hxxps://tria[.]ge/submit/file

Resubmissions

09/05/2024, 09:15

240509-k72qxadc27 8

09/05/2024, 09:06

240509-k27d7saa7v 10

09/05/2024, 08:59

240509-kx4grahg7w 8

Analysis

max time kernel
467s
max time network
460s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
09/05/2024, 09:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://tria.ge/submit/file

Score

10^/10

Malware Config

Signatures

Suspicious use of NtCreateProcessExOtherParentProcess 2 IoCs

description	pid	Process	procid_target
PID 5408 created 464	5408	taskmgr.exe	155
PID 5408 created 464	5408	taskmgr.exe	155

Downloads MZ/PE file

Executes dropped EXE 3 IoCs

pid	Process
3712	CookieClickerHack.exe
464	Hydra.exe
1056	Melting.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
129	raw.githubusercontent.com
130	raw.githubusercontent.com

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-540404634-651139247-2967210625-1000\{DC3EA22F-C464-412B-BC87-BC8B0580AA22}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000_Classes\Local Settings	taskmgr.exe

NTFS ADS 3 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 637087.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 153893.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 408895.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2088	msedge.exe
2088	msedge.exe
3236	msedge.exe
3236	msedge.exe
2420	identity_helper.exe
2420	identity_helper.exe
2008	msedge.exe
2008	msedge.exe
916	msedge.exe
916	msedge.exe
6016	msedge.exe
6016	msedge.exe
6016	msedge.exe
6016	msedge.exe
5408	taskmgr.exe
5408	taskmgr.exe
5408	taskmgr.exe
5408	taskmgr.exe
5408	taskmgr.exe
5408	taskmgr.exe
5408	taskmgr.exe
5408	taskmgr.exe
5408	taskmgr.exe
5408	taskmgr.exe
5408	taskmgr.exe
5408	taskmgr.exe
5408	taskmgr.exe
5408	taskmgr.exe
5408	taskmgr.exe
5408	taskmgr.exe
5408	taskmgr.exe
5408	taskmgr.exe
5408	taskmgr.exe
5408	taskmgr.exe
5408	taskmgr.exe
5408	taskmgr.exe
5408	taskmgr.exe
5408	taskmgr.exe
5408	taskmgr.exe
5408	taskmgr.exe
5408	taskmgr.exe
5408	taskmgr.exe
5408	taskmgr.exe
5408	taskmgr.exe
5408	taskmgr.exe
5408	taskmgr.exe
5408	taskmgr.exe
5408	taskmgr.exe
5408	taskmgr.exe
5408	taskmgr.exe
5408	taskmgr.exe
5408	taskmgr.exe
5408	taskmgr.exe
5408	taskmgr.exe
5408	taskmgr.exe
5408	taskmgr.exe
5408	taskmgr.exe
5408	taskmgr.exe
5408	taskmgr.exe
5408	taskmgr.exe
5408	taskmgr.exe
5408	taskmgr.exe
5408	taskmgr.exe
5408	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5408	taskmgr.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 18 IoCs

