hxxps://github[.]com/Tyrrrz/YoutubeDownloader/releases/tag/1[.]12[.]2

Analysis

max time kernel
368s
max time network
370s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
11/08/2024, 08:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/Tyrrrz/YoutubeDownloader/releases/tag/1.12.2

Score

6^/10

discovery

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
115	pastebin.com
112	pastebin.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 54 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	YoutubeDownloader.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	YoutubeDownloader.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5FA96407-7E77-483C-AC93-691D05850DE8}\LogicalViewMode = "3"	YoutubeDownloader.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5FA96407-7E77-483C-AC93-691D05850DE8}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000050000001800000030f125b7ef471a10a5f102608c9eebac0a000000a0000000b474dbf787420341afbaf1b13dcd75cf64000000a000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000900444648b4cd1118b70080036b11a030300000078000000	YoutubeDownloader.exe
Key created	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\2	YoutubeDownloader.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5FA96407-7E77-483C-AC93-691D05850DE8}\GroupView = "0"	YoutubeDownloader.exe
Key created	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg	YoutubeDownloader.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1 = 14002e80922b16d365937a46956b92703aca08af0000	YoutubeDownloader.exe
Key created	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell	YoutubeDownloader.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5FA96407-7E77-483C-AC93-691D05850DE8}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	YoutubeDownloader.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5FA96407-7E77-483C-AC93-691D05850DE8}\Mode = "1"	YoutubeDownloader.exe
Key created	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1	YoutubeDownloader.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\NodeSlot = "2"	YoutubeDownloader.exe
Key created	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2	YoutubeDownloader.exe
Key created	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}	YoutubeDownloader.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1092616257"	YoutubeDownloader.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	YoutubeDownloader.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 020000000100000000000000ffffffff	YoutubeDownloader.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5FA96407-7E77-483C-AC93-691D05850DE8}\FFlags = "1092616257"	YoutubeDownloader.exe
Key created	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	YoutubeDownloader.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\2\NodeSlot = "3"	YoutubeDownloader.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\IconSize = "16"	YoutubeDownloader.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByDirection = "1"	YoutubeDownloader.exe
Key created	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5FA96407-7E77-483C-AC93-691D05850DE8}	YoutubeDownloader.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5FA96407-7E77-483C-AC93-691D05850DE8}\IconSize = "96"	YoutubeDownloader.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5FA96407-7E77-483C-AC93-691D05850DE8}\FFlags = "1"	YoutubeDownloader.exe
Key created	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings	YoutubeDownloader.exe
Key created	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	YoutubeDownloader.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 0100000000000000ffffffff	YoutubeDownloader.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	YoutubeDownloader.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202	YoutubeDownloader.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\SniffedFolderType = "Videos"	YoutubeDownloader.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:PID = "0"	YoutubeDownloader.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5FA96407-7E77-483C-AC93-691D05850DE8}\GroupByDirection = "1"	YoutubeDownloader.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\MRUListEx = ffffffff	YoutubeDownloader.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	YoutubeDownloader.exe
Key created	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg	YoutubeDownloader.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5FA96407-7E77-483C-AC93-691D05850DE8}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	YoutubeDownloader.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5FA96407-7E77-483C-AC93-691D05850DE8}\GroupByKey:PID = "0"	YoutubeDownloader.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	YoutubeDownloader.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupView = "0"	YoutubeDownloader.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\2\MRUListEx = ffffffff	YoutubeDownloader.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	YoutubeDownloader.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1"	YoutubeDownloader.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\2 = 3a002e80aba36ff8d270c74f9c99fcbf05467f3a260001002600efbe1100000013908f63d7e4da0182350c66d7e4da01784f39a1d7e4da0114000000	YoutubeDownloader.exe
Key created	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	YoutubeDownloader.exe
Key created	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell	YoutubeDownloader.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\LogicalViewMode = "1"	YoutubeDownloader.exe
Key created	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3	YoutubeDownloader.exe
Key created	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	YoutubeDownloader.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Documents"	YoutubeDownloader.exe
Key created	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	YoutubeDownloader.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Mode = "4"	YoutubeDownloader.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
3232	vlc.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
3308	msedge.exe
3308	msedge.exe
3380	msedge.exe
3380	msedge.exe
3200	identity_helper.exe
3200	identity_helper.exe
768	msedge.exe
768	msedge.exe
5384	msedge.exe
5384	msedge.exe
5384	msedge.exe
5384	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
5140	YoutubeDownloader.exe
3232	vlc.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 16 IoCs

pid	Process
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	5140	YoutubeDownloader.exe
Token: 33	2380	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2380	AUDIODG.EXE
Token: 33	3232	vlc.exe
Token: SeIncBasePriorityPrivilege	3232	vlc.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe

