Analysis Overview
Threat Level: Likely malicious
The file https://github.com/Da2dalus/The-MALWARE-Repo/blob/master/Trojan/FreeYoutubeDownloader.exe was found to be: Likely malicious.
Malicious Activity Summary
Downloads MZ/PE file
Executes dropped EXE
Checks computer location settings
Checks installed software on the system
Adds Run key to start application
Legitimate hosting services abused for malware hosting/C2
Drops file in Windows directory
Enumerates physical storage devices
Suspicious use of SetWindowsHookEx
Enumerates system info in registry
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
Suspicious use of WriteProcessMemory
NTFS ADS
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2024-02-22 18:52
Signatures
Analysis: behavioral1
Detonation Overview
Submitted
2024-02-22 18:52
Reported
2024-02-22 18:55
Platform
win10v2004-20240221-en
Max time kernel
148s
Max time network
152s
Command Line
Signatures
Downloads MZ/PE file
Checks computer location settings
| Description | Indicator | Process | Target |
| Key value queried | \REGISTRY\USER\S-1-5-21-1790404759-2178872477-2616469472-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\Downloads\FreeYoutubeDownloader.exe | N/A |
| Key value queried | \REGISTRY\USER\S-1-5-21-1790404759-2178872477-2616469472-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\Downloads\FreeYoutubeDownloader.exe | N/A |
| Key value queried | \REGISTRY\USER\S-1-5-21-1790404759-2178872477-2616469472-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\Downloads\FreeYoutubeDownloader.exe | N/A |
| Key value queried | \REGISTRY\USER\S-1-5-21-1790404759-2178872477-2616469472-1000\Control Panel\International\Geo\Nation | C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Free YouTube Downloader.exe | N/A |
Executes dropped EXE
Adds Run key to start application
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\USER\S-1-5-21-1790404759-2178872477-2616469472-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Free Youtube Downloader = "C:\\Windows\\Free Youtube Downloader\\Free Youtube Downloader\\Free YouTube Downloader.exe" | C:\Users\Admin\Downloads\FreeYoutubeDownloader.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-1790404759-2178872477-2616469472-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Free Youtube Downloader = "C:\\Windows\\Free Youtube Downloader\\Free Youtube Downloader\\Free YouTube Downloader.exe" | C:\Users\Admin\Downloads\FreeYoutubeDownloader.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-1790404759-2178872477-2616469472-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Free Youtube Downloader = "C:\\Windows\\Free Youtube Downloader\\Free Youtube Downloader\\Free YouTube Downloader.exe" | C:\Users\Admin\Downloads\FreeYoutubeDownloader.exe | N/A |
Checks installed software on the system
Legitimate hosting services abused for malware hosting/C2
| Description | Indicator | Process | Target |
| N/A | raw.githubusercontent.com | N/A | N/A |
| N/A | raw.githubusercontent.com | N/A | N/A |
Drops file in Windows directory
| Description | Indicator | Process | Target |
| File created | C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Uninstall.ini | C:\Users\Admin\Downloads\FreeYoutubeDownloader.exe | N/A |
| File opened for modification | C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Free YouTube Downloader.exe | C:\Users\Admin\Downloads\FreeYoutubeDownloader.exe | N/A |
