5c87f76fca785e5ccca4c7aa3c3e2ba9fedbc6ee7ae48b3f5d75b3831a211353

Resubmissions

14/05/2023, 22:29

230514-2ehk1aga9s 5

14/05/2023, 22:26

14/05/2023, 22:23

14/05/2023, 22:19

14/05/2023, 22:15

14/05/2023, 22:12

14/05/2023, 22:09

Analysis

max time kernel
148s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
14/05/2023, 22:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

dump.pcapng
Size

38KB
MD5

7b4a96b7864203fa0b1b84703ca55996
SHA1

aff893300475cf0a66b7b4f4dec812c0ef8c41c0
SHA256

5c87f76fca785e5ccca4c7aa3c3e2ba9fedbc6ee7ae48b3f5d75b3831a211353
SHA512

1f4383f798a46c656097f0acf86896885f3f85c674fe2f69ef620f860ad8caebfb7bf337778f8d36d94847fd50f9b97a4f9482d77a08e44aa46d9c5431dc08c4
SSDEEP

768:7uC8U+CYAV18LZrHifO6fU3AKwqlGP5IHr:758UTMLFiO6fU7BYyL

Score

8^/10

Malware Config

Signatures

Drops file in Drivers directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\drivers\myfault.sys	notmyfault64.exe
File created	C:\Windows\system32\drivers\myfault.sys	notmyfault64.exe
File opened for modification	C:\Windows\SysWOW64\drivers\myfault.sys	notmyfault.exe
File created	C:\Windows\SysWOW64\drivers\myfault.sys	notmyfault.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\177a8b0e-fbb4-427d-a5a3-d462007f78c1.tmp	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20230515002730.pma	setup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	msedge.exe

Enumerates system info in registry 2 TTPs 5 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	msedge.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
2780	msedge.exe
2780	msedge.exe
3912	msedge.exe
3912	msedge.exe
4124	identity_helper.exe
4124	identity_helper.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
6128	msedge.exe
6128	msedge.exe

Suspicious behavior: LoadsDriver 5 IoCs

pid	Process
672	Process not Found
672	Process not Found
672	Process not Found
672	Process not Found
672	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 25 IoCs

