hxxps://github[.]com/Da2dalus/The-MALWARE-Repo

Resubmissions

07/03/2024, 17:12

240307-vq9qasgd66 1

07/03/2024, 17:11

07/03/2024, 17:10

07/03/2024, 17:07

07/03/2024, 16:58

07/03/2024, 16:58

07/03/2024, 16:49

07/03/2024, 16:45

Analysis

max time kernel
466s
max time network
456s
platform
windows11-21h2_x64
resource
win11-20240221-en
resource tags

arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system
submitted
07/03/2024, 16:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/Da2dalus/The-MALWARE-Repo

Score

8^/10

aspackv2 evasion

Malware Config

Signatures

Disables Task Manager via registry modification
evasion
Downloads MZ/PE file

ASPack v2.12-2.42 1 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral1/files/0x000300000002a856-494.dat	aspack_v212_v242

Executes dropped EXE 8 IoCs

pid	Process
1956	YouAreAnIdiot.exe
4920	YouAreAnIdiot.exe
4636	Avoid.exe
2308	ChilledWindows.exe
1664	ChilledWindows.exe
4744	YouAreAnIdiot.exe
3976	rickroll.exe
4780	Trololo (5).exe

Loads dropped DLL 4 IoCs

pid	Process
4920	YouAreAnIdiot.exe
4920	YouAreAnIdiot.exe
4744	YouAreAnIdiot.exe
4744	YouAreAnIdiot.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\J:	ChilledWindows.exe
File opened (read-only)	\??\L:	ChilledWindows.exe
File opened (read-only)	\??\M:	ChilledWindows.exe
File opened (read-only)	\??\H:	ChilledWindows.exe
File opened (read-only)	\??\K:	ChilledWindows.exe
File opened (read-only)	\??\L:	ChilledWindows.exe
File opened (read-only)	\??\P:	ChilledWindows.exe
File opened (read-only)	\??\I:	ChilledWindows.exe
File opened (read-only)	\??\T:	ChilledWindows.exe
File opened (read-only)	\??\U:	ChilledWindows.exe
File opened (read-only)	\??\X:	ChilledWindows.exe
File opened (read-only)	\??\A:	ChilledWindows.exe
File opened (read-only)	\??\B:	ChilledWindows.exe
File opened (read-only)	\??\E:	ChilledWindows.exe
File opened (read-only)	\??\N:	ChilledWindows.exe
File opened (read-only)	\??\Q:	ChilledWindows.exe
File opened (read-only)	\??\T:	ChilledWindows.exe
File opened (read-only)	\??\M:	ChilledWindows.exe
File opened (read-only)	\??\Z:	ChilledWindows.exe
File opened (read-only)	\??\V:	ChilledWindows.exe
File opened (read-only)	\??\H:	ChilledWindows.exe
File opened (read-only)	\??\N:	ChilledWindows.exe
File opened (read-only)	\??\U:	ChilledWindows.exe
File opened (read-only)	\??\G:	ChilledWindows.exe
File opened (read-only)	\??\J:	ChilledWindows.exe
File opened (read-only)	\??\V:	ChilledWindows.exe
File opened (read-only)	\??\Y:	ChilledWindows.exe
File opened (read-only)	\??\G:	ChilledWindows.exe
File opened (read-only)	\??\R:	ChilledWindows.exe
File opened (read-only)	\??\X:	ChilledWindows.exe
File opened (read-only)	\??\Z:	ChilledWindows.exe
File opened (read-only)	\??\W:	ChilledWindows.exe
File opened (read-only)	\??\A:	ChilledWindows.exe
File opened (read-only)	\??\Q:	ChilledWindows.exe
File opened (read-only)	\??\S:	ChilledWindows.exe
File opened (read-only)	\??\Y:	ChilledWindows.exe
File opened (read-only)	\??\I:	ChilledWindows.exe
File opened (read-only)	\??\S:	ChilledWindows.exe
File opened (read-only)	\??\E:	ChilledWindows.exe
File opened (read-only)	\??\W:	ChilledWindows.exe
File opened (read-only)	\??\R:	ChilledWindows.exe
File opened (read-only)	\??\O:	ChilledWindows.exe
File opened (read-only)	\??\B:	ChilledWindows.exe
File opened (read-only)	\??\K:	ChilledWindows.exe
File opened (read-only)	\??\O:	ChilledWindows.exe
File opened (read-only)	\??\P:	ChilledWindows.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
11	raw.githubusercontent.com
30	raw.githubusercontent.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 3 IoCs

pid	pid_target	Process	procid_target
2420	1956	WerFault.exe	101
4844	4920	WerFault.exe	114
1884	4744	WerFault.exe	132

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Kills process with taskkill 2 IoCs

evasion

pid	Process
960	taskkill.exe
2144	taskkill.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1637591879-962683004-3585269084-1000\{74338502-6AAC-4BDA-9124-53B10A7670D4}	ChilledWindows.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1637591879-962683004-3585269084-1000\{7EB06AEC-DB0C-424C-A617-71B3E1DD883B}	ChilledWindows.exe

NTFS ADS 25 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 103769.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 75697.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 359802.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 710075.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\YouAreAnIdiot.exe:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Interop.ShockwaveFlashObjects.dll:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 486798.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 86900.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 955963.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\AxInterop.ShockwaveFlashObjects.dll:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 520123.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\rickroll.exe:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 999950.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 14521.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 33091.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 350232.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\ChilledWindows.exe:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 313905.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 706349.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 265958.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 676642.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 540786.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Avoid.exe:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Trololo (5).exe:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 676929.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 27 IoCs

pid	Process
464	msedge.exe
464	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
3204	msedge.exe
3204	msedge.exe
4396	identity_helper.exe
4396	identity_helper.exe
2416	msedge.exe
2416	msedge.exe
4832	msedge.exe
4832	msedge.exe
1596	msedge.exe
1596	msedge.exe
3044	msedge.exe
3044	msedge.exe
3044	msedge.exe
3044	msedge.exe
1096	msedge.exe
1096	msedge.exe
1456	msedge.exe
1456	msedge.exe
3912	msedge.exe
3912	msedge.exe
2952	msedge.exe
2952	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 19 IoCs

