5834f6ae3522131494c225a93c30173430be80b5c144519b265395c54f35172b

Analysis

max time kernel
1761s
max time network
1797s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
11/08/2024, 04:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
FreePiano/freepiano.exe
Size 1.3MB
Sample240811-eppqqsyckg
SHA256 f53c7cdf9fa04426f4e1100d7347d35eeb4fbd7c6795651412d229fa77ab8698
MD5 0742c857b186d7178a6f13c16765086c
SHA1 082a0aebe67a8991a968972127d2ee8bad6bab1d
SHA512 d2d6877092dfb2483a0b9efa2b7774178185c9c477b66baaaf38b30b672f023008e2e8a2289f205f3c73ead24f5360b578f6a56100c9687422b060f1cb5c673d
SSDEEP 24576:GVGj/JdqXfc9NubYNr7dxGycjkUTZZWIDR7p35DNy09x/:GVGjhdjTWarBxGYUTbW0d57V
MD5 SHA1 SHA512 SSDEEP

Score

6^/10

discovery

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
1	raw.githubusercontent.com
57	raw.githubusercontent.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Google Chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 36 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	OpenWith.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\SniffedFolderType = "Generic"	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-970747758-134341002-3585657277-1000\{A557D11A-8AB3-4003-B062-F58664833F37}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\1\NodeSlot = "3"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\Local Settings	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\1 = 8c0031000000000002598f7e110050524f4752417e310000740009000400efbec552596102598f7e2e0000003f0000000000010000000000000000004a00000000004e142601500072006f006700720061006d002000460069006c0065007300000040007300680065006c006c00330032002e0064006c006c002c002d0032003100370038003100000018000000	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\1	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\Local Settings	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = 0100000000000000ffffffff	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\1\MRUListEx = ffffffff	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\Local Settings	OpenWith.exe

NTFS ADS 3 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\You-Are-An-Idiot-main.zip:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\README.md:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\You-are-an-idiot.zip:Zone.Identifier	msedge.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
3252	msedge.exe
3252	msedge.exe
2412	msedge.exe
2412	msedge.exe
4836	msedge.exe
4836	msedge.exe
1148	msedge.exe
1148	msedge.exe
3428	identity_helper.exe
3428	identity_helper.exe
4696	msedge.exe
4696	msedge.exe
2396	msedge.exe
2396	msedge.exe
832	msedge.exe
832	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
1360	OpenWith.exe
3596	OpenWith.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 23 IoCs

pid	Process
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	4708	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	4708	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe

Suspicious use of SetWindowsHookEx 22 IoCs

pid	Process
3108	freepiano.exe
2432	OpenWith.exe
2432	OpenWith.exe
2432	OpenWith.exe
2432	OpenWith.exe
2432	OpenWith.exe
1360	OpenWith.exe
1360	OpenWith.exe
1360	OpenWith.exe
1360	OpenWith.exe
1360	OpenWith.exe
1360	OpenWith.exe
1360	OpenWith.exe
1360	OpenWith.exe
1360	OpenWith.exe
1360	OpenWith.exe
1360	OpenWith.exe
1360	OpenWith.exe
3596	OpenWith.exe
2244	Google Chrome.exe
2244	Google Chrome.exe
3108	freepiano.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3252 wrote to memory of 4772	3252	msedge.exe	88
PID 3252 wrote to memory of 4772	3252	msedge.exe	88
PID 3252 wrote to memory of 4212	3252	msedge.exe	89
PID 3252 wrote to memory of 4212	3252	msedge.exe	89
PID 3252 wrote to memory of 4212	3252	msedge.exe	89
PID 3252 wrote to memory of 4212	3252	msedge.exe	89
PID 3252 wrote to memory of 4212	3252	msedge.exe	89
PID 3252 wrote to memory of 4212	3252	msedge.exe	89
PID 3252 wrote to memory of 4212	3252	msedge.exe	89
PID 3252 wrote to memory of 4212	3252	msedge.exe	89
PID 3252 wrote to memory of 4212	3252	msedge.exe	89
PID 3252 wrote to memory of 4212	3252	msedge.exe	89
PID 3252 wrote to memory of 4212	3252	msedge.exe	89
PID 3252 wrote to memory of 4212	3252	msedge.exe	89
PID 3252 wrote to memory of 4212	3252	msedge.exe	89
PID 3252 wrote to memory of 4212	3252	msedge.exe	89
PID 3252 wrote to memory of 4212	3252	msedge.exe	89
PID 3252 wrote to memory of 4212	3252	msedge.exe	89
PID 3252 wrote to memory of 4212	3252	msedge.exe	89
PID 3252 wrote to memory of 4212	3252	msedge.exe	89
PID 3252 wrote to memory of 4212	3252	msedge.exe	89
PID 3252 wrote to memory of 4212	3252	msedge.exe	89
PID 3252 wrote to memory of 4212	3252	msedge.exe	89
PID 3252 wrote to memory of 4212	3252	msedge.exe	89
PID 3252 wrote to memory of 4212	3252	msedge.exe	89
PID 3252 wrote to memory of 4212	3252	msedge.exe	89
PID 3252 wrote to memory of 4212	3252	msedge.exe	89
PID 3252 wrote to memory of 4212	3252	msedge.exe	89
PID 3252 wrote to memory of 4212	3252	msedge.exe	89
PID 3252 wrote to memory of 4212	3252	msedge.exe	89
PID 3252 wrote to memory of 4212	3252	msedge.exe	89
PID 3252 wrote to memory of 4212	3252	msedge.exe	89
PID 3252 wrote to memory of 4212	3252	msedge.exe	89
PID 3252 wrote to memory of 4212	3252	msedge.exe	89
PID 3252 wrote to memory of 4212	3252	msedge.exe	89
PID 3252 wrote to memory of 4212	3252	msedge.exe	89
PID 3252 wrote to memory of 4212	3252	msedge.exe	89
PID 3252 wrote to memory of 4212	3252	msedge.exe	89
PID 3252 wrote to memory of 4212	3252	msedge.exe	89
PID 3252 wrote to memory of 4212	3252	msedge.exe	89
PID 3252 wrote to memory of 4212	3252	msedge.exe	89
PID 3252 wrote to memory of 4212	3252	msedge.exe	89
PID 3252 wrote to memory of 2412	3252	msedge.exe	90
PID 3252 wrote to memory of 2412	3252	msedge.exe	90
PID 3252 wrote to memory of 3552	3252	msedge.exe	91
PID 3252 wrote to memory of 3552	3252	msedge.exe	91
PID 3252 wrote to memory of 3552	3252	msedge.exe	91
PID 3252 wrote to memory of 3552	3252	msedge.exe	91
PID 3252 wrote to memory of 3552	3252	msedge.exe	91
PID 3252 wrote to memory of 3552	3252	msedge.exe	91
PID 3252 wrote to memory of 3552	3252	msedge.exe	91
PID 3252 wrote to memory of 3552	3252	msedge.exe	91
PID 3252 wrote to memory of 3552	3252	msedge.exe	91
PID 3252 wrote to memory of 3552	3252	msedge.exe	91
PID 3252 wrote to memory of 3552	3252	msedge.exe	91
PID 3252 wrote to memory of 3552	3252	msedge.exe	91
PID 3252 wrote to memory of 3552	3252	msedge.exe	91
PID 3252 wrote to memory of 3552	3252	msedge.exe	91
PID 3252 wrote to memory of 3552	3252	msedge.exe	91
PID 3252 wrote to memory of 3552	3252	msedge.exe	91
PID 3252 wrote to memory of 3552	3252	msedge.exe	91
PID 3252 wrote to memory of 3552	3252	msedge.exe	91
PID 3252 wrote to memory of 3552	3252	msedge.exe	91
PID 3252 wrote to memory of 3552	3252	msedge.exe	91

C:\Users\Admin\AppData\Local\Temp\FreePiano\freepiano.exe
"C:\Users\Admin\AppData\Local\Temp\FreePiano\freepiano.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:3108

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004D4 0x00000000000004EC
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4708