pid	Process
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe

Suspicious use of FindShellTrayWindow 12 IoCs

pid	Process
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe
3912	msedge.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
3880	OpenWith.exe
4008	notmyfault.exe
5632	notmyfault64.exe
1932	notmyfaultc.exe
1780	notmyfaultc64.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3912 wrote to memory of 4676	3912	msedge.exe	96
PID 3912 wrote to memory of 4676	3912	msedge.exe	96
PID 3912 wrote to memory of 1664	3912	msedge.exe	97
PID 3912 wrote to memory of 1664	3912	msedge.exe	97
PID 3912 wrote to memory of 1664	3912	msedge.exe	97
PID 3912 wrote to memory of 1664	3912	msedge.exe	97
PID 3912 wrote to memory of 1664	3912	msedge.exe	97
PID 3912 wrote to memory of 1664	3912	msedge.exe	97
PID 3912 wrote to memory of 1664	3912	msedge.exe	97
PID 3912 wrote to memory of 1664	3912	msedge.exe	97
PID 3912 wrote to memory of 1664	3912	msedge.exe	97
PID 3912 wrote to memory of 1664	3912	msedge.exe	97
PID 3912 wrote to memory of 1664	3912	msedge.exe	97
PID 3912 wrote to memory of 1664	3912	msedge.exe	97
PID 3912 wrote to memory of 1664	3912	msedge.exe	97
PID 3912 wrote to memory of 1664	3912	msedge.exe	97
PID 3912 wrote to memory of 1664	3912	msedge.exe	97
PID 3912 wrote to memory of 1664	3912	msedge.exe	97
PID 3912 wrote to memory of 1664	3912	msedge.exe	97
PID 3912 wrote to memory of 1664	3912	msedge.exe	97
PID 3912 wrote to memory of 1664	3912	msedge.exe	97
PID 3912 wrote to memory of 1664	3912	msedge.exe	97
PID 3912 wrote to memory of 1664	3912	msedge.exe	97
PID 3912 wrote to memory of 1664	3912	msedge.exe	97
PID 3912 wrote to memory of 1664	3912	msedge.exe	97
PID 3912 wrote to memory of 1664	3912	msedge.exe	97
PID 3912 wrote to memory of 1664	3912	msedge.exe	97
PID 3912 wrote to memory of 1664	3912	msedge.exe	97
PID 3912 wrote to memory of 1664	3912	msedge.exe	97
PID 3912 wrote to memory of 1664	3912	msedge.exe	97
PID 3912 wrote to memory of 1664	3912	msedge.exe	97
PID 3912 wrote to memory of 1664	3912	msedge.exe	97
PID 3912 wrote to memory of 1664	3912	msedge.exe	97
PID 3912 wrote to memory of 1664	3912	msedge.exe	97
PID 3912 wrote to memory of 1664	3912	msedge.exe	97
PID 3912 wrote to memory of 1664	3912	msedge.exe	97
PID 3912 wrote to memory of 1664	3912	msedge.exe	97
PID 3912 wrote to memory of 1664	3912	msedge.exe	97
PID 3912 wrote to memory of 1664	3912	msedge.exe	97
PID 3912 wrote to memory of 1664	3912	msedge.exe	97
PID 3912 wrote to memory of 1664	3912	msedge.exe	97
PID 3912 wrote to memory of 1664	3912	msedge.exe	97
PID 3912 wrote to memory of 2780	3912	msedge.exe	98
PID 3912 wrote to memory of 2780	3912	msedge.exe	98
PID 3912 wrote to memory of 4616	3912	msedge.exe	99
PID 3912 wrote to memory of 4616	3912	msedge.exe	99
PID 3912 wrote to memory of 4616	3912	msedge.exe	99
PID 3912 wrote to memory of 4616	3912	msedge.exe	99
PID 3912 wrote to memory of 4616	3912	msedge.exe	99
PID 3912 wrote to memory of 4616	3912	msedge.exe	99
PID 3912 wrote to memory of 4616	3912	msedge.exe	99
PID 3912 wrote to memory of 4616	3912	msedge.exe	99
PID 3912 wrote to memory of 4616	3912	msedge.exe	99
PID 3912 wrote to memory of 4616	3912	msedge.exe	99
PID 3912 wrote to memory of 4616	3912	msedge.exe	99
PID 3912 wrote to memory of 4616	3912	msedge.exe	99
PID 3912 wrote to memory of 4616	3912	msedge.exe	99
PID 3912 wrote to memory of 4616	3912	msedge.exe	99
PID 3912 wrote to memory of 4616	3912	msedge.exe	99
PID 3912 wrote to memory of 4616	3912	msedge.exe	99
PID 3912 wrote to memory of 4616	3912	msedge.exe	99
PID 3912 wrote to memory of 4616	3912	msedge.exe	99
PID 3912 wrote to memory of 4616	3912	msedge.exe	99
PID 3912 wrote to memory of 4616	3912	msedge.exe	99

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\dump.pcapng
1⤵
- Modifies registry class
PID:4540

