hxxps://malc0de[.]com/database/

Resubmissions

14-02-2024 17:05

240214-vl6g3sgc5t 10

14-02-2024 17:05

14-02-2024 17:00

14-02-2024 16:55

14-02-2024 16:52

Analysis

max time kernel
148s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
14-02-2024 17:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://malc0de.com/database/

Score

8^/10

Malware Config

Signatures

Downloads MZ/PE file

Executes dropped EXE 3 IoCs

pid	Process
5916	ChilledWindows.exe
5176	Hydra.exe
4480	Hydra.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\R:	ChilledWindows.exe
File opened (read-only)	\??\S:	ChilledWindows.exe
File opened (read-only)	\??\W:	ChilledWindows.exe
File opened (read-only)	\??\B:	ChilledWindows.exe
File opened (read-only)	\??\H:	ChilledWindows.exe
File opened (read-only)	\??\J:	ChilledWindows.exe
File opened (read-only)	\??\P:	ChilledWindows.exe
File opened (read-only)	\??\A:	ChilledWindows.exe
File opened (read-only)	\??\E:	ChilledWindows.exe
File opened (read-only)	\??\N:	ChilledWindows.exe
File opened (read-only)	\??\V:	ChilledWindows.exe
File opened (read-only)	\??\G:	ChilledWindows.exe
File opened (read-only)	\??\I:	ChilledWindows.exe
File opened (read-only)	\??\Q:	ChilledWindows.exe
File opened (read-only)	\??\Y:	ChilledWindows.exe
File opened (read-only)	\??\T:	ChilledWindows.exe
File opened (read-only)	\??\U:	ChilledWindows.exe
File opened (read-only)	\??\X:	ChilledWindows.exe
File opened (read-only)	\??\Z:	ChilledWindows.exe
File opened (read-only)	\??\K:	ChilledWindows.exe
File opened (read-only)	\??\L:	ChilledWindows.exe
File opened (read-only)	\??\M:	ChilledWindows.exe
File opened (read-only)	\??\O:	ChilledWindows.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
100	raw.githubusercontent.com
101	raw.githubusercontent.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2398549320-3657759451-817663969-1000\{75241B93-BD15-47DE-8F16-8D5127EA5EF0}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2398549320-3657759451-817663969-1000\{8CBD3D2B-1829-42C9-A44B-8B70F94F838F}	ChilledWindows.exe
Key created	\REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000_Classes\Local Settings	msedge.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 569780.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 989733.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 19 IoCs

pid	Process
4008	msedge.exe
4008	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
4736	msedge.exe
4736	msedge.exe
4432	identity_helper.exe
4432	identity_helper.exe
3788	msedge.exe
3788	msedge.exe
4060	msedge.exe
4060	msedge.exe
5456	msedge.exe
5456	msedge.exe
5456	msedge.exe
5456	msedge.exe
912	msedge.exe
912	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 18 IoCs