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7fffaab83cb8,0x7fffaab83cc8,0x7fffaab83cd8
  2⤵
  PID:4772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1940,3931824718247976110,11366581780788655231,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1952 /prefetch:2
  2⤵
  PID:4212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1940,3931824718247976110,11366581780788655231,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2020 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1940,3931824718247976110,11366581780788655231,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2556 /prefetch:8
  2⤵
  PID:3552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,3931824718247976110,11366581780788655231,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3340 /prefetch:1
  2⤵
  PID:4740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,3931824718247976110,11366581780788655231,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3356 /prefetch:1
  2⤵
  PID:4224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,3931824718247976110,11366581780788655231,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3944 /prefetch:1
  2⤵
  PID:3548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,3931824718247976110,11366581780788655231,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4952 /prefetch:1
  2⤵
  PID:3496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1940,3931824718247976110,11366581780788655231,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3500 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,3931824718247976110,11366581780788655231,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3936 /prefetch:1
  2⤵
  PID:420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,3931824718247976110,11366581780788655231,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3500 /prefetch:1
  2⤵
  PID:3536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,3931824718247976110,11366581780788655231,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3944 /prefetch:1
  2⤵
  PID:336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,3931824718247976110,11366581780788655231,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5316 /prefetch:1
  2⤵
  PID:872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,3931824718247976110,11366581780788655231,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5348 /prefetch:1
  2⤵
  PID:456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,3931824718247976110,11366581780788655231,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5184 /prefetch:1
  2⤵
  PID:2768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,3931824718247976110,11366581780788655231,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5076 /prefetch:1
  2⤵
  PID:4084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,3931824718247976110,11366581780788655231,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3372 /prefetch:1
  2⤵
  PID:2408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1940,3931824718247976110,11366581780788655231,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5648 /prefetch:8
  2⤵
  PID:4088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=1940,3931824718247976110,11366581780788655231,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5660 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:1148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,3931824718247976110,11366581780788655231,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5832 /prefetch:1
  2⤵
  PID:4768
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1940,3931824718247976110,11366581780788655231,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5008 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,3931824718247976110,11366581780788655231,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5064 /prefetch:1
  2⤵
  PID:3128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1940,3931824718247976110,11366581780788655231,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6724 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:4696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,3931824718247976110,11366581780788655231,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6904 /prefetch:1
  2⤵
  PID:4000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1940,3931824718247976110,11366581780788655231,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6920 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:2396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,3931824718247976110,11366581780788655231,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6012 /prefetch:1
  2⤵
  PID:1920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1940,3931824718247976110,11366581780788655231,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5772 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1940,3931824718247976110,11366581780788655231,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=2624 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,3931824718247976110,11366581780788655231,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7004 /prefetch:1
  2⤵
  PID:8
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,3931824718247976110,11366581780788655231,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3832 /prefetch:1
  2⤵
  PID:2244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,3931824718247976110,11366581780788655231,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5192 /prefetch:1
  2⤵
  PID:4992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,3931824718247976110,11366581780788655231,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6912 /prefetch:1
  2⤵
  PID:984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,3931824718247976110,11366581780788655231,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6828 /prefetch:1
  2⤵
  PID:3784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,3931824718247976110,11366581780788655231,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5212 /prefetch:1
  2⤵
  PID:3588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,3931824718247976110,11366581780788655231,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7008 /prefetch:1
  2⤵
  PID:380

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3892

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:868

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1448

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2432

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1360

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:3596

C:\Users\Admin\AppData\Local\Temp\Temp1_You-are-an-idiot.zip\Google Chrome.exe
"C:\Users\Admin\AppData\Local\Temp\Temp1_You-are-an-idiot.zip\Google Chrome.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2244

C:\Windows\SysWOW64\werfault.exe
werfault.exe /h /shared Global\ac64bf472c464a269817ae5eb91244d1 /t 5036 /p 2244
1⤵
PID:3648

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
1⤵
PID:560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7fffaab83cb8,0x7fffaab83cc8,0x7fffaab83cd8
  2⤵
  PID:4752

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004D4 0x00000000000004EC
1⤵
PID:4780

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 847f60e288d327496b72dbe1e7aa1470a99bf27c0a07548b6a386a6188cd72da
MD5 a8276eab0f8f0c0bb325b5b8c329f64f
SHA1 8ce681e4056936ca8ccd6f487e7cd7cccbae538b
SHA512 42f91bf90e92220d0731fa4279cc5773d5e9057a9587f311bee0b3f7f266ddceca367bd0ee7f1438c3606598553a2372316258c05e506315e4e11760c8f13918
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 1c3a7192c514ef0d2a8cf9115cfb44137ca98ec6daa4f68595e2be695c7ed67e
MD5 058032c530b52781582253cb245aa731
SHA1 7ca26280e1bfefe40e53e64345a0d795b5303fab
SHA512 77fa3cdcd53255e7213bb99980049e11d6a2160f8130c84bd16b35ba9e821a4e51716371526ec799a5b4927234af99e0958283d78c0799777ab4dfda031f874f
MD5 SHA1 SHA512

Submit Download

f_000002

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000002
Size 62KB
SHA256 eb48be34490ec9c4f9402b882166cd82cd317b51b2a49aae75cdf9ee035035eb
MD5 c3c0eb5e044497577bec91b5970f6d30
SHA1 d833f81cf21f68d43ba64a6c28892945adc317a6
SHA512 83d3545a4ed9eed2d25f98c4c9f100ae0ac5e4bc8828dccadee38553b7633bb63222132df8ec09d32eb37d960accb76e7aab5719fc08cc0a4ef07b053f30cf38
SSDEEP 1536:6+yyTwrwGtdPDZMlQcadLSHdqyjTxJMJwh09KWWXDManYPHc:6byTwrXL7ZoM28wPIawHc
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000003