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3880

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ff84fe846f8,0x7ff84fe84708,0x7ff84fe84718
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  PID:4676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,357433659332263085,1015491670482595943,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2136 /prefetch:2
  2⤵
  PID:1664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2108,357433659332263085,1015491670482595943,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2428 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2108,357433659332263085,1015491670482595943,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2664 /prefetch:8
  2⤵
  PID:4616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,357433659332263085,1015491670482595943,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3376 /prefetch:1
  2⤵
  PID:4464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,357433659332263085,1015491670482595943,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3384 /prefetch:1
  2⤵
  PID:4372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,357433659332263085,1015491670482595943,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5312 /prefetch:1
  2⤵
  PID:3000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,357433659332263085,1015491670482595943,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5156 /prefetch:1
  2⤵
  PID:2168
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,357433659332263085,1015491670482595943,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3524 /prefetch:8
  2⤵
  PID:4504
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
  2⤵
  - Drops file in Program Files directory
  PID:4192
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x220,0x224,0x228,0x1fc,0x22c,0x7ff7d8705460,0x7ff7d8705470,0x7ff7d8705480
    3⤵
    PID:116
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,357433659332263085,1015491670482595943,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3524 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,357433659332263085,1015491670482595943,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5628 /prefetch:1
  2⤵
  PID:3396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,357433659332263085,1015491670482595943,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5368 /prefetch:1
  2⤵
  PID:4200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,357433659332263085,1015491670482595943,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5380 /prefetch:1
  2⤵
  PID:4572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,357433659332263085,1015491670482595943,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5644 /prefetch:1
  2⤵
  PID:3700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,357433659332263085,1015491670482595943,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5508 /prefetch:1
  2⤵
  PID:1388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,357433659332263085,1015491670482595943,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6040 /prefetch:1
  2⤵
  PID:4332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,357433659332263085,1015491670482595943,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6060 /prefetch:1
  2⤵
  PID:1352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,357433659332263085,1015491670482595943,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5752 /prefetch:1
  2⤵
  PID:3000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,357433659332263085,1015491670482595943,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6116 /prefetch:1
  2⤵
  PID:2844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,357433659332263085,1015491670482595943,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6056 /prefetch:1
  2⤵
  PID:4000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,357433659332263085,1015491670482595943,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6404 /prefetch:1
  2⤵
  PID:1932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,357433659332263085,1015491670482595943,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6424 /prefetch:1
  2⤵
  PID:4816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,357433659332263085,1015491670482595943,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6396 /prefetch:1
  2⤵
  PID:4332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,357433659332263085,1015491670482595943,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6264 /prefetch:1
  2⤵
  PID:4780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,357433659332263085,1015491670482595943,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3728 /prefetch:1
  2⤵
  PID:2924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,357433659332263085,1015491670482595943,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6200 /prefetch:1
  2⤵
  PID:5240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,357433659332263085,1015491670482595943,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5668 /prefetch:1
  2⤵
  PID:5316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,357433659332263085,1015491670482595943,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6728 /prefetch:1
  2⤵
  PID:5744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,357433659332263085,1015491670482595943,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5704 /prefetch:1
  2⤵
  PID:5776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,357433659332263085,1015491670482595943,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7012 /prefetch:1
  2⤵
  PID:5768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,357433659332263085,1015491670482595943,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6704 /prefetch:1
  2⤵
  PID:6120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2108,357433659332263085,1015491670482595943,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=7552 /prefetch:8
  2⤵
  PID:6112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2108,357433659332263085,1015491670482595943,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7384 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:6128

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3460

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5280

C:\Users\Admin\Desktop\notmyfault.exe
"C:\Users\Admin\Desktop\notmyfault.exe"
1⤵
- Drops file in Drivers directory
- Suspicious use of SetWindowsHookEx
PID:4008

C:\Users\Admin\Desktop\notmyfault64.exe
"C:\Users\Admin\Desktop\notmyfault64.exe"
1⤵
- Drops file in Drivers directory
- Suspicious use of SetWindowsHookEx
PID:5632

C:\Users\Admin\AppData\Local\Temp\Temp1_NotMyFault.zip\notmyfaultc.exe
"C:\Users\Admin\AppData\Local\Temp\Temp1_NotMyFault.zip\notmyfaultc.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:1932

C:\Users\Admin\AppData\Local\Temp\Temp1_NotMyFault.zip\notmyfaultc64.exe
"C:\Users\Admin\AppData\Local\Temp\Temp1_NotMyFault.zip\notmyfaultc64.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:1780

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\reports\b747f1f5-2524-4cd9-a067-9fe7cb4dd486.dmp