pid	Process
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2308	ChilledWindows.exe
Token: SeCreatePagefilePrivilege	2308	ChilledWindows.exe
Token: SeShutdownPrivilege	2308	ChilledWindows.exe
Token: SeCreatePagefilePrivilege	2308	ChilledWindows.exe
Token: SeShutdownPrivilege	2308	ChilledWindows.exe
Token: SeCreatePagefilePrivilege	2308	ChilledWindows.exe
Token: SeShutdownPrivilege	1664	ChilledWindows.exe
Token: SeCreatePagefilePrivilege	1664	ChilledWindows.exe
Token: SeShutdownPrivilege	1664	ChilledWindows.exe
Token: SeCreatePagefilePrivilege	1664	ChilledWindows.exe
Token: SeDebugPrivilege	2144	taskkill.exe
Token: SeDebugPrivilege	960	taskkill.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe

Suspicious use of SendNotifyMessage 20 IoCs

pid	Process
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2036 wrote to memory of 2284	2036	msedge.exe	80
PID 2036 wrote to memory of 2284	2036	msedge.exe	80
PID 2036 wrote to memory of 1640	2036	msedge.exe	81
PID 2036 wrote to memory of 1640	2036	msedge.exe	81
PID 2036 wrote to memory of 1640	2036	msedge.exe	81
PID 2036 wrote to memory of 1640	2036	msedge.exe	81
PID 2036 wrote to memory of 1640	2036	msedge.exe	81
PID 2036 wrote to memory of 1640	2036	msedge.exe	81
PID 2036 wrote to memory of 1640	2036	msedge.exe	81
PID 2036 wrote to memory of 1640	2036	msedge.exe	81
PID 2036 wrote to memory of 1640	2036	msedge.exe	81
PID 2036 wrote to memory of 1640	2036	msedge.exe	81
PID 2036 wrote to memory of 1640	2036	msedge.exe	81
PID 2036 wrote to memory of 1640	2036	msedge.exe	81
PID 2036 wrote to memory of 1640	2036	msedge.exe	81
PID 2036 wrote to memory of 1640	2036	msedge.exe	81
PID 2036 wrote to memory of 1640	2036	msedge.exe	81
PID 2036 wrote to memory of 1640	2036	msedge.exe	81
PID 2036 wrote to memory of 1640	2036	msedge.exe	81
PID 2036 wrote to memory of 1640	2036	msedge.exe	81
PID 2036 wrote to memory of 1640	2036	msedge.exe	81
PID 2036 wrote to memory of 1640	2036	msedge.exe	81
PID 2036 wrote to memory of 1640	2036	msedge.exe	81
PID 2036 wrote to memory of 1640	2036	msedge.exe	81
PID 2036 wrote to memory of 1640	2036	msedge.exe	81
PID 2036 wrote to memory of 1640	2036	msedge.exe	81
PID 2036 wrote to memory of 1640	2036	msedge.exe	81
PID 2036 wrote to memory of 1640	2036	msedge.exe	81
PID 2036 wrote to memory of 1640	2036	msedge.exe	81
PID 2036 wrote to memory of 1640	2036	msedge.exe	81
PID 2036 wrote to memory of 1640	2036	msedge.exe	81
PID 2036 wrote to memory of 1640	2036	msedge.exe	81
PID 2036 wrote to memory of 1640	2036	msedge.exe	81
PID 2036 wrote to memory of 1640	2036	msedge.exe	81
PID 2036 wrote to memory of 1640	2036	msedge.exe	81
PID 2036 wrote to memory of 1640	2036	msedge.exe	81
PID 2036 wrote to memory of 1640	2036	msedge.exe	81
PID 2036 wrote to memory of 1640	2036	msedge.exe	81
PID 2036 wrote to memory of 1640	2036	msedge.exe	81
PID 2036 wrote to memory of 1640	2036	msedge.exe	81
PID 2036 wrote to memory of 1640	2036	msedge.exe	81
PID 2036 wrote to memory of 1640	2036	msedge.exe	81
PID 2036 wrote to memory of 464	2036	msedge.exe	82
PID 2036 wrote to memory of 464	2036	msedge.exe	82
PID 2036 wrote to memory of 2100	2036	msedge.exe	83
PID 2036 wrote to memory of 2100	2036	msedge.exe	83
PID 2036 wrote to memory of 2100	2036	msedge.exe	83
PID 2036 wrote to memory of 2100	2036	msedge.exe	83
PID 2036 wrote to memory of 2100	2036	msedge.exe	83
PID 2036 wrote to memory of 2100	2036	msedge.exe	83
PID 2036 wrote to memory of 2100	2036	msedge.exe	83
PID 2036 wrote to memory of 2100	2036	msedge.exe	83
PID 2036 wrote to memory of 2100	2036	msedge.exe	83
PID 2036 wrote to memory of 2100	2036	msedge.exe	83
PID 2036 wrote to memory of 2100	2036	msedge.exe	83
PID 2036 wrote to memory of 2100	2036	msedge.exe	83
PID 2036 wrote to memory of 2100	2036	msedge.exe	83
PID 2036 wrote to memory of 2100	2036	msedge.exe	83
PID 2036 wrote to memory of 2100	2036	msedge.exe	83
PID 2036 wrote to memory of 2100	2036	msedge.exe	83
PID 2036 wrote to memory of 2100	2036	msedge.exe	83
PID 2036 wrote to memory of 2100	2036	msedge.exe	83
PID 2036 wrote to memory of 2100	2036	msedge.exe	83
PID 2036 wrote to memory of 2100	2036	msedge.exe	83