pid	Process
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5916	ChilledWindows.exe
Token: SeCreatePagefilePrivilege	5916	ChilledWindows.exe
Token: 33	6064	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	6064	AUDIODG.EXE
Token: SeShutdownPrivilege	5916	ChilledWindows.exe
Token: SeCreatePagefilePrivilege	5916	ChilledWindows.exe
Token: SeShutdownPrivilege	5916	ChilledWindows.exe
Token: SeCreatePagefilePrivilege	5916	ChilledWindows.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 536 wrote to memory of 2080	536	msedge.exe	36
PID 536 wrote to memory of 2080	536	msedge.exe	36
PID 2772 wrote to memory of 4116	2772	msedge.exe	89
PID 2772 wrote to memory of 4116	2772	msedge.exe	89
PID 536 wrote to memory of 1952	536	msedge.exe	92
PID 536 wrote to memory of 1952	536	msedge.exe	92
PID 536 wrote to memory of 1952	536	msedge.exe	92
PID 536 wrote to memory of 1952	536	msedge.exe	92
PID 536 wrote to memory of 1952	536	msedge.exe	92
PID 536 wrote to memory of 1952	536	msedge.exe	92
PID 536 wrote to memory of 1952	536	msedge.exe	92
PID 536 wrote to memory of 1952	536	msedge.exe	92
PID 536 wrote to memory of 1952	536	msedge.exe	92
PID 536 wrote to memory of 1952	536	msedge.exe	92
PID 536 wrote to memory of 1952	536	msedge.exe	92
PID 536 wrote to memory of 1952	536	msedge.exe	92
PID 536 wrote to memory of 1952	536	msedge.exe	92
PID 536 wrote to memory of 1952	536	msedge.exe	92
PID 536 wrote to memory of 1952	536	msedge.exe	92
PID 536 wrote to memory of 1952	536	msedge.exe	92
PID 536 wrote to memory of 1952	536	msedge.exe	92
PID 536 wrote to memory of 1952	536	msedge.exe	92
PID 536 wrote to memory of 1952	536	msedge.exe	92
PID 536 wrote to memory of 1952	536	msedge.exe	92
PID 536 wrote to memory of 1952	536	msedge.exe	92
PID 536 wrote to memory of 1952	536	msedge.exe	92
PID 536 wrote to memory of 1952	536	msedge.exe	92
PID 536 wrote to memory of 1952	536	msedge.exe	92
PID 536 wrote to memory of 1952	536	msedge.exe	92
PID 536 wrote to memory of 1952	536	msedge.exe	92
PID 536 wrote to memory of 1952	536	msedge.exe	92
PID 536 wrote to memory of 1952	536	msedge.exe	92
PID 536 wrote to memory of 1952	536	msedge.exe	92
PID 536 wrote to memory of 1952	536	msedge.exe	92
PID 536 wrote to memory of 1952	536	msedge.exe	92
PID 536 wrote to memory of 1952	536	msedge.exe	92
PID 536 wrote to memory of 1952	536	msedge.exe	92
PID 536 wrote to memory of 1952	536	msedge.exe	92
PID 536 wrote to memory of 1952	536	msedge.exe	92
PID 536 wrote to memory of 1952	536	msedge.exe	92
PID 536 wrote to memory of 1952	536	msedge.exe	92
PID 536 wrote to memory of 1952	536	msedge.exe	92
PID 536 wrote to memory of 1952	536	msedge.exe	92
PID 536 wrote to memory of 1952	536	msedge.exe	92
PID 536 wrote to memory of 4008	536	msedge.exe	90
PID 536 wrote to memory of 4008	536	msedge.exe	90
PID 536 wrote to memory of 2868	536	msedge.exe	91
PID 536 wrote to memory of 2868	536	msedge.exe	91
PID 536 wrote to memory of 2868	536	msedge.exe	91
PID 536 wrote to memory of 2868	536	msedge.exe	91
PID 536 wrote to memory of 2868	536	msedge.exe	91
PID 536 wrote to memory of 2868	536	msedge.exe	91
PID 536 wrote to memory of 2868	536	msedge.exe	91
PID 536 wrote to memory of 2868	536	msedge.exe	91
PID 536 wrote to memory of 2868	536	msedge.exe	91
PID 536 wrote to memory of 2868	536	msedge.exe	91
PID 536 wrote to memory of 2868	536	msedge.exe	91
PID 536 wrote to memory of 2868	536	msedge.exe	91
PID 536 wrote to memory of 2868	536	msedge.exe	91
PID 536 wrote to memory of 2868	536	msedge.exe	91
PID 536 wrote to memory of 2868	536	msedge.exe	91
PID 536 wrote to memory of 2868	536	msedge.exe	91
PID 536 wrote to memory of 2868	536	msedge.exe	91
PID 536 wrote to memory of 2868	536	msedge.exe	91