Filesize
3.6MB

MD5
e4345a7e016971e54179ac3d2c689807

SHA1
c5fc132ff9aade83d39e29545ee8b96f41ac9e42

SHA256
c02a84efeb5697c01cd70397c7ae108b076abf6eb356ee213b9e51fd3991908a

SHA512
b68b86e110317dca88876861d6e468d077be39c7f4c2986c3ad3430c947cee367375c40f994b1bd7999cc74180a887c898552120e647f79546c76159c6250e09

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
78c7656527762ed2977adf983a6f4766

SHA1
21a66d2eefcb059371f4972694057e4b1f827ce6

SHA256
e1000099751602ae1adcec6f1c74e1d65f472936817b45239dfed4b043984296

SHA512
0a8e58ae95163b3cdf8e81b5085887761e73cb7c836a1a6a972e837fb3df69b2ac70cfd6311d06d40656344ec35eb48e512f007561480f0345486ac2b329be0b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
3136cfe883301c75484dee7b1acd6868

SHA1
bcb862ed4b48977882737076f03fabbf15f0f835

SHA256
21225aba48d055ac1a3724c146504f3573e41d8deca73b7d8d44f2ea2cbc52d0

SHA512
b2454873cb9781195b41dceda04979c02f3ec2b0b353a7637389818dc5bda23abc499100521df055f88ec3998b4a50f4e3b44328f09c0867f2b17f168d4132c2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00002e

Filesize
32KB

MD5
90af67e8fd4d5ab0d104b28b82a5f9e3

SHA1
0172e38010ebd25ebcb3f0a4094be0e20f72ac48

SHA256
971b268c15450ab1dded5c1e8e7875660b086b2ca6c45a31ddfa82486b1d06d3

SHA512
ab10e3bd86abf1ae574133f34e7d5a8bff59f3bd003ba42da7e6b3b8744abc59df74b7b71b5c83537a2342adff2aa175caa0db5e5ba7f3a3e480820ef52b4672

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
e5059dcc5d4a9200ab7d3e84f8568b44

SHA1
ea31f855d4af983ae7930f20c18673903484c9b1

SHA256
cbfd3c297de89e436f9db9bb87df06ade4e0a5c1fe9924142d0e1615bde35132

SHA512
64ea9dd6d19f97fd3746a670ecf6d6796f4b5194f59c8b76d605497ddb4fcdf94c0e6262ebed2f944fdf0ed9a3a520323582b0317a3bdfed8cad89acfef32ad7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
48B

MD5
565ac6062b32cef4c511eede673ef1bd

SHA1
a856aa6dd73679919dffef9e83c2c3e9cfc74048

SHA256
cd93919b3788bbfc2e73b058474663af1547618fd0ba1f79f942858ba2d0b2d4

SHA512
446faece03864da45126bd7fb8f99d94e5ef005721afc3c229e5ffdfceab3a285bd2d143dc5b8df6db912d0660ab9800b9c77155ea455e6dd14ae6b1e05470cd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico

Filesize
70KB

MD5
e5e3377341056643b0494b6842c0b544

SHA1
d53fd8e256ec9d5cef8ef5387872e544a2df9108

SHA256
e23040951e464b53b84b11c3466bbd4707a009018819f9ad2a79d1b0b309bc25

SHA512
83f09e48d009a5cf83fa9aa8f28187f7f4202c84e2d0d6e5806c468f4a24b2478b73077381d2a21c89aa64884df3c56e8dc94eb4ad2d6a8085ac2feb1e26c2ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Microsoft Edge.lnk

Filesize
2KB

MD5
6471b64efe5f988c0ab748ae7a31ec7a

SHA1
7f36ff3fba454d3d3720e823a8ae2b19745d0670

SHA256
f78ee3b0c8babc60f1e0b0f654b2ecc14c293edd2a650fcec11f0afaea9fd134

SHA512
51b7cbbf79080e786d6bd74ec12ba9a22a3ef16b95e6c1ce440707cc3c33a6e531a94b95b8edce0a2c09fea536ce490eef9a6e7b44c91591784063e556e07ef0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
5KB