| File opened for modification | C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Uninstall.ini | C:\Users\Admin\Downloads\FreeYoutubeDownloader.exe | N/A |
| File opened for modification | C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Box.exe | C:\Users\Admin\Downloads\FreeYoutubeDownloader.exe | N/A |
| File opened for modification | C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Uninstall.ini | C:\Users\Admin\Downloads\FreeYoutubeDownloader.exe | N/A |
| File opened for modification | C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Free YouTube Downloader.exe | C:\Users\Admin\Downloads\FreeYoutubeDownloader.exe | N/A |
| File opened for modification | C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Uninstall.exe | C:\Users\Admin\Downloads\FreeYoutubeDownloader.exe | N/A |
| File opened for modification | C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Box.exe | C:\Users\Admin\Downloads\FreeYoutubeDownloader.exe | N/A |
| File opened for modification | C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Uninstall.exe | C:\Users\Admin\Downloads\FreeYoutubeDownloader.exe | N/A |
| File opened for modification | C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Free YouTube Downloader.exe | C:\Users\Admin\Downloads\FreeYoutubeDownloader.exe | N/A |
| File opened for modification | C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Uninstall.exe | C:\Users\Admin\Downloads\FreeYoutubeDownloader.exe | N/A |
| File opened for modification | C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Box.exe | C:\Users\Admin\Downloads\FreeYoutubeDownloader.exe | N/A |
Enumerates physical storage devices
Enumerates system info in registry
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
NTFS ADS
| Description | Indicator | Process | Target |
| File opened for modification | C:\Users\Admin\Downloads\Unconfirmed 827411.crdownload:SmartScreen | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of SetWindowsHookEx
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\Downloads\FreeYoutubeDownloader.exe | N/A |
| N/A | N/A | C:\Users\Admin\Downloads\FreeYoutubeDownloader.exe | N/A |
| N/A | N/A | C:\Users\Admin\Downloads\FreeYoutubeDownloader.exe | N/A |
Suspicious use of WriteProcessMemory
Processes
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://github.com/Da2dalus/The-MALWARE-Repo/blob/master/Trojan/FreeYoutubeDownloader.exe
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd4fe246f8,0x7ffd4fe24708,0x7ffd4fe24718
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2212,1799407227213626947,2347249985289365508,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2240 /prefetch:2
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2212,1799407227213626947,2347249985289365508,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2808 /prefetch:8
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2212,1799407227213626947,2347249985289365508,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2136 /prefetch:3
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,1799407227213626947,2347249985289365508,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,1799407227213626947,2347249985289365508,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3444 /prefetch:1
C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2212,1799407227213626947,2347249985289365508,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5232 /prefetch:8
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2212,1799407227213626947,2347249985289365508,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5232 /prefetch:8