Suspicious use of SendNotifyMessage 28 IoCs

pid	Process
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3232	vlc.exe
3232	vlc.exe
3232	vlc.exe
3232	vlc.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
5140	YoutubeDownloader.exe
3232	vlc.exe
3232	vlc.exe
3232	vlc.exe
3232	vlc.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3380 wrote to memory of 2808	3380	msedge.exe	84
PID 3380 wrote to memory of 2808	3380	msedge.exe	84
PID 3380 wrote to memory of 116	3380	msedge.exe	85
PID 3380 wrote to memory of 116	3380	msedge.exe	85
PID 3380 wrote to memory of 116	3380	msedge.exe	85
PID 3380 wrote to memory of 116	3380	msedge.exe	85
PID 3380 wrote to memory of 116	3380	msedge.exe	85
PID 3380 wrote to memory of 116	3380	msedge.exe	85
PID 3380 wrote to memory of 116	3380	msedge.exe	85
PID 3380 wrote to memory of 116	3380	msedge.exe	85
PID 3380 wrote to memory of 116	3380	msedge.exe	85
PID 3380 wrote to memory of 116	3380	msedge.exe	85
PID 3380 wrote to memory of 116	3380	msedge.exe	85
PID 3380 wrote to memory of 116	3380	msedge.exe	85
PID 3380 wrote to memory of 116	3380	msedge.exe	85
PID 3380 wrote to memory of 116	3380	msedge.exe	85
PID 3380 wrote to memory of 116	3380	msedge.exe	85
PID 3380 wrote to memory of 116	3380	msedge.exe	85
PID 3380 wrote to memory of 116	3380	msedge.exe	85
PID 3380 wrote to memory of 116	3380	msedge.exe	85
PID 3380 wrote to memory of 116	3380	msedge.exe	85
PID 3380 wrote to memory of 116	3380	msedge.exe	85
PID 3380 wrote to memory of 116	3380	msedge.exe	85
PID 3380 wrote to memory of 116	3380	msedge.exe	85
PID 3380 wrote to memory of 116	3380	msedge.exe	85
PID 3380 wrote to memory of 116	3380	msedge.exe	85
PID 3380 wrote to memory of 116	3380	msedge.exe	85
PID 3380 wrote to memory of 116	3380	msedge.exe	85
PID 3380 wrote to memory of 116	3380	msedge.exe	85
PID 3380 wrote to memory of 116	3380	msedge.exe	85
PID 3380 wrote to memory of 116	3380	msedge.exe	85
PID 3380 wrote to memory of 116	3380	msedge.exe	85
PID 3380 wrote to memory of 116	3380	msedge.exe	85
PID 3380 wrote to memory of 116	3380	msedge.exe	85
PID 3380 wrote to memory of 116	3380	msedge.exe	85
PID 3380 wrote to memory of 116	3380	msedge.exe	85
PID 3380 wrote to memory of 116	3380	msedge.exe	85
PID 3380 wrote to memory of 116	3380	msedge.exe	85
PID 3380 wrote to memory of 116	3380	msedge.exe	85
PID 3380 wrote to memory of 116	3380	msedge.exe	85
PID 3380 wrote to memory of 116	3380	msedge.exe	85
PID 3380 wrote to memory of 116	3380	msedge.exe	85
PID 3380 wrote to memory of 3308	3380	msedge.exe	86
PID 3380 wrote to memory of 3308	3380	msedge.exe	86
PID 3380 wrote to memory of 2272	3380	msedge.exe	87
PID 3380 wrote to memory of 2272	3380	msedge.exe	87
PID 3380 wrote to memory of 2272	3380	msedge.exe	87
PID 3380 wrote to memory of 2272	3380	msedge.exe	87
PID 3380 wrote to memory of 2272	3380	msedge.exe	87
PID 3380 wrote to memory of 2272	3380	msedge.exe	87
PID 3380 wrote to memory of 2272	3380	msedge.exe	87
PID 3380 wrote to memory of 2272	3380	msedge.exe	87
PID 3380 wrote to memory of 2272	3380	msedge.exe	87
PID 3380 wrote to memory of 2272	3380	msedge.exe	87
PID 3380 wrote to memory of 2272	3380	msedge.exe	87
PID 3380 wrote to memory of 2272	3380	msedge.exe	87
PID 3380 wrote to memory of 2272	3380	msedge.exe	87
PID 3380 wrote to memory of 2272	3380	msedge.exe	87
PID 3380 wrote to memory of 2272	3380	msedge.exe	87
PID 3380 wrote to memory of 2272	3380	msedge.exe	87
PID 3380 wrote to memory of 2272	3380	msedge.exe	87
PID 3380 wrote to memory of 2272	3380	msedge.exe	87
PID 3380 wrote to memory of 2272	3380	msedge.exe	87
PID 3380 wrote to memory of 2272	3380	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://github.com/Tyrrrz/YoutubeDownloader/releases/tag/1.12.2
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9addf46f8,0x7ff9addf4708,0x7ff9addf4718
  2⤵
  PID:2808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2212,127829054656112534,13390457030931071794,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2232 /prefetch:2
  2⤵