pid	Process
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	5408	taskmgr.exe
Token: SeSystemProfilePrivilege	5408	taskmgr.exe
Token: SeCreateGlobalPrivilege	5408	taskmgr.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
5408	taskmgr.exe
5408	taskmgr.exe
5408	taskmgr.exe
5408	taskmgr.exe
5408	taskmgr.exe
5408	taskmgr.exe
5408	taskmgr.exe
5408	taskmgr.exe
5408	taskmgr.exe
5408	taskmgr.exe
5408	taskmgr.exe
5408	taskmgr.exe
5408	taskmgr.exe
5408	taskmgr.exe
5408	taskmgr.exe
5408	taskmgr.exe
5408	taskmgr.exe
5408	taskmgr.exe
5408	taskmgr.exe
5408	taskmgr.exe
5408	taskmgr.exe
5408	taskmgr.exe
5408	taskmgr.exe
5408	taskmgr.exe
5408	taskmgr.exe
5408	taskmgr.exe
5408	taskmgr.exe
5408	taskmgr.exe
5408	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
5408	taskmgr.exe
5408	taskmgr.exe
5408	taskmgr.exe
5408	taskmgr.exe
5408	taskmgr.exe
5408	taskmgr.exe
5408	taskmgr.exe
5408	taskmgr.exe
5408	taskmgr.exe
5408	taskmgr.exe
5408	taskmgr.exe
5408	taskmgr.exe
5408	taskmgr.exe
5408	taskmgr.exe
5408	taskmgr.exe
5408	taskmgr.exe
5408	taskmgr.exe
5408	taskmgr.exe
5408	taskmgr.exe
5408	taskmgr.exe
5408	taskmgr.exe
5408	taskmgr.exe
5408	taskmgr.exe
5408	taskmgr.exe
5408	taskmgr.exe
5408	taskmgr.exe
5408	taskmgr.exe
5408	taskmgr.exe
5408	taskmgr.exe
5408	taskmgr.exe
5408	taskmgr.exe
5408	taskmgr.exe
5408	taskmgr.exe
5408	taskmgr.exe
5408	taskmgr.exe
5408	taskmgr.exe
5408	taskmgr.exe
5408	taskmgr.exe
5408	taskmgr.exe
5408	taskmgr.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3236 wrote to memory of 4496	3236	msedge.exe	83
PID 3236 wrote to memory of 4496	3236	msedge.exe	83
PID 3236 wrote to memory of 1000	3236	msedge.exe	84
PID 3236 wrote to memory of 1000	3236	msedge.exe	84
PID 3236 wrote to memory of 1000	3236	msedge.exe	84
PID 3236 wrote to memory of 1000	3236	msedge.exe	84
PID 3236 wrote to memory of 1000	3236	msedge.exe	84
PID 3236 wrote to memory of 1000	3236	msedge.exe	84
PID 3236 wrote to memory of 1000	3236	msedge.exe	84
PID 3236 wrote to memory of 1000	3236	msedge.exe	84
PID 3236 wrote to memory of 1000	3236	msedge.exe	84
PID 3236 wrote to memory of 1000	3236	msedge.exe	84
PID 3236 wrote to memory of 1000	3236	msedge.exe	84
PID 3236 wrote to memory of 1000	3236	msedge.exe	84
PID 3236 wrote to memory of 1000	3236	msedge.exe	84
PID 3236 wrote to memory of 1000	3236	msedge.exe	84
PID 3236 wrote to memory of 1000	3236	msedge.exe	84
PID 3236 wrote to memory of 1000	3236	msedge.exe	84
PID 3236 wrote to memory of 1000	3236	msedge.exe	84
PID 3236 wrote to memory of 1000	3236	msedge.exe	84
PID 3236 wrote to memory of 1000	3236	msedge.exe	84
PID 3236 wrote to memory of 1000	3236	msedge.exe	84
PID 3236 wrote to memory of 1000	3236	msedge.exe	84
PID 3236 wrote to memory of 1000	3236	msedge.exe	84
PID 3236 wrote to memory of 1000	3236	msedge.exe	84
PID 3236 wrote to memory of 1000	3236	msedge.exe	84
PID 3236 wrote to memory of 1000	3236	msedge.exe	84
PID 3236 wrote to memory of 1000	3236	msedge.exe	84
PID 3236 wrote to memory of 1000	3236	msedge.exe	84
PID 3236 wrote to memory of 1000	3236	msedge.exe	84
PID 3236 wrote to memory of 1000	3236	msedge.exe	84
PID 3236 wrote to memory of 1000	3236	msedge.exe	84
PID 3236 wrote to memory of 1000	3236	msedge.exe	84
PID 3236 wrote to memory of 1000	3236	msedge.exe	84
PID 3236 wrote to memory of 1000	3236	msedge.exe	84
PID 3236 wrote to memory of 1000	3236	msedge.exe	84
PID 3236 wrote to memory of 1000	3236	msedge.exe	84
PID 3236 wrote to memory of 1000	3236	msedge.exe	84
PID 3236 wrote to memory of 1000	3236	msedge.exe	84
PID 3236 wrote to memory of 1000	3236	msedge.exe	84
PID 3236 wrote to memory of 1000	3236	msedge.exe	84
PID 3236 wrote to memory of 1000	3236	msedge.exe	84
PID 3236 wrote to memory of 2088	3236	msedge.exe	85
PID 3236 wrote to memory of 2088	3236	msedge.exe	85
PID 3236 wrote to memory of 2444	3236	msedge.exe	86
PID 3236 wrote to memory of 2444	3236	msedge.exe	86
PID 3236 wrote to memory of 2444	3236	msedge.exe	86
PID 3236 wrote to memory of 2444	3236	msedge.exe	86
PID 3236 wrote to memory of 2444	3236	msedge.exe	86
PID 3236 wrote to memory of 2444	3236	msedge.exe	86
PID 3236 wrote to memory of 2444	3236	msedge.exe	86
PID 3236 wrote to memory of 2444	3236	msedge.exe	86
PID 3236 wrote to memory of 2444	3236	msedge.exe	86
PID 3236 wrote to memory of 2444	3236	msedge.exe	86
PID 3236 wrote to memory of 2444	3236	msedge.exe	86
PID 3236 wrote to memory of 2444	3236	msedge.exe	86
PID 3236 wrote to memory of 2444	3236	msedge.exe	86
PID 3236 wrote to memory of 2444	3236	msedge.exe	86
PID 3236 wrote to memory of 2444	3236	msedge.exe	86
PID 3236 wrote to memory of 2444	3236	msedge.exe	86
PID 3236 wrote to memory of 2444	3236	msedge.exe	86
PID 3236 wrote to memory of 2444	3236	msedge.exe	86
PID 3236 wrote to memory of 2444	3236	msedge.exe	86
PID 3236 wrote to memory of 2444	3236	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://tria.ge/submit/file
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff54f946f8,0x7fff54f94708,0x7fff54f94718
  2⤵
  PID:4496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,770027128488434662,17404521504415107035,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2184 /prefetch:2
  2⤵
  PID:1000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2136,770027128488434662,17404521504415107035,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2236 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2136,770027128488434662,17404521504415107035,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2804 /prefetch:8
  2⤵
  PID:2444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,770027128488434662,17404521504415107035,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1
  2⤵
