hxxps://killl4d2movement[.]netlify[.]app/DDOS/NyanDDoS[.]exe

Analysis

user interaction
yes
max time kernel
575s
max time network
579s
platform
windows10-2004_x64
resource
win10v2004-20260911-es
resource tags

arch:x64arch:x86image:win10v2004-20260911-eslocale:es-esos:windows10-2004-x64systemwindows
submitted
02/11/2026, 19:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://killl4d2movement.netlify.app/DDOS/NyanDDoS.exe
Sample261102-xtsbjayx8r

Score

8^/10

discovery

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
18	2596	msedge.exe

Executes dropped EXE 1 IoCs

pid	Process
1128	NyanDDoS.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NyanDDoS.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2596	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 8 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-939655444-3071939294-1401108526-1000\{44191057-2D2D-4BF1-AC2B-FC4C15140E0C}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
176	msedge.exe
176	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe

Suspicious use of FindShellTrayWindow 43 IoCs

pid	Process
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe

Suspicious use of WriteProcessMemory 49 IoCs

description	pid	Process	procid_target
PID 1308 wrote to memory of 4748	1308	msedge.exe	85
PID 1308 wrote to memory of 2596	1308	msedge.exe	86
PID 1308 wrote to memory of 2120	1308	msedge.exe	87
PID 1308 wrote to memory of 2120	1308	msedge.exe	87
PID 1308 wrote to memory of 2120	1308	msedge.exe	87
PID 1308 wrote to memory of 2396	1308	msedge.exe	88
PID 1308 wrote to memory of 2396	1308	msedge.exe	88
PID 1308 wrote to memory of 4436	1308	msedge.exe	89
PID 1308 wrote to memory of 4424	1308	msedge.exe	90
PID 1308 wrote to memory of 4436	1308	msedge.exe	89
PID 1308 wrote to memory of 4436	1308	msedge.exe	89
PID 1308 wrote to memory of 4424	1308	msedge.exe	90
PID 1308 wrote to memory of 4424	1308	msedge.exe	90
PID 1308 wrote to memory of 3256	1308	msedge.exe	91
PID 1308 wrote to memory of 3256	1308	msedge.exe	91
PID 1308 wrote to memory of 3256	1308	msedge.exe	91
PID 1308 wrote to memory of 4124	1308	msedge.exe	92
PID 1308 wrote to memory of 4124	1308	msedge.exe	92
PID 1308 wrote to memory of 4124	1308	msedge.exe	92
PID 1308 wrote to memory of 876	1308	msedge.exe	96
PID 1308 wrote to memory of 5008	1308	msedge.exe	97
PID 1308 wrote to memory of 876	1308	msedge.exe	96
PID 1308 wrote to memory of 5008	1308	msedge.exe	97
PID 1308 wrote to memory of 1672	1308	msedge.exe	99
PID 1308 wrote to memory of 1672	1308	msedge.exe	99
PID 1308 wrote to memory of 1608	1308	msedge.exe	100
PID 1308 wrote to memory of 1608	1308	msedge.exe	100
PID 1308 wrote to memory of 1608	1308	msedge.exe	100
PID 1308 wrote to memory of 652	1308	msedge.exe	101
PID 1308 wrote to memory of 564	1308	msedge.exe	102
PID 1308 wrote to memory of 564	1308	msedge.exe	102
PID 1308 wrote to memory of 3688	1308	msedge.exe	104
PID 1308 wrote to memory of 1128	1308	msedge.exe	105
PID 1308 wrote to memory of 4644	1308	msedge.exe	115
PID 1308 wrote to memory of 1048	1308	msedge.exe	116
PID 1308 wrote to memory of 1536	1308	msedge.exe	117
PID 1308 wrote to memory of 4276	1308	msedge.exe	119
PID 1308 wrote to memory of 4276	1308	msedge.exe	119
PID 1308 wrote to memory of 1752	1308	msedge.exe	120
PID 1308 wrote to memory of 1752	1308	msedge.exe	120
PID 1308 wrote to memory of 176	1308	msedge.exe	121
PID 1308 wrote to memory of 1864	1308	msedge.exe	122
PID 1308 wrote to memory of 1864	1308	msedge.exe	122
PID 1308 wrote to memory of 3672	1308	msedge.exe	123
PID 1308 wrote to memory of 3672	1308	msedge.exe	123
PID 1308 wrote to memory of 3544	1308	msedge.exe	124
PID 1308 wrote to memory of 3544	1308	msedge.exe	124
PID 1308 wrote to memory of 3504	1308	msedge.exe	127
PID 1308 wrote to memory of 3504	1308	msedge.exe	127

