5834f6ae3522131494c225a93c30173430be80b5c144519b265395c54f35172b

Analysis

max time kernel
1761s
max time network
1797s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
11-08-2024 04:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

FreePiano/freepiano.exe
Size

1.3MB
MD5

0742c857b186d7178a6f13c16765086c
SHA1

082a0aebe67a8991a968972127d2ee8bad6bab1d
SHA256

f53c7cdf9fa04426f4e1100d7347d35eeb4fbd7c6795651412d229fa77ab8698
SHA512

d2d6877092dfb2483a0b9efa2b7774178185c9c477b66baaaf38b30b672f023008e2e8a2289f205f3c73ead24f5360b578f6a56100c9687422b060f1cb5c673d
SSDEEP

24576:GVGj/JdqXfc9NubYNr7dxGycjkUTZZWIDR7p35DNy09x/:GVGjhdjTWarBxGYUTbW0d57V

Score

6^/10

discovery

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
1	raw.githubusercontent.com
57	raw.githubusercontent.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Google Chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 36 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	OpenWith.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\SniffedFolderType = "Generic"	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-970747758-134341002-3585657277-1000\{A557D11A-8AB3-4003-B062-F58664833F37}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\1\NodeSlot = "3"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\Local Settings	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\1 = 8c0031000000000002598f7e110050524f4752417e310000740009000400efbec552596102598f7e2e0000003f0000000000010000000000000000004a00000000004e142601500072006f006700720061006d002000460069006c0065007300000040007300680065006c006c00330032002e0064006c006c002c002d0032003100370038003100000018000000	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\1	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\Local Settings	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = 0100000000000000ffffffff	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\1\MRUListEx = ffffffff	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\Local Settings	OpenWith.exe

NTFS ADS 3 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\You-Are-An-Idiot-main.zip:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\README.md:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\You-are-an-idiot.zip:Zone.Identifier	msedge.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
3252	msedge.exe
3252	msedge.exe
2412	msedge.exe
2412	msedge.exe
4836	msedge.exe
4836	msedge.exe
1148	msedge.exe
1148	msedge.exe
3428	identity_helper.exe
3428	identity_helper.exe
4696	msedge.exe
4696	msedge.exe
2396	msedge.exe
2396	msedge.exe
832	msedge.exe
832	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
1360	OpenWith.exe
3596	OpenWith.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 23 IoCs

pid	Process
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	4708	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	4708	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe

Suspicious use of SetWindowsHookEx 22 IoCs

pid	Process
3108	freepiano.exe
2432	OpenWith.exe
2432	OpenWith.exe
2432	OpenWith.exe
2432	OpenWith.exe
2432	OpenWith.exe
1360	OpenWith.exe
1360	OpenWith.exe
1360	OpenWith.exe
1360	OpenWith.exe
1360	OpenWith.exe
1360	OpenWith.exe
1360	OpenWith.exe
1360	OpenWith.exe
1360	OpenWith.exe
1360	OpenWith.exe
1360	OpenWith.exe
1360	OpenWith.exe
3596	OpenWith.exe
2244	Google Chrome.exe
2244	Google Chrome.exe
3108	freepiano.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3252 wrote to memory of 4772	3252	msedge.exe	88
PID 3252 wrote to memory of 4772	3252	msedge.exe	88
PID 3252 wrote to memory of 4212	3252	msedge.exe	89
PID 3252 wrote to memory of 4212	3252	msedge.exe	89
PID 3252 wrote to memory of 4212	3252	msedge.exe	89
PID 3252 wrote to memory of 4212	3252	msedge.exe	89
PID 3252 wrote to memory of 4212	3252	msedge.exe	89
PID 3252 wrote to memory of 4212	3252	msedge.exe	89
PID 3252 wrote to memory of 4212	3252	msedge.exe	89
PID 3252 wrote to memory of 4212	3252	msedge.exe	89
PID 3252 wrote to memory of 4212	3252	msedge.exe	89
PID 3252 wrote to memory of 4212	3252	msedge.exe	89
PID 3252 wrote to memory of 4212	3252	msedge.exe	89
PID 3252 wrote to memory of 4212	3252	msedge.exe	89
PID 3252 wrote to memory of 4212	3252	msedge.exe	89
PID 3252 wrote to memory of 4212	3252	msedge.exe	89
PID 3252 wrote to memory of 4212	3252	msedge.exe	89
PID 3252 wrote to memory of 4212	3252	msedge.exe	89
PID 3252 wrote to memory of 4212	3252	msedge.exe	89
PID 3252 wrote to memory of 4212	3252	msedge.exe	89
PID 3252 wrote to memory of 4212	3252	msedge.exe	89
PID 3252 wrote to memory of 4212	3252	msedge.exe	89
PID 3252 wrote to memory of 4212	3252	msedge.exe	89
PID 3252 wrote to memory of 4212	3252	msedge.exe	89
PID 3252 wrote to memory of 4212	3252	msedge.exe	89
PID 3252 wrote to memory of 4212	3252	msedge.exe	89
PID 3252 wrote to memory of 4212	3252	msedge.exe	89
PID 3252 wrote to memory of 4212	3252	msedge.exe	89
PID 3252 wrote to memory of 4212	3252	msedge.exe	89
PID 3252 wrote to memory of 4212	3252	msedge.exe	89
PID 3252 wrote to memory of 4212	3252	msedge.exe	89
PID 3252 wrote to memory of 4212	3252	msedge.exe	89
PID 3252 wrote to memory of 4212	3252	msedge.exe	89
PID 3252 wrote to memory of 4212	3252	msedge.exe	89
PID 3252 wrote to memory of 4212	3252	msedge.exe	89
PID 3252 wrote to memory of 4212	3252	msedge.exe	89
PID 3252 wrote to memory of 4212	3252	msedge.exe	89
PID 3252 wrote to memory of 4212	3252	msedge.exe	89
PID 3252 wrote to memory of 4212	3252	msedge.exe	89
PID 3252 wrote to memory of 4212	3252	msedge.exe	89
PID 3252 wrote to memory of 4212	3252	msedge.exe	89
PID 3252 wrote to memory of 4212	3252	msedge.exe	89
PID 3252 wrote to memory of 2412	3252	msedge.exe	90
PID 3252 wrote to memory of 2412	3252	msedge.exe	90
PID 3252 wrote to memory of 3552	3252	msedge.exe	91
PID 3252 wrote to memory of 3552	3252	msedge.exe	91
PID 3252 wrote to memory of 3552	3252	msedge.exe	91
PID 3252 wrote to memory of 3552	3252	msedge.exe	91
PID 3252 wrote to memory of 3552	3252	msedge.exe	91
PID 3252 wrote to memory of 3552	3252	msedge.exe	91
PID 3252 wrote to memory of 3552	3252	msedge.exe	91
PID 3252 wrote to memory of 3552	3252	msedge.exe	91
PID 3252 wrote to memory of 3552	3252	msedge.exe	91
PID 3252 wrote to memory of 3552	3252	msedge.exe	91
PID 3252 wrote to memory of 3552	3252	msedge.exe	91
PID 3252 wrote to memory of 3552	3252	msedge.exe	91
PID 3252 wrote to memory of 3552	3252	msedge.exe	91
PID 3252 wrote to memory of 3552	3252	msedge.exe	91
PID 3252 wrote to memory of 3552	3252	msedge.exe	91
PID 3252 wrote to memory of 3552	3252	msedge.exe	91
PID 3252 wrote to memory of 3552	3252	msedge.exe	91
PID 3252 wrote to memory of 3552	3252	msedge.exe	91
PID 3252 wrote to memory of 3552	3252	msedge.exe	91
PID 3252 wrote to memory of 3552	3252	msedge.exe	91

C:\Users\Admin\AppData\Local\Temp\FreePiano\freepiano.exe
"C:\Users\Admin\AppData\Local\Temp\FreePiano\freepiano.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:3108

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004D4 0x00000000000004EC
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4708