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2212,1799407227213626947,2347249985289365508,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5508 /prefetch:8
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,1799407227213626947,2347249985289365508,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5540 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2212,1799407227213626947,2347249985289365508,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6084 /prefetch:8
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2212,1799407227213626947,2347249985289365508,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5840 /prefetch:8
C:\Users\Admin\Downloads\FreeYoutubeDownloader.exe
"C:\Users\Admin\Downloads\FreeYoutubeDownloader.exe"
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,1799407227213626947,2347249985289365508,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6196 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,1799407227213626947,2347249985289365508,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6172 /prefetch:1
C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Free YouTube Downloader.exe
"C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Free YouTube Downloader.exe"
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,1799407227213626947,2347249985289365508,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5600 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,1799407227213626947,2347249985289365508,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6400 /prefetch:1
C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
C:\Users\Admin\Downloads\FreeYoutubeDownloader.exe
"C:\Users\Admin\Downloads\FreeYoutubeDownloader.exe"
C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Free YouTube Downloader.exe
"C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Free YouTube Downloader.exe"
C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Free YouTube Downloader.exe
"C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Free YouTube Downloader.exe"
C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Free YouTube Downloader.exe
"C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Free YouTube Downloader.exe"
C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Free YouTube Downloader.exe
"C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Free YouTube Downloader.exe"
C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Free YouTube Downloader.exe
"C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Free YouTube Downloader.exe"
C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Free YouTube Downloader.exe
"C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Free YouTube Downloader.exe"
C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Free YouTube Downloader.exe
"C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Free YouTube Downloader.exe"
C:\Users\Admin\Downloads\FreeYoutubeDownloader.exe
"C:\Users\Admin\Downloads\FreeYoutubeDownloader.exe"
C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Free YouTube Downloader.exe
"C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Free YouTube Downloader.exe"
C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Free YouTube Downloader.exe
"C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Free YouTube Downloader.exe"
C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Free YouTube Downloader.exe
"C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Free YouTube Downloader.exe"