  PID:116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2212,127829054656112534,13390457030931071794,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2292 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2212,127829054656112534,13390457030931071794,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2752 /prefetch:8
  2⤵
  PID:2272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,127829054656112534,13390457030931071794,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1
  2⤵
  PID:2688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,127829054656112534,13390457030931071794,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:1
  2⤵
  PID:2168
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2212,127829054656112534,13390457030931071794,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5284 /prefetch:8
  2⤵
  PID:1708
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2212,127829054656112534,13390457030931071794,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5284 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2212,127829054656112534,13390457030931071794,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5448 /prefetch:8
  2⤵
  PID:1708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,127829054656112534,13390457030931071794,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5076 /prefetch:1
  2⤵
  PID:4940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,127829054656112534,13390457030931071794,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5440 /prefetch:1
  2⤵
  PID:3444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,127829054656112534,13390457030931071794,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6048 /prefetch:1
  2⤵
  PID:3604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,127829054656112534,13390457030931071794,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5488 /prefetch:1
  2⤵
  PID:3576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,127829054656112534,13390457030931071794,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6272 /prefetch:1
  2⤵
  PID:3784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,127829054656112534,13390457030931071794,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3912 /prefetch:1
  2⤵
  PID:5376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,127829054656112534,13390457030931071794,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6212 /prefetch:1
  2⤵
  PID:5536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,127829054656112534,13390457030931071794,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6128 /prefetch:1
  2⤵
  PID:5544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,127829054656112534,13390457030931071794,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2208 /prefetch:1
  2⤵
  PID:5736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2212,127829054656112534,13390457030931071794,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5416 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2212,127829054656112534,13390457030931071794,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3388 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,127829054656112534,13390457030931071794,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2492 /prefetch:1
  2⤵
  PID:5312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,127829054656112534,13390457030931071794,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6332 /prefetch:1
  2⤵
  PID:5832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,127829054656112534,13390457030931071794,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5676 /prefetch:1
  2⤵
  PID:3556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,127829054656112534,13390457030931071794,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2500 /prefetch:1
  2⤵
  PID:3908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,127829054656112534,13390457030931071794,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5852 /prefetch:1
  2⤵
  PID:1068