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://github.com/Da2dalus/The-MALWARE-Repo
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff9351e3cb8,0x7ff9351e3cc8,0x7ff9351e3cd8
  2⤵
  PID:2284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1820,14462520913101214009,16509574061881716140,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1912 /prefetch:2
  2⤵
  PID:1640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1820,14462520913101214009,16509574061881716140,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2360 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1820,14462520913101214009,16509574061881716140,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2624 /prefetch:8
  2⤵
  PID:2100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1820,14462520913101214009,16509574061881716140,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
  2⤵
  PID:3736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1820,14462520913101214009,16509574061881716140,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:3548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1820,14462520913101214009,16509574061881716140,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3700 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3204
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1820,14462520913101214009,16509574061881716140,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5452 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1820,14462520913101214009,16509574061881716140,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4944 /prefetch:1
  2⤵
  PID:128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1820,14462520913101214009,16509574061881716140,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5148 /prefetch:1
  2⤵
  PID:1376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1820,14462520913101214009,16509574061881716140,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:1584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1820,14462520913101214009,16509574061881716140,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3344 /prefetch:1
  2⤵
  PID:1356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1820,14462520913101214009,16509574061881716140,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5956 /prefetch:1
  2⤵
  PID:4948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1820,14462520913101214009,16509574061881716140,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5496 /prefetch:8
  2⤵
  PID:3308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1820,14462520913101214009,16509574061881716140,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6196 /prefetch:8
  2⤵
  PID:1048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1820,14462520913101214009,16509574061881716140,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5660 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:2416
- C:\Users\Admin\Downloads\YouAreAnIdiot.exe
  "C:\Users\Admin\Downloads\YouAreAnIdiot.exe"
  2⤵
  - Executes dropped EXE
  PID:1956
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1956 -s 1232
    3⤵
    - Program crash
    PID:2420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1820,14462520913101214009,16509574061881716140,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6052 /prefetch:1
  2⤵
  PID:4352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1820,14462520913101214009,16509574061881716140,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1320 /prefetch:1
  2⤵
  PID:3392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1820,14462520913101214009,16509574061881716140,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1760 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:4832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1820,14462520913101214009,16509574061881716140,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5960 /prefetch:8
  2⤵
  PID:4600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1820,14462520913101214009,16509574061881716140,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6276 /prefetch:1
  2⤵
  PID:4120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1820,14462520913101214009,16509574061881716140,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4780 /prefetch:8
  2⤵
  PID:1784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1820,14462520913101214009,16509574061881716140,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6568 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:1596
- C:\Users\Admin\Downloads\YouAreAnIdiot.exe
  "C:\Users\Admin\Downloads\YouAreAnIdiot.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:4920
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4920 -s 1424
    3⤵
    - Program crash
    PID:4844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1820,14462520913101214009,16509574061881716140,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6496 /prefetch:1
  2⤵
  PID:1852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1820,14462520913101214009,16509574061881716140,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6484 /prefetch:8
  2⤵
  PID:4076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1820,14462520913101214009,16509574061881716140,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=4876 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1820,14462520913101214009,16509574061881716140,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5004 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:1096
- C:\Users\Admin\Downloads\Avoid.exe
  "C:\Users\Admin\Downloads\Avoid.exe"
  2⤵
  - Executes dropped EXE
  PID:4636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1820,14462520913101214009,16509574061881716140,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5180 /prefetch:1
  2⤵
  PID:3960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1820,14462520913101214009,16509574061881716140,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6412 /prefetch:1
  2⤵
  PID:2952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1820,14462520913101214009,16509574061881716140,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6744 /prefetch:1
  2⤵
  PID:2916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1820,14462520913101214009,16509574061881716140,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6380 /prefetch:1
  2⤵
  PID:2672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1820,14462520913101214009,16509574061881716140,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=7072 /prefetch:8
  2⤵
  PID:1916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1820,14462520913101214009,16509574061881716140,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6508 /prefetch:8
  2⤵
  PID:2348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1820,14462520913101214009,16509574061881716140,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6876 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:1456
- C:\Users\Admin\Downloads\ChilledWindows.exe
  "C:\Users\Admin\Downloads\ChilledWindows.exe"
  2⤵
  - Executes dropped EXE
  - Enumerates connected drives
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  PID:2308
- C:\Users\Admin\Downloads\ChilledWindows.exe
  "C:\Users\Admin\Downloads\ChilledWindows.exe"
  2⤵
  - Executes dropped EXE
  - Enumerates connected drives
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  PID:1664
- C:\Users\Admin\Downloads\YouAreAnIdiot.exe
  "C:\Users\Admin\Downloads\YouAreAnIdiot.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:4744
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4744 -s 1424
    3⤵
    - Program crash
    PID:1884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1820,14462520913101214009,16509574061881716140,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6520 /prefetch:1
  2⤵
  PID:1432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1820,14462520913101214009,16509574061881716140,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5628 /prefetch:8
  2⤵
  PID:1116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1820,14462520913101214009,16509574061881716140,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6576 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:3912
- C:\Users\Admin\Downloads\rickroll.exe
  "C:\Users\Admin\Downloads\rickroll.exe"
  2⤵
  - Executes dropped EXE
  PID:3976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1820,14462520913101214009,16509574061881716140,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7024 /prefetch:1
  2⤵
  PID:2916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1820,14462520913101214009,16509574061881716140,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2580 /prefetch:1
  2⤵
  PID:2416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1820,14462520913101214009,16509574061881716140,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6476 /prefetch:1
  2⤵
  PID:2832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1820,14462520913101214009,16509574061881716140,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=1528 /prefetch:8
  2⤵
  PID:4204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1820,14462520913101214009,16509574061881716140,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=7044 /prefetch:8
  2⤵
  PID:4928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1820,14462520913101214009,16509574061881716140,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6800 /prefetch:8
  2⤵
  PID:1672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1820,14462520913101214009,16509574061881716140,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5136 /prefetch:8
  2⤵
  PID:2384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1820,14462520913101214009,16509574061881716140,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6564 /prefetch:8
  2⤵
  PID:4612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1820,14462520913101214009,16509574061881716140,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5668 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:2952
- C:\Users\Admin\Downloads\Trololo (5).exe
  "C:\Users\Admin\Downloads\Trololo (5).exe"
  2⤵
  - Executes dropped EXE
  PID:4780
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill.exe /f /im explorer.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:960
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill.exe /f /im taskmgr.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2144