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000003
Size 67KB
SHA256 4cdcda7d8363be5bc824064259780779e7c046d56399c8a191106f55ce2ed8a6
MD5 a074f116c725add93a8a828fbdbbd56c
SHA1 88ca00a085140baeae0fd3072635afe3f841d88f
SHA512 43ed55cda35bde93fc93c408908ab126e512c45611a994d7f4e5c85d4f2d90d573066082cb7b8dffce6a24a1f96cd534586646719b214ac7874132163faa5f28
SSDEEP 1536:H5i9enNYGgeLlZsrdXqTWdienK6kq+wWT2P7tk9/yIVBr/+elJ+0m4+r:H5QergOlyhX5nRkq+wWTo72/L+elJ/mn
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000004

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000004
Size 41KB
SHA256 414024b478738b35312a098bc7f911300b14396d34718f78886b5942d9afe346
MD5 a7ee007fb008c17e73216d0d69e254e8
SHA1 160d970e6a8271b0907c50268146a28b5918c05e
SHA512 669bec67d3fc1932a921dd683e6acfdf462b9063e1726770bae8740d83503a799c2e30030f2aca7ec96df0bfd6d8b7f999f8296ee156533302161eb7c9747602
SSDEEP 768:4RLGm79L1/LEY/7t727XJapUmqd7cpDoSQ/E4+Bvx7CQ4hyDGSZnY+:4Um7x5xtoXJiHwGH7F4hy1JY+
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000005

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000005
Size 19KB
SHA256 c1334e604dbbffdf38e9e2f359938569afe25f7150d1c39c293469c1ee4f7b6f
MD5 2e86a72f4e82614cd4842950d2e0a716
SHA1 d7b4ee0c9af735d098bff474632fc2c0113e0b9c
SHA512 7a5fd3e3e89c5f8afca33b2d02e5440934e5186b9fa6367436e8d20ad42b211579225e73e3a685e5e763fa3f907fc4632b9425e8bd6d6f07c5c986b6556d47b1
SSDEEP 384:eV4Eqc1qgk/XDVGi8m7JEM9TUKPqivdjfommfP974oNF38:eV9qlxhVEM9UKPpMV74kFM
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000006

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000006
Size 63KB
SHA256 c0997474b99524325dfedb5c020436e7ea9f9c9a1a759ed6daf7bdd4890bdc2b
MD5 710d7637cc7e21b62fd3efe6aba1fd27
SHA1 8645d6b137064c7b38e10c736724e17787db6cf3
SHA512 19aa77bed3c441228789cf8f931ca6194cc8d4bc7bb85d892faf5eaeda67d22c8c3b066f8ceda8169177da95a1fe111bd3436ceeaf4c784bd2bf96617f4d0c44
SSDEEP 1536:ZNIPgrq59wJU9Czk2BFfKoUwOGeoDfEge1gS+UYSdU6D+sNZnwbo2Fa:TI4S67kEfU11yqlYS1/NZyo2Q
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000008

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000008
Size 88KB
SHA256 b18b9eb934a5b3b81b16c66ec3ec8e8fecdb3d43550ce050eb2523aabc08b9cd
MD5 b38fbbd0b5c8e8b4452b33d6f85df7dc
SHA1 386ba241790252df01a6a028b3238de2f995a559
SHA512 546ca9fb302bf28e3a178e798dd6b80c91cba71d0467257b8ed42e4f845aa6ecb858f718aac1e0865b791d4ecf41f1239081847c75c6fb3e9afd242d3704ad16
SSDEEP 1536:WwVbiMNFmJrBrbhiWu0FKK9fLRXT+FjhwTn1sH5J3iotwUB4xzjIRB9h:zVOiFWwg3Rjm1wRW5JSywbo9h
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000009