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3640

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2304

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:712

C:\Users\Admin\Downloads\YoutubeDownloader.win-x64\YoutubeDownloader.exe
"C:\Users\Admin\Downloads\YoutubeDownloader.win-x64\YoutubeDownloader.exe"
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:5140
- C:\Users\Admin\Downloads\YoutubeDownloader.win-x64\ffmpeg.exe
  "C:\Users\Admin\Downloads\YoutubeDownloader.win-x64\ffmpeg.exe" -i "C:\Users\Admin\Videos\If rainbow friends was real life secret.mp4.stream-0.tmp" -i "C:\Users\Admin\Videos\If rainbow friends was real life secret.mp4.stream-1.tmp" -map 0 -map 1 -f mp4 -preset Medium -c:v:0 copy -c:a:0 copy -metadata:s:v:0 "title=720p | 2.21 Mbit/s" -metadata:s:a:0 "title=127.92 Kbit/s" -loglevel info -stats -hide_banner -threads 2 -nostdin -y "C:\Users\Admin\Videos\If rainbow friends was real life secret.mp4"
  2⤵
  PID:3600

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Videos\If rainbow friends was real life secret.mp4"
1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:3232

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x384 0x508
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2380

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e4f80e7950cbd3bb11257d2000cb885e

SHA1
10ac643904d539042d8f7aa4a312b13ec2106035

SHA256
1184ee8d32d0edecddd93403fb888fad6b3e2a710d37335c3989cc529bc08124

SHA512
2b92c9807fdcd937e514d4e7e1cc7c2d3e3aa162099b7289ceac2feea72d1a4afbadf1c09b3075d470efadf9a9edd63e07ea7e7a98d22243e45b3d53473fa4f0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
2dc1a9f2f3f8c3cfe51bb29b078166c5

SHA1
eaf3c3dad3c8dc6f18dc3e055b415da78b704402

SHA256
dcb76fa365c2d9ee213b224a91cdd806d30b1e8652d72a22f2371124fa4479fa

SHA512
682061d9cc86a6e5d99d022da776fb554350fc95efbf29cd84c1db4e2b7161b76cd1de48335bcc3a25633079fb0bd412e4f4795ed6291c65e9bc28d95330bb25

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
50fa5837ad7acef81d8462883abbcc9d

SHA1
806d2cd2d01100fe7ef6ab1429a022094dd82cc6

SHA256
3e0d0c2a51f7a396c1f54c0e69ce1e69e1f13d3205364944c1a46e110a643dfa

SHA512
b5d3ca7782d8b852cd9c31e99ba230aef7254cdeecc152ecf80ac1c791648ab9c5b5e62ca08ffe50c2b51fc935cc2c7160060c8e4e7985554b8f1dcfd2ddf318

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
daf2b4a914f3a5a04023a6b7b6cc8211

SHA1
abd2c2566767245e854b5a77ad5c5b54e0da3018

SHA256
0fd09514b0db2b281335a97534a070b473baab7fa2608dcd6e555839b7055867

SHA512
255e2006c9cd5e0b616cb221cac516e38c710d1403bbaea6d6d162a0420e7c97720d9b85c32bd3e35c31c0f7c15431e19be7b0c1830b7ee34036de21b16f3f2e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
566B

MD5
809b5306db6f1496b010c781bbd9a9d3

SHA1
794da9d6cc2fcc42bbaa558644b3774f711ae823

SHA256
4ec3d292997fd4ef1e5bfe6a2b9300730c893a15c3bc7091d13a66d4de3e54d4

SHA512
889228992c4b84fd00f2eec2b368ef1e0bfe850d2a988c30d4c0cc7e92d5386f8c963db248ce51720e73882b14baf6ef656b53db6aa3555f8fd0e8dbbdecdd2b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
cab157199e21c53161c28a7c3c299067

SHA1
28657481d464e71d78e060ea18ecc2ac45962bed

SHA256
c5ab105fc665fce75458c6820addfc31e145ffeaeb66d28244b753d7202c6dff

SHA512
77c0e78b72b77f1abb0746e2c509813a08013c08eaa6de5cad6d535310b6e0f3b04577df271f399adf06bccf1f7c2222f8d04795a16525a75f01d67c421f8019

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
496B

MD5
30322550d9f9c54f345ea1c71f3b2e8f

SHA1
b5a3cff2995147279c2bbed7c03b2280ecb286e5

SHA256
4e7798d8476361378f8fbfb0442db63c7f6bf7e1830d50808bfdb8a58700d8f9

SHA512
261d1f5bc9c8a369f815eb846c252f54681f70862153bd49959411450870207b3ee240cc9016533c27401922527d561cc1ea7bb23708e4a257f071d010cf55ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
335f8612ffbbc39e1b1b11213f852541

