C428233751F2FE76E3E3EACB76319E09C691B91EFC5EE9F4494E17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NyanDDoS.exe.crdownload

Path C:\Users\Admin\Downloads\NyanDDoS.exe.crdownload
Size 1.0MB
SHA256 b990cb67ed4e182319908c7969833db566027daf6c2256159f3b0ce19f50c0bc
MD5 53a0aa0858192ccd185d71d5ed3ebb6c
SHA1 bb5717204e5f7cd9ab8d148fc3c47619abcdde2b
SHA512 59806bd345d30a51196014ac388222710285f7bc95ee1f98a9b7dad085d963937eae9eefd962e06d6c9f7c17ccfa032dabc5798708fa8d0c14d960a3d34c24ce
SSDEEP 12288:8vi/J/42t+qJKIk/J/42t+qJ9NYYOrGJ/42t+qJ:8vi/i2DJ2/i2DJvti2DJ
TLSH
T18435B282454A4206C428233751F2FE76E3E3EACB76319E09C691B91EFC5EE9F4494E17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4904-194-0x0000000004DD0000-0x0000000004DDA000-memory.dmp

Download

memory/4904-193-0x0000000004E20000-0x0000000004EB2000-memory.dmp

Download

memory/4904-192-0x0000000005330000-0x00000000058D4000-memory.dmp

Download

memory/4904-191-0x00000000002C0000-0x00000000003D0000-memory.dmp

Download

memory/4904-299-0x000000004DC10000-0x000000004DD12000-memory.dmp

Download