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000009
Size 1.2MB
SHA256 ab481b8b19b3336deda1b9ad4680cce4958152c9f9daa60c7bd8eb6786887359
MD5 9f8f80ca4d9435d66dd761fbb0753642
SHA1 5f187d02303fd9044b9e7c74e0c02fe8e6a646b7
SHA512 9c0de8e5bf16f096bf781189d813eeb52c3c8ec73fc791de10a8781e9942de06ed30ff5021ab7385c98686330049e3e610adc3e484e12ef807eec58607cfae63
SSDEEP 24576:S7x2qYa9jhhLH4QHqXGBGeDxphmsUat0Vb66ZYM4ElNZ+1Z:rzadLYQHqWBGeFSsrCV/+MXNaZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 9c5b292c916afd33b6a5d7812e78196664bb48c75375d6cbdfce76722e7de526
MD5 cbb9e89ef3b0f041ff5931eef2e9db36
SHA1 bcb12d87f09b400634f25ed680d39dbc7e40ec55
SHA512 23a134c88d2a369b2097af0b48df04c4b6d305deee936a2764dbf32831ec0d0696e411fa0fc121cab73a3b8d1f45f0a9530e53002b0ed9fd27aa32594ff29716
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 2df874e2366f5cffc803e5b65dbf308405d557f69f3095bd3952658ccd1d9069
MD5 2a94ddb61dad6d931d1e1000e8f9f151
SHA1 9a4c046cf26daa85f41c298b4507868e057ac035
SHA512 0a3cd1fc9e86813238fbc031a5e9914824c6015be7bef0b72ff4efe30249714f4195e2d9adff82966b04d2f4841455675a4947c89553356e8996c2bcdd1ce833
SSDEEP 96:Uyl1iWR2tMuOmJWjJyFe6ylK9dnqoFUzqTXB+RTHA6s9XpA6wK5DUdP4rl3apBPC:vUU0oAFl
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 45fb1b545596ca4ef87f8c74e394ecc530c173853f2cfc205ec9d88a368a3e9d
MD5 1507cb471456ea5714faa28969083900
SHA1 7e68cad0eec377eacc53e8395d7f63e2268983f0
SHA512 7663d4905d210b2d6ab92d438b6e9de6eca018eafe4c382aaa38f74ae966e83a1f70456eef6f72b64f97e84a15a0bbc774101878ef1903bbddd7c02cc3e01653
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 1KB
SHA256 30871ba064b6442bf1984e398489c1212c3292013d8ef3017a164affd46bf250
MD5 666fce094fa96e8d2186a3394c435fdb
SHA1 1f26b71ff65ada8c0b067c1a2aa0523ded2633bd
SHA512 ffd121a5520d7b6811047adcf7bd34197bf09cfa6e08deabbd87ac3a3ef2819d2f667f24d15d23e9e19c976c195eed4a6252a5d55635b8d6508ec3df943011b7
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 790B
SHA256 025a2156b138c935a3b1d36cb72084168d9382b0275c2615392d68a70a111a88
MD5 3a997c6dfbeb01676b468b486eeb7a0a
SHA1 c7401acc6077b8bb37e103034a64ab6e9fa5ca52
SHA512 bc0e71ddeb4beac257c9884d0abc4a0e48a2c8fcc1c12ca74b3ae4f10137c08265806180cf1c8685c54289a407749a2e22d9e292c878114fab44d2c860cae3f4
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 1KB
SHA256 bd8227a6c3b6eac027d4a4870ff3e15478c9ddb2a99de219dcc45755e17109b7
MD5 2ae65dab6c2c39b29f346736f9e03699
SHA1 2fa110d70a3bf5f1640f398a63c38523cca71065
SHA512 3023d952dcf6feff63b8484d3cc45abb3862130b95568443a0bc9102b410185e54b1b94f2fdfa5125acfaee093930260151138e1f7a80aac5f3753f8391cfad5
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 873B
SHA256 5d1f07bdd568af94cefe66bba644ec63840a46fd7292f12f9a6442b9cbb19173
MD5 a4744b7e0f5144460b293544c5ca4f2e
SHA1 352a3a4a98a6858a6ff85fb24714bdafd1a626a5
SHA512 7c9ed6bd170cec00d79553a30ecd758e71249b2b464a5c9aecf1f8f880e32883508b66c05266696d1060fffcdb494d1619dde8d1f4e8d187cd4f11f9349ce036
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 ef6b4204190b2eed66c3265900b3787fcfe050fd40e3c5b33ba626397ec21dc7
MD5 a2e1ce7a5263c5c8bbfba03154a212a0
SHA1 75a3f55e67333dad96bcd5531d130607fe799b28
SHA512 70a8f513e359580d4dbf93bc0e58898fd1aab362cfc0b6f209cd755055636294c05769f99729df88494277dd8c2d2dc4bfc1dc33dce992a813e8b2f373ba736f
SSDEEP 96:njk35Dxm/LQYmtGEkEzwSv0MoiVmdHIAJh0WQyV+VuziX3wI3:njk35wAIEkEzv0MAI2hLM93
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 137f02ad6640fd7f58502852aab4532ca584cb1af1c5fe1cde369727cf168de4
MD5 b09a69b18f5d3684b6b185ef1d69d6ee
SHA1 288bb07fbdc3bbf786884638e23de001fd18ffe9