C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Box.exe
"C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Box.exe"
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 148.177.190.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | github.com | udp |
| DE | 140.82.121.3:443 | github.com | tcp |
| US | 8.8.8.8:53 | 0.205.248.87.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 3.121.82.140.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 241.154.82.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | avatars.githubusercontent.com | udp |
| US | 8.8.8.8:53 | github.githubassets.com | udp |
| US | 185.199.108.133:443 | avatars.githubusercontent.com | tcp |
| US | 185.199.108.154:443 | github.githubassets.com | tcp |
| US | 8.8.8.8:53 | github-cloud.s3.amazonaws.com | udp |
| US | 8.8.8.8:53 | user-images.githubusercontent.com | udp |
| US | 185.199.108.154:443 | github.githubassets.com | tcp |
| US | 185.199.108.154:443 | github.githubassets.com | tcp |
| US | 185.199.108.154:443 | github.githubassets.com | tcp |
| US | 185.199.108.154:443 | github.githubassets.com | tcp |
| US | 185.199.108.154:443 | github.githubassets.com | tcp |
| US | 8.8.8.8:53 | 133.108.199.185.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 154.108.199.185.in-addr.arpa | udp |
| US | 8.8.8.8:53 | collector.github.com | udp |
| US | 140.82.114.22:443 | collector.github.com | tcp |
| US | 140.82.114.22:443 | collector.github.com | tcp |
| US | 8.8.8.8:53 | 41.110.16.96.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 22.114.82.140.in-addr.arpa | udp |
| US | 185.199.108.154:443 | github.githubassets.com | tcp |
| US | 8.8.8.8:53 | api.github.com | udp |
| DE | 140.82.121.6:443 | api.github.com | tcp |
| US | 8.8.8.8:53 | 6.121.82.140.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 205.47.74.20.in-addr.arpa | udp |
| N/A | 224.0.0.251:5353 | udp | |
| US | 8.8.8.8:53 | raw.githubusercontent.com | udp |
| US | 185.199.108.133:443 | raw.githubusercontent.com | tcp |
| US | 8.8.8.8:53 | 103.169.127.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 15.164.165.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 134.71.91.104.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 190.178.17.96.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 14.227.111.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 182.178.17.96.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 26.73.42.20.in-addr.arpa | udp |
Files
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
| MD5 | 9cafa4c8eee7ab605ab279aafd19cc14 |
| SHA1 | e362e5d37d1a79e7b4a8642b068934e4571a55f1 |
| SHA256 | d0817f51aa2fb8c3cae18605dbfd6ec21a6ff3f953171e7ac064648ffdee1166 |
| SHA512 | eefd65ffcfb98ac8c3738eb2b3f4933d5bc5b992a1d465b8424903c8f74382ec2c95074290ddbb1001204843bfef59a32b868808a6bee4bc41ee9571515bbac6 |
\??\pipe\LOCAL\crashpad_4548_CKUDXNMVCMCEIKZF
| MD5 | d41d8cd98f00b204e9800998ecf8427e |
| SHA1 | da39a3ee5e6b4b0d3255bfef95601890afd80709 |
| SHA256 | e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
| SHA512 | cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
| MD5 | 3bde7b7b0c0c9c66bdd8e3f712bd71eb |
| SHA1 | 266bd462e249f029df05311255a15c8f42719acc |
| SHA256 | 2ccd4a1b56206faa8f6482ce7841636e7bb2192f4cf5258d47e209953a77a01a |
| SHA512 | 5fab7a83d86d65e7c369848c5a7d375d9ad132246b57653242c7c7d960123a50257c9e8c4c9a8f22ee861fce357b018236ac877b96c03990a88de4ddb9822818 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