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7fffaab83cb8,0x7fffaab83cc8,0x7fffaab83cd8
  2⤵
  PID:4772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1940,3931824718247976110,11366581780788655231,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1952 /prefetch:2
  2⤵
  PID:4212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1940,3931824718247976110,11366581780788655231,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2020 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1940,3931824718247976110,11366581780788655231,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2556 /prefetch:8
  2⤵
  PID:3552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,3931824718247976110,11366581780788655231,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3340 /prefetch:1
  2⤵
  PID:4740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,3931824718247976110,11366581780788655231,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3356 /prefetch:1
  2⤵
  PID:4224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,3931824718247976110,11366581780788655231,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3944 /prefetch:1
  2⤵
  PID:3548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,3931824718247976110,11366581780788655231,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4952 /prefetch:1
  2⤵
  PID:3496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1940,3931824718247976110,11366581780788655231,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3500 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,3931824718247976110,11366581780788655231,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3936 /prefetch:1
  2⤵
  PID:420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,3931824718247976110,11366581780788655231,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3500 /prefetch:1
  2⤵
  PID:3536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,3931824718247976110,11366581780788655231,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3944 /prefetch:1
  2⤵
  PID:336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,3931824718247976110,11366581780788655231,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5316 /prefetch:1
  2⤵
  PID:872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,3931824718247976110,11366581780788655231,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5348 /prefetch:1
  2⤵
  PID:456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,3931824718247976110,11366581780788655231,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5184 /prefetch:1
  2⤵
  PID:2768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,3931824718247976110,11366581780788655231,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5076 /prefetch:1
  2⤵
  PID:4084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,3931824718247976110,11366581780788655231,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3372 /prefetch:1
  2⤵
  PID:2408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1940,3931824718247976110,11366581780788655231,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5648 /prefetch:8
  2⤵
  PID:4088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=1940,3931824718247976110,11366581780788655231,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5660 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:1148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,3931824718247976110,11366581780788655231,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5832 /prefetch:1
  2⤵
  PID:4768
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1940,3931824718247976110,11366581780788655231,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5008 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,3931824718247976110,11366581780788655231,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5064 /prefetch:1
  2⤵
  PID:3128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1940,3931824718247976110,11366581780788655231,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6724 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:4696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,3931824718247976110,11366581780788655231,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6904 /prefetch:1
  2⤵
  PID:4000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1940,3931824718247976110,11366581780788655231,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6920 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:2396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,3931824718247976110,11366581780788655231,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6012 /prefetch:1
  2⤵
  PID:1920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1940,3931824718247976110,11366581780788655231,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5772 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1940,3931824718247976110,11366581780788655231,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=2624 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,3931824718247976110,11366581780788655231,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7004 /prefetch:1
  2⤵
  PID:8
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,3931824718247976110,11366581780788655231,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3832 /prefetch:1
  2⤵
  PID:2244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,3931824718247976110,11366581780788655231,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5192 /prefetch:1
  2⤵
  PID:4992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,3931824718247976110,11366581780788655231,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6912 /prefetch:1
  2⤵
  PID:984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,3931824718247976110,11366581780788655231,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6828 /prefetch:1
  2⤵
  PID:3784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,3931824718247976110,11366581780788655231,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5212 /prefetch:1
  2⤵
  PID:3588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,3931824718247976110,11366581780788655231,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7008 /prefetch:1
  2⤵
  PID:380

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3892

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:868

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1448

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2432

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1360

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:3596

C:\Users\Admin\AppData\Local\Temp\Temp1_You-are-an-idiot.zip\Google Chrome.exe
"C:\Users\Admin\AppData\Local\Temp\Temp1_You-are-an-idiot.zip\Google Chrome.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2244

C:\Windows\SysWOW64\werfault.exe
werfault.exe /h /shared Global\ac64bf472c464a269817ae5eb91244d1 /t 5036 /p 2244
1⤵
PID:3648

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
1⤵
PID:560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7fffaab83cb8,0x7fffaab83cc8,0x7fffaab83cd8
  2⤵
  PID:4752

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004D4 0x00000000000004EC
1⤵
PID:4780

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a8276eab0f8f0c0bb325b5b8c329f64f