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://killl4d2movement.netlify.app/DDOS/NyanDDoS.exe
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffe6ed0c188,0x7ffe6ed0c194,0x7ffe6ed0c1a0
  2⤵
  PID:4748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=es --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1888,i,4962786067962967933,2754556833947024738,524288 --field-trial-handle=2228,i,11281297332784037984,13756426690611583007,262144 --variations-seed-version --mojo-platform-channel-handle=2256 /prefetch:3
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:2596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1628,i,4503664760865458035,14541541012232307879,262144 --field-trial-handle=2228,i,11281297332784037984,13756426690611583007,262144 --variations-seed-version --mojo-platform-channel-handle=2224 /prefetch:2
  2⤵
  PID:2120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=es --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2600,i,15374867575824323658,2143715248389167739,524288 --field-trial-handle=2228,i,11281297332784037984,13756426690611583007,262144 --variations-seed-version --mojo-platform-channel-handle=2744 /prefetch:8
  2⤵
  PID:2396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3444,i,1426667617095779590,5792053674994221746,2097152 --field-trial-handle=2228,i,11281297332784037984,13756426690611583007,262144 --variations-seed-version --mojo-platform-channel-handle=3448 /prefetch:1
  2⤵
  PID:4436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3456,i,17236122616137600438,17500447572897230126,2097152 --field-trial-handle=2228,i,11281297332784037984,13756426690611583007,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:1
  2⤵
  PID:4424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4184,i,5592069363685095609,2684560967562862149,2097152 --field-trial-handle=2228,i,11281297332784037984,13756426690611583007,262144 --variations-seed-version --mojo-platform-channel-handle=4300 /prefetch:1
  2⤵
  PID:3256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4196,i,7597832607674908645,10356263268514221125,2097152 --field-trial-handle=2228,i,11281297332784037984,13756426690611583007,262144 --variations-seed-version --mojo-platform-channel-handle=4320 /prefetch:2
  2⤵
  PID:4124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=es --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5284,i,18381112392632306170,6882018269724890280,524288 --field-trial-handle=2228,i,11281297332784037984,13756426690611583007,262144 --variations-seed-version --mojo-platform-channel-handle=5296 /prefetch:8
  2⤵
  PID:876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=es --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5280,i,18173309529553309540,800446454975635847,524288 --field-trial-handle=2228,i,11281297332784037984,13756426690611583007,262144 --variations-seed-version --mojo-platform-channel-handle=5316 /prefetch:8
  2⤵
  PID:5008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=es --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5820,i,6584606937707060786,9386341264675939911,524288 --field-trial-handle=2228,i,11281297332784037984,13756426690611583007,262144 --variations-seed-version --mojo-platform-channel-handle=5836 /prefetch:8
  2⤵
  PID:1672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5824,i,9350754174068123138,3098751793764610296,2097152 --field-trial-handle=2228,i,11281297332784037984,13756426690611583007,262144 --variations-seed-version --mojo-platform-channel-handle=5852 /prefetch:1
  2⤵
  PID:1608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=es --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6132,i,13958161981921670951,1188636394501038631,524288 --field-trial-handle=2228,i,11281297332784037984,13756426690611583007,262144 --variations-seed-version --mojo-platform-channel-handle=5272 /prefetch:8
  2⤵
  PID:652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=es --service-sandbox-type=icon_reader --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6328,i,17566701735445286295,3764022937581609997,524288 --field-trial-handle=2228,i,11281297332784037984,13756426690611583007,262144 --variations-seed-version --mojo-platform-channel-handle=6332 /prefetch:8
  2⤵
  PID:564
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=es --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6660,i,2473088942420533130,8091443399328286979,524288 --field-trial-handle=2228,i,11281297332784037984,13756426690611583007,262144 --variations-seed-version --mojo-platform-channel-handle=6688 /prefetch:8
  2⤵
  PID:4192
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=es --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6660,i,2473088942420533130,8091443399328286979,524288 --field-trial-handle=2228,i,11281297332784037984,13756426690611583007,262144 --variations-seed-version --mojo-platform-channel-handle=6688 /prefetch:8
  2⤵
  PID:3688
- C:\Users\Admin\Downloads\NyanDDoS.exe
  "C:\Users\Admin\Downloads\NyanDDoS.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=es --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6684,i,10943176249693162484,17437841612683728174,524288 --field-trial-handle=2228,i,11281297332784037984,13756426690611583007,262144 --variations-seed-version --mojo-platform-channel-handle=7084 /prefetch:8
  2⤵
  PID:4644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=es --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4440,i,7723885354279935879,16905626075163209671,524288 --field-trial-handle=2228,i,11281297332784037984,13756426690611583007,262144 --variations-seed-version --mojo-platform-channel-handle=4444 /prefetch:8
  2⤵
  PID:1048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=es --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4380,i,4998530248426513674,7558544452860117828,524288 --field-trial-handle=2228,i,11281297332784037984,13756426690611583007,262144 --variations-seed-version --mojo-platform-channel-handle=560 /prefetch:8
  2⤵
  PID:1536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=es --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6548,i,12779454911598566708,604437134504801548,524288 --field-trial-handle=2228,i,11281297332784037984,13756426690611583007,262144 --variations-seed-version --mojo-platform-channel-handle=5984 /prefetch:8
  2⤵
  PID:4276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=es --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6588,i,4156865074926294124,11121079874418240731,524288 --field-trial-handle=2228,i,11281297332784037984,13756426690611583007,262144 --variations-seed-version --mojo-platform-channel-handle=5380 /prefetch:8
  2⤵
  PID:1752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6352,i,8826450111264224605,15697939074854381881,262144 --field-trial-handle=2228,i,11281297332784037984,13756426690611583007,262144 --variations-seed-version --mojo-platform-channel-handle=748 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=es --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5768,i,13183209318241377041,16569785896929445280,524288 --field-trial-handle=2228,i,11281297332784037984,13756426690611583007,262144 --variations-seed-version --mojo-platform-channel-handle=6660 /prefetch:8
  2⤵
  PID:1864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=es --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6572,i,1031706922471616506,9277218536437057621,524288 --field-trial-handle=2228,i,11281297332784037984,13756426690611583007,262144 --variations-seed-version --mojo-platform-channel-handle=3980 /prefetch:8
  2⤵
  PID:3672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=es --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5336,i,1252510099324257774,11576267953063959831,524288 --field-trial-handle=2228,i,11281297332784037984,13756426690611583007,262144 --variations-seed-version --mojo-platform-channel-handle=2912 /prefetch:8
  2⤵
  PID:3544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=es --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3964,i,16020462215711844766,6086060844689402888,524288 --field-trial-handle=2228,i,11281297332784037984,13756426690611583007,262144 --variations-seed-version --mojo-platform-channel-handle=1348 /prefetch:8
  2⤵
  PID:3504