MD5
efe9deac92643277e729e94cccc3b967

SHA1
a24bfc11535976c26e811c42ba0a0b075db47f4e

SHA256
198f402509ff9e7a61bc68703456d6b6afab61cfe4b6ab1396e1429d06b63768

SHA512
b72d26e3c260e723bc0ded33dbef8aefe2aa8cb18e7e15436be7efb1648389ecea7acbaaba871a23c1cb8315413d083ee2c901081adc72f613e7b667e92eafbb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
a164365264cecfccb458b28e21bd9431

SHA1
7e012a964bd9463858be3c7f7eedb3caa029a802

SHA256
890f505731162571cce9c90b71e94ec0b504ca95a5ff5aa761bd7c9209a8792a

SHA512
69b2f794d374c9ae9b0662d388178b9b99aca5a94911cd50987d7e746d97d7f7c971d0b8a3a639361d42a5291c29a9dbea572e8bfd2c5d102fb5522c9709b320

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
4KB

MD5
3c83a6d94dbc7bf346da5a8522fdbdb2

SHA1
85ff5d1bf3635ee8e752c39fc0354866a66976c6

SHA256
83bad40f99c0ae5276751f92959e2add82203abd743c931b45081200bd98eef6

SHA512
947110ac747002f7c8d345ade45bbdbc0e24f10d6ddd24296936d476b7a52d43c3d131fc93c53bd579acd9ddd3539870f89c0783ada38755b9d71695b7eccfab

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
4f0d159fadc7f17085ac5658c03263b0

SHA1
f00462c5086f5a1a878c3fae85aa2a360099b44b

SHA256
554a325eba71a1d60e73e34459f8cf83635644512aa0c08366c0c0e6dd021263

SHA512
4f7e81424664b287d1992a29ace968ca8cbbec9d68106d0d37fea2c77e50f50cbe739f0576dc1bb905d24802a2ad17ccdded224d5b4eba1fd63f0524b84c340b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
21658ebc35daf887cb8dbb59835254ba

SHA1
f502437102e70788f1dedd46dd2c79dd8b650e5d

SHA256
8a5e67d0bf35fc3910f9a3ce248050ce762ff8a4bbae43134ccb7b7eda53465c

SHA512
879249e146edb9f852c8043e5253b7a0110a64ef4854bfa32ac5dff849cdff43d5224caeb620964470f570b60586c79ed4552c36b3f860ef2cdb4d94bbaaeef4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
26d221b3fe58444e6c6c14b6c18da546

SHA1
cdd3bc9650784299d0d3f0e2b48bf201728d7ea0

SHA256
43bc83927d142ace2bb67400e66566a2243b7114ef68458aaf477ab4f8e2e47d

SHA512
ab02cb248b5ded8601c3aae8ddbc77dc23b8dc639d274bf0a90890a29500f66c6b7426060705a7d557ae08191f6321c0857108d06d8b172be11a49890097392f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
02ee7addc9e8a2d07af55556ebf0ff5c

SHA1
020161bb64ecb7c6e6886ccc055908984dc651d8

SHA256
552d3ed359b7a52278ce621674d16428d8a7969f6cd5663df18e240cce66aadc

SHA512
567989543c3848a0c3276d96b96ca761f750e4b71fb74f36d809f590ffe16a72fd5ece251737a8b1ffe65f0051e211bd7ad19d2b8b0b7ca1b7ffc86dd2a52883

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
3966348bbd403f0d73c498b32b42c474

SHA1
e831a80dc7540db9afced875d230530380ec5119

SHA256
85295f1484a81c8e36f1287dbb3d8c2ff4f80a5b2dc0985b88abcf49850d7542

SHA512
75a7fe567b809507d121ecfccd5cb85d7dc8e64609f916a450345a1ba959f7535767619970de25f9474c498666ad1b08250697222d5696f7a589f663a035c41c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
beb817adaf9728ce40fe5882e640a916

SHA1
257b6465bd5acad316276d16d241fe3ee9e7f698

SHA256
db38f0b6e029d3ea0ff3967ab9b68cf3dd6623397bce7d154fcea1b041ec2688

SHA512
80744a2ff4b4be0bbd31a01353dd9b2cd957fc623c80e62efada3f38c958f043bbc008389cfc7b9c8b4bc18ae290566416784bdf123916689b647c27e0e8fd08