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://malc0de.com/database/
1⤵
- Enumerates system info in registry
- Modifies registry class
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd592546f8,0x7ffd59254708,0x7ffd59254718
  2⤵
  PID:2080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2216,7552344060865341320,11729876036783144366,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2280 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2216,7552344060865341320,11729876036783144366,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2852 /prefetch:8
  2⤵
  PID:2868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2216,7552344060865341320,11729876036783144366,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2228 /prefetch:2
  2⤵
  PID:1952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,7552344060865341320,11729876036783144366,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
  2⤵
  PID:3512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,7552344060865341320,11729876036783144366,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:1136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,7552344060865341320,11729876036783144366,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4592 /prefetch:1
  2⤵
  PID:1540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,7552344060865341320,11729876036783144366,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4828 /prefetch:1
  2⤵
  PID:4068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,7552344060865341320,11729876036783144366,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4732 /prefetch:1
  2⤵
  PID:3640
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2216,7552344060865341320,11729876036783144366,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5756 /prefetch:8
  2⤵
  PID:4060
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2216,7552344060865341320,11729876036783144366,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5756 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,7552344060865341320,11729876036783144366,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5520 /prefetch:1
  2⤵
  PID:3512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,7552344060865341320,11729876036783144366,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5316 /prefetch:1
  2⤵
  PID:2292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,7552344060865341320,11729876036783144366,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5752 /prefetch:1
  2⤵
  PID:4040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,7552344060865341320,11729876036783144366,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3464 /prefetch:1
  2⤵
  PID:4080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2216,7552344060865341320,11729876036783144366,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4872 /prefetch:8
  2⤵
  PID:3100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2216,7552344060865341320,11729876036783144366,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5328 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:3788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,7552344060865341320,11729876036783144366,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6136 /prefetch:1
  2⤵
  PID:5392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,7552344060865341320,11729876036783144366,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4724 /prefetch:1
  2⤵
  PID:5688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,7552344060865341320,11729876036783144366,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6196 /prefetch:1
  2⤵
  PID:5680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,7552344060865341320,11729876036783144366,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5960 /prefetch:1
  2⤵
  PID:5928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,7552344060865341320,11729876036783144366,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6156 /prefetch:1
  2⤵
  PID:2768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2216,7552344060865341320,11729876036783144366,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=6796 /prefetch:8
  2⤵
  PID:4348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2216,7552344060865341320,11729876036783144366,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6316 /prefetch:8
  2⤵
  PID:5284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,7552344060865341320,11729876036783144366,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7028 /prefetch:1
  2⤵
  PID:5356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2216,7552344060865341320,11729876036783144366,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5840 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2216,7552344060865341320,11729876036783144366,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3332 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,7552344060865341320,11729876036783144366,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4740 /prefetch:1
  2⤵
  PID:5144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2216,7552344060865341320,11729876036783144366,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6412 /prefetch:8
  2⤵
  PID:4620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,7552344060865341320,11729876036783144366,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6236 /prefetch:1
  2⤵
  PID:2584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,7552344060865341320,11729876036783144366,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6360 /prefetch:1
  2⤵
  PID:6000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2216,7552344060865341320,11729876036783144366,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5868 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:912
- C:\Users\Admin\Downloads\Hydra.exe
  "C:\Users\Admin\Downloads\Hydra.exe"
  2⤵
  - Executes dropped EXE
  PID:5176
- C:\Users\Admin\Downloads\Hydra.exe
  "C:\Users\Admin\Downloads\Hydra.exe"
  2⤵
  - Executes dropped EXE
  PID:4480

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Suspicious use of WriteProcessMemory
PID:2772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd592546f8,0x7ffd59254708,0x7ffd59254718
  2⤵
  PID:4116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2068,11772027212410025151,3882957758805339757,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2128 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2068,11772027212410025151,3882957758805339757,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2076 /prefetch:2
  2⤵
  PID:4080

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1800

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4452

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1516

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2792

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5872

C:\Users\Admin\Downloads\ChilledWindows.exe
"C:\Users\Admin\Downloads\ChilledWindows.exe"
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:5916