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1832

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

0a1b20ff-6935-4c4c-9a85-4ee32a8a9b6e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\0a1b20ff-6935-4c4c-9a85-4ee32a8a9b6e.tmp
Size 18KB
SHA256 fcd3db2d538900bb3b79651e704dc045721841a8219f2fa68d332ecbcfe4e891
MD5 75b2815f6c8a1c7c3cb5ea17b14e6cb1
SHA1 688bba3ce1c13a4b53a24b7b9f2d53708c863e14
SHA512 99fc5abed132f41fb674dc2fddce32ea5dc622797360d5248634df2532d965ec13e96bec444b02f5d197dc3d4f0e5c21e6605cb38b0ce38664c4bbccaf469fc1
SSDEEP 384:9QkUSvasNrS812aEzIGmr6+BsIEi+lH7vBETAIIlE:nakh+w6Vhi+lH75ETALi
TLSH
T12E827C329878AC7B9EB7A504F04A3A17AEB4915BD7D81F90EDDC5B1C00DF29C234B916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0a4e1ada-8667-4aaf-964e-79d14f2e3114.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\0a4e1ada-8667-4aaf-964e-79d14f2e3114.tmp
Size 8KB
SHA256 4d11987f98a4cfeab22eaee778cc0c547bd400f7fc385978abcc94ca2c450487
MD5 fd2584630f182f3cecf1c294cd02f3ea
SHA1 8dc3b90162006221aad59264a6ee8956bb7cc4d3
SHA512 b1915e5a60a161add4b05aec28fcbbd9c01fefddf6741cbda061daa770eed7358f861d90f0a5280af5a03a4038b833e7333e3536cc0d6c28b54edbf4b5fa09fa
SSDEEP 192:MON26IEwQmiUyNcTEuIGmr6+qesIJe5R27H+OqJU6:MON26Dw/EuIGmr6+BsILH+lU6
TLSH
T144120A329CBCBC7BAEA3A845B48739179DA55217D7C97F90D9DC1A1C00EF29C130B916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