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2684

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3556

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1956 -ip 1956
1⤵
PID:128

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 352 -p 4920 -ip 4920
1⤵
PID:4592

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004D0 0x00000000000004C8
1⤵
PID:2884

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 356 -p 4744 -ip 4744
1⤵
PID:4928

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\ChilledWindows.exe.log

Filesize
2KB

MD5
01634db740c4b6af1e97697b928c19a7

SHA1
c2450780121e171e6a30222b0b6ff486806b39c4

SHA256
ae1e51aa14401830ff1d9a7e3b71a98f6fabfc3372a38ff64ad6622334b40023

SHA512
4030707da446012033e90e1f273d9229a30c9c6a479a4517b9693d0ce80fb4f2e3212496d996b8f96f7018b478ba014ebd53849f3357ce6da8709aacc647bee6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d459a8c16562fb3f4b1d7cadaca620aa

SHA1
7810bf83e8c362e0c69298e8c16964ed48a90d3a

SHA256
fa31bc49a2f9af06d325871104e36dd69bfe3847cd521059b62461a92912331a

SHA512
35cb00c21908e1332c3439af1ec9867c81befcc4792248ee392080b455b1f5ce2b0c0c2415e344d91537469b5eb72f330b79feb7e8a86eeb6cf41ec5be5dfd2f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
656bb397c72d15efa159441f116440a6

SHA1
5b57747d6fdd99160af6d3e580114dbbd351921f

SHA256
770ed0fcd22783f60407cdc55b5998b08e37b3e06efb3d1168ffed8768751fab

SHA512
5923db1d102f99d0b29d60916b183b92e6be12cc55733998d3da36d796d6158c76e385cef320ec0e9afa242a42bfb596f7233b60b548f719f7d41cb8f404e73c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000010

Filesize
424KB

MD5
e263c5b306480143855655233f76dc5a

SHA1
e7dcd6c23c72209ee5aa0890372de1ce52045815

SHA256
1f69810b8fe71e30a8738278adf09dd982f7de0ab9891d296ce7ea61b3fa4f69

SHA512
e95981eae02d0a8bf44493c64cca8b7e50023332e91d75164735a1d0e38138f358100c93633ff3a0652e1c12a5155cba77d81e01027422d7d5f71000eafb4113

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
57114f9a16d26b1dd8ec2f940c91e316

SHA1
8d40e375c058738af4385db31ef79cc5421be4ed

SHA256
e7baf8f1b2070a05e29fdea86f8031911b63d4255d4b47accc59ab627d15197d

SHA512
2dcdb4161b9af6a6756ec19790fcf2e6bad8d569dd4fd837f233369727a969c8aaf971f05d9c4108198b0dea30b28d6459a0090e291eca1201fe167e5b9453aa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
579B

MD5
e51401bdf1eae288a9ba5d952ebb3aa9

SHA1
5effd82fee8231e1294fd404dd1f10caf5c41fd2

SHA256
a08ea4c022c5207583d92dedf27194f6d81335b90bef42e90132333220a52fa2

SHA512
f777e86f2eb64d2c31afba76f544f9a65392b0d77de18e16d6a2b5534f43febc083f757d37c0719b29b556c5f73b1238c0857ee7b9a6e18c0c9c99ca54133edb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
579B

MD5
8d2e35ef5e680209262a2ac011f22a63

SHA1
3da604fe13d647f45c5236949de0a1cc3d3006dc

SHA256
9a51cbfc34a99cd5e8540827f9796364cbf35b01e6b535b7e06e51bd9778dcd8

SHA512
4eb414626c9fd3c013cf1dc2cc3303d25002505f97eb1f1f1420653277333b96710946b9b9bfde5dc3889b2259df5259fc23e23df29dbfd5df94c51b41fe8aa1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
050b72390e3bcf9e9b941918304792b7

SHA1
57ff5cde46d5f086b6481bee6143b29797ef8f7b

SHA256
26d4a2d7b72c12c489c285825ee79880994daccaa841fc7b862253bef76a8ace

SHA512
03aedd996195d3b4613bddad531c88a6fc5b7691a51bcdeefa56201db49f185247a685446ea8b2e0e6c898291965a9f040394526f656596d17a113350d6c00a0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
834d9b3557cea4c0f4c018c679736789

SHA1
a1668d9df224b43d4ab87a93260bcf3a1150ca5b

SHA256
53c681abd31711c868c275e575f3fbe69a18171efa6965dc4575c6af0ca9c851

SHA512
55a16ae0593d349a0d281500a9f1a3f5636553ae35214920258b08fb61eea5be5cacbd1ccedb5b97b8944edbc371a140d66fbed28188b49b1b35875dd1fa2117

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
2fc2842f5c437d6bdbe0ff76d53c42a6

SHA1
109474305c4715ae2138fa19f0a17ed0ef4773fd

SHA256
8abbf6fd794aeb2b228f8f467c69b1e7a9e18f026b2ac569d6c092df54cafe5f

SHA512
8f80dd21526d33323a2726ea062e1d349d697051d53b8604f867849f1fabf4335e059c8550baab7b724ac2009008f7e786c3c8fc8eab6d63c682ea93db2d1146

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
b8fd4a13b860325d24765f3347fcdb1c

SHA1
f4670e986a43318e0e62db59c106379a2538ce67

SHA256
5942b7e4a6c8aae821929eb5ef56470b70c334d5d9a3bbca2446b380b9bfc61e

SHA512
73932eb6d0a1545594f3dc2a6ab271e334e34a3fb7b1ace32322d9bb6ea6da1e6a657eea9eff89cd1258c355bbf1a1b88bbbde8687adb83ac803fa6f2488240d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
8c12601b14416be2961b7e6efd031e87

