hxxps://github[.]com/Da2dalus/Virus_Maker-by-Black_Host

Analysis

max time kernel
2700s
max time network
2698s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
17/08/2024, 01:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/Da2dalus/Virus_Maker-by-Black_Host

Score

8^/10

discovery

Malware Config

Signatures

Downloads MZ/PE file

Executes dropped EXE 1 IoCs

pid	Process
5768	Virus Maker.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
54	raw.githubusercontent.com
55	raw.githubusercontent.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Virus Maker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DllHost.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 42 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	Virus Maker.exe
Key created	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1	Virus Maker.exe
Key created	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2	Virus Maker.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	Virus Maker.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	Virus Maker.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:PID = "0"	Virus Maker.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 0100000000000000ffffffff	Virus Maker.exe
Key created	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings	Virus Maker.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupView = "0"	Virus Maker.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	Virus Maker.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	Virus Maker.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\MRUListEx = ffffffff	Virus Maker.exe
Key created	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	Virus Maker.exe
Key created	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	Virus Maker.exe
Key created	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	Virus Maker.exe
Key created	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg	Virus Maker.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1092616257"	Virus Maker.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\IconSize = "16"	Virus Maker.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByDirection = "1"	Virus Maker.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\NodeSlot = "2"	Virus Maker.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	Virus Maker.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	Virus Maker.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	Virus Maker.exe
Key created	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	Virus Maker.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\LogicalViewMode = "1"	Virus Maker.exe
Key created	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	Virus Maker.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 14002e80922b16d365937a46956b92703aca08af0000	Virus Maker.exe
Key created	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}	Virus Maker.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	Virus Maker.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	Virus Maker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Documents"	Virus Maker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	Virus Maker.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1"	Virus Maker.exe
Key created	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell	Virus Maker.exe
Key created	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	Virus Maker.exe
Key created	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	Virus Maker.exe
Key created	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	Virus Maker.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Mode = "4"	Virus Maker.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1 = 14002e80d43aad2469a5304598e1ab02f9417aa80000	Virus Maker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Pictures"	Virus Maker.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1"	Virus Maker.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff	Virus Maker.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 62188.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 56215.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
2452	msedge.exe
2452	msedge.exe
1068	msedge.exe
1068	msedge.exe
4716	identity_helper.exe
4716	identity_helper.exe
5660	msedge.exe
5660	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5768	Virus Maker.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 21 IoCs