30aab606-03ff-45ef-be7b-f360d41ec5c5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\30aab606-03ff-45ef-be7b-f360d41ec5c5.tmp
Size 18KB
SHA256 5182c1de3c8825e871bcb7285c1e1000df79429104cf7fc5240125e6adac5457
MD5 79254e5269f87481e9e41df8ab084501
SHA1 d8e40f89630328f16cda1ca03b91f4517e6c0227
SHA512 04fbcbca53ec211de11b3a24bcd140b78fa10702ae15a35fd38a65104b6027fdfdc082effc8580aa9a8a535432121d3e5e40bc5983da98dda7ecb5d758f09dc2
SSDEEP 384:JQkUSvasNre812aEzIGmr6+BsIEi+lH7vBETAIIlE:raYh+w6Vhi+lH75ETALi
TLSH
T1A4826C329C78AC7B9EB7A504F04A3A17EEB4915BD7D81F90E9DC5B1C00DB29C234B916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

811e1535-4b2c-45f6-98d9-cc333d5dfea4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\811e1535-4b2c-45f6-98d9-cc333d5dfea4.tmp
Size 18KB
SHA256 744a15bbd982b661fa13cd9dbd79890172e400ffb3ec95381252ce03a62bb23f
MD5 59324e89bb9a3827c5a54d05b6dacd9f
SHA1 98ee2618d0c3780706a36fe2028580b4c743edc2
SHA512 c7379640f9cb6193299ccc62cdf60c5da02f1b2d33ff6e0fba4b4fcfc0ec2456d202ff662e5576e82efce0efcc8e4a11fc95704623250944afe3b54c33fbeb10
SSDEEP 384:GQkUSvasNrp812aEzIGmr6+BsIEi+lH7vBETAIIlE:maDh+w6Vhi+lH75ETALi
TLSH
T12E826B329C78AC7B9EB7A504F04A3A17EEB4915BD7D81F90E9DC5B1C00DB28C234B916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9f32ed82-b494-4957-bda5-66d871a49532.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\9f32ed82-b494-4957-bda5-66d871a49532.tmp
Size 8KB
SHA256 e5f1a51d8ad343b2f8b262b87c8632dc054b87d0ea9029af7b1f5f37d997ae17
MD5 4e9ce18d18dd8f7d02668234f9ae1345
SHA1 4591395ce9c8b160dd84d05010c15f85f939ad7c
SHA512 98534b417e5ec5328ab321c6668d6795b2101001e95d20c9456631f8ae0c08e6e22915d13111859c5b3a73971c14e27f63cc663e92158c15e40a2ca4bec7c49d
SSDEEP 192:aONw6IE7QmiUyDcTPuIGmr6+qevC7s+uhBU6:aONw6DtrPuIGmr6+BIs+EBU6
TLSH
T13E02F935AC7CBC7B9EF36D09B4873A276EA5112BD6952F84D9E81A1D00DB24C1306927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 7fbf8b23a13854c0c33f9b9cc9b82042dfb881d0f9995938391cf2da54cfb3de
MD5 f027022507ec94f32265883243245251
SHA1 a21e2e3703475c52ae4b2881bbdf87320a7a1aa4
SHA512 b618f5fec905802eac699560ca9b2bc85f4fdd04e41ff5ea96bbc8db8724a369489826c4b1839db0a0fe4023e73b7e95ac2ee4efdd1fc7f55c8c5ffcbd19d4cc
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7r:fwUQC5VwBIiElEd2K57P7r
TLSH
T1E0B3B931457E36BF26E93EE828CF1511B84F3912624895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 9e411e40b2b1e7f1576e6c2cf3027d590d4c5916b7a5e41c1a711f9117d0f1e1
MD5 f86a69ac894860b8a7e2ac52b3c2987b
SHA1 835d87e07bf2af2a2410d66f27145dd25efdaad6
SHA512 6de1915f0367b482a80195c1b703b1007a524ab2a6815670db955de8dd4235e1faa888dde7fcefe1ccbf4dae73b9d41563a6a2f7e5d8d75bf2ff9783b485b777
TLSH
T1ABD02BF8DBD88120F033383400398283308C660420061120A873114C0C441C34225868
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 18eb5a70b8dc14ee5a30ef2a54b3e14abbda2b2d751a8e8abad286d8e92d8872
MD5 a2b3071ef6468d20d3499dac11b0df41
SHA1 e96a1ba764d6003a0c508557df66dec18df2a1e7
SHA512 144677b38dc2433c6ce2cd569ea8dac3d5f5013e173fcf4e0e6d6d88ad42c12001c58ec8fdf8229ee7476fa921cb946792037c4914570deac4969d9365895b19
TLSH
T113D02BF89BD88520F433383400388283308C660420065221A873114C0C451C34225868
MD5 SHA1 SHA512 TLSH