  PID:3060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,770027128488434662,17404521504415107035,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3356 /prefetch:1
  2⤵
  PID:2068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,770027128488434662,17404521504415107035,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4680 /prefetch:1
  2⤵
  PID:2372
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,770027128488434662,17404521504415107035,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5324 /prefetch:8
  2⤵
  PID:208
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,770027128488434662,17404521504415107035,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5324 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,770027128488434662,17404521504415107035,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5444 /prefetch:1
  2⤵
  PID:3956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,770027128488434662,17404521504415107035,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5552 /prefetch:1
  2⤵
  PID:680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,770027128488434662,17404521504415107035,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5472 /prefetch:1
  2⤵
  PID:1440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,770027128488434662,17404521504415107035,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5880 /prefetch:1
  2⤵
  PID:1580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,770027128488434662,17404521504415107035,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5480 /prefetch:1
  2⤵
  PID:5300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,770027128488434662,17404521504415107035,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5620 /prefetch:1
  2⤵
  PID:5308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,770027128488434662,17404521504415107035,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5476 /prefetch:1
  2⤵
  PID:5516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,770027128488434662,17404521504415107035,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3996 /prefetch:1
  2⤵
  PID:5688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,770027128488434662,17404521504415107035,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4912 /prefetch:1
  2⤵
  PID:5988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2136,770027128488434662,17404521504415107035,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=3980 /prefetch:8
  2⤵
  PID:4112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2136,770027128488434662,17404521504415107035,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=6104 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:2008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,770027128488434662,17404521504415107035,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5520 /prefetch:1
  2⤵
  PID:5428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,770027128488434662,17404521504415107035,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5532 /prefetch:1
  2⤵
  PID:5460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,770027128488434662,17404521504415107035,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5488 /prefetch:1
  2⤵
  PID:2012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2136,770027128488434662,17404521504415107035,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=6188 /prefetch:8
  2⤵
  PID:3604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,770027128488434662,17404521504415107035,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6344 /prefetch:1
  2⤵
  PID:6044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2136,770027128488434662,17404521504415107035,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6872 /prefetch:8
  2⤵
  PID:3164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2136,770027128488434662,17404521504415107035,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5776 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:916
- C:\Users\Admin\Downloads\CookieClickerHack.exe
  "C:\Users\Admin\Downloads\CookieClickerHack.exe"
  2⤵
  - Executes dropped EXE
  PID:3712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,770027128488434662,17404521504415107035,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6236 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:6016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,770027128488434662,17404521504415107035,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3004 /prefetch:1
  2⤵
  PID:3308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2136,770027128488434662,17404521504415107035,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=7024 /prefetch:8
  2⤵
  PID:5692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2136,770027128488434662,17404521504415107035,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3520 /prefetch:8
  2⤵
  PID:3736
- C:\Users\Admin\Downloads\Hydra.exe
  "C:\Users\Admin\Downloads\Hydra.exe"
  2⤵
  - Executes dropped EXE
  PID:464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,770027128488434662,17404521504415107035,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6924 /prefetch:1
  2⤵
  PID:5380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2136,770027128488434662,17404521504415107035,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6944 /prefetch:8
  2⤵
  PID:3624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2136,770027128488434662,17404521504415107035,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6460 /prefetch:8
  2⤵
  PID:3584
- C:\Users\Admin\Downloads\Melting.exe
  "C:\Users\Admin\Downloads\Melting.exe"
  2⤵
  - Executes dropped EXE
  PID:1056