SHA1
816cc174ceefff0d20987d78329415d66581fd4e

SHA256
6b718b2422f923d66e50d3817391dc7de508aa7b2c2f0f92edfceb92f65b39d6

SHA512
d8d260be2cb3a6c1ced9b426a0962d45b738b710abf6cfc99f404ba158752e69e56728f3ba0fa64753b9f452ab9e35a7113c85a93d6041c20a328d30767e0200

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
97b8515ec7e8906b6d181de434569aff

SHA1
d75c6ca8eff978b8b1017908a1f6751a75607705

SHA256
7f45b6a4269154108664a46bb3af84ef37b8a6f76432d308d22df0050ada960b

SHA512
4fafaf8e7366a92b9923ba642202397be6a6ea29412a44a61c8cabf8ed57505e1489d0707a355e048c600029e3297adfab10a0e8fbcc1cde51ba144ce541156b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
124ef4040034756717495f60367f83a8

SHA1
2cabd663fbc9dea919bfc524a26fb1efafa32ec8

SHA256
6d3c4c989dd3d996688b1ff09270cc5bc444d218f4f9241c35a38ecf5880b5a2

SHA512
d1b9831e85a339a41c26ed9ee4bf1f2b253df15d6b091c3af027d0b590b5586d90b748828f96036691b96acc999ed6de3e809fb32a846040d914453826f32d4a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
50cd58888a497088887e2a11135cbd60

SHA1
34a2cdc3a7ecb24d98ea71593e05343d6dcbf01a

SHA256
24a7ec90aa14a2d83eb59ab98661eac060a0d38b2320d2a4fe401651d3ee0ba7

SHA512
b089b13d0f40b48f5017eae2026f18328143014a024e53739ff05c96f5f3f45597b8f77edfbee4303dd7d1150b63441797cfbd8d68b01847d5e9763ff0a34721

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
12859ea906e0c4aa943ff58d7fa65d01

SHA1
25d091930efbeaec1b789427abd44853e9418285

SHA256
fb6947f2d6df68e3c1b202e91fa330ab839db4c43ffcd6f65d57b5829b311ebd

SHA512
456af2155a922c01d9c0cc7b87c61dad3971833a71fa0da1454469996b84808abd9162bc3e40de4ede4586d934921752c1e7f23a193b0da48b0ea35efca9c0e0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
cc7dcb6357058596f1a2c16c446ae2f7

SHA1
cba43ca5a51ae2a8fe4c9df1b49b3dcb655ff2fe

SHA256
0f9cb55a949085c8f029c5367ae23efddadb0bdf548d2db10be7c9a4b43780fa

SHA512
719595013ea235e7903ca7eacbc46805d428c0b0ce1e7a003572b7c135d0cb017395ced2305ea550992972322703f866bd26b607d26ce1efd6878e2fa94121e5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
9fc280a0e6b86bd292df981f4c001fb8

SHA1
631f51f2149357e7021657b17ee8dc74996e6ac5

SHA256
f6e86c6b61d3c4ff67d9354574636b4084ceca3deec68846d0f6045c16b762da

SHA512
1228743ad80421a01f421b1da63b3d35dab1420824c306b94e93eb8985c78f45e0c560a6c2c1960bea59c0f081401a5bd0523c2be41656819cde98171f4d32ce

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
874B

MD5
050a4a597caf67dd89e2c1bbda566559

SHA1
5e82aa79d19b77ec2fef2fd09228a2ed05c10c75

SHA256
0eff3ab9ef19fd6d7f08b15f52775aad4074d38d5456a3f30340cf6951222c4b

SHA512
5b614482929e56f8181168de1e7a7defb60355f94857f8ba1f8dd314e756a7f9ca11d83dbe75b8c267121d6cd7091ef8e9695a6e73557a41d0099113af06aa1c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
874B

MD5
51325e3e1d9b23e240935a98bceb4863

SHA1
7ab977176611bf2c0d094e841efe9fa1e943e987

SHA256
bfa0925b8974b32229929a38e2b273dd61df40f02a3990c23d83e0d48acf7bc7

SHA512
cf8bb24a23f49a41d8ffb20394b03c953fae1c42d7b1912b7ed5b6503a8e104b429ebd7a8955d6c2c57c9c7975b8ed0318c6c8fda5ef580d210de7ae39505e6e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
dd87c0f4167b6dc7c5b037818b6a825b