SHA1
8ce681e4056936ca8ccd6f487e7cd7cccbae538b

SHA256
847f60e288d327496b72dbe1e7aa1470a99bf27c0a07548b6a386a6188cd72da

SHA512
42f91bf90e92220d0731fa4279cc5773d5e9057a9587f311bee0b3f7f266ddceca367bd0ee7f1438c3606598553a2372316258c05e506315e4e11760c8f13918

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
058032c530b52781582253cb245aa731

SHA1
7ca26280e1bfefe40e53e64345a0d795b5303fab

SHA256
1c3a7192c514ef0d2a8cf9115cfb44137ca98ec6daa4f68595e2be695c7ed67e

SHA512
77fa3cdcd53255e7213bb99980049e11d6a2160f8130c84bd16b35ba9e821a4e51716371526ec799a5b4927234af99e0958283d78c0799777ab4dfda031f874f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000002

Filesize
62KB

MD5
c3c0eb5e044497577bec91b5970f6d30

SHA1
d833f81cf21f68d43ba64a6c28892945adc317a6

SHA256
eb48be34490ec9c4f9402b882166cd82cd317b51b2a49aae75cdf9ee035035eb

SHA512
83d3545a4ed9eed2d25f98c4c9f100ae0ac5e4bc8828dccadee38553b7633bb63222132df8ec09d32eb37d960accb76e7aab5719fc08cc0a4ef07b053f30cf38

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000003

Filesize
67KB

MD5
a074f116c725add93a8a828fbdbbd56c

SHA1
88ca00a085140baeae0fd3072635afe3f841d88f

SHA256
4cdcda7d8363be5bc824064259780779e7c046d56399c8a191106f55ce2ed8a6

SHA512
43ed55cda35bde93fc93c408908ab126e512c45611a994d7f4e5c85d4f2d90d573066082cb7b8dffce6a24a1f96cd534586646719b214ac7874132163faa5f28

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000004

Filesize
41KB

MD5
a7ee007fb008c17e73216d0d69e254e8

SHA1
160d970e6a8271b0907c50268146a28b5918c05e

SHA256
414024b478738b35312a098bc7f911300b14396d34718f78886b5942d9afe346

SHA512
669bec67d3fc1932a921dd683e6acfdf462b9063e1726770bae8740d83503a799c2e30030f2aca7ec96df0bfd6d8b7f999f8296ee156533302161eb7c9747602

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000005

Filesize
19KB

MD5
2e86a72f4e82614cd4842950d2e0a716

SHA1
d7b4ee0c9af735d098bff474632fc2c0113e0b9c

SHA256
c1334e604dbbffdf38e9e2f359938569afe25f7150d1c39c293469c1ee4f7b6f

SHA512
7a5fd3e3e89c5f8afca33b2d02e5440934e5186b9fa6367436e8d20ad42b211579225e73e3a685e5e763fa3f907fc4632b9425e8bd6d6f07c5c986b6556d47b1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000006

Filesize
63KB

MD5
710d7637cc7e21b62fd3efe6aba1fd27

SHA1
8645d6b137064c7b38e10c736724e17787db6cf3

SHA256
c0997474b99524325dfedb5c020436e7ea9f9c9a1a759ed6daf7bdd4890bdc2b

SHA512
19aa77bed3c441228789cf8f931ca6194cc8d4bc7bb85d892faf5eaeda67d22c8c3b066f8ceda8169177da95a1fe111bd3436ceeaf4c784bd2bf96617f4d0c44

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000008

Filesize
88KB

MD5
b38fbbd0b5c8e8b4452b33d6f85df7dc

SHA1
386ba241790252df01a6a028b3238de2f995a559

SHA256
b18b9eb934a5b3b81b16c66ec3ec8e8fecdb3d43550ce050eb2523aabc08b9cd

SHA512
546ca9fb302bf28e3a178e798dd6b80c91cba71d0467257b8ed42e4f845aa6ecb858f718aac1e0865b791d4ecf41f1239081847c75c6fb3e9afd242d3704ad16

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000009

Filesize
1.2MB

MD5
9f8f80ca4d9435d66dd761fbb0753642

SHA1
5f187d02303fd9044b9e7c74e0c02fe8e6a646b7

SHA256
ab481b8b19b3336deda1b9ad4680cce4958152c9f9daa60c7bd8eb6786887359

SHA512
9c0de8e5bf16f096bf781189d813eeb52c3c8ec73fc791de10a8781e9942de06ed30ff5021ab7385c98686330049e3e610adc3e484e12ef807eec58607cfae63