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1924

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3080

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /7
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:5408

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5204

C:\Windows\System32\pb7nq5.exe
"C:\Windows\System32\pb7nq5.exe"
1⤵
PID:4492

C:\Windows\SysWOW64\werfault.exe
werfault.exe /h /shared Global\da90ee149a574361ab236036e647079f /t 116 /p 464
1⤵
PID:5892

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
2daa93382bba07cbc40af372d30ec576

SHA1
c5e709dc3e2e4df2ff841fbde3e30170e7428a94

SHA256
1826d2a57b1938c148bf212a47d947ed1bfb26cfc55868931f843ee438117f30

SHA512
65635cb59c81548a9ef8fdb0942331e7f3cd0c30ce1d4dba48aed72dbb27b06511a55d2aeaadfadbbb4b7cb4b2e2772bbabba9603b3f7d9c8b9e4a7fbf3d6b6b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ecdc2754d7d2ae862272153aa9b9ca6e

SHA1
c19bed1c6e1c998b9fa93298639ad7961339147d

SHA256
a13d791473f836edcab0e93451ce7b7182efbbc54261b2b5644d319e047a00a7

SHA512
cd4fb81317d540f8b15f1495a381bb6f0f129b8923a7c06e4b5cf777d2625c30304aee6cc68aa20479e08d84e5030b43fbe93e479602400334dfdd7297f702f2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
216B

MD5
4a9be35399baa7a2ccda03592b539446

SHA1
04228e3fe88ba8f3027ba8237bc3a9a8e614f211

SHA256
93c0ab232e2e067389c12f7fc417a531abdb142678b7af848e60da74e28a853c

SHA512
2796d67adf8c16788b3a819a92693ab81c8c00127cda6898d753a48e36187b589a25037d996743234993bca3735d78038833420d166ba6b02aea66738982ae4c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
af25bf4df8c39a8fc2e0a30591efbe9e

SHA1
302ae94cad511baf5c2f742d2f4dd6c8633f1f01

SHA256
8fd94a80e5a3ced556205066510a46709461aad357e2e7175a16ced10c51345b

SHA512
7916f10787ac9978f5b8928bcd6c4a817af4e57c56f4a8b7a20c738c192586b11a974e06f4a5edc955aaf0f295df00376ed3564860cf8280e82af34781bba95c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
ae9f310c9a6dde794903bf955048e57b