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x470 0x408
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:6064

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
7a5862a0ca86c0a4e8e0b30261858e1f

SHA1
ee490d28e155806d255e0f17be72509be750bf97

SHA256
92b4c004a9ec97ccf7a19955926982bac099f3b438cd46063bb9bf5ac7814a4b

SHA512
0089df12ed908b4925ba838e07128987afe1c9235097b62855122a03ca6d34d7c75fe4c30e68581c946b77252e7edf1dd66481e20c0a9cccd37e0a4fe4f0a6fe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
003b955079d7e446adc65bd148b42667

SHA1
1082822725cdbca61528ba4e087550d645fd2af1

SHA256
b6492a4bb1010ff6da6e2e9a71b61965ddf0ab6080393e86d1eac74b05fedc53

SHA512
21eeff064aca7e638fc2e9adeadfdd263603808fd5a78b0a3eb04a75ac1ac39da6579d68fedceaf62769de5528f217d0340651a66ecab6ca0400378e042df9ed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
950B

MD5
ae0c015d766a9c477430f0679cea7bad

SHA1
9b667a96109e33c3af4aa3d47a365a6b4cac427a

SHA256
25fe095da5946565f9e784543fb0958bec9214c15f3b006d0c2c9e85ec2c6ebb

SHA512
0cdbad6535b85312407d295caef02ccba7ecd9b225f6c736942d14ab14bb78819ac21f2ef21d21ce0e8e60a06610f8f2906f9ca6eebd17119b15f324f479a22c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
b9f9cb43a7ea50222f7157d771033327

SHA1
e181340ea38b69bf47d60f96a94cec91663da9eb

SHA256
35fa28d3aa9beb8ad40a6afb56cc98dbc71772aa974d3ef0661b73f4b6b8fc83

SHA512
e6a3042c2b8efc37c51310c9bfe947f34599935a72e30fbab1a70ae4f374776e03b23073f4f1a0d66531892e7b9c623321ad7765f46e9cb02f73969b45f4b217

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
aad5fe18c5ec4aaf934a7566977472b7

SHA1
df6f67cdff81d3fa191ccf6df3812b52418475ca

SHA256
f70cbcd632a17b3a1b4456823b4870723d355ebedc9d332996e509fded832ad1

SHA512
2060f4367d10617829f21a89c4c0bb88f92f1bade9c73291576c483668bcc4dfc47fe3a6f0b3c4e21f05e3faed383e2bdb6ccc938ebbabf2993779d038be983c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
5e78f8dfbd929eff0af4b606752100e4

SHA1
7c5b14e5d31edd62206685d2d0cf5905ceb6c9a3

SHA256
908bfc0f36b17dda7c7d694c9b2e723089e817317daf15e0e69e51ac4396e429

SHA512
25a971ae61c4c1a816c68528f1ba12fe54afd9b27dccd4b6ccb1ccfccd5aae43dda6c8cd8d36cbaaf02c95411d643c79e5d88b17a01daaf43f13d1d384fcbfa6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
5a0274be7ebfe4d057f2172fee641ee2

SHA1
830efc564353c251c29f5452c417605e396d0982

SHA256
ce04da59feadbea84776711e0d4ed4d9976b06b454a9156d17d30df591c23eb2

SHA512
809b3550d1e6027c7599d25ba4a779a57c9efcd942b8348f75a5874631abf3a446cd1e4098c6069aee67d6a46c76769f42a89e055b8434a0f0e4d7b3c93d93d3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
9b812f4417049be9b99d7cef5b7097b9

SHA1
ac19847d0f341ed2000e63c7f40143203b3060d9

SHA256
3fe75f8dd256f4f7cfe21d082aef731d140e711cce5ba41c67ba403728aa2aaa

SHA512
0da3ec97c1c7a663913b81b7eb59bc22f331ff2968c023641d4ed71f5c7b3a58985e648c4bfc4531ccf236d18180c42151a3737029d23f03ae661db7077e2702