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index

Filesize
3KB

MD5
cbb9e89ef3b0f041ff5931eef2e9db36

SHA1
bcb12d87f09b400634f25ed680d39dbc7e40ec55

SHA256
9c5b292c916afd33b6a5d7812e78196664bb48c75375d6cbdfce76722e7de526

SHA512
23a134c88d2a369b2097af0b48df04c4b6d305deee936a2764dbf32831ec0d0696e411fa0fc121cab73a3b8d1f45f0a9530e53002b0ed9fd27aa32594ff29716

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
2a94ddb61dad6d931d1e1000e8f9f151

SHA1
9a4c046cf26daa85f41c298b4507868e057ac035

SHA256
2df874e2366f5cffc803e5b65dbf308405d557f69f3095bd3952658ccd1d9069

SHA512
0a3cd1fc9e86813238fbc031a5e9914824c6015be7bef0b72ff4efe30249714f4195e2d9adff82966b04d2f4841455675a4947c89553356e8996c2bcdd1ce833

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
1507cb471456ea5714faa28969083900

SHA1
7e68cad0eec377eacc53e8395d7f63e2268983f0

SHA256
45fb1b545596ca4ef87f8c74e394ecc530c173853f2cfc205ec9d88a368a3e9d

SHA512
7663d4905d210b2d6ab92d438b6e9de6eca018eafe4c382aaa38f74ae966e83a1f70456eef6f72b64f97e84a15a0bbc774101878ef1903bbddd7c02cc3e01653

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
666fce094fa96e8d2186a3394c435fdb

SHA1
1f26b71ff65ada8c0b067c1a2aa0523ded2633bd

SHA256
30871ba064b6442bf1984e398489c1212c3292013d8ef3017a164affd46bf250

SHA512
ffd121a5520d7b6811047adcf7bd34197bf09cfa6e08deabbd87ac3a3ef2819d2f667f24d15d23e9e19c976c195eed4a6252a5d55635b8d6508ec3df943011b7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
790B

MD5
3a997c6dfbeb01676b468b486eeb7a0a

SHA1
c7401acc6077b8bb37e103034a64ab6e9fa5ca52

SHA256
025a2156b138c935a3b1d36cb72084168d9382b0275c2615392d68a70a111a88

SHA512
bc0e71ddeb4beac257c9884d0abc4a0e48a2c8fcc1c12ca74b3ae4f10137c08265806180cf1c8685c54289a407749a2e22d9e292c878114fab44d2c860cae3f4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
2ae65dab6c2c39b29f346736f9e03699

SHA1
2fa110d70a3bf5f1640f398a63c38523cca71065

SHA256
bd8227a6c3b6eac027d4a4870ff3e15478c9ddb2a99de219dcc45755e17109b7

SHA512
3023d952dcf6feff63b8484d3cc45abb3862130b95568443a0bc9102b410185e54b1b94f2fdfa5125acfaee093930260151138e1f7a80aac5f3753f8391cfad5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
873B

MD5
a4744b7e0f5144460b293544c5ca4f2e

SHA1
352a3a4a98a6858a6ff85fb24714bdafd1a626a5

SHA256
5d1f07bdd568af94cefe66bba644ec63840a46fd7292f12f9a6442b9cbb19173

SHA512
7c9ed6bd170cec00d79553a30ecd758e71249b2b464a5c9aecf1f8f880e32883508b66c05266696d1060fffcdb494d1619dde8d1f4e8d187cd4f11f9349ce036

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
a2e1ce7a5263c5c8bbfba03154a212a0

SHA1
75a3f55e67333dad96bcd5531d130607fe799b28

SHA256
ef6b4204190b2eed66c3265900b3787fcfe050fd40e3c5b33ba626397ec21dc7

SHA512
70a8f513e359580d4dbf93bc0e58898fd1aab362cfc0b6f209cd755055636294c05769f99729df88494277dd8c2d2dc4bfc1dc33dce992a813e8b2f373ba736f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
b09a69b18f5d3684b6b185ef1d69d6ee