SHA512 ca6844fdcadf7f9a2dcb181775083c2f67572d1a45ea5506e414e64911a448bede15f996ed125925c35ff6f3548171a1e0823538788bb264de45dcf0f4496ab5
SSDEEP 96:njk36Dxm/LsmtGEkzzwSZO0MoiVmdfdcGVJuD1jIcJp0WQyV+VpAiX3wI3:njk36wLIEkzzZO0MSdccJuDhIKpLe93
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 8fc26cf1e2a6ca81984a75ca4d9e4f85d8fc50a5f7bab40a0d9d4c021eb7e7de
MD5 147b9631605b4aa365f75fc8ca1ac1ed
SHA1 189e364158d1f2fb1576c84b55289342ca8dfc19
SHA512 d0242d1682bc33314f7917774befc7adcd0fc215f9756d2e604b59efcb1d509bdf29cf3678a2a9e577be5f04bd607b6f833ebb6b60f3cc123216fc0edab833dd
SSDEEP 96:njk3tDxm/LLmtGEkCzwSZO0MoiVmdiuD1jIPJh0WQyV+VuAiX3wI3:njk3tweIEkCzZO0M3uDhIBhLH93
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 1a0a3d4f27975907c4029d98a6d4f601ce77c49ed3f5447f6e800e0e4fd9ee08
MD5 ec8843b6464705a3e395b85bdf58c7f3
SHA1 8e71290a084200baccbde1b71d0dd5fc7c5b83ab
SHA512 b72cef617b1dc2b87fa1982692c20ea38203e3add08fcc7ac9456ae28d785e529c260b56d4bdee7777f9402c1ed82bcad78ee9bd6710b2fa62e43c2d666bb336
SSDEEP 96:njk3tDxm/LsmtGEkzzwSZO0MoiVmdiuD1jIPJh0WQyV+VpAiX3wI3:njk3twLIEkzzZO0M3uDhIBhLe93
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 83438530f8743e99c2fa8fb0023d568f2be9c81db7e1e8f17024c9e9d9175db8
MD5 c828ca05025a1e940ff75d87b8761d30
SHA1 9d3a831505cd3459272b8a0dcca56af5525a4ed4
SHA512 7e0cb02970876ac4bb33045ce85e327a708376c2ed6385bd78e39959b31a07dd0be330f64436c43eebb0ea3996a10162c8090eec08ab65ce736773fbe362f8ae
SSDEEP 192:njkHw/IEkkzzKd0MSdccYYCBxek2tLe93:njwEkkKd0YJuk2tC93
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 83be2734c7516781f5ec963c47a2bb6134e3b2fcb28a2f01add2c32c064618d0
MD5 b717bb0eef113a020f0f08c67bc3ad26
SHA1 705db389594d5c9083647e4eccf9cf8feb577184
SHA512 1c0da849ed1d9874f2d29a2c6cb59acca94b172a4722c5e89cfdb0df48c67d013cc2a488c28a299f03fcfc14c6b7f8f4d62d900352b9402e013f0f8712792d39
SSDEEP 192:njkHw/IEkkzuGk0MSdcc3cvZxeFDtLe93:njwEkkrk0Y7GFDtC93
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 986bed3b6fb92cd8a38210ac35fb519f889987973b493136f33621d6ddbcb836
MD5 3c387da2118d5b19600559f7de18879c
SHA1 54b22fec8c520a3bc2e0a288a6a1f4dd86c37257
SHA512 f64b42db30093b316b428bef9fe950741f341cbd80104322aa082dc4da0eb5b31568c274a3ac75d3d1fe869b9cac9d894ee5994c555f4f0df16313f46000e48c
SSDEEP 192:njkHw/IEkkzfKGL0MSdccYYCBxek2tLe93:njwEkkLjL0YJuk2tC93
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 1KB
SHA256 4d8d12cb8f199cba89cbd8743286c302d8936940326b3837291d3c141cf8d2c6
MD5 1a0c1ce3ff368c6a59cc9c3b1d2bafc5
SHA1 f61605d452803ae76a465b2ca7087178a9666716
SHA512 3b016b4485319d045677f70a2a8ea0f167b1e9ab401baffe78de5446ad131eaff456c1b42a08644acdda49731671ac39141033aca1789c6f4f8a7087756684cb
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 1KB
SHA256 4d4797a89413f29f910b8a172de8bd080f374eef552636a48744bde517865e79
MD5 6728e14f5ff4b545c30056a2df0a4fde
SHA1 abbe8edc8816d5be9b16f56f97e866af53c87d6e
SHA512 1202ecb795963f548932772c30cdd63f7554e4d0640036893c18b5f5360642994a9edb531282359fc5450bf74948d4303d2d58b5de46633a4c1d59f62bcae339
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 1KB
SHA256 c4768cf87fec9be334b4cc60a18e43f1c6d110d33e1bb23165c5c181d7285a14
MD5 0949c79743470d8df48dfff745c0929b
SHA1 e401730039abbc5e8ec1ca8dccb3efef891e9d87
SHA512 fef51503e37d8584ad581305bc4d1b5afedb580a3797bae0af08ce586b6e0fd283ffde0cdac80049cacd32cdb0acc24086c07400eb755ad05fc564d6016e746f
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 1KB
SHA256 7cd058ed3289c2d50cf523d4fdc1010d5cccb44d644924d0d95e278531d8956a
MD5 840aadcad26978f38d7a0d99be0680e5
SHA1 c952ff65d0ca39e16d545ea4e2cf3b7e351d45e5
SHA512 0131e145beacd80d0db2b81458efcd8c37e3787987f8bfdafcecbb0abbd3d5f40a0e94fca63e772076e7adf75ef4d6366c6b80398fe9742c48b1172e4fbf2411