pid	Process
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
5768	Virus Maker.exe
5768	Virus Maker.exe
5768	Virus Maker.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1068 wrote to memory of 1264	1068	msedge.exe	85
PID 1068 wrote to memory of 1264	1068	msedge.exe	85
PID 1068 wrote to memory of 1940	1068	msedge.exe	86
PID 1068 wrote to memory of 1940	1068	msedge.exe	86
PID 1068 wrote to memory of 1940	1068	msedge.exe	86
PID 1068 wrote to memory of 1940	1068	msedge.exe	86
PID 1068 wrote to memory of 1940	1068	msedge.exe	86
PID 1068 wrote to memory of 1940	1068	msedge.exe	86
PID 1068 wrote to memory of 1940	1068	msedge.exe	86
PID 1068 wrote to memory of 1940	1068	msedge.exe	86
PID 1068 wrote to memory of 1940	1068	msedge.exe	86
PID 1068 wrote to memory of 1940	1068	msedge.exe	86
PID 1068 wrote to memory of 1940	1068	msedge.exe	86
PID 1068 wrote to memory of 1940	1068	msedge.exe	86
PID 1068 wrote to memory of 1940	1068	msedge.exe	86
PID 1068 wrote to memory of 1940	1068	msedge.exe	86
PID 1068 wrote to memory of 1940	1068	msedge.exe	86
PID 1068 wrote to memory of 1940	1068	msedge.exe	86
PID 1068 wrote to memory of 1940	1068	msedge.exe	86
PID 1068 wrote to memory of 1940	1068	msedge.exe	86
PID 1068 wrote to memory of 1940	1068	msedge.exe	86
PID 1068 wrote to memory of 1940	1068	msedge.exe	86
PID 1068 wrote to memory of 1940	1068	msedge.exe	86
PID 1068 wrote to memory of 1940	1068	msedge.exe	86
PID 1068 wrote to memory of 1940	1068	msedge.exe	86
PID 1068 wrote to memory of 1940	1068	msedge.exe	86
PID 1068 wrote to memory of 1940	1068	msedge.exe	86
PID 1068 wrote to memory of 1940	1068	msedge.exe	86
PID 1068 wrote to memory of 1940	1068	msedge.exe	86
PID 1068 wrote to memory of 1940	1068	msedge.exe	86
PID 1068 wrote to memory of 1940	1068	msedge.exe	86
PID 1068 wrote to memory of 1940	1068	msedge.exe	86
PID 1068 wrote to memory of 1940	1068	msedge.exe	86
PID 1068 wrote to memory of 1940	1068	msedge.exe	86
PID 1068 wrote to memory of 1940	1068	msedge.exe	86
PID 1068 wrote to memory of 1940	1068	msedge.exe	86
PID 1068 wrote to memory of 1940	1068	msedge.exe	86
PID 1068 wrote to memory of 1940	1068	msedge.exe	86
PID 1068 wrote to memory of 1940	1068	msedge.exe	86
PID 1068 wrote to memory of 1940	1068	msedge.exe	86
PID 1068 wrote to memory of 1940	1068	msedge.exe	86
PID 1068 wrote to memory of 1940	1068	msedge.exe	86
PID 1068 wrote to memory of 2452	1068	msedge.exe	87
PID 1068 wrote to memory of 2452	1068	msedge.exe	87
PID 1068 wrote to memory of 3124	1068	msedge.exe	88
PID 1068 wrote to memory of 3124	1068	msedge.exe	88
PID 1068 wrote to memory of 3124	1068	msedge.exe	88
PID 1068 wrote to memory of 3124	1068	msedge.exe	88
PID 1068 wrote to memory of 3124	1068	msedge.exe	88
PID 1068 wrote to memory of 3124	1068	msedge.exe	88
PID 1068 wrote to memory of 3124	1068	msedge.exe	88
PID 1068 wrote to memory of 3124	1068	msedge.exe	88
PID 1068 wrote to memory of 3124	1068	msedge.exe	88
PID 1068 wrote to memory of 3124	1068	msedge.exe	88
PID 1068 wrote to memory of 3124	1068	msedge.exe	88
PID 1068 wrote to memory of 3124	1068	msedge.exe	88
PID 1068 wrote to memory of 3124	1068	msedge.exe	88
PID 1068 wrote to memory of 3124	1068	msedge.exe	88
PID 1068 wrote to memory of 3124	1068	msedge.exe	88
PID 1068 wrote to memory of 3124	1068	msedge.exe	88
PID 1068 wrote to memory of 3124	1068	msedge.exe	88
PID 1068 wrote to memory of 3124	1068	msedge.exe	88
PID 1068 wrote to memory of 3124	1068	msedge.exe	88
PID 1068 wrote to memory of 3124	1068	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://github.com/Da2dalus/Virus_Maker-by-Black_Host
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbc36446f8,0x7ffbc3644708,0x7ffbc3644718
  2⤵
  PID:1264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2212,17536781139180813392,17195554897697267908,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2240 /prefetch:2
  2⤵
  PID:1940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2212,17536781139180813392,17195554897697267908,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2296 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2212,17536781139180813392,17195554897697267908,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2720 /prefetch:8
  2⤵
  PID:3124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,17536781139180813392,17195554897697267908,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,17536781139180813392,17195554897697267908,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
  2⤵
  PID:4356
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2212,17536781139180813392,17195554897697267908,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5812 /prefetch:8
  2⤵
  PID:2068
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2212,17536781139180813392,17195554897697267908,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5812 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2212,17536781139180813392,17195554897697267908,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5212 /prefetch:8
  2⤵
  PID:1256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,17536781139180813392,17195554897697267908,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5236 /prefetch:1
  2⤵
  PID:184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2212,17536781139180813392,17195554897697267908,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5084 /prefetch:8
  2⤵
  PID:2912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,17536781139180813392,17195554897697267908,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4920 /prefetch:1
  2⤵
  PID:3800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,17536781139180813392,17195554897697267908,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3016 /prefetch:1
  2⤵
  PID:5040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,17536781139180813392,17195554897697267908,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5592 /prefetch:1
  2⤵
  PID:5236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,17536781139180813392,17195554897697267908,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5624 /prefetch:1
  2⤵
  PID:5244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2212,17536781139180813392,17195554897697267908,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5620 /prefetch:8
  2⤵
  PID:5500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2212,17536781139180813392,17195554897697267908,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6252 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5660
- C:\Users\Admin\Downloads\Virus Maker.exe
  "C:\Users\Admin\Downloads\Virus Maker.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:5768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2212,17536781139180813392,17195554897697267908,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3148 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,17536781139180813392,17195554897697267908,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1
  2⤵
  PID:2356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,17536781139180813392,17195554897697267908,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6248 /prefetch:1
  2⤵
  PID:5628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,17536781139180813392,17195554897697267908,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6268 /prefetch:1
  2⤵
  PID:4996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,17536781139180813392,17195554897697267908,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1704 /prefetch:1
  2⤵
  PID:3828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,17536781139180813392,17195554897697267908,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6344 /prefetch:1
  2⤵
  PID:4880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,17536781139180813392,17195554897697267908,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6248 /prefetch:1
  2⤵
  PID:5796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,17536781139180813392,17195554897697267908,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:1
  2⤵
  PID:3624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,17536781139180813392,17195554897697267908,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3964 /prefetch:1
  2⤵
  PID:3528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,17536781139180813392,17195554897697267908,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6428 /prefetch:1
  2⤵
  PID:5092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,17536781139180813392,17195554897697267908,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4104 /prefetch:1
  2⤵
  PID:5380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,17536781139180813392,17195554897697267908,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5360 /prefetch:1
  2⤵
  PID:4792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,17536781139180813392,17195554897697267908,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5152 /prefetch:1
  2⤵
  PID:4352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2212,17536781139180813392,17195554897697267908,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=1080 /prefetch:8
  2⤵
  PID:2920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,17536781139180813392,17195554897697267908,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5356 /prefetch:1
  2⤵
  PID:3256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,17536781139180813392,17195554897697267908,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6448 /prefetch:1
  2⤵
  PID:1728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2212,17536781139180813392,17195554897697267908,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=3036 /prefetch:8
  2⤵
  PID:3480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=paint_preview.mojom.PaintPreviewCompositorCollection --field-trial-handle=2212,17536781139180813392,17195554897697267908,131072 --lang=en-US --service-sandbox-type=print_compositor --mojo-platform-channel-handle=6264 /prefetch:8
  2⤵
  PID:5148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2212,17536781139180813392,17195554897697267908,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=2996 /prefetch:8
  2⤵
  PID:2212