SHA1
cbce2ffee6755b86244f507011b0a3eb50e06596

SHA256
3ad406cc1a48053383c6c95cf7030781ebbaf7e03246eba86bd1f819fdbbb7af

SHA512
7795e219230f986639a0bcfb8738d45c7094672ba210463685a4d6d9b57f0792f8c83036716b1199b341ee310ec2a03efdb21b060acd3798d031a46b9c5108e4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
20780dd5573a2ad47fe34cbb74ee35dc

SHA1
57f1670435d80fea1283738a9c7d707e7a63dae3

SHA256
a4963a5516f3228ae0ce97cf67596d46a109f3bdf161aecb4eead134962dfa47

SHA512
75b0dd865eabbbf27a6563345ddf315fad324041f3956cd6ab92d8127ae433e089eecd1a68a78278e0c196c36be6a413b31950baa113d331655e94c18e382104

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
981B

MD5
f82bac1b7951c16eea6a442b98e8db8f

SHA1
e87e7303ce9a11f352cbcb552646883f4e0deca8

SHA256
9bcc500f81e618f3793b201b6c834f6be1877cc33870c27cbcdf3a29973012e6

SHA512
d7201f2ef515842da2bb14a4373b44944c67e5a215f9af37101038a6588ea47f1a24094c10fecedb778f031bcb10d292b1fa0f777215171e5b0b2f4a3b5264f9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
a375c1932ecab4524eac756b761c8a37

SHA1
5383fc73f5d32af41bcf21e31d0681ab2f19c227

SHA256
2f2a063804778712c1d2d8f347509682fd08db542aa3ff0bebeceec44bb016b3

SHA512
b69804b8e0ef2160432fb183e0be14135465adfbb55fc0d0bc4775b179a966bebdb42a36056007c40c872d809cf3bd7fd9e9240615df0a3bdc183fc14ae6443a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
584ecffdaa1a2c20a95defc374942f44

SHA1
d8156e74e7ec01b18d110e206bcf32b9bb7fe577

SHA256
c70e3dbc7bba9dc5bf87041f5d72bbb46f46820e4321adc01393831ef792d39c

SHA512
c729062d5df85706d2a80b8028592d691c882726d020be317c4be40bff4a2e824bc56469e2438b48f90ef0d375fc8f88fe5c47224b502e94e146d954a906b66e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
9a403619c55fdfd558a9261192025a99

SHA1
d21c5ae07db2792c65ae5908c70a2c64098afa0b

SHA256
800a3f8d81ea3548579ea91484ca79a26d25189d3069ff1342b1474a73a9718f

SHA512
f0070526c3fc4c32c32a4af78e93a2494a04ee99abb3fe41d1a76f616db4cff3072c0fb8e68b3ca83d1352da98e750483f6e863d50d33977a600a737e755aeef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
69ed32dc0c65cf8f2cd89a774840dd6e

SHA1
5f3c1671dc44e30471824059609974e40c0ca4ca

SHA256
aac67b02490a3492c53452c53acf9b1b0d43b532c91ee9549ae611aa7a21c20c

SHA512
d282b788df4de78036537ee9a559eec61d647acfc3fc3201b7d463b4554d1447e5b5bbf419dbde7b4613de357713a27ca1c1a0f95b2f9b1d4d008cc256cc98b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
e3d336228fcde90032e37f48cff4b070

SHA1
42740836e0f70dc70678e942457fe49aeb35ae96

SHA256
3c89598b9783ad886d622a495579b60b57d7978af2b33dbc0fea031b9158f17b

SHA512
feab7d53d289087b24f57c8129854ccd2af52a5a56f7b787cb754fc59a80144d482ddd1a6791557c125ea596448bf15c8683f9a18b9ffdb7364262d58342a891

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
21f11cebf1f3e133de65bf2f052c0065

SHA1
3264cb9d582d8f0e19fce1d8edf109540f22c48c

SHA256
08473485d628e4768daa314d4a382bff1302e658f2f6d1ee6e5a041da76c590b

SHA512
76df67b2c037511626530a82306b8336b4fb47753899174c6880cccb4924bae9b0e306f581e45ca084a255e845c92bb19470528597f9dd92acd0735f8aa06e00

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
d08f4b4720a83a5838d461c488ce1a44