SHA1
9e0445091d9a36dd5e779b171b05ad2574a55701

SHA256
db8554a4c6326ec9da2f4941ab0ea8935b4d0dfdc882db0fa008a3b7ae3cf7b2

SHA512
8e617c59faa4c9b97d7e36f901c105b20d05fa2feb7fa3f1a4e6e8928aa8e4482afe125811fa36b559de41982401384a2a0c5b4486f71e34029056e37001254e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
62c51f57322c200f441e85bf2bb74538

SHA1
3f10e292077b3ec1150d010cb755c902542ccc1f

SHA256
a38174759dd51751cc15b2908b48ae23be7eb089a8ca10bf069e39f89cad45c4

SHA512
e83ded745b5aeb23fa0a0b894920ef614768de64723b3252899ea9ee9b44a2d496f17d4519a8cbf833374f0259ec2d7095e9ddcfac0232c39493b761d0233f4f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
25142ecd597aed00d3d139c83b214d49

SHA1
0899fed93503312c6bc8cdebd01ae97464c19cc1

SHA256
799e23d785357a19458df4dee911f477778bc1d370f44f4a69e9528816b4c939

SHA512
8cc164ba9e0443a4b76813195d09df7b6a52d87887179ec0e31c543dfce5111f88ebde500c5606b889308d0cd35dd8ab66723dd9387043effb31e055097b6fb0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
24799f379791aa2c2b66ee15859bd98c

SHA1
d22da9fc649232fc5967e847305edbca7b240e22

SHA256
a13ee40f76f2650cf987486fee1fc9ce7d8e6c477fd755c1f1109928edb37d45

SHA512
1305dd759f9a0e5a1f8bbc12908328212faf98b812e135c4bb79d710de34ec3cd53554965d55ba9b4f55be72f707807800d1e3fec8db13bf5af4d95f8fc5633f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
8e9792dbca0a13b5458bb981eadb073d

SHA1
bc5f0e52153d874a31ca54915ffbaeecc36a1a4e

SHA256
5307c8c51fb032add873c9fd157dfc5c90165040d829f22569c91462fc55e53f

SHA512
cf83de2a0cc83311335b51a474ca8e72f01e0d67196b17b870edaa18796e581ceef27038f5931c451aeace80f9135365c713cff1221150b5c5392870af2930f1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
d2913e59fa674bcb69cad0435a12b436

SHA1
892e8d008f18eb0c115121d3163c6d16b60e948d

SHA256
7dd84e20d4dcf2e21455b7d59a4bd870c5add469ef5360a4f4696dfa9d624821

SHA512
43f77a1155bb330fd5ebaf6fceecdfa62bb470a469aa4d7f280971615be9d739866ff5921a7f64f8f31eeacce18e35970e070cdeb1431ebc9f2db5b1134b4ba7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
74994e8190a04ac67106e5a4026a8e1a

SHA1
b410e6ffa09cf1627699ad8f735a29d3a2e31995

SHA256
60729c33b8562b3fa2dfa505383ae3be645f9ee70698c5d4c415c066923c5305

SHA512
610b7b2676c24ee07a9d8ad6f8116bded07c2d784273ce8409bce50160b1e4e873267347d1fd37f3cf6d1796126624fc608f23c43e5a8b75e5836726bb5f0bd7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
874B

MD5
1139c85225ece37aca03a4c104927f70

SHA1
9c8936cdfb6c2dfbf282f205b5cbc350be9eb674

SHA256
3c6fb98a72841163ba710b2b6769e5c4795f7f8251fd2319c3de39c71b60da47

SHA512
d3bce71afa8b43ea503c9296661ce283e7a0ffc83786e42bb35ef2b781a99c4d2f4712b30032d9c3d3e5cbe5fb713384451a2a4c863286556cb36a0461239ea5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
814e52616b5e6d71ca0f42e8ae960ecd

SHA1
a382fd2969c981732008e5fcc5fc35223c5d1d85

SHA256
84f421f557b127f3b8f414185f17eaba969b41548bec5721cdb32d952e1901d9

SHA512
0b7b462720c396b09913fd09ff12b014ea8eef25ea59f964734f7dec125c454aff66e50683e02bfe6aa8f22433dcc5f1e77a6f011e2266b2d0f343c7116d378a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
d9d44a243a70da67eb95a1639532f7e1

SHA1
20837b66e609eee169e01bd43005ab47ab04ea8c

SHA256
7389958b5c29b9873c0bdf227688901e583f1d3017b482d285c5a15f132eb507

SHA512
555015e9841d7d787061cb53fe10306a157552e975ddf2e531bb9157616ef5d70303b4df25de0415b0062c45729bfaa7b32460060db83c19cf6b7e0f3cd49bb6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
aff9200d5b014644c6b492e5cc3a931a

SHA1
ada9df098aa63948ecaba9c125102ed06d3c2925

SHA256
f6a8c47aca8602282ed38f4a7c7b6b15e2fbace1eed6c0bc41a9c1ea0ba3786b

SHA512
2938916615cb07707e4ec03d63ac32c37321470c21bd8ef393c3e9d159d983a1aeeec89247e3dcf163d1fe574f913796286b57a5c623fe37fbc5ff192b2da28d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
bb9c9ed9f6f1a179012b5079cf7fead3

SHA1
46236a5986b1fd61f39cc7edfa0a8da10a1f4e42

SHA256
e3aec3f18bc7786c0cae41cbe09da003ef058d06ea3f4cbc8fdffaefd3aefa47

SHA512
3c5a2766ce5044ea77af70df8fe8b590a1635081ab12abb1fe04ef7998cbe4bedebd81654993ad8a88102256eb9e582b5f38a8fe0867178d2b2d3898b524ab19

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
8fa06ba4a0e904256cd39e887e0e2836