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4452

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4540

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x528 0x524
1⤵
PID:4776

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
1⤵
- System Location Discovery: System Language Discovery
PID:5368

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e4f80e7950cbd3bb11257d2000cb885e

SHA1
10ac643904d539042d8f7aa4a312b13ec2106035

SHA256
1184ee8d32d0edecddd93403fb888fad6b3e2a710d37335c3989cc529bc08124

SHA512
2b92c9807fdcd937e514d4e7e1cc7c2d3e3aa162099b7289ceac2feea72d1a4afbadf1c09b3075d470efadf9a9edd63e07ea7e7a98d22243e45b3d53473fa4f0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
2dc1a9f2f3f8c3cfe51bb29b078166c5

SHA1
eaf3c3dad3c8dc6f18dc3e055b415da78b704402

SHA256
dcb76fa365c2d9ee213b224a91cdd806d30b1e8652d72a22f2371124fa4479fa

SHA512
682061d9cc86a6e5d99d022da776fb554350fc95efbf29cd84c1db4e2b7161b76cd1de48335bcc3a25633079fb0bd412e4f4795ed6291c65e9bc28d95330bb25

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000e

Filesize
3.7MB

MD5
c00845708ee4e6cbaa628a0886076c4d

SHA1
e011d28a40304957961654e62d00754a772fdee8

SHA256
16f14bd60c84a7838b99c34a791d5d334f08ee1e588c95162290ced38db8b092

SHA512
2b6a09b934ad6076008ad1b8bc960b6c3bf39968275f9f46fe1afbed7228eb196b46172c175106da70af80ad78aafc327869e71860af6472c74867dba022fb59