SHA1
b2190bfc8b49d44e9077a55f7cb8f708799d3e83

SHA256
24567a02ded9e14a5be79c741a1b89706ef65b959987a1e3b9756957fbef9dff

SHA512
1314c58f016e6c24c27e61f7b360ece8d951fca0e0e97ee08daa0c2c6ce9904d6182f3535d2f32c256c36cc6e096644524fd0b2fdb26674ed7cb962975034315

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57cddf.TMP

Filesize
874B

MD5
41d406d2f5ac883357d9a26b85b40053

SHA1
e95244c58fcc792f6b08fffef26e1d62eb11a256

SHA256
6f9415108d1ad4e93100b866289353d6ab2acd4253ecaff9fe50876bbcaa9884

SHA512
b92f6c2545fc55faa1f99d66823c35b4f69ffc06d308fcfe59243888feea33b7af3ab5ddcc0c3003f2ec3f2e2e7127c816a18589c84f966557d953278493f308

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\d582b635-538b-4512-9258-f40611b50615.tmp

Filesize
6KB

MD5
67fe9a2944828eb4c150e42414b29845

SHA1
106773ee55c0bb3ca2881b7873174bf58ce9d0e8

SHA256
27b1f7212de1279fea5acbc67394a37031272fdbd03ea66c265f28f2a6f1f039

SHA512
fcc34159df2fa27dc925fbacaec953024f498a50a93f7bfc19c48520a3901d3aa878c856fdd7d35e3a9bcbae27e5d9b89c65f51c8b8476a6a8bf954a0717f74a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
c26a4ecdec315c5351e626abf7d823aa

SHA1
10eac99905b632a215c1ad2c5adf0a71903204ab

SHA256
86596d702552c5837c89358ffb49802bca30bd3f413a9c3228a864ab38087232

SHA512
ff21a183e3c224f7164c86c78cc59e134f032c141072ec820fd1f1eb77dee84abe55357bd716378e43d48951e39fff7b9349e7c515f872b1a0493a1b79eb8bca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
ecef6d2dd18e2d8d2e4a71692a144fdc

SHA1
146b3f956396563fd6c8a7b49b30c4892b5b0a24

SHA256
d881bef1fe55127b5dcacfce4d2aaa806200611a2fdda4d3e68df0033c0c83fe

SHA512
2510fb458705e05539a2b896e8f3144c98d1e253f094f281fac401e8bf261f7724e645e1eee83505fd65f3c812e17eb68c841d5696d678ed5731359f36bf4f7f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
1e3362e5027e621b0d9236da7bf4e166

SHA1
6137a73a12ef7c26f5afdad825c83d6200488969

SHA256
ddb0edb40a53e0013477f6c77079a5c059db33a2c8772a1e53289164e5e3f26c

SHA512
dd9b050a88047af1a5315884e19e5d1ff396dc8e2ccd33a6f8e15eccba37102c4b37f5caea52e2f0e22d14eb9fbc9e80b526ba9f085fec458f55865cd183ba1a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
0a587a34023e17ac4d575c0a89d9b31b

SHA1
af6258580850df9250b2e750e337c25b8a0a623a

SHA256
f90e91034b8076a1e7c48dbc0ea8d8cf4860c91498eac8734f150a9e43aa28df

SHA512
3f5b83e48cc8209aa738a7db07c975401d3c3d5a34a81ec9dc02096fdc2aeb048a2c3f81fdbc80744aed69d87ab2d1e5fb6cf5735ca3acf1da96b2c6c35799d8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
db5ebd024aa3114f8cdf4a0e853794ac

SHA1
0ded2df828d458662a77fb625e10dd354035322a

SHA256
e5398392127fec0a7e3af41dafdaae49ffbc30766535a789d45ab753c1faea06

SHA512
87808e5c74594ca4fd61706d6a51a40d9c608cc5c20221d1883416775895dc1a9dc2535e41e0c2a6eac6a2598b0ef985d1c57a76c7573fb2f0fc7fc7bc59d8de