SHA1
8df077b3abe251a2ecccf98acf87580d7f6357d8

SHA256
17cc658d8ebfa2611b47083032cd92dad44b0957418138c222fd1796ff6c64aa

SHA512
c83b36b6e705812116ca435a7975abab2672a4e0abec4732a2419a5482595f427c0d80e9b0f3a34aebb5bef4f6abfc8cb6e78e2271ac2f35bfc6b8619ffe6ebb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
47e10f599eb8610e823242dc3deddd69

SHA1
aad997e64b9066c9cdb8f8b23a8f07b6bab05c2a

SHA256
3fe4703ebfc85066afc375a53a9e9edb187881ce496e5b145b0406e351655934

SHA512
cd8113d4c01aac2213d765a3a84c238228cd68eaf9ac7c73cfd0b36fe89a53b956fea163556ade5c374a203d418452b5cefe99c851fdbf827e8803003b93a5f6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
28316d14c72917bb2a5a297b378b6aec

SHA1
3296e36007378da2455db79da63e21045ee94642

SHA256
4d520cfee3ed2b0e2eaa85f43e6ee9d7f909f1bf9da8f21bbd6af6dad6295426

SHA512
eb0ecbbea077e95c9788153260a7621369f9f1e3c9937c2229d612341de19ac487c3d89404141a23e43f0ab03886aebd26f36ef1389229c302c519327a0cd98f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
26a1c9ec1f6918759263598574588985

SHA1
d3fd9a0295048a110a617ce66975f099927e32aa

SHA256
2cbee6e50684bfd0b0a1083454e32f604a699dc80485f08dcf73c5cf3ca82c94

SHA512
168fe1d27638153493a4543237be5076c35a22a23f21230d8d63f6a4ea5771f68fa9e47896ac09bc359b4351a147ca8006bf157d6c345562e824bedd1ddb7e6f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
ece4d3874c0aa0c82c161bd31bfca04a

SHA1
7117ad019003eeb25a06fdbbf0a3f1d11951700e

SHA256
e62ad0365d9c2aa0603cd1de1ee21608d305c1f6e30520ed728aa037c5818d8c

SHA512
eb878fb5e7e1a01bca04f8b7dd0e0c587d785c14371db5e84272782806eba381af570e82ba36fe78a3af2ea923ba5884a31da4bfabae353a3d9e47a14f660708

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe578cfe.TMP

Filesize
874B

MD5
6296af4d7616978472d4db95770d1bcd

SHA1
41cab94ae4af02b6b83b5d4b8c79bc8e04390882

SHA256
bfd82abc0310dcad87435565dc45125d4de4f152d28aaddf67d29f030a2abb63

SHA512
7e712eb6d07f8dd398c1498a961914ddac17007ba8332d7614302411f347baae3d3d79912aabac467f2d396824266a9ae088b3de3b9ac337863180a7404bc193

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
fb6a10ae3ded6e614bc95a8b792b5d96

SHA1
15a88d956f91565d4b5f4d182b7183629a59dfe1

SHA256
c8ada9b2e715d354ec4cfa74cdbb4632004c087daefd1a4d9321e91319e36a68

SHA512
9bfe2862fc62963f0806577e6ee4368fc4103f08e6f77d113d7b2b7b6608c2a392c38be7faa0b9bba0b4902b18614a75a96cf02ebc7ddeb9b6f02e1e090d11b4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
2ca2ff69164c542b3cacb78726cebb99

SHA1
ea3432b54242711741a9d31335263a17b6c10b44

SHA256
9efcef1c8493926917b7f28ecbace89cab558f31bd98fe4aed8ffa1b039b358f

SHA512
bf1c4d5b764a8e5b9b836b537c8b386d9b448183dc8bec4d3402b4747fad1a5c18739a9754383e545fd341bec743a7dbf9611a59e89f07a488443ad2fa9ee6f3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
1c63f945d94f9b23f8c97eeed04e5b2c

SHA1
d42a2b1eae1e485edc2599a448bca2c021bca9ca

SHA256
e486f0a75d8502b4390bd54e2b91b10a02d7d07bac28b723cc55b8527364b8ed

SHA512
433e63260dcba4bb5ec39a8c4c7d5cca02e353baab66af980859c187f4db89d636cbad10925bf95245d7edf65cd83d44e993cb9356989efcfe28b68695280a5f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
8d52eb2a6a4aedc03387fcd384320703

SHA1
930b3372e91471e0df754812efd956b5e8d11347

SHA256
8776a9d0c4db5364423000e1f9028348faf277ac66c946df1c9bd251d71ac158

SHA512
4bf5d28281788b42dd1bbb3962c4a60a552ca08bda0f5c29b48a056f62e0c2e65bd2235c63e0a15bc054b78d6a7cb001663d7e8a5dc1af3615a22809f2085fcf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
d9b78a6a1ed7b40e08875a3b23c99668

SHA1
f7380e84d38153d4d9e7f904312bd0565f7c89e9

SHA256
cae585ce6cd970609c6d5e7f8baa11f9a117a92512f970a4c4d547f14595a0bb

SHA512
6249ccdda0b3421b85bae7095c0041f0b64613c56461fd2b5cc8c99042c5ff5866ece45ca6ee11d7f830d405fd3006d5771d1ee5280ebf65c03fabf09a2d32fc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb

Filesize
768KB

MD5
c48a0af74a192dbf62b47b4c39f4d591

SHA1
f04df512ff97ef6f69e48235b61ae510d60897a5

SHA256
22ea8f9b6d0e011986338635712d339e710cb17acb8dec9a01d7aca0848ca640

SHA512
9fcd0bff7892675d78e391f345ded606f6a39782ef6f075ea8fcc84ee3768cf0f43873c049178c71444bd1ccc05eeab4f6282d2d3406fa08af43e867427a2dee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb

Filesize
1024KB

MD5
cee7bebba6acf6c834080ccbb15322cc

SHA1
f39a8bb4f0dc34984b3eda5aff1f42b7545bd927

SHA256
5d7c35e5501cb31c84a9094212521c754a19d39e2c655d31db5d6ea95f3a89a9

SHA512
b010a866d5bf928df69a7f6e59c0fe891ee8a02c5e38dc6458879f3081a3be368fa79fe0ae6535be28eab9ec587401109fedb8b50389b19c73cfe0d710171588

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML

Filesize
9KB

MD5
7050d5ae8acfbe560fa11073fef8185d

SHA1
5bc38e77ff06785fe0aec5a345c4ccd15752560e

SHA256
cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b

SHA512
a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b

Download Submit
C:\Users\Admin\Downloads\437cd0bf-cba8-4a49-9cf0-ab2ecea99956.tmp

Filesize
3.0MB

MD5
b6d61b516d41e209b207b41d91e3b90d

SHA1
e50d4b7bf005075cb63d6bd9ad48c92a00ee9444

SHA256
3d0efd55bde5fb7a73817940bac2a901d934b496738b7c5cab7ea0f6228e28fe

SHA512
3217fc904e4c71b399dd273786634a6a6c19064a9bf96960df9b3357001c12b9547813412173149f6185eb5d300492d290342ec955a8347c6f9dcac338c136da

Download Submit
C:\Users\Admin\Downloads\AxInterop.ShockwaveFlashObjects.dll:Zone.Identifier

Filesize
55B

MD5
0f98a5550abe0fb880568b1480c96a1c

SHA1
d2ce9f7057b201d31f79f3aee2225d89f36be07d

SHA256
2dfb5f4b33e4cf8237b732c02b1f2b1192ffe4b83114bcf821f489bbf48c6aa1

SHA512
dbc1150d831950684ab37407defac0177b7583da0fe13ee8f8eeb65e8b05d23b357722246888189b4681b97507a4262ece96a1c458c4427a9a41d8ea8d11a2f6

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 103769.crdownload

Filesize
129KB

MD5
0ec108e32c12ca7648254cf9718ad8d5

SHA1
78e07f54eeb6af5191c744ebb8da83dad895eca1

SHA256
48b08ea78124ca010784d9f0faae751fc4a0c72c0e7149ded81fc03819f5d723

SHA512
1129e685f5dd0cb2fa22ef4fe5da3f1e2632e890333ce17d3d06d04a4097b4d9f4ca7d242611ffc9e26079900945cf04ab6565a1c322e88e161f1929d18a2072

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 313905.crdownload

Filesize
248KB

MD5
20d2c71d6d9daf4499ffc4a5d164f1c3

SHA1
38e5dcd93f25386d05a34a5b26d3fba1bf02f7c8

SHA256
3ac8cc58dcbceaec3dab046aea050357e0e2248d30b0804c738c9a5b037c220d

SHA512
8ffd56fb3538eb60da2dde9e3d6eee0dac8419c61532e9127f47c4351b6e53e01143af92b2e26b521e23cdbbf15d7a358d3757431e572e37a1eede57c7d39704

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 313905.crdownload:SmartScreen

Filesize
7B

MD5
4047530ecbc0170039e76fe1657bdb01

SHA1
32db7d5e662ebccdd1d71de285f907e3a1c68ac5

SHA256
82254025d1b98d60044d3aeb7c56eed7c61c07c3e30534d6e05dab9d6c326750

SHA512
8f002af3f4ed2b3dfb4ed8273318d160152da50ee4842c9f5d9915f50a3e643952494699c4258e6af993dc6e1695d0dc3db6d23f4d93c26b0bc6a20f4b4f336e

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 359802.crdownload

Filesize
17KB

MD5
451112d955af4fe3c0d00f303d811d20

SHA1
1619c35078ba891091de6444099a69ef364e0c10

SHA256
0d57a706d4e10cca3aed49b341a651f29046f5ef1328878d616be93c3b4cbce9

SHA512
35357d2c4b8229ef9927fa37d85e22f3ae26606f577c4c4655b2126f0ecea4c69dae03043927207ca426cc3cd54fc3e72124369418932e04733a368c9316cf87

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 676929.crdownload

Filesize
21KB

MD5
e869d1d4545c212d9068a090a370ded3

SHA1
a6a92f108bba390cd14e7103ba710efec1d270f9

SHA256
63af704211a03f6ff6530ebfca095b6c97636ab66e5a6de80d167b19c3c30c66

SHA512
ee108b0ebefb476c5beb568129da7ce058229fb42ad3500c6fc37a36d718eb67a17b331d73f6920a5290c3977be2eda96aa057533c3344898d161cb464c6ef76

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 706349.crdownload

Filesize
4.4MB

MD5
6a4853cd0584dc90067e15afb43c4962

SHA1
ae59bbb123e98dc8379d08887f83d7e52b1b47fc

SHA256
ccb9502bf8ba5becf8b758ca04a5625c30b79e2d10d2677cc43ae4253e1288ec

SHA512
feb223e0de9bd64e32dc4f3227e175b58196b5e614bca8c2df0bbca2442a564e39d66bcd465154149dc7ebbd3e1ca644ed09d9a9174b52236c76e7388cb9d996

Download Submit
C:\Users\Admin\Downloads\YouAreAnIdiot.exe:Zone.Identifier

Filesize
26B

MD5
fbccf14d504b7b2dbcb5a5bda75bd93b

SHA1
d59fc84cdd5217c6cf74785703655f78da6b582b

SHA256
eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913

SHA512
aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98

Download Submit
C:\Users\Admin\Downloads\chilledwindows.mp4

Filesize
3.6MB

MD5
698ddcaec1edcf1245807627884edf9c

SHA1
c7fcbeaa2aadffaf807c096c51fb14c47003ac20

SHA256
cde975f975d21edb2e5faa505205ab8a2c5a565ba1ff8585d1f0e372b2a1d78b

SHA512
a2c326f0c653edcd613a3cefc8d82006e843e69afc787c870aa1b9686a20d79e5ab4e9e60b04d1970f07d88318588c1305117810e73ac620afd1fb6511394155