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00004b

Filesize
43KB

MD5
77ad2a9fb99a4b14419fa968b8c1b979

SHA1
c96d6b5ec25173529cc98c29a3f4ac8769dfee65

SHA256
c8654ac665692db225fbaeb4a51c55474c8d7f02804ef274e231e250fb0afd8a

SHA512
9f353af0ca21457f659bc880ebf8ce941895418dd5d2b472a8ac87ee0d3b31a611021ea81af9c100d892e596cb814e56ea15c8fb3a51eec4815ab879d6c9b690

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000051

Filesize
22KB

MD5
a9cb726786df5afa09eeadbe5846ef66

SHA1
fba4dfe09299134ade5cb5d7116517c8778287b4

SHA256
6a3c362b3bb698447b22bdc90fc22ae1a5402a90ab43399c9758213593fb7aa7

SHA512
16da80f5879d6a0adcf85c2bfa51ddc9581a53f607d823955c2e66f3b0fa7b0ffa65d52c46d716748a7b0e99956cafc6675988586c35c322a7e557563e8a9ee3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\63ae369f53bd7945_0

Filesize
5KB

MD5
ce078506d1928e44038c3020074d7813

SHA1
8c45438e7e79cb4703f69b7b23d5791d9189bcbb

SHA256
5fa908572496c6ca6a188e823767baab3a2ee8f95748ce75c8c9f0611bd07a1a

SHA512
6b7e8707e705b7bb584b1f1aa4ec9e85544d646b88e7b56bb25de37f743654b1faa63f9e8ac5809e429573dd6ebf806a5bfb6ae9a59e2c7ef76e2899c27bba2d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\6cb9629731c8b170_0

Filesize
2KB

MD5
9d2b39a32900668c24931548996499ea

SHA1
d37a45246a264f093bae08a10666e9efdff75539

SHA256
500d3d3f8b17c785edab44b3c390b4d1aa48702a9b4a38e3d823efa1876aab7d

SHA512
cb6d63b7b6e4d7e9b422afdd2c3a6e0bdf13fba69c51383408a205d9258a425467394242249286d9533088ba330219095bc47c410c1f9ae71d05c65783b40fdd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
c7c9ee52b122eedb05e6286d8fbaad0e

SHA1
df4eeeda423bcafe288db7c1f596baa8bffbf720

SHA256
7880100f77875c41406ebf2c4cca52f40952230c2aaaac1e09c22bcfc671204f

SHA512
34d6541fbdbbac781b2ab7827eb5e93418aa753aaa2b79d1af5f6931087d7c9bfd781ab3e8086d7dcf7441df8aaa429f905bc54a4eaac828c6e1040d2e4e6848

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
10KB

MD5
826a9c9c12e631711a99fa13823e18d9

SHA1
e44a15e3f5a5eb21bd54a2be129750eacc342dfc

SHA256
e626432a189e75a190a74b52a43d310f5813b00282184cf6b128ff4a78099fad

SHA512
3a7b0daef8269dfb92bcdbf043932fb42fef66a0f021506030ed1f89507b83f56bb585473538cef8e912e08c0670c47ea63c01bfba968cf8b68596ccde883f74

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
10KB

MD5
abf130c11f27ceebc210925d1ba45123

SHA1
858ed026518b104ff98ae8669b8c31757c44e7bb

SHA256
ef2f916532e844db2b90e8af389c3d7a8d6efc854ff2e47dc992b21411131c45

SHA512
ad647dffd0a334cf12aeb38c6766a474faef07162daebfb9b51fce2428375a3093652a303877e2e7a8a66651619d7f4e9e53d43979494bcc7da931c6ec315f4a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
579B

MD5
5613f5ab886cc1ce42bc8b34123df98c

SHA1
1ef00f63038f992470abd0d530e1033b076e676c

SHA256
0a63b79dda73fb0d7941488e73455bbf96e5f1c3df920c93a959605ad8445d16

SHA512
55c098634c4457091724a69d2a15bba1c59bee26faa0b27c3e58e8de2cee808db4493847306a2ddfeaec3dce72d21f4b2d1dcedf1895fe64ca9a3cd07daf3a02

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
eab050719444585b07dc6d4a2cc8609c