SHA1
288bb07fbdc3bbf786884638e23de001fd18ffe9

SHA256
137f02ad6640fd7f58502852aab4532ca584cb1af1c5fe1cde369727cf168de4

SHA512
ca6844fdcadf7f9a2dcb181775083c2f67572d1a45ea5506e414e64911a448bede15f996ed125925c35ff6f3548171a1e0823538788bb264de45dcf0f4496ab5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
147b9631605b4aa365f75fc8ca1ac1ed

SHA1
189e364158d1f2fb1576c84b55289342ca8dfc19

SHA256
8fc26cf1e2a6ca81984a75ca4d9e4f85d8fc50a5f7bab40a0d9d4c021eb7e7de

SHA512
d0242d1682bc33314f7917774befc7adcd0fc215f9756d2e604b59efcb1d509bdf29cf3678a2a9e577be5f04bd607b6f833ebb6b60f3cc123216fc0edab833dd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
ec8843b6464705a3e395b85bdf58c7f3

SHA1
8e71290a084200baccbde1b71d0dd5fc7c5b83ab

SHA256
1a0a3d4f27975907c4029d98a6d4f601ce77c49ed3f5447f6e800e0e4fd9ee08

SHA512
b72cef617b1dc2b87fa1982692c20ea38203e3add08fcc7ac9456ae28d785e529c260b56d4bdee7777f9402c1ed82bcad78ee9bd6710b2fa62e43c2d666bb336

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
c828ca05025a1e940ff75d87b8761d30

SHA1
9d3a831505cd3459272b8a0dcca56af5525a4ed4

SHA256
83438530f8743e99c2fa8fb0023d568f2be9c81db7e1e8f17024c9e9d9175db8

SHA512
7e0cb02970876ac4bb33045ce85e327a708376c2ed6385bd78e39959b31a07dd0be330f64436c43eebb0ea3996a10162c8090eec08ab65ce736773fbe362f8ae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
b717bb0eef113a020f0f08c67bc3ad26

SHA1
705db389594d5c9083647e4eccf9cf8feb577184

SHA256
83be2734c7516781f5ec963c47a2bb6134e3b2fcb28a2f01add2c32c064618d0

SHA512
1c0da849ed1d9874f2d29a2c6cb59acca94b172a4722c5e89cfdb0df48c67d013cc2a488c28a299f03fcfc14c6b7f8f4d62d900352b9402e013f0f8712792d39

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
3c387da2118d5b19600559f7de18879c

SHA1
54b22fec8c520a3bc2e0a288a6a1f4dd86c37257

SHA256
986bed3b6fb92cd8a38210ac35fb519f889987973b493136f33621d6ddbcb836

SHA512
f64b42db30093b316b428bef9fe950741f341cbd80104322aa082dc4da0eb5b31568c274a3ac75d3d1fe869b9cac9d894ee5994c555f4f0df16313f46000e48c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
1a0c1ce3ff368c6a59cc9c3b1d2bafc5

SHA1
f61605d452803ae76a465b2ca7087178a9666716

SHA256
4d8d12cb8f199cba89cbd8743286c302d8936940326b3837291d3c141cf8d2c6

SHA512
3b016b4485319d045677f70a2a8ea0f167b1e9ab401baffe78de5446ad131eaff456c1b42a08644acdda49731671ac39141033aca1789c6f4f8a7087756684cb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
6728e14f5ff4b545c30056a2df0a4fde

SHA1
abbe8edc8816d5be9b16f56f97e866af53c87d6e

SHA256
4d4797a89413f29f910b8a172de8bd080f374eef552636a48744bde517865e79

SHA512
1202ecb795963f548932772c30cdd63f7554e4d0640036893c18b5f5360642994a9edb531282359fc5450bf74948d4303d2d58b5de46633a4c1d59f62bcae339

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
0949c79743470d8df48dfff745c0929b