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
b1572c591f1f8ce2093ec6dec15479a0

SHA1
c873ecd3adb917e141a7c641db8766fd4a7b1ef6

SHA256
239827213654a7a764672c1121a65cbe4e1cf7ca5775e623cf8be999595b4237

SHA512
b710d5e7efe722e58e1f2280c745e129410fdcc523f57d28871068437ab129e9fd9243f473820137902b7a8fc766b3cdbb1e4d85573d02204c69704083c7c4d7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
52826cef6409f67b78148b75e442b5ea

SHA1
a675db110aae767f5910511751cc3992cddcc393

SHA256
98fc43994599573e7181c849e5865f23b4f05f85c1115dff53c58764d80373fb

SHA512
f18df18cab6b5ecd71b79c81a2a1fdac42cc9960f62f06ac25f4d6487792705f2766ee3a10239eaac940d090186e6bc820e4eb7a5ee138f6e5c1c64f951b960c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
ea36bdbbedea843d95830d24ffd1e78d

SHA1
b584ce2faf9a5fdc2b7f608e161c93cad3ae4479

SHA256
136ee89a65ffee6cd2f0ced8f91ccc9893b66da89d47f28eddb2dc9c53866311

SHA512
beace73e27ba955029544018f00588fed836d59b9dd01f1abaab26cf4a5900efa508580549d269068419b453bf6f3118acf0db2311e82cc11f6742c13f0b6cc1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
e3905a97d9355e6e10a8086d0b41d486

SHA1
5fba60660500147220d894306df9197fb5dee64b

SHA256
8ba3ebf1730cf4fa1a84296233ebca23d7102c98e9bd0da892bfec2114c193e0

SHA512
73625f356bd9a93e390d15b20f030478124d9ef92b725232be0c372641fd06c7d5485062d7853bf04a4c68ca144dfa2e4ab7714c9bb4ee7445f96b0a9888f933

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
f7e47175cdc90e25f92552b1d7003b91

SHA1
fa003a5f50e778d45bcdbab569fd58eb45ac701c

SHA256
61b159870347d52f62b2efb5622b07a2e40e6a57565a08ec216191285de5dc3f

SHA512
6e8bcbc4ee98433257143ed86f590da932fde4065a6f9cd1cfc33f65cba533eeb46cd3e36913fbbc20e8b35e6eb4561c9795f6d8d48df904dbf1323313e34cc4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
04b157d10ab4193532694af8de71c9c0

SHA1
8de8c48f951910150ea8ec18a89b8b5cd5a121bf

SHA256
8ca28323c0b557735ff77b23780249f1db25236d15989670bd367ae7f53cf94a

SHA512
4f7892942d50968b9a426334b2f289af3cfb7fc41c5cd56f6f2d8fe5543017872067bfb208f653df17935d910775796cc5ca9d371cb6b3085fb098a98297ad3c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
1c29668de7f9cca02c83bb58caf0e3bb

SHA1
0a9653e607fb983ca5cae418ae5f37610c9fbdb1

SHA256
d8e7fe0d83411c4cc34ac76d46dd90338e716d32f2f001eac5f129fb2b87af70

SHA512
dc404664091e91b8774b7d88b4c66882b5d0bf1627d6b5d3ad34ca73147428579b73f76447391034f080f20f1509afcff84be68701ec47aa23aad450f4cef8f2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57e177.TMP

Filesize
1KB

MD5
a9512e9bf917d506bcfcca2b57ba50e1

SHA1
a8ea5b2da36e054e1013632bcd9f2a0e583afdf2

SHA256
113267a271a61590e91c3ae6d6420adaa7d94ef346906297d6271fbaf0676cc2

SHA512
98d01f4ae470a0c1388dc410b5514967a1d9f530b886d233317d7ac5b0b58fa988761e26b33be5e35f0ea523423ea7b9cc53e908a67ba9435bbdd3d7c018f504

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
3ec3cfdb793735f209b5d05ef21774df