SHA1
e09819bbe2c2414031c054af9da84983394d9f4f

SHA256
5f7b9f0ff257d5ff786b9fe5c7b935327225abd3b8c8bc90ef1f999dd7b775fd

SHA512
8744e1dc6884e614cba7cfb0bfcb32a95136c2d90b1ddaf7698787566872ceb1a444f6499e84f599f6fba01452c9caf09da3e7dd2d5fbf6a14669113af9ad505

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
807419ca9a4734feaf8d8563a003b048

SHA1
a723c7d60a65886ffa068711f1e900ccc85922a6

SHA256
aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631

SHA512
f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
579B

MD5
7ac37464384ee7179ac68d1e99242b2d

SHA1
4ee441656cca629a32015adecc58aee62ae1f653

SHA256
e1ccebabefc990c0bc44376e9070301b5f1d57ed0260c81c4e78136e66fe2690

SHA512
ff6a8d9db51b9abeeceb69d251f38ccab6be5b670c193cab2f2b60292f5c66016db516980f14848021dbdb6e1933712d588fd3eafa7a7a36fd1657a3b55b3db1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
c18990a679fe8d7a9043743294bf40a9

SHA1
72c80cb2cf05be791f1bf590cfb150469d05d383

SHA256
81682842cbc9ad1c4eeb8a0729a6aa59ceda2b6b94b0c91e71138888867aacea

SHA512
e84c1f90d85e8aeb55cc6a342cc2eaa7be4f6308028802df8eae19833f10605e27608b59a72b1913e066576d6bd9e51e0b2e17b258dc243f029fd040a08b2c9b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
e1e7eb60df319041e8645a884f217e63

SHA1
a88d899a151701fc1031bf146cb3159f2a01fc56

SHA256
00a845456b2cf61e694fe0e62a453edeac6f4183218669f245a6630918953274

SHA512
a7bac5f98eac6e6bf06ea570ee2984121e7b9259bf69315580b08ccd1adb055c4200834edfe1c90fdb47215c16a4627f121a05ad8b8fab9e0029e1a58bce6b3d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
ea8641634d048ea9cf8f4df436fe520b

SHA1
7702a6c3c6bf21d8f8dc8acbad27e9216e6cb738

SHA256
d7818f7d188258a515409d94be107f51f7fd170165a94263ea0db7443f79230e

SHA512
aa8a55e3ce2ac5abbd2c45bbbfc9bac9f745c35352fad19bf6d12df2688ff641948fa3d957331773f4d3ba3a48d84e81dd97619441cf61238c4447604a2ba4e1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
5a31cd51c52713cb08336d5f017fd26f

SHA1
57136416428222e221e9f60811907dc111c41362

SHA256
a859a0f5d723cc9c545cada69c345ba6deb626cde1d2f02eb64d726b359e71cb

SHA512
eea4a0e6c6aa81c545877ef57b396c7004079468acaeaa817de7f98c93faa8b72757d2e572d41918dee32d40633950e9393d4744755d95a1e91911a8f19aa82d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
f0d906e75f88426aab2e0f6b4ceb8fb7

SHA1
585c5f005bea66805763f0b66139fe8518624636

SHA256
e7f05c09e3c7b040dd1481adc354475c2a12ad41a61dab0867b56d1871c88658

SHA512
e53245e0b5577796be54c4658fd516414f17f090978dfdd2f5dcbd2a823d694761456cedaaf79c12995e4e8f8504b34d746011db0639b56ff83cff5d5ee31be5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
49590a264da0fbdac69a327a7c95f176

SHA1
bef30b42250c5a68e667da4fcaeeda50557baeae

SHA256
821b76630a8eb059cb0e0e47d3d2fbacf045835d539b30f3b428b00df4882fb8

SHA512
c578ddb98f23bfc931cfd6445a310796c79c020dd0568b19bfb885255ad809fb0d8a504752cfdd68e3eb4395e8561e06f718b0ba9c6e288a1edce9cec2bb93dc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
2d183748bc52ca96494e1635a8dfb456

SHA1
9ca0f28eb5f0a24604ad8cf70187f83d0ee2925f

SHA256
acf98582b61e04bef62174e59a159bbc55d25e3da152b64a2251b8ac38321a24

SHA512
66d34bd994a24136c2bda8f70dc36b28962ae8b5003ee2b7228b86d180d2c8b77659ab4857055ed8b7f8283e1836c88128fabaec77e9fb845c683d96e0f7a51d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
d88c8a6d2d533d2e641d9b0fdbee360e