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 1KB
SHA256 f35d63a6e7fa3a1c9138ca56b15955adb90a8afc3fa0930b3951c020e16a3bb6
MD5 7f1374d03cfee2c2e1068fc7db0a67e0
SHA1 f2ff48d65a55d1f5fdfd8ef66636e799a2367dd5
SHA512 70f7b11b5c15087fb57a9d1b7a83368d529597e59c56ba2e5b4b0399f195b4e872b453129b70b8c48434c6e8c24158a6c4c0c39a0bd58f64f00ee1043591e963
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 1KB
SHA256 e8ce5444076d17a492876aad3f131cc7d571569d224de7a684f8d81b314284b1
MD5 714ee8adf6ceb0ba673ccd51d96f7049
SHA1 dfbb22b000726acd5362617e778d901ad856cffb
SHA512 2edc1d272c1eb1286704bf019981ff2fc1553f66a245d032fe87cf34a647755394dbc901631841bd9b2763b3fe2eeb7f8c29e2b7c8355a5880ac66f0acd89719
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RFe588681.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe588681.TMP
Size 1KB
SHA256 5e0644a7e413d7540f99d66f7a423a91e2694a632d4825eea9b2a828da8ee467
MD5 eef65b1be8957b619297e3ad5fe40c23
SHA1 26ce3363263e002a7e91b3ac3f7f8e1b1b825b69
SHA512 4cf8192fd48e0c47ecd05780cc009b59a9a345a9133624524e500d2ea729bf8f10216f77ff5cd8a9951ae85051ac4241a70edb01b5699cd4dfb16dc3ad6c031c
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
MD5 206702161f94c5cd39fadd03f4014d98
SHA1 bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA512 0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 86eabb3efd2597613e0360489c677e7fc7a6328bcbf6b1c0b9cef6ac9f44329a
MD5 b8655f0d8c9448a5befdb4f0c7a5c650
SHA1 159b82500b26d30f7309ee2171a99a55bd6140a9
SHA512 d7bbca3576258548dfdc0b9fc9f223fc9a16fb0f415d157be4ef217050005f7430a2e09bad4c8b5fb10989827042ea44541889ebca343d81178c9ce4a254ebaf
SSDEEP 192:coCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxA38pNIWl1e2RUABSOsmqo+QQHO5:M9iIxuERzA83h09RZxA38b5JB8o+QV0E
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 c03c0ddf38bc9e862d167c1b60b53a66dcebaf1cdf97b66ce78a5ded3bf41eb2
MD5 0f33b5aaa38c25266a6e9e9a60aad078
SHA1 46dd87ecbebce63d4af4690551cdaf3bc4ea151b
SHA512 506e77af0e1ed5f8c19b289c8b4ccd3eebd159cb920d0961e160fd75356432adf4145fde499fc0d91968e99f17f041659629d05598650f3015e1538c960f5b1f
SSDEEP 192:coCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxASGJpNIWl1e2RUABSOsmq9JQQH4:M9iIxuERzA83h09RZxASGJb5JB89JQV5
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 dbbef9b5e8929b591fcdf4827faadeefbbec1b2a8a48dc2da9b653cb726ed66e
MD5 619e21f84f0d636365df052c2d363922
SHA1 cea3787e1989e200a4f85ca336e8b8ed3483509b
SHA512 b7b685a1a10305391e3113fb14c8baca5b17460404d061112b0b9a67de978cc143f8412d4c1a253f0328c24fb5978dfa76ac8253107a7b6ed987e1706fdb3239
SSDEEP 192:voCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxASGJpNIWlfe2RUABSONF59AQQH4:X9iIxuERzA83h09RZxASGJb/JBR59AQL
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 8024691b3efd92daeb0411ab926b80a36e263a971226dc6df0a199d25e9c40f6
MD5 ba9598653fdcacd6023e1f97c6559326
SHA1 cb725cb4d7cd5b53beec1584913a99784d6d745a
SHA512 4d2318eaa2aa9f3667163c20b33df0761a0b5a6e277058774f918c2c21fb7d99bedf21832fc41717db381571e29f1bf43573c5fad36147a18f0a8f1a01bb0712
SSDEEP 192:qoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxASGJpNIWl1e2RUABSOsmq9JQQH4:u9iIxuERzA83h09RZxASGJb5JB89JQV5
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 9f7c5be8580b7f2a94dea92ce8cf35cb0a3ea13f8e52d622e95aa30a2f41a09c
MD5 2d031129156a54c22bc76766ed5902d3
SHA1 e16770a4f43df8192c2c279c7ce02ddb15b34e7a
SHA512 dd06b6e10c0f3217cfaa532bb32e62f2d4522b97b4cfabed977744572948f7eee85c537307c9f3b3326c1622a8205e0a94dea2dc947d147709802ff43d1ea29c
SSDEEP 192:aoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxASGRpNIWlfe2RUA7MNF592QQHO5:e9iIxuERzA83h09RZxASGRb/JM592QV5
MD5 SHA1 SHA512 SSDEEP