| MD5 | 0a44e3ad99fb52ab9eb8e3a54369510a |
| SHA1 | 7a8fa2c812200067e02357d192c8311b3a11e62e |
| SHA256 | 7e2d3f44fca88b4d3f005906b178300eb97cc963b049020dce3ad1fbf868f78b |
| SHA512 | bd99f17721aab75e7926c95f7684e6f7daf9141c829650836ac76d6b9ae4d721bae1ddb617cfac7d84c2e62849bc01a58c6b94716e4785f2a20fec11f4b981d6 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
| MD5 | 6752a1d65b201c13b62ea44016eb221f |
| SHA1 | 58ecf154d01a62233ed7fb494ace3c3d4ffce08b |
| SHA256 | 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd |
| SHA512 | 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389 |
C:\Users\Admin\Downloads\Unconfirmed 827411.crdownload
| MD5 | 13f4b868603cf0dd6c32702d1bd858c9 |
| SHA1 | a595ab75e134f5616679be5f11deefdfaae1de15 |
| SHA256 | cae57a60c4d269cd1ca43ef143aedb8bfc4c09a7e4a689544883d05ce89406e7 |
| SHA512 | e0d7a81c9cdd15a4ef7c8a9492fffb2c520b28cebc54a139e1bffa5c523cf17dfb9ffe57188cf8843d74479df402306f4f0ce9fc09d87c7cca92aea287e5ff24 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
| MD5 | 9a2692e770e568755f3710567ba2c68d |
| SHA1 | 91473b189956f801e425a1b3e2c283c1046dcc70 |
| SHA256 | d83b9e06f8b8d2a7406956f3b5253947b2c2005505d94c9df8e2e36f9a99e056 |
| SHA512 | bcd6195aea28ab25fcfe0cd581ba935650040e1845c206683b185bcb6c48fee8e5ff896616a04295fe3d4d1536062d3eee85061cd3026c7348869aede4f585a4 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\25620a44-0802-481a-b13f-2c5e81f191b5.tmp
| MD5 | 6cd271a89ce4d5ade0c3ae73f609198b |
| SHA1 | 4d8779ada4f14bc6719d57fbed7978578056a458 |
| SHA256 | e179619b5ee6f7a9d55bbfdfe3ff8b4e2c6d618e0d5ee150eae261725918772f |
| SHA512 | 1227420b77a2987401215537ca18fa63d5c67590810fc4e262d3caeaeba38a1cf18edf3ec68dd42662ce4a9ecf1e16c058f809a3d3be11f8cb5f13bf1b3fc91e |
C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Free YouTube Downloader.exe
| MD5 | f33a4e991a11baf336a2324f700d874d |
| SHA1 | 9da1891a164f2fc0a88d0de1ba397585b455b0f4 |
| SHA256 | a87524035509ff7aa277788e1a9485618665b7da35044d70c41ec0f118f3dfd7 |
| SHA512 | edf066968f31451e21c7c21d3f54b03fd5827a8526940c1e449aad7f99624577cbc6432deba49bb86e96ac275f5900dcef8d7623855eb3c808e084601ee1df20 |
memory/4116-202-0x0000000000400000-0x000000000043C000-memory.dmp
memory/4596-203-0x00000147EF260000-0x00000147EF28E000-memory.dmp
memory/4596-204-0x00007FFD4BD40000-0x00007FFD4C801000-memory.dmp
memory/4596-205-0x00000147F1950000-0x00000147F1960000-memory.dmp
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
| MD5 | 70b41e39da7efb1225b2db98f94c583c |
| SHA1 | 009bce5703f7580dd487279362fe2a81a0234a83 |
| SHA256 | 0a9c67019317f360c81a364f60a825b154e2a05411885b1866b8c68606773624 |
| SHA512 | 47b0e083478d3e5b5e1613f9364fecd2d370419ceb27fee306a7ed04629db5bb0a9233fe2d650ffd100895bf3a269fbd309fd899cc1ab8893a0ec0929f014c58 |
memory/4596-215-0x00000147F1950000-0x00000147F1960000-memory.dmp
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
| MD5 | 3d6bf3a595ee22812202d9b964a390eb |
| SHA1 | 5674c0f4146ef5c53732a4f839c5085506613d96 |
| SHA256 | d83f7013dab341d20d627b7a60a66776d8d878499f6a2e8e83b23864c72961bf |
| SHA512 | 3a64277d2aec1cb1422c919d9ff14ecd3f9a2d26f81730246a2f776a38d31ec1e272185d3123f6fc6a55881e7e8db3f683d79bfbef5123c724766d539c1f0edd |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
| MD5 | 6cc2d97df56b2f11c456682f5456938b |
| SHA1 | 8f8495505091779bfa35abcea961849f77b3c4c8 |
| SHA256 | b2a446cc1aa26fee8083c2f924ad8f2f10cc7b3a2e42edea989bbe2bec2465c0 |