SHA1
e401730039abbc5e8ec1ca8dccb3efef891e9d87

SHA256
c4768cf87fec9be334b4cc60a18e43f1c6d110d33e1bb23165c5c181d7285a14

SHA512
fef51503e37d8584ad581305bc4d1b5afedb580a3797bae0af08ce586b6e0fd283ffde0cdac80049cacd32cdb0acc24086c07400eb755ad05fc564d6016e746f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
840aadcad26978f38d7a0d99be0680e5

SHA1
c952ff65d0ca39e16d545ea4e2cf3b7e351d45e5

SHA256
7cd058ed3289c2d50cf523d4fdc1010d5cccb44d644924d0d95e278531d8956a

SHA512
0131e145beacd80d0db2b81458efcd8c37e3787987f8bfdafcecbb0abbd3d5f40a0e94fca63e772076e7adf75ef4d6366c6b80398fe9742c48b1172e4fbf2411

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
7f1374d03cfee2c2e1068fc7db0a67e0

SHA1
f2ff48d65a55d1f5fdfd8ef66636e799a2367dd5

SHA256
f35d63a6e7fa3a1c9138ca56b15955adb90a8afc3fa0930b3951c020e16a3bb6

SHA512
70f7b11b5c15087fb57a9d1b7a83368d529597e59c56ba2e5b4b0399f195b4e872b453129b70b8c48434c6e8c24158a6c4c0c39a0bd58f64f00ee1043591e963

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
714ee8adf6ceb0ba673ccd51d96f7049

SHA1
dfbb22b000726acd5362617e778d901ad856cffb

SHA256
e8ce5444076d17a492876aad3f131cc7d571569d224de7a684f8d81b314284b1

SHA512
2edc1d272c1eb1286704bf019981ff2fc1553f66a245d032fe87cf34a647755394dbc901631841bd9b2763b3fe2eeb7f8c29e2b7c8355a5880ac66f0acd89719

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe588681.TMP

Filesize
1KB

MD5
eef65b1be8957b619297e3ad5fe40c23

SHA1
26ce3363263e002a7e91b3ac3f7f8e1b1b825b69

SHA256
5e0644a7e413d7540f99d66f7a423a91e2694a632d4825eea9b2a828da8ee467

SHA512
4cf8192fd48e0c47ecd05780cc009b59a9a345a9133624524e500d2ea729bf8f10216f77ff5cd8a9951ae85051ac4241a70edb01b5699cd4dfb16dc3ad6c031c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
b8655f0d8c9448a5befdb4f0c7a5c650

SHA1
159b82500b26d30f7309ee2171a99a55bd6140a9

SHA256
86eabb3efd2597613e0360489c677e7fc7a6328bcbf6b1c0b9cef6ac9f44329a

SHA512
d7bbca3576258548dfdc0b9fc9f223fc9a16fb0f415d157be4ef217050005f7430a2e09bad4c8b5fb10989827042ea44541889ebca343d81178c9ce4a254ebaf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
0f33b5aaa38c25266a6e9e9a60aad078

SHA1
46dd87ecbebce63d4af4690551cdaf3bc4ea151b

SHA256
c03c0ddf38bc9e862d167c1b60b53a66dcebaf1cdf97b66ce78a5ded3bf41eb2

SHA512
506e77af0e1ed5f8c19b289c8b4ccd3eebd159cb920d0961e160fd75356432adf4145fde499fc0d91968e99f17f041659629d05598650f3015e1538c960f5b1f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
619e21f84f0d636365df052c2d363922

SHA1
cea3787e1989e200a4f85ca336e8b8ed3483509b

SHA256
dbbef9b5e8929b591fcdf4827faadeefbbec1b2a8a48dc2da9b653cb726ed66e

SHA512
b7b685a1a10305391e3113fb14c8baca5b17460404d061112b0b9a67de978cc143f8412d4c1a253f0328c24fb5978dfa76ac8253107a7b6ed987e1706fdb3239

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
ba9598653fdcacd6023e1f97c6559326

SHA1
cb725cb4d7cd5b53beec1584913a99784d6d745a

SHA256
8024691b3efd92daeb0411ab926b80a36e263a971226dc6df0a199d25e9c40f6

SHA512
4d2318eaa2aa9f3667163c20b33df0761a0b5a6e277058774f918c2c21fb7d99bedf21832fc41717db381571e29f1bf43573c5fad36147a18f0a8f1a01bb0712