Submit Download

569b3ad9-85ac-4510-8e92-e05c62f63dcc.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\569b3ad9-85ac-4510-8e92-e05c62f63dcc.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

5eccebc9-d1b6-450d-9481-4e0d11a05e2d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\5eccebc9-d1b6-450d-9481-4e0d11a05e2d.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

824cf7f2-d909-4dfe-ad71-3278095765a8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\824cf7f2-d909-4dfe-ad71-3278095765a8.tmp
Size 9KB
SHA256 2c17362a473cb02a95249aaae2b54f53d03945204682a322507e8233a157d494
MD5 9ac897c70bdd0cfa52f338c0e19532c6
SHA1 9ac7162d1d889349b64eef3aab8a864bcb5f32c2
SHA512 3f1d4a163c32ded2ef509aa2953deb794711a3bd6bc7d9976da615f1e5c3127f2d09729b052b51db76cbbdbb67732eafad40cdb4dd66fd1422ac93f6170e1d98
SSDEEP 192:sxZDpLnD/fQsZGxzIupJHW6+WNGYapJQMLIgrJ:sxZDpLD/fQsZGRJHbGB9
TLSH
T10C12B5526E38A57B8CCBE20DBB19BB53D6F9503291D41E58EAFC861C04E76DD224780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 e08bd4f27951e8414f06b04af5446582fd74976ff5db5e16a7cf3d16249522e6
MD5 0ecd504ff29d7cfe2debf3c3c86255cf
SHA1 458d02f38049925532e330266f7e19f7a1f56fad
SHA512 13e87e1864dba7fd4f9f9a9b12518f6ad46c79a70e1863aeffb762f4438afff5074056cc9923a8ad34ea5cfe0aff6f8c4505ebb178bf9dbe39631f64c9ede8f0
TLSH
T1A7E026C946CAE23EF658E44701BCD30CC280375BABC0690F6748C5EA7002E40A78BBE4
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 58956986d6ab4611a613919a2208c8aee7b79300ad8787185fa658591e9720b1
MD5 4d9f027cb4c8a9037473a8c8a7828527
SHA1 49dfb4a1846423525f86decc3498a60822e7e25d
SHA512 b2929a7682fd08a9a06422a6c0ea25f8e620fbb71001f2682852d88a7fd5082139eb164d65f51cccdc88c814b676fd78a847f165abff5cb554a97b0f75670adc
TLSH
T1ACE026E505C9C23EB20C645B02BE670C828C371B9BC0ED0E2B00C4847883844A6867A1
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 d24f2e6a04b10804cd22006899289421d01f7373b4843a74b8bfe60a84a33e48
MD5 ca019ccaeed49178f70aaf211c9bb444
SHA1 60b897ef828857d907ebb7b8be99750154c963fa
SHA512 810c32e48a56c0b5d33db6272719cb3514fc18091ad1ad2c16635f2fe2b95a2afd52f7d0a5cd15a4844fb429f1ebf264441e2b0e00e31f8008f1e4d001f04ea4
TLSH
T144E026CE26C9C72FF258648701BCA78DCAA13A5FA7C06E0F1B08C5CC7003444A7A67A0
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 569b507e082041d3468cb193ceaea06eaa0fb312bc74913b76501135ce15bebf
MD5 b5207a83ff6229daf59db3f84de229d5
SHA1 af96a1797b12026dd32ec2c764aea670f744a9be
SHA512 67f57d7aa37994e15e5404ccf9e53448495c468d720a4fc2c39c40a67202ca2ed9d11a3a5c882f1b999d7aaa21df84e3394dec255603f9d6b6e90984b5b4e1b4
TLSH
T17861C9A2A6604A90DFDCA67081C5714F3E7842B8DDFF2E1D3594F1FB070ABC92055179
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 69caef4473e7ca9162370f32ccefd0caa616cb5b9ec6f25428ccd3f703f19e30
MD5 fc53acf4b8ffeb449053613fabd235d4
SHA1 c6d29f3e1ee197862e056d90d6575ac2c48a5ccb
SHA512 399f66324f9a353af183db9c00b38c9594cb96038c1bc3534615f1b994d5ddb89c350a09fb0ddbe242b0d597a69cdd2291a1f674747beebc07db74c3eef8f0e9
TLSH
T1C761C8A2A6604A90DFDCA67081D5718F3E7842B8DDFF2E1E3594F1FB0B0ABC92055179
MD5 SHA1 SHA512 TLSH