| SHA512 | 9f01e7e2805bd12cc3ce1c7b0d775d00ebc884741568569b6759255ecfab179e07346adec68aede9003a86e78cc67010534a3064031396ee4a2659c346cf5509 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
| MD5 | 8a2a7fbf64b3559e6dbda7f69ccc5251 |
| SHA1 | 46a174cf98fda172c4a117d6b56adc4badf4890a |
| SHA256 | f2f6694b63896a560d350e13276553e00f7c68f8d44c8e1d9129f9ecd914e3ac |
| SHA512 | 7b0384301dcd6e3e33e5f9642a888b16985c2d87f815a1d51b97539f87abd00ead53158dc6b9e73dc67d0aae70ec85f0968b82d75ce6ef60b89547f3ffbf78ed |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
| MD5 | 0a8a7c3dafeb4ad3d8cb846fc95b8f1c |
| SHA1 | 69e2b994e6882e1e783410dae53181984050fa13 |
| SHA256 | a88495f2c1c26c6c1d5690a29289467c8bb8a94bf6f4801d2c14da1456773f90 |
| SHA512 | 2e59b4cd4cf6f86537aae4ae88e56e21abcff5070c5c1d1d2105a8e863523c80740438cc36b2b57672bc7bb7fb9387896135afcce534edfd4697fecf61031a5c |
memory/4596-340-0x00007FFD4BD40000-0x00007FFD4C801000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\$inst\2.tmp
| MD5 | 8708699d2c73bed30a0a08d80f96d6d7 |
| SHA1 | 684cb9d317146553e8c5269c8afb1539565f4f78 |
| SHA256 | a32e0a83001d2c5d41649063217923dac167809cab50ec5784078e41c9ec0f0f |
| SHA512 | 38ece3e441cc5d8e97781801d5b19bdede6065a0a50f7f87337039edeeb4a22ad0348e9f5b5542b26236037dd35d0563f62d7f4c4f991c51020552cfae03b264 |
memory/4596-346-0x00000147F1950000-0x00000147F1960000-memory.dmp
memory/4596-347-0x00000147F1950000-0x00000147F1960000-memory.dmp
memory/4884-348-0x0000000000400000-0x000000000043C000-memory.dmp
C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Box.exe
| MD5 | 1bb4dd43a8aebc8f3b53acd05e31d5b5 |
| SHA1 | 54cd1a4a505b301df636903b2293d995d560887e |
| SHA256 | a2380a5f503bc6f5fcfd4c72e5b807df0740a60a298e8686bf6454f92e5d3c02 |
| SHA512 | 94c70d592e806bb426760f61122b8321e8dc5cff7f793d51f9d5650821c502c43096f41d3e61207ca6989df5bfdbff57bc23328de16e99dd56e85efc90affdce |
C:\Users\Admin\AppData\Local\Temp\$inst\temp_0.tmp
| MD5 | bc82784f4aa47bcfed93e81a3b9950f2 |
| SHA1 | f5f2238d45733a6dde53c7b7dfe3645ee8ae3830 |
| SHA256 | dd47684334f0a2b716e96f142e8915266d5bc1725853fd0bdc6d06148db6167f |
| SHA512 | d2378f324d430f16ce7dcf1f656b504009b005cdb6df9d5215fe0786c112e8eba8c1650a83192b6a9afad5892a1a456714665233f6767765619ccb5ff28e2b8a |
C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Uninstall.exe
| MD5 | ab648a0df4fe7a47fe9d980c545b065d |
| SHA1 | ce28ea7dd117289daf467467a592bc304c72d4e6 |
| SHA256 | 905a849721ec95ab08754aeee9a60b3ed435d36962466fcbe5cfca63dfc455cd |
| SHA512 | 7ae99da55fbf1c31c5281e5f4e10ab2bc33b89effeee82b574eb4b60541c5ea2913d5d99836608873da372c78e75436ae7e535568f48d81cb9dd26d2cc1b3a8c |
C:\Users\Admin\Desktop\Free Youtube Downloader.lnk
| MD5 | c46d0c6fa2a8fa622adec56ce7da63dd |
| SHA1 | 13e3f68eb77f6e88ccfa4ea7397317a87c78ed49 |
| SHA256 | 438993af75242a4c23141a81770a85e74512fd603925484758f112039a546cdd |
| SHA512 | 97b34cbd67d6732841609d2780ec35ed7b2555a0771bedc6ca3c979236b85fb2f8a3cc39be96058cad518dfd387569f377c4cc894678c9fd88fbc42d99ef36f8 |
C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Uninstall.ini
| MD5 | c92a1d4d0755c886dd137c6cab43c35e |
| SHA1 | fc16175e58ad1f67c57e7fdf55333fdd0e01d936 |
| SHA256 | 6ab1ee65e6c9c5e31fe3680fc92a2a0ae73f216e966f5582a2d9c265357238d4 |
| SHA512 | 0525880a1f4cc7dd912ca4006fe4bd02bf1218931fcb56489a0ec728a682fdf1ecd35e8797c665c63dc19d8236942d9b832a6a8c46e00df02afa2c65327dd9de |
memory/4884-367-0x0000000000400000-0x000000000043C000-memory.dmp
memory/2524-368-0x00007FFD4BD40000-0x00007FFD4C801000-memory.dmp
memory/2524-369-0x00000202F1F10000-0x00000202F1F20000-memory.dmp