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe577697.TMP

Filesize
538B

MD5
16653d9df68349f649ac5c8fd611e7e4

SHA1
b3d25aaa0522bbe10c780f356703d227ad512ff7

SHA256
63f015689c3bd7e19c1c9103ad3f58bb59fbd8cf74c06bc51dead5b20834f923

SHA512
3ad4a4c3853f638f68944f2f969d031e18f9f15d1cdea222da70a48f288e7e5a506ebc87431b61a56a0a77fdbf4bd16abb696cbeb429d4ebfc81057d13609fc9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
9KB

MD5
e7e578f4de52ecade7341c0be9c70e2a

SHA1
9f1badf5a5fb6ffa65cbc56a70fdd6250d81e238

SHA256
116ed41e48729aaa92fc274f0537904851ab811a951f447b40c3a89266f5c12b

SHA512
886c140f762ec8eadfd91fee67b53bc3eed3f4f7cbafa687cfbdcdc337e11fce750a1fc4bf41a6dca0924a4300c929cf26f47b65b74be0c883e0df6dee66c856

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
4d1bcf793f2381be1cb993263df5ccce

SHA1
ba6ff417b43a9106c321606bcdff72e691f4ddc7

SHA256
d5c10a90d47fa988dcce4c03b196e9631dafb33ff749ecaba3e277045b046805

SHA512
472a5a4949f59e35c81bd82bbe71666df6a95280c14b4c91fb6272edd5d705ae7e48a89a0bba2d783f003ee823914a35158d685b43b6f6977ccffeef3cd37f25

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\b16f482a-70bc-4fe3-85a2-0e8ef5bf0658.tmp

Filesize
12KB

MD5
310c54bfaa2ccff2dfeaaef6f46649ca

SHA1
4e6f6e73f5ca72fa287dc5f53e2a8a77e2a8d174

SHA256
e415f972a220bde31384189612e9c6873a087da61fda5feb55b3f53654579087

SHA512
f5b171233949b45bd6d8fc2fd1ff4fb6dcc017bc24858556e53f041d15fdfada14fee0802ad38d92d9d83b4a70a63e8ec2e5c5ea8c15f0c7728d7cba5d83814b

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
3KB

MD5
14d2c31845dfc59f7c69f1b3d9d90f81

SHA1
ddd92462e699a28699cc545051023c4234f40e04

SHA256
0b9da12469f41f76190ca9fed7cb15d51a00d17f3b40d1e9622b0f8769fbf204

SHA512
5a0689a540cfdf1eefbf51c2502f93c7a8ff14c5993a6098448dea1581b40a3de4c4cf15996fdd2929f849eaacf874bbe9f8e18f8de44b08cb2e7deb34202795

Download Submit
C:\Users\Admin\Downloads\NotMyFault.zip

Filesize
1.4MB

MD5
3098d0f7a888949089cdfb9351904303

SHA1
ca50aef1aff4b17be449ec7276b01ba728ca7c6f

SHA256
e26db5a12a6e1f83085cc40446a0b8fb6e322b989c46f4cb649a955682c15de4

SHA512
2a0972c2d7854c6b84a1f68dc437f99b7cbb4cd03a46f275c30d5f0c80f6140bceb33cdc29e7ec96e4ff76796e388090b46112e709e6736bb0fe388c64dacff2

Download Submit
C:\Windows\System32\drivers\myfault.sys

Filesize
21KB

MD5
d5adea32410f975ea943521da0f7f31f

SHA1
835896d28dbe897fe11c8605f59588741389c152

SHA256
49c93b06246d47522e1a9cb9b1f5e0513db736bc466983eebfbf4445479d9419

SHA512
5f4814e3de3cfecaf3f4b2a9daea783e8d61a516b2ef3298205fca050a4674bdc5f38c2823b33e8aee24346efcd56a75a92409be9ee2414cc2b178b95322743a

Download Submit