Submit Download

bd5aea97-19d2-40c6-a189-d85a2bf1554c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\bd5aea97-19d2-40c6-a189-d85a2bf1554c.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

18343004-bbc1-4f52-8857-574f8c5a85fe.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\18343004-bbc1-4f52-8857-574f8c5a85fe.tmp
Size 638B
SHA256 02052e1a13b1426db12f37135583650efc0eddc46a6cf048d0bd7176a4f1aa4c
MD5 514a9fbb39986bc9068490b881332967
SHA1 51830c4175f84d81c7029b7c0615f91e3c39af36
SHA512 8ddc078c7b1a6def8bb848e755f97a70f237f86cb36214a8ea47b962b67e31e925145db47a028ef3ec3203290c8464a660e339c80b22a2bbc1ac7816154d86a7
TLSH
T19AF049B383E069BE8A1152F09A18BE2BCF690506831C385686D0AE2793E3465E400D5B
MD5 SHA1 SHA512 TLSH

Submit Download

42b7667c-247f-4d4e-9614-b51571c8845c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\42b7667c-247f-4d4e-9614-b51571c8845c.tmp
Size 833B
SHA256 65cecd631af7a5aa919b16e9bdda764a0b5f38c662d3f0938c9f775a01a89e99
MD5 433ff5c2c563af81cf272cb2d7cf19df
SHA1 039ae0acef35ac82c7db73a40289f4fc38cd434d
SHA512 6d46eb6da69b8cb7321ed5f823070a0d2ef521f4f76d76b33321087c03ac597801112ff3082ba884884a56a90923ba0dec9f7e3104a9ee97a317d0f0bdd95be6
TLSH
T18901CEF383E5557ECA1122F09A287E1BCF2D0806835C3C1686D0AF2793E2025E445E6F
MD5 SHA1 SHA512 TLSH

Submit Download

8882b9ab-9766-43f7-996d-ac43235a1d2c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\8882b9ab-9766-43f7-996d-ac43235a1d2c.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