SHA1
c1c54c155b84f2dfafc78dc2a1fb0bfc9221edb6

SHA256
7ea1af3249d653fea5c0bd13c278250b4359e4da409da81680023c9e0b3863e4

SHA512
345f64d1607c157509b6158b01cfacd8e119d5a1161979f1a559515db80fd592ce539e4c407cf12b2e862108b0fa871890bebd84b907d866d9a6c4eb2a9980b5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
706B

MD5
81fbd3b874dcb20b2cd4d68ceefbff2a

SHA1
04db9fc0746f4d3f55992d73124e5be579818645

SHA256
04fd9a044c80110f4d1eb72dc9c05e0e03a3439be6cc0028a42d084226d58212

SHA512
244b28e3cb07bf9cc5efd8937cba62d618f758d1c2f6f35c1c31cd239ced18a51c5be364ddf37667425aa0438c8a8ca93336c192ab5c1102a0a1be8f33246f12

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
db3e700c70aafff3027c811233d78b14

SHA1
d36aefc1d67d61fe1b206788b88191b14af56984

SHA256
4a05947e1aff0b91b17eda7b06849870109476993bde41a2b0f311bea701d1be

SHA512
845da3c2b626deda8150b838d8577eb4b082bf20a1c6faab93539f3e3b8016b2eba615c5e61a986f2af910f51afae3e8b721774b95033211baa166338825d2ff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
a6050c094adab6a6f0756b4df1db27a2

SHA1
4cc6128ec5fdaeaae6f55120bbeaaca011ae385f

SHA256
d4a22da88c1333d29213b8dcc0c9bbd9b069860cf14b285af78b3ea26889d882

SHA512
6b32a25526bcc77f7b3d0b8b1889ccf6c13fcb769ff486560eaa8f3627dd345f43b952248c0a650650bb9a4fdc5468216b798031e242ce6e16f3c2e273d86231

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57beeb.TMP

Filesize
204B

MD5
ebb655b1fbabb25240727ca8aff10877

SHA1
b02521baa44b43fcabd5b12cc0e038e4bc7351c8

SHA256
9d619ab9334497e3c8e1721b7226b057f3ad887e44b12480e935706528686652

SHA512
83fc2897bfd775308ac94a2e3580a0d832501a674421bddce7d4efcf999c3feb42aa7eb46bf862824dabe59d0e4fd5586c0f746a728ff4583f816689695335c2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
4b901833dced4cb1e047d55ec9732bbe

SHA1
3e4289553099da756e3221be28acd81ea6b739ad

SHA256
e4f33697a58742851c5cf0571e456f7437a08854edd1a714dcb85f7d6ed7da75

SHA512
5fe5ec287fe6dbba24a66094645166d428e74a0f8fb541b514dc1bce487eb390b1d5f541221d7cc318b3fea23230e9febe0903517765d658bf1c38386b30c8be

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
891d316e4d6f9cb8a38bf3603c765a7d

SHA1
95a0d4135b1650c4452b7ed6085c70e4779fed95

SHA256
6d5622d67fcd192f61758414572ec0c4621d57dee3ae29137b229af2d0506fc7

SHA512
5e9f0557b455a0d07c660b66e84d603ac19d189d91f94ff1a3fe50dc1c9aa2727e73e0810b55b39307b38b882c7c9394f163c0266b7da9e4748b9756de7c43ac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
7cfee84c8fe9df151f40c7bd77b274a7

SHA1
7b922bef94e4b2fc725e956fe0d2d8dcaa93cdf7

SHA256
01d879864fddf8a0a77943cb07551e0ac3460aaac77a2298be6be561c9d8efda

SHA512
9358239346d444328ae86e61ade5faf886e9a1f89fc889a798b1a765c9924eba97d52bd1bebc25320ad28d4941092ce4c7f75c28c64b75edb0b3bb9765d7fee3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
143614a477d61166c67855eef5c3e2ab

SHA1
36db2caab1684f2501d1aaf7a383952f8b82650a

SHA256
bf472b43f0a925e35e132468bf940ca511927721939e23d77bb18a99b2cba4c6

SHA512
4fdda081c3cddce2e086725ab259606fa0744cf0b93a3486461eadd7bfff379f670d9781bd2f6f6d19198afa8cc3ff25ab797d821c571cbd23317d2b96fc58e1