Submit Download

README.md:Zone.Identifier

Path C:\Users\Admin\Downloads\README.md:Zone.Identifier
Size 55B
SHA256 2dfb5f4b33e4cf8237b732c02b1f2b1192ffe4b83114bcf821f489bbf48c6aa1
MD5 0f98a5550abe0fb880568b1480c96a1c
SHA1 d2ce9f7057b201d31f79f3aee2225d89f36be07d
SHA512 dbc1150d831950684ab37407defac0177b7583da0fe13ee8f8eeb65e8b05d23b357722246888189b4681b97507a4262ece96a1c458c4427a9a41d8ea8d11a2f6
MD5 SHA1 SHA512

Submit Download

Unconfirmed 843231.crdownload

Path C:\Users\Admin\Downloads\Unconfirmed 843231.crdownload
Size 4.6MB
SHA256 4b6edb96987da0a7714e705a7af8516ee7167c8a616eff6eb3ed9e54f6d02ee1
MD5 7cae6b379184f1cc5444ca2fc9a8ec75
SHA1 9a68fb4fed6c6f633275480ac481b7d24a1e60ad
SHA512 fc81537d3fa0aa4fdc56ebcbc13bc43167cf1cd5424077c65292d7c86dd1e7aa11c44a5c78d8ca6fb31d942c034c1a9ee309aa8ee8a75a39dea0d3ed65790604
SSDEEP 98304:cZs+JQa8mt1MlmmWsIsM4hvCj3PIOsIvcxRSynnF3LfrSfpIE5V:ca+Jlwf+R4hBIknF3zrSfV3
MD5 SHA1 SHA512 SSDEEP

Submit Download

You-Are-An-Idiot-main.zip:Zone.Identifier

Path C:\Users\Admin\Downloads\You-Are-An-Idiot-main.zip:Zone.Identifier
Size 175B
SHA256 b62a1a122557244bef3a5996967592e735e2d8e1a5e9e073ccf4fc7b244581d7
MD5 90f01ae4cae6dfeb503e0037667e4227
SHA1 e046fd008fdf2f70842c428dcdf5926934d5ff3a
SHA512 f513e33b98868d4119130ccb4bb179b173e4f1e267d5a6ca1aadbfa0cb689a4ef7360a70812436be5f4f76f760cb8ba135ed8155528e5bc0ead533581b05a777
MD5 SHA1 SHA512

Submit Download

You-are-an-idiot.zip

Path C:\Users\Admin\Downloads\You-are-an-idiot.zip
Size 33KB
SHA256 47dca4e070081df4b70053c858a851dbd720845d4ac579eb5e7334a44ffa16c7
MD5 4acd75f2bfeb99226a8c9cc721284208
SHA1 4c5fc527d8825952a6f45d4fcbab3bdb074e9713
SHA512 ba18b878ad12916ae75dd1f5fbee09bbdfef4776d243fa4e9d7b34a113978b529a242c66e868c52cbb0cab4198d0b356e83dc36355f9452e03e7fbd4e0f9f6e0
SSDEEP 768:XSAiCxuDCOUT3qQG7VepMaNNo3Bn9JtmqU731RY4EF:CAi5OnTDG7kPNu9zeLEF
MD5 SHA1 SHA512 SSDEEP

Submit Download

You-are-an-idiot.zip:Zone.Identifier

Path C:\Users\Admin\Downloads\You-are-an-idiot.zip:Zone.Identifier
Size 672B
SHA256 b1ecb036b1118919c5e66b0aa60b34933a808eb8fec675c828108274bc5e2399
MD5 9b8399b34d3847b52d1da63f3a46fb28
SHA1 9e8213458dd6f1a7f1b9f6d8fca3a054385ccf50
SHA512 9bb7437de72212e4babb052fe00da85b2feae93a858e9369d557d9719ddff1387aa2686fb3dd5687a4213b57a19d2ec6031d0612818dc45105c83e51c2d79fd8
MD5 SHA1 SHA512

Submit Download

memory/2244-544-0x0000000005A60000-0x0000000006006000-memory.dmp

Download

memory/2244-543-0x0000000000950000-0x000000000095C000-memory.dmp

Download

memory/2244-546-0x00000000055A0000-0x00000000055AA000-memory.dmp

Download

memory/2244-545-0x00000000053F0000-0x0000000005482000-memory.dmp

Download