memory/2524-370-0x00000202F1F10000-0x00000202F1F20000-memory.dmp
memory/2524-371-0x00007FFD4BD40000-0x00007FFD4C801000-memory.dmp
memory/4592-373-0x00007FFD4BD40000-0x00007FFD4C801000-memory.dmp
memory/2524-374-0x00000202F1F10000-0x00000202F1F20000-memory.dmp
memory/2524-375-0x00000202F1F10000-0x00000202F1F20000-memory.dmp
memory/4592-376-0x000001BCFDB70000-0x000001BCFDB80000-memory.dmp
memory/3952-378-0x00007FFD4BD40000-0x00007FFD4C801000-memory.dmp
memory/3952-379-0x0000014EAFBB0000-0x0000014EAFBC0000-memory.dmp
memory/3952-380-0x0000014EAFBB0000-0x0000014EAFBC0000-memory.dmp
memory/4592-382-0x00007FFD4BD40000-0x00007FFD4C801000-memory.dmp
memory/680-383-0x00007FFD4BD40000-0x00007FFD4C801000-memory.dmp
memory/680-384-0x000002156FFA0000-0x000002156FFB0000-memory.dmp
memory/4592-386-0x000001BCFDB70000-0x000001BCFDB80000-memory.dmp
memory/1872-388-0x00007FFD4BD40000-0x00007FFD4C801000-memory.dmp
memory/3776-390-0x000001F3F3160000-0x000001F3F3170000-memory.dmp
memory/1872-389-0x0000021738CC0000-0x0000021738CD0000-memory.dmp
memory/3776-391-0x00007FFD4BD40000-0x00007FFD4C801000-memory.dmp
memory/3952-392-0x00007FFD4BD40000-0x00007FFD4C801000-memory.dmp
memory/1872-393-0x0000021738CC0000-0x0000021738CD0000-memory.dmp
memory/3952-394-0x0000014EAFBB0000-0x0000014EAFBC0000-memory.dmp
memory/1492-396-0x00007FFD4BD40000-0x00007FFD4C801000-memory.dmp
memory/680-397-0x00007FFD4BD40000-0x00007FFD4C801000-memory.dmp
memory/1492-398-0x0000023C6FE00000-0x0000023C6FE10000-memory.dmp
memory/680-399-0x000002156FFA0000-0x000002156FFB0000-memory.dmp
memory/1872-400-0x00007FFD4BD40000-0x00007FFD4C801000-memory.dmp
memory/3776-401-0x000001F3F3160000-0x000001F3F3170000-memory.dmp
memory/3776-402-0x00007FFD4BD40000-0x00007FFD4C801000-memory.dmp
memory/3776-403-0x000001F3F3160000-0x000001F3F3170000-memory.dmp
memory/1872-404-0x0000021738CC0000-0x0000021738CD0000-memory.dmp
memory/1492-405-0x00007FFD4BD40000-0x00007FFD4C801000-memory.dmp
memory/1492-406-0x0000023C6FE00000-0x0000023C6FE10000-memory.dmp
memory/1492-407-0x0000023C6FE00000-0x0000023C6FE10000-memory.dmp
memory/3040-431-0x0000000000400000-0x000000000043C000-memory.dmp
memory/2216-432-0x00007FFD4BD40000-0x00007FFD4C801000-memory.dmp
memory/2216-433-0x0000022167390000-0x00000221673A0000-memory.dmp
memory/2216-434-0x0000022167390000-0x00000221673A0000-memory.dmp
memory/2012-436-0x00007FFD4BD40000-0x00007FFD4C801000-memory.dmp
memory/2012-437-0x000001F14DD30000-0x000001F14DD40000-memory.dmp
memory/2452-439-0x00007FFD4BD40000-0x00007FFD4C801000-memory.dmp
memory/2012-440-0x000001F14DD30000-0x000001F14DD40000-memory.dmp
memory/2452-441-0x0000026550670000-0x0000026550680000-memory.dmp
memory/2216-442-0x00007FFD4BD40000-0x00007FFD4C801000-memory.dmp
memory/2452-443-0x0000026550670000-0x0000026550680000-memory.dmp
memory/2216-444-0x0000022167390000-0x00000221673A0000-memory.dmp
memory/2216-445-0x0000022167390000-0x00000221673A0000-memory.dmp
memory/3484-448-0x00000000009B0000-0x0000000000A24000-memory.dmp
memory/3484-449-0x0000000075090000-0x0000000075840000-memory.dmp
memory/3484-450-0x0000000005AA0000-0x0000000006044000-memory.dmp
memory/3484-451-0x0000000005400000-0x0000000005492000-memory.dmp
memory/2012-452-0x00007FFD4BD40000-0x00007FFD4C801000-memory.dmp
memory/3484-453-0x00000000055D0000-0x00000000055E0000-memory.dmp
memory/3484-454-0x00000000054C0000-0x00000000054CA000-memory.dmp
memory/2012-455-0x000001F14DD30000-0x000001F14DD40000-memory.dmp
memory/2452-456-0x00007FFD4BD40000-0x00007FFD4C801000-memory.dmp