SHA1
d2b738d0d5cf0bdff5682a25f96d5ea8db93fef6

SHA256
bca0f872cc8d1f4fa7ddd3e555b49f6228e708d19d2a735f2a7bf23750b08c28

SHA512
0c36c925fb6e833126099c06bf6a023c5b7d91589152ec1469e24eb3fd21990f0279b00b6fb578563ed83d20fd65bf2fa38a8ac3ec3a973fc93e56ac8da0d540

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
cd634f3ba16caab42b5f7f09a6291ba6

SHA1
7709e0052c8b646e24389d93b36e05ae035e1d6e

SHA256
a987d49a3fa55a4d0d0945e1402964f916489c702178549139673d6cac4c2d44

SHA512
27ef913b265877e38405ca568ca74937406a0db0fcbd831f30194bb6fbe8b2a39e926792a164e38c4dce92a3beafdc330246100851d55c6b0188f7e932036a74

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
2KB

MD5
27c1f49945bebcf67c185c95ab4a4138

SHA1
3e7c122cf428e2bcc54e3dd8989423e21f892168

SHA256
f65e4b7bf9020cece0cac7ee57222c6f3d9c9c8d6015a29ce226fe92cef592df

SHA512
cf103bb919c071bee24c15fddc7f4a63d2cb79c6b6198b9c5fbaf2b5e28ca96e50206650420ebdc2bc7f670ac53b27e0759fbd3c28e990f4cf227c915194b47b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb

Filesize
384KB

MD5
3b511a53742151cfa0d6b0b1348674d6

SHA1
2ca3347973cd7b56c0d9387fa1810d4c117a9de0

SHA256
fb298910eedecfefe8eaf4b9ed5f400cd59f630cb2c4013f5828f477a9db37a6

SHA512
9b1b6d00bee353ab192f6ca6842275e9ab5e8dd07bb4e71edf5aec50fcff126e6134e4f895f2799cdfde37e0d6492375a505740d1bb3751798467fcbca7b887f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML

Filesize
9KB

MD5
7050d5ae8acfbe560fa11073fef8185d

SHA1
5bc38e77ff06785fe0aec5a345c4ccd15752560e

SHA256
cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b

SHA512
a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b

Download Submit
C:\Users\Admin\Downloads\ChilledWindows.exe

Filesize
3.6MB

MD5
04b248bd040d5eb40a31cdb7c9e536d6

SHA1
1bfdf534f9dcdc08242109beeaf8674c0f0abc49

SHA256
e8b2ae0d14c2724956b817bf5c53e3fff846e1414bc1e2a553757c55a8404930

SHA512
cfc42c6f358801e2c5806c94cd0b07418b49d0240f91a7b7cb5b2477aa1cc7537571517f65fbd85e44ac08d25c742b1defc5bb585bfc3eaa0c41274976b69754

Download Submit
C:\Users\Admin\Downloads\ChilledWindows.exe

Filesize
3.9MB

MD5
c686425137ef76e9ef7e64d86bb675b2

SHA1
17da20959724b841745c4f8e89a6c6bdb7b98a26

SHA256
f92ae994dc88093d04e86822322b6af0f2cda759e51d707e6211e586a343666f

SHA512
27b8ac18d7e127f0438a7654a0e0825657ea3ce64b61c1acf7c95bd8a741fed31d71e96d4d977c5a84def9106c38da7f21f823435bfd4d7f594f716feda5daa4

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 569780.crdownload

Filesize
4.0MB

MD5
42c326f9dd001204a266ef5f751af3ac

SHA1
b59c574fb890f427ea5bd2c5e9bce7c3ebb7be19

SHA256
34f86f8ff42f98a4c451418f2a6967ad15b3e6213c67016109e882ddd72ac966

SHA512
46802783e8d9cecb40ba503b6cb7f532525a5d8418a5224476ac3bd71da4161c610e2f957d9ae6a8f1c5f9c40f3b1ae09d398feee56b376c187370ba30958c9d