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
12KB

MD5
84efd273af9c61e246521e995a8ad2d6

SHA1
c70aae3b7a341b8e08f2ca6f92946ba436c390e5

SHA256
09871b63fad5308ed4fe7785a5f7c8943251d4c6ffb04fe9ab703b8df92c383e

SHA512
62a6a72907805cdb92375e89aeceb429f8ea587834a7adb446f97cdaead9bc4ea1b01b5536ccdd4706198c254636d4741f2499c59c4f688417250d8d337702c5

Download Submit
C:\Users\Admin\Videos\If rainbow friends was real life secret.mp4

Filesize
48B

MD5
a5953ce258f705d1f1686e5463505c42

SHA1
774c01b44a32a5a89953487cc30c22fd47359fec

SHA256
64d52708f594e8a1a3a4f76deef7275c8ad5184480c9473d8f60a0c9b6f4628b

SHA512
a4c83e5d6d9c98af7c93da92b4b8bad25970530655fda2fbb551949fc2ae96eef4fb38ae1799b2f4b84857fd0dd9b3c6a7c9948461394b45b7f2833b8f9ea789

Download Submit
C:\Users\Admin\Videos\If rainbow friends was real life secret.mp4.stream-1.tmp

Filesize
7.2MB

MD5
0e1a35fcc8fe6d37f05fa070f91fdd16

SHA1
4746026625c1f1b60cd649c6f3512e4b4889211e

SHA256
f23bdf1aeb99a4f3a3c17456b12d886cbab1d1748c580129bac1c85227770e65

SHA512
03ff831449fe296619c048ceb51e392fa4bfeca4810a59a1973ebb8aaee12bf4248e75704bb2b81bf96f40f96886802d6c2762e62c2ed21f86cd1a84592f3fd6

Download Submit
memory/3232-740-0x00007FF9AE130000-0x00007FF9AE141000-memory.dmp

Filesize
68KB

Download
memory/3232-725-0x00007FF99C5D0000-0x00007FF99C886000-memory.dmp

Filesize
2.7MB

Download
memory/3232-731-0x00007FF9B2AE0000-0x00007FF9B2AFD000-memory.dmp

Filesize
116KB

Download
memory/3232-733-0x00007FF99AB50000-0x00007FF99AD5B000-memory.dmp

Filesize
2.0MB

Download
memory/3232-730-0x00007FF9B3B80000-0x00007FF9B3B91000-memory.dmp

Filesize
68KB

Download
memory/3232-729-0x00007FF9B50F0000-0x00007FF9B5107000-memory.dmp

Filesize
92KB

Download
memory/3232-728-0x00007FF9B5650000-0x00007FF9B5661000-memory.dmp

Filesize
68KB

Download
memory/3232-727-0x00007FF9B56E0000-0x00007FF9B56F7000-memory.dmp

Filesize
92KB

Download
memory/3232-723-0x00007FF7223C0000-0x00007FF7224B8000-memory.dmp

Filesize
992KB

Download
memory/3232-726-0x00007FF9B5700000-0x00007FF9B5718000-memory.dmp

Filesize
96KB

Download
memory/3232-737-0x00007FF9AE670000-0x00007FF9AE688000-memory.dmp

Filesize
96KB

Download
memory/3232-738-0x00007FF9AE310000-0x00007FF9AE321000-memory.dmp

Filesize
68KB

Download
memory/3232-739-0x00007FF9AE2F0000-0x00007FF9AE301000-memory.dmp

Filesize
68KB

Download
memory/3232-736-0x00007FF9AE710000-0x00007FF9AE731000-memory.dmp

Filesize
132KB

Download
memory/3232-735-0x00007FF9B2A00000-0x00007FF9B2A41000-memory.dmp

Filesize
260KB

Download
memory/3232-734-0x00007FF9983B0000-0x00007FF999460000-memory.dmp

Filesize
16.7MB

Download
memory/3232-724-0x00007FF9B5750000-0x00007FF9B5784000-memory.dmp

Filesize
208KB

Download
memory/3232-753-0x00007FF99C5D0000-0x00007FF99C886000-memory.dmp

Filesize
2.7MB

Download
memory/3232-762-0x00007FF9983B0000-0x00007FF999460000-memory.dmp

Filesize
16.7MB

Download
memory/3232-732-0x00007FF9B2A50000-0x00007FF9B2A61000-memory.dmp

Filesize
68KB

Download