SHA1
800252fe6abe57344c5c07188e28024a7c33433c

SHA256
65a4650b40aa78f500e6c379569d7d871714362e986c298231e7c73c6d02b360

SHA512
43e985d1d6512b903fa1b2a76c099841afb1a629d8a532a611e073e48b5e1931fbac5c2e635649f40d5fa9ea3b38448bb57dbcaf128df64ed9e55a4c40179799

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
26bb33a60af5c177798309df22eac523

SHA1
a51f4cb94e033f0c3a4186a31d7e208b7f792d51

SHA256
5093ac068d0f327db1ac1336c7c40dfc3b01554d3b322e15644513ef9a13d529

SHA512
690d5b90b9b1b1d4d43c9fc4252966d0e3c0f63a025e1841b28a2450db32ce000747fc76cc2bfda357067be7a04138fed36a0ca4fa2b6e8cfdcbf1cb6034f0c0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
9dba1063fe66b13cfbc52c3f0f586c75

SHA1
4ea454311a6741e3a69b45e0d43ac44ef30d1cbc

SHA256
96c1aaa9f32e0873e77cf5b3fcaef21d0b950cdde3d7c62b8dc49e2e7a5a8b25

SHA512
485a7a495c8fa17745ab4821086fdebc771640d464b507e3433d9dc5dd1895182b06be199be9bc886f4268008ed37c83b67de9dfe38b00d001b7a77e692f50a8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
d9df687cbef7121480bbbf355e1f95db

SHA1
e3519b82d759501532ec105d82c7afcf405bfc85

SHA256
f5ea441dbfdac8ed187ff4a52be12c0b31660d9b3b97c2b98e080813d26066b6

SHA512
54dad14724694abe48b28e2dc83934d7f9fd6d552b3179376f40d82611adfeded26746dfe82c0c4189afd6efcca3eebc6bf8c704995e848c70b9fcc8e27b34e3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
bcaf006cf457a4b6acba60e8bf6ce62a

SHA1
9d87ee7b52e955c6a0c43a37a1bcdf904da00557

SHA256
f9c6b3b422fea5202cb592f858662087d61718f4935bb05f7c4ebab93e10adf6

SHA512
5a54ca17278f912fa0a24bb4f3e189ef84b18c928d5219e9ef9c75ec60e72f541e1afb44b830501999d2da7f7c99a72ff21533b50502bc6018687661df04aa31

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
5e2c2bb64abbb215bcc44c5f20382884

SHA1
a288987085366b75bd50f7a2efac38488e626aed

SHA256
00e9f0a96ac07f9186e8cd2d13bd0cbcae245cb4fb696d2216addcf5eb14006b

SHA512
800ea218ca0a4461ebeb562b9a99e91716b6e7ed1d75d1ee63cb8825f28f46fd364073331bec0de28a03c23a7a1042ede0c74fed37bdb4dd3ca41a6a859fc5fe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
3b613749e936b5fdf899fb0dac8de865

SHA1
f94c8a8efcef24fd6894b7efe7236b5e4dc97e40

SHA256
497088647e54dd903ef684768ecbc51705b71af63465ddd45b12fad8c5a0d20e

SHA512
a405f6248d12cdb9e36ce88e8e285058e08ba2d53ac12f60da2fffc9f2e694c0e61af013b73c0bff9beae48a40f178603e0ebffa50e0b780c63b06c173957672

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
2f485db036283b3e5333778583e71906

SHA1
dafbe98ead2a84f3b3a602a4e093fd020a9e129e

SHA256
34494bafb83133ce4703d5b14bb00344b09833307c63afa6229d0f2a8a7206de

SHA512
e05a91efe116ad76025cb695a4fb121f1287c59598f793b4651e26485a9af89eb376df516672388e66187c71e3119e09277bbae98b0d3856a901deb565ae686f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
b6ac95e246cd51f3e58e1afaffad7dbc

SHA1
51d8492c8a6b42de5aea27c1424265c9d9e69d76

SHA256
968492eec4833a1b492e75ca867c1e4a4a3ee9a421e3bf60a728a4aeb3e574b4

SHA512
0ea2629b5d5844ae04fd432c991bb663dd2e49949fd4ebffd0e4386ea2f387b44458a52ea8d7de15a4bdfaba651f28e9bede267e864efa0bad1799ffba7ecc02