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 989733.crdownload

Filesize
43KB

MD5
b2eca909a91e1946457a0b36eaf90930

SHA1
3200c4e4d0d4ece2b2aadb6939be59b91954bcfa

SHA256
0b6c0af51cde971b3e5f8aa204f8205418ab8c180b79a5ac1c11a6e0676f0f7c

SHA512
607d20e4a46932c7f4d9609ef9451e2303cd79e7c4778fe03f444e7dc800d6de7537fd2648c7c476b9f098588dc447e8c39d8b21cd528d002dfa513a19c6ebbf

Download Submit
C:\Users\Admin\Downloads\chilledwindows.mp4

Filesize
1.9MB

MD5
ea1a5e9954f4da0ef4a428ed4b6562a5

SHA1
446a5b41be3ec483ed58e2028cf6cdd01f7d0039

SHA256
73a537076023e684e6be99f77b53f4a72597f89dba0b766fd1f86e4fae7bed12

SHA512
23658082a1acbd1d3e08da868aa5f78fbbc11572147f5e9d02dc1d54330fdada66b7494e12be32b0116b5f709909a32e83390a592997e83c54875186a69326ce

Download Submit
memory/4480-697-0x0000000004C70000-0x0000000004C7A000-memory.dmp

Filesize
40KB

Download
memory/4480-694-0x00000000745F0000-0x0000000074DA0000-memory.dmp

Filesize
7.7MB

Download
memory/4480-696-0x0000000004EA0000-0x0000000004EB0000-memory.dmp

Filesize
64KB

Download
memory/4480-699-0x0000000004EA0000-0x0000000004EB0000-memory.dmp

Filesize
64KB

Download
memory/5176-692-0x0000000005480000-0x0000000005512000-memory.dmp

Filesize
584KB

Download
memory/5176-695-0x00000000056E0000-0x00000000056F0000-memory.dmp

Filesize
64KB

Download
memory/5176-691-0x0000000005990000-0x0000000005F34000-memory.dmp

Filesize
5.6MB

Download
memory/5176-690-0x00000000745F0000-0x0000000074DA0000-memory.dmp

Filesize
7.7MB

Download
memory/5176-689-0x0000000000BD0000-0x0000000000BE0000-memory.dmp

Filesize
64KB

Download
memory/5176-698-0x00000000056E0000-0x00000000056F0000-memory.dmp

Filesize
64KB

Download
memory/5916-504-0x000000001B520000-0x000000001B530000-memory.dmp

Filesize
64KB

Download
memory/5916-592-0x00007FFD45BE0000-0x00007FFD466A1000-memory.dmp

Filesize
10.8MB

Download
memory/5916-578-0x000000001B520000-0x000000001B530000-memory.dmp

Filesize
64KB

Download
memory/5916-577-0x000000001B520000-0x000000001B530000-memory.dmp

Filesize
64KB

Download
memory/5916-576-0x000000001B520000-0x000000001B530000-memory.dmp

Filesize
64KB

Download
memory/5916-575-0x00007FFD45BE0000-0x00007FFD466A1000-memory.dmp

Filesize
10.8MB

Download
memory/5916-506-0x000000001C2B0000-0x000000001C2BE000-memory.dmp

Filesize
56KB

Download
memory/5916-505-0x000000001C2E0000-0x000000001C318000-memory.dmp

Filesize
224KB

Download
memory/5916-503-0x000000001BC30000-0x000000001BC38000-memory.dmp

Filesize
32KB

Download
memory/5916-501-0x000000001B520000-0x000000001B530000-memory.dmp

Filesize
64KB

Download
memory/5916-490-0x000000001B520000-0x000000001B530000-memory.dmp

Filesize
64KB

Download
memory/5916-489-0x00007FFD45BE0000-0x00007FFD466A1000-memory.dmp

Filesize
10.8MB

Download
memory/5916-488-0x0000000000360000-0x00000000007C4000-memory.dmp

Filesize
4.4MB

Download