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
2d031129156a54c22bc76766ed5902d3

SHA1
e16770a4f43df8192c2c279c7ce02ddb15b34e7a

SHA256
9f7c5be8580b7f2a94dea92ce8cf35cb0a3ea13f8e52d622e95aa30a2f41a09c

SHA512
dd06b6e10c0f3217cfaa532bb32e62f2d4522b97b4cfabed977744572948f7eee85c537307c9f3b3326c1622a8205e0a94dea2dc947d147709802ff43d1ea29c

Download Submit
C:\Users\Admin\Downloads\README.md:Zone.Identifier

Filesize
55B

MD5
0f98a5550abe0fb880568b1480c96a1c

SHA1
d2ce9f7057b201d31f79f3aee2225d89f36be07d

SHA256
2dfb5f4b33e4cf8237b732c02b1f2b1192ffe4b83114bcf821f489bbf48c6aa1

SHA512
dbc1150d831950684ab37407defac0177b7583da0fe13ee8f8eeb65e8b05d23b357722246888189b4681b97507a4262ece96a1c458c4427a9a41d8ea8d11a2f6

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 843231.crdownload

Filesize
4.6MB

MD5
7cae6b379184f1cc5444ca2fc9a8ec75

SHA1
9a68fb4fed6c6f633275480ac481b7d24a1e60ad

SHA256
4b6edb96987da0a7714e705a7af8516ee7167c8a616eff6eb3ed9e54f6d02ee1

SHA512
fc81537d3fa0aa4fdc56ebcbc13bc43167cf1cd5424077c65292d7c86dd1e7aa11c44a5c78d8ca6fb31d942c034c1a9ee309aa8ee8a75a39dea0d3ed65790604

Download Submit
C:\Users\Admin\Downloads\You-Are-An-Idiot-main.zip:Zone.Identifier

Filesize
175B

MD5
90f01ae4cae6dfeb503e0037667e4227

SHA1
e046fd008fdf2f70842c428dcdf5926934d5ff3a

SHA256
b62a1a122557244bef3a5996967592e735e2d8e1a5e9e073ccf4fc7b244581d7

SHA512
f513e33b98868d4119130ccb4bb179b173e4f1e267d5a6ca1aadbfa0cb689a4ef7360a70812436be5f4f76f760cb8ba135ed8155528e5bc0ead533581b05a777

Download Submit
C:\Users\Admin\Downloads\You-are-an-idiot.zip

Filesize
33KB

MD5
4acd75f2bfeb99226a8c9cc721284208

SHA1
4c5fc527d8825952a6f45d4fcbab3bdb074e9713

SHA256
47dca4e070081df4b70053c858a851dbd720845d4ac579eb5e7334a44ffa16c7

SHA512
ba18b878ad12916ae75dd1f5fbee09bbdfef4776d243fa4e9d7b34a113978b529a242c66e868c52cbb0cab4198d0b356e83dc36355f9452e03e7fbd4e0f9f6e0

Download Submit
C:\Users\Admin\Downloads\You-are-an-idiot.zip:Zone.Identifier

Filesize
672B

MD5
9b8399b34d3847b52d1da63f3a46fb28

SHA1
9e8213458dd6f1a7f1b9f6d8fca3a054385ccf50

SHA256
b1ecb036b1118919c5e66b0aa60b34933a808eb8fec675c828108274bc5e2399

SHA512
9bb7437de72212e4babb052fe00da85b2feae93a858e9369d557d9719ddff1387aa2686fb3dd5687a4213b57a19d2ec6031d0612818dc45105c83e51c2d79fd8

Download Submit
memory/2244-544-0x0000000005A60000-0x0000000006006000-memory.dmp

Filesize
5.6MB

Download
memory/2244-543-0x0000000000950000-0x000000000095C000-memory.dmp

Filesize
48KB

Download
memory/2244-546-0x00000000055A0000-0x00000000055AA000-memory.dmp

Filesize
40KB

Download
memory/2244-545-0x00000000053F0000-0x0000000005482000-memory.dmp

Filesize
584KB

Download