Download Submit
C:\Users\Admin\Downloads\Melting.exe

Filesize
12KB

MD5
833619a4c9e8c808f092bf477af62618

SHA1
b4a0efa26f790e991cb17542c8e6aeb5030d1ebf

SHA256
92a284981c7ca33f1af45ce61738479fbcbb5a4111f5498e2cb54931c8a36c76

SHA512
4f231fc16339d568b5cf9353133aeae835eb262dab68bc80d92f37b43df64dce4fae0e913cbaa3bb61351a759aeecf9d280bc5779b0853c980559a654d6cca11

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 153893.crdownload

Filesize
43KB

MD5
b2eca909a91e1946457a0b36eaf90930

SHA1
3200c4e4d0d4ece2b2aadb6939be59b91954bcfa

SHA256
0b6c0af51cde971b3e5f8aa204f8205418ab8c180b79a5ac1c11a6e0676f0f7c

SHA512
607d20e4a46932c7f4d9609ef9451e2303cd79e7c4778fe03f444e7dc800d6de7537fd2648c7c476b9f098588dc447e8c39d8b21cd528d002dfa513a19c6ebbf

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 637087.crdownload

Filesize
68KB

MD5
bc1e7d033a999c4fd006109c24599f4d

SHA1
b927f0fc4a4232a023312198b33272e1a6d79cec

SHA256
13adae722719839af8102f98730f3af1c5a56b58069bfce8995acd2123628401

SHA512
f5d9b8c1fd9239894ec9c075542bff0bcef79871f31038e627ae257b8c1db9070f4d124448a78e60ccc8bc12f138102a54825e9d7647cd34832984c7c24a6276

Download Submit
memory/464-671-0x0000000004D80000-0x0000000004D8A000-memory.dmp

Filesize
40KB

Download
memory/464-668-0x00000000002E0000-0x00000000002F0000-memory.dmp

Filesize
64KB

Download
memory/464-669-0x00000000051B0000-0x0000000005754000-memory.dmp

Filesize
5.6MB

Download
memory/464-670-0x0000000004CE0000-0x0000000004D72000-memory.dmp

Filesize
584KB

Download
memory/3712-538-0x000000001C180000-0x000000001C64E000-memory.dmp

Filesize
4.8MB

Download
memory/3712-541-0x000000001C950000-0x000000001C99C000-memory.dmp

Filesize
304KB

Download
memory/3712-537-0x000000001BC00000-0x000000001BCA6000-memory.dmp

Filesize
664KB

Download
memory/3712-539-0x000000001C6F0000-0x000000001C78C000-memory.dmp

Filesize
624KB

Download
memory/3712-540-0x0000000001440000-0x0000000001448000-memory.dmp

Filesize
32KB

Download
memory/5408-604-0x000001E53C080000-0x000001E53C081000-memory.dmp

Filesize
4KB

Download
memory/5408-608-0x000001E53C080000-0x000001E53C081000-memory.dmp

Filesize
4KB

Download
memory/5408-609-0x000001E53C080000-0x000001E53C081000-memory.dmp

Filesize
4KB

Download
memory/5408-610-0x000001E53C080000-0x000001E53C081000-memory.dmp

Filesize
4KB

Download
memory/5408-611-0x000001E53C080000-0x000001E53C081000-memory.dmp

Filesize
4KB

Download
memory/5408-612-0x000001E53C080000-0x000001E53C081000-memory.dmp

Filesize
4KB

Download
memory/5408-613-0x000001E53C080000-0x000001E53C081000-memory.dmp

Filesize
4KB

Download
memory/5408-614-0x000001E53C080000-0x000001E53C081000-memory.dmp

Filesize
4KB

Download
memory/5408-602-0x000001E53C080000-0x000001E53C081000-memory.dmp

Filesize
4KB

Download
memory/5408-603-0x000001E53C080000-0x000001E53C081000-memory.dmp

Filesize
4KB

Download