96252b60-f116-4aa5-9365-ca5ef7b4289f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\96252b60-f116-4aa5-9365-ca5ef7b4289f.tmp
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 8208033ef96b0188da330eb11dd64b50636c8fef72b30e82c2aed293f488bcb2
MD5 a7ae4b9fe5f64e9c07ea419aa8dd9e8a
SHA1 284270a26bc366c2e7d616208f6e57169956b086
SHA512 57aec221b7f3cd1f033496eb66474bb53655b3dfa5a419e1326022214a60b433d4670ab5617ea6e656292aa6bed25205503e31741f8e3d1b5b76a144b641a5f1
SSDEEP 96:KFfKNJXVV9URAwGh9KO8G396P3YxVGLZAvrp73/UveWGj/KOuGF/6R5Gf7EgKhmg:YfKNJXVVORAVh78G3IP3YxVGLZAvrp7u
TLSH
T1BB91415435AF028039BE341950BA9A1B824132B3712CF97B3FED84B24D67E441CBEDC9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a35636bf-7a01-4c8d-978a-97a6b1c002be.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\a35636bf-7a01-4c8d-978a-97a6b1c002be.tmp
Size 27KB
SHA256 7272ff585f8b94c47f22586bc82b916ace6b80f88956343e571726ab60990156
MD5 076bcdf3353c8f0470d8595d4cacf1da
SHA1 ef02257f02107ece5b276d1a15ff8552154de8c3
SHA512 d080659eb81d7d0bf8d5541462c672611efd68e137583e6581c9b483576ed3c83fc1b9b52f33205f64a9ca8baad263f976836bf93c4fbf5058cdfe566cbf0710
SSDEEP 768:xbWPcLKWvKeEe8F1+UoAYDCx9Tuqh0VfUC9xbog/OVjlLlACy7Gro4mfe9mR6:xbWPcLKWvKeEeu1jaClLiF794mW9mR6
TLSH
T15DC2EA3B640CCB7E5FC11A9DDC5A6FA77E9802C79A548D4047FE984C02C77EA912A4CB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a3aa686d-49a8-4296-9bbf-b96e533c4070.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\a3aa686d-49a8-4296-9bbf-b96e533c4070.tmp
Size 10KB
SHA256 b7475f2f557245e4208f8fa0f4e6d69daddcc2916510c809be4bae4704bc8fbb
MD5 0da458e0e7a9efccdb877588c6a312dd
SHA1 2734b2b22dd31e7ed8c400f4eb41dc40532f8c2e
SHA512 a63c87b152cbf3694b5988a315680916cbc10bdce3b9eabb524fa6ef6b285ba8048250508eceb80d4e10967e87b605ce365b12fe119226288cec0d59ba59c889
SSDEEP 192:sxZDpLnD/fQsMGxzIupLHW6+WNGYapGhGzLIg5CJ:sxZDpLD/fQsMGRLHbGJM
TLSH
T15C22B752AE38A97BDCCBE21DBA557F13E2F9503250901E58AAFC861C05E76DD224780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c1f03a5a-b3b2-4863-8e5e-2208cfb58a0b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\c1f03a5a-b3b2-4863-8e5e-2208cfb58a0b.tmp
Size 9KB
SHA256 69dad3eee537809e093b769d35c7c3fa9ab914ea55a6b462f86ddbb22518e6c1
MD5 c81c41969475af5b902dcc856ffd1d96
SHA1 6bdad0b4ab8726a7c0a8b5ad940c36862acc0df9
SHA512 36e0b0c79f8d12078e5c185b113a74117b372a461b49afda8dd418625e7f28233cb32719864bdf0db404e6904ae5a5e883f9c49b508c465edb70b5a333bd7957
SSDEEP 192:sxZDpLnD/fQsDGxzIupJHW6+WNGYapJLMLIg5QJ:sxZDpLD/fQsDGRJHbG+e
TLSH
T15622B652AE38A57B8CCBD20DBB55BB53D6F9503250D01E58AAFC861C05E76DD224780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e0ac36ef-c41e-4cc2-b524-684967e6a0a0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\e0ac36ef-c41e-4cc2-b524-684967e6a0a0.tmp
Size 9KB
SHA256 e3a2d1a51decb5353c39ffd1c56c822ea4d6caa2d63bdc7e89ce84d92e19a0cc
MD5 f9c6dd4dfa5f0aa2e63fbef96e1ef437
SHA1 383618270d463d63d2375415f32313a0f1677c66
SHA512 6fb55d2c5b0cc24735d1ab388ab5849dec2b97bc036ed72937f1d7747107ebbf9d0d876b93dd7483a068fda2d267048e6b6e6be1fb35e5cd30911ca7119f6f28
SSDEEP 192:sxZDpLnD/fQsMGxzIupJHW6+WNGYap0hVMLIg5CJ:sxZDpLD/fQsMGRJHbG9M
TLSH
T1E022B552AE38A97BCCCBE20DBB557F53E6F9503250D01E58AAFC861C05E76DD224780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