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
0777a9ea09efc5d006cf3f395cfa0cf8

SHA1
51ae04899b9036af56de8338fbb975ec570ecb4a

SHA256
4d19c0ef526bac5af3973f7e3fd37b8533faa1d76b344173938107c9fa213f17

SHA512
5a35551c077f6284a1280ae2756dab49edcdd8a3d1d7367e0af16102f7d227eeed1ecdd8f32d86f1894e08421a9171610fdb3af95ce476427c13483ac7f1b2e8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
5b7a0d54ef829ea869262958d792b747

SHA1
6a0ebf651d71dc20753dd40e7528b3ec127fe5bb

SHA256
7d0890a8aa61e3213e2ce0953177fd17d44b7be65e1c284b83824b5ab599cb30

SHA512
7bd50ca446bdd1e13f10f8855f8012b3e95db00400f1d783e255062f9c9e1b1273581a275bd46822c10028a2333d1b1245f833525bd881c3a0471f66178d2544

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5826cd.TMP

Filesize
707B

MD5
be50b8fd40c33fed67ccb389cf69720b

SHA1
4cb907de4c3e27cbeaa1a7796a65cdd0d13cbe75

SHA256
18a21d73318b925cd0fc2973592aed1b24059208e124e4bbd4a8dbbb462fcb30

SHA512
c6b96cdd51f7f4663c64ba248fd38f9977b25b8de36e5474621b00e29f18f289cf76e977e44dc0f322b5d4677ebd13810362a1e4779b43df9fdf2775d5715bad

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
c8f30b4a01e15bcd3e97de9d07553887

SHA1
2993db4e38ea5d6d538e18a3e30fe3ad5f8eb718

SHA256
e59cc985b3164199bb9641c89ef568df2f99194a83dbc1e33c29f296feec2f8e

SHA512
7e0e41728bd730a5af6c29422802774fcb965b2184029b7c61bf4500b6ee72829353b7fb1d688d4fd52eac211f95a349db01547d98232d891012367a72c64cb4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
e76e5e468456d9b46e805be4eb5ede79

SHA1
fdfd6590c4219db3252a82cc7427b4b297fde86f

SHA256
95df058c22d82c7a13f20b4077d8a88446171345487f14de119601ef3289c94b

SHA512
1faa057c98436181f92bf1390b142f25eb173d14a9a49d0eaa45b42fc582a10bcccaf615ed3d0ce9bfdbc681b5af41590837f0eee7777597c373651d66c82ac6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
d1580224c6941e1a84f86d22fb676f98

SHA1
f92e329e804e2a12662d64c6528e1357addc5694

SHA256
f0cdf75f774ffb245cc74b0ce4e819e3875b9b6f9f459162108bc3117709fd7d

SHA512
817460d226927db52399be946b23257f1fb03e189ec1a9014a450c191fe1f7b90c648c85ac14b1903b8ab321872e0755d87b45bec31a7644ec5c3b7b42d2b742

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
3b00d316c67ca563c4f9076b41edb5a4

SHA1
1f26e7874bb67c42ae7d257c705f743c11bfded9

SHA256
a02651f644ba1c5338f142a2b9215aa47160a8c8cbf9f41d2518afa947ec7d4f

SHA512
8e6394d366a9f4402127204bd8a930750c1c60e71b36dfe6e7c511d7683a096d3ee15bb97521fbeb726f1f2fcb092bf7d959eed179b062a51183c8867542af4a

Download Submit
memory/5768-269-0x0000000005810000-0x0000000005DB4000-memory.dmp

Filesize
5.6MB

Download
memory/5768-267-0x00000000004A0000-0x000000000084E000-memory.dmp

Filesize
3.7MB

Download
memory/5768-270-0x0000000005300000-0x0000000005392000-memory.dmp

Filesize
584KB

Download
memory/5768-268-0x00000000051B0000-0x000000000524C000-memory.dmp

Filesize
624KB

Download
memory/5768-271-0x00000000052D0000-0x00000000052DA000-memory.dmp

Filesize
40KB

Download
memory/5768-272-0x00000000055A0000-0x00000000055F6000-memory.dmp

Filesize
344KB

Download