Download Submit
memory/1664-800-0x0000000001A70000-0x0000000001A80000-memory.dmp

Filesize
64KB

Download
memory/1664-798-0x0000000001A70000-0x0000000001A80000-memory.dmp

Filesize
64KB

Download
memory/1664-761-0x0000000001A70000-0x0000000001A80000-memory.dmp

Filesize
64KB

Download
memory/1664-797-0x00007FF9204F0000-0x00007FF920FB2000-memory.dmp

Filesize
10.8MB

Download
memory/1664-805-0x00007FF9204F0000-0x00007FF920FB2000-memory.dmp

Filesize
10.8MB

Download
memory/1664-759-0x0000000001A70000-0x0000000001A80000-memory.dmp

Filesize
64KB

Download
memory/1664-758-0x00007FF9204F0000-0x00007FF920FB2000-memory.dmp

Filesize
10.8MB

Download
memory/1956-301-0x0000000005810000-0x0000000005820000-memory.dmp

Filesize
64KB

Download
memory/1956-297-0x0000000074B30000-0x00000000752E1000-memory.dmp

Filesize
7.7MB

Download
memory/1956-296-0x0000000000A50000-0x0000000000AC2000-memory.dmp

Filesize
456KB

Download
memory/1956-298-0x00000000055C0000-0x000000000565C000-memory.dmp

Filesize
624KB

Download
memory/1956-299-0x0000000005C10000-0x00000000061B6000-memory.dmp

Filesize
5.6MB

Download
memory/1956-300-0x0000000005660000-0x00000000056F2000-memory.dmp

Filesize
584KB

Download
memory/1956-302-0x0000000005560000-0x000000000556A000-memory.dmp

Filesize
40KB

Download
memory/1956-303-0x0000000005760000-0x00000000057B6000-memory.dmp

Filesize
344KB

Download
memory/1956-304-0x0000000074B30000-0x00000000752E1000-memory.dmp

Filesize
7.7MB

Download
memory/2308-683-0x000000001BC90000-0x000000001BCA0000-memory.dmp

Filesize
64KB

Download
memory/2308-686-0x0000000021FB0000-0x0000000021FE8000-memory.dmp

Filesize
224KB

Download
memory/2308-739-0x000000001BC90000-0x000000001BCA0000-memory.dmp

Filesize
64KB

Download
memory/2308-738-0x000000001BC90000-0x000000001BCA0000-memory.dmp

Filesize
64KB

Download
memory/2308-736-0x000000001BC90000-0x000000001BCA0000-memory.dmp

Filesize
64KB

Download
memory/2308-735-0x00007FF9204F0000-0x00007FF920FB2000-memory.dmp

Filesize
10.8MB

Download
memory/2308-687-0x000000001CA50000-0x000000001CA5E000-memory.dmp

Filesize
56KB

Download
memory/2308-670-0x00007FF9204F0000-0x00007FF920FB2000-memory.dmp

Filesize
10.8MB

Download
memory/2308-671-0x000000001BC90000-0x000000001BCA0000-memory.dmp

Filesize
64KB

Download
memory/2308-753-0x00007FF9204F0000-0x00007FF920FB2000-memory.dmp

Filesize
10.8MB

Download
memory/2308-669-0x0000000000AC0000-0x0000000000F24000-memory.dmp

Filesize
4.4MB

Download
memory/2308-685-0x0000000003330000-0x0000000003338000-memory.dmp

Filesize
32KB

Download
memory/2308-672-0x000000001BC90000-0x000000001BCA0000-memory.dmp

Filesize
64KB

Download
memory/3976-884-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/4636-551-0x0000000000400000-0x00000000004A6000-memory.dmp

Filesize
664KB

Download
memory/4636-538-0x0000000002200000-0x0000000002201000-memory.dmp

Filesize
4KB

Download
memory/4744-812-0x0000000074A10000-0x00000000751C1000-memory.dmp

Filesize
7.7MB

Download
memory/4744-808-0x0000000074A10000-0x00000000751C1000-memory.dmp

Filesize
7.7MB

Download
memory/4744-809-0x0000000005850000-0x0000000005860000-memory.dmp

Filesize
64KB

Download
memory/4780-1025-0x000000001D000000-0x000000001D04C000-memory.dmp

Filesize
304KB

Download
memory/4780-1026-0x0000000001AF0000-0x0000000001B00000-memory.dmp

Filesize
64KB

Download
memory/4780-1013-0x000000001CDA0000-0x000000001CE3C000-memory.dmp

Filesize
624KB

Download
memory/4780-1014-0x00007FF920610000-0x00007FF920FB1000-memory.dmp

Filesize
9.6MB

Download
memory/4780-1012-0x000000001C800000-0x000000001CCCE000-memory.dmp

Filesize
4.8MB

Download
memory/4780-1024-0x0000000001C50000-0x0000000001C58000-memory.dmp

Filesize
32KB

Download
memory/4780-1010-0x000000001C260000-0x000000001C306000-memory.dmp

Filesize
664KB

Download
memory/4780-1011-0x00007FF920610000-0x00007FF920FB1000-memory.dmp

Filesize
9.6MB

Download
memory/4780-1169-0x0000000001AF0000-0x0000000001B00000-memory.dmp

Filesize
64KB

Download
memory/4780-1168-0x00007FF920610000-0x00007FF920FB1000-memory.dmp

Filesize
9.6MB

Download
memory/4780-1166-0x00007FF920610000-0x00007FF920FB1000-memory.dmp

Filesize
9.6MB

Download
memory/4920-455-0x0000000074BD0000-0x0000000075381000-memory.dmp

Filesize
7.7MB

Download
memory/4920-456-0x0000000005A20000-0x0000000005A30000-memory.dmp

Filesize
64KB

Download
memory/4920-459-0x0000000005A10000-0x0000000005A1A000-memory.dmp

Filesize
40KB

Download
memory/4920-460-0x0000000074BD0000-0x0000000075381000-memory.dmp

Filesize
7.7MB

Download