50491fb9-8a69-41c7-80f7-8674f1989c5c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\50491fb9-8a69-41c7-80f7-8674f1989c5c.tmp
Size 22KB
SHA256 e7dfcd2af3cefc7ce57f7bf6991d35a5d20958cb42766f953d9e1c76fae333b6
MD5 5cb2b7e81b4702abd9866dd283d10b96
SHA1 5384d524ca48437435a367dbbc158070ce70493b
SHA512 c5558f99f45f9b2e4cc7c7fd80211556401a16d808a8b34aaccf6cba23f5b5a5e834235a19cf251015bda0baa50c8bea1b0a20624e7e483f5a039e0d86134f85
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/uQ:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAZ
TLSH
T168A2B81DC81C7E3257CA2F7D6A2F9DB276CA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

e617e4f5-50f9-4498-b77f-f78261890bb5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\e617e4f5-50f9-4498-b77f-f78261890bb5.tmp
Size 21KB
SHA256 6b4b2605bb9b451b00593da51686266bf0151256bd0c061f2ce02053ccbec973
MD5 79fa8f5c5890cebc236e37684f5c35db
SHA1 60d03e4bc71d40411bb2428a1e7e1f2a83191fe0
SHA512 21c00b1f7ddde597df61245dc50a2d70b269371fb7707580edddc1b8ec3953fb25162b2d496ce29c37f7b9a9e01124ed15adcd50ba6b921ac2a0a654ce53f662
SSDEEP 384:R67FrQkUSvdlsN18TUNTUlIlp812aEzIGmr6+BsI2wi+lH7vBETAIIlE:IFl/4wg8h+w6VPwi+lH75ETALi
TLSH
T106A25D738CA8EC7BEEB79A04F54A3617DEB09167C6D56BA0EAC85A1C00DB1CC134BD15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2391db95-ca2c-421b-970e-7b4fb849f0a4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\2391db95-ca2c-421b-970e-7b4fb849f0a4.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 766af9192567975b33dbb7a371f419e5486a932ad884e2fa6e196c78bd50454f
MD5 7eda4f0302db334ee47f3411c16f7830
SHA1 bee141947464d2a3d904cdd88edcba9962d5f1cf
SHA512 456e721a811c81a349804a60c2a566cabf5f38662e23816c4c92eff470d887daf6c1c6f180ad84683044a13d3dc9be40ce961dfacd2b2539f1b93b19c011bde3
TLSH
T177412A58A6E90148B3B77F4AAFF7A8AE487FB8772E06945D00110E4E4662A40DC71737
MD5 SHA1 SHA512 TLSH

Submit Download

NyanDDoS.exe.crdownload

Path C:\Users\Admin\Downloads\NyanDDoS.exe.crdownload
Size 1.0MB
SHA256 b990cb67ed4e182319908c7969833db566027daf6c2256159f3b0ce19f50c0bc
MD5 53a0aa0858192ccd185d71d5ed3ebb6c
SHA1 bb5717204e5f7cd9ab8d148fc3c47619abcdde2b
SHA512 59806bd345d30a51196014ac388222710285f7bc95ee1f98a9b7dad085d963937eae9eefd962e06d6c9f7c17ccfa032dabc5798708fa8d0c14d960a3d34c24ce
SSDEEP 12288:8vi/J/42t+qJKIk/J/42t+qJ9NYYOrGJ/42t+qJ:8vi/i2DJ2/i2DJvti2DJ
TLSH
T18435B282454A4206C428233751F2FE76E3E3EACB76319E09C691B91EFC5EE9F4494E17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b19172e0-62d1-4584-8867-d6af6759068c.tmp

Path C:\Users\Admin\Downloads\b19172e0-62d1-4584-8867-d6af6759068c.tmp
Size 387KB
SHA256 665c4c8db1a2c1e283331859359ef4ba82ca7785085cb163930e0ce45e61a31b
MD5 fe7f6459a77e010a7e1c99554bf8e658
SHA1 6db542e7539614c345a6e06b2675452ca1f47931
SHA512 613c3fab9eb494e6415ee6842aeac6db0f3a903ffed31dc295179b1221233b39c01f5758922612b8868864a4643ea124b5dd791eb412ac3c2ec98b4405b87f44
SSDEEP 3072:gHv7rFEvhsElX5LVxL/CNo/t5Idqr1EMkhPekY:8vHFE5sElJLLCN2tGdqr1aq
TLSH
T1AC842242590947058468323741F6FD39E3D2FACB23319D09CB81BA5BFC9DAAE948DE47
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1128-188-0x0000000000CD0000-0x0000000000DE0000-memory.dmp

Download

memory/1128-189-0x0000000005E20000-0x00000000063C4000-memory.dmp

Download

memory/1128-193-0x0000000005870000-0x0000000005902000-memory.dmp

Download

memory/1128-194-0x00000000057C0000-0x00000000057CA000-memory.dmp

Download

memory/1128-375-0x000000004E630000-0x000000004E732000-memory.dmp

Download