hxxp://normalnastrona[.]rf[.]gd

Resubmissions

03/09/2024, 15:57

240903-td5p5ssaqc 8

03/09/2024, 15:55

03/09/2024, 15:54

03/09/2024, 15:53

03/09/2024, 15:53

03/09/2024, 15:50

03/09/2024, 15:45

Analysis

max time kernel
316s
max time network
313s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
03/09/2024, 15:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://normalnastrona.rf.gd

Score

8^/10

discovery

Malware Config

Signatures

Downloads MZ/PE file

Executes dropped EXE 8 IoCs

pid	Process
5168	ChilledWindows.exe
5856	rickroll.exe
5192	rickroll.exe
4212	rickroll.exe
5980	rickroll.exe
2292	rickroll.exe
6120	CrazyNCS.exe
3624	Melting.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\B:	ChilledWindows.exe
File opened (read-only)	\??\N:	ChilledWindows.exe
File opened (read-only)	\??\X:	ChilledWindows.exe
File opened (read-only)	\??\Y:	ChilledWindows.exe
File opened (read-only)	\??\G:	ChilledWindows.exe
File opened (read-only)	\??\J:	ChilledWindows.exe
File opened (read-only)	\??\L:	ChilledWindows.exe
File opened (read-only)	\??\R:	ChilledWindows.exe
File opened (read-only)	\??\S:	ChilledWindows.exe
File opened (read-only)	\??\U:	ChilledWindows.exe
File opened (read-only)	\??\W:	ChilledWindows.exe
File opened (read-only)	\??\E:	ChilledWindows.exe
File opened (read-only)	\??\H:	ChilledWindows.exe
File opened (read-only)	\??\M:	ChilledWindows.exe
File opened (read-only)	\??\Q:	ChilledWindows.exe
File opened (read-only)	\??\V:	ChilledWindows.exe
File opened (read-only)	\??\Z:	ChilledWindows.exe
File opened (read-only)	\??\A:	ChilledWindows.exe
File opened (read-only)	\??\I:	ChilledWindows.exe
File opened (read-only)	\??\K:	ChilledWindows.exe
File opened (read-only)	\??\O:	ChilledWindows.exe
File opened (read-only)	\??\P:	ChilledWindows.exe
File opened (read-only)	\??\T:	ChilledWindows.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
97	raw.githubusercontent.com
98	raw.githubusercontent.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CrazyNCS.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2392887640-1187051047-2909758433-1000\{864613AC-2ADD-4C27-9A49-4D157535E6D3}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2392887640-1187051047-2909758433-1000\{2243E9B2-14C8-4721-88BB-CF4B6E3342DE}	ChilledWindows.exe

NTFS ADS 4 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 551981.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 613112.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 669809.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 340562.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
3560	msedge.exe
3560	msedge.exe
3500	msedge.exe
3500	msedge.exe
4912	msedge.exe
4912	msedge.exe
2848	identity_helper.exe
2848	identity_helper.exe
1776	msedge.exe
1776	msedge.exe
5764	msedge.exe
5764	msedge.exe
5764	msedge.exe
5764	msedge.exe
5792	msedge.exe
5792	msedge.exe
5316	msedge.exe
5316	msedge.exe
2636	msedge.exe
2636	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 18 IoCs

pid	Process
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: 33	4988	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	4988	AUDIODG.EXE
Token: SeShutdownPrivilege	5168	ChilledWindows.exe
Token: SeCreatePagefilePrivilege	5168	ChilledWindows.exe
Token: SeShutdownPrivilege	5168	ChilledWindows.exe
Token: SeCreatePagefilePrivilege	5168	ChilledWindows.exe
Token: SeShutdownPrivilege	5168	ChilledWindows.exe
Token: SeCreatePagefilePrivilege	5168	ChilledWindows.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
5168	ChilledWindows.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3500 wrote to memory of 556	3500	msedge.exe	83
PID 3500 wrote to memory of 556	3500	msedge.exe	83
PID 3500 wrote to memory of 1816	3500	msedge.exe	84
PID 3500 wrote to memory of 1816	3500	msedge.exe	84
PID 3500 wrote to memory of 1816	3500	msedge.exe	84
PID 3500 wrote to memory of 1816	3500	msedge.exe	84
PID 3500 wrote to memory of 1816	3500	msedge.exe	84
PID 3500 wrote to memory of 1816	3500	msedge.exe	84
PID 3500 wrote to memory of 1816	3500	msedge.exe	84
PID 3500 wrote to memory of 1816	3500	msedge.exe	84
PID 3500 wrote to memory of 1816	3500	msedge.exe	84
PID 3500 wrote to memory of 1816	3500	msedge.exe	84
PID 3500 wrote to memory of 1816	3500	msedge.exe	84
PID 3500 wrote to memory of 1816	3500	msedge.exe	84
PID 3500 wrote to memory of 1816	3500	msedge.exe	84
PID 3500 wrote to memory of 1816	3500	msedge.exe	84
PID 3500 wrote to memory of 1816	3500	msedge.exe	84
PID 3500 wrote to memory of 1816	3500	msedge.exe	84
PID 3500 wrote to memory of 1816	3500	msedge.exe	84
PID 3500 wrote to memory of 1816	3500	msedge.exe	84
PID 3500 wrote to memory of 1816	3500	msedge.exe	84
PID 3500 wrote to memory of 1816	3500	msedge.exe	84
PID 3500 wrote to memory of 1816	3500	msedge.exe	84
PID 3500 wrote to memory of 1816	3500	msedge.exe	84
PID 3500 wrote to memory of 1816	3500	msedge.exe	84
PID 3500 wrote to memory of 1816	3500	msedge.exe	84
PID 3500 wrote to memory of 1816	3500	msedge.exe	84
PID 3500 wrote to memory of 1816	3500	msedge.exe	84
PID 3500 wrote to memory of 1816	3500	msedge.exe	84
PID 3500 wrote to memory of 1816	3500	msedge.exe	84
PID 3500 wrote to memory of 1816	3500	msedge.exe	84
PID 3500 wrote to memory of 1816	3500	msedge.exe	84
PID 3500 wrote to memory of 1816	3500	msedge.exe	84
PID 3500 wrote to memory of 1816	3500	msedge.exe	84
PID 3500 wrote to memory of 1816	3500	msedge.exe	84
PID 3500 wrote to memory of 1816	3500	msedge.exe	84
PID 3500 wrote to memory of 1816	3500	msedge.exe	84
PID 3500 wrote to memory of 1816	3500	msedge.exe	84
PID 3500 wrote to memory of 1816	3500	msedge.exe	84
PID 3500 wrote to memory of 1816	3500	msedge.exe	84
PID 3500 wrote to memory of 1816	3500	msedge.exe	84
PID 3500 wrote to memory of 1816	3500	msedge.exe	84
PID 3500 wrote to memory of 3560	3500	msedge.exe	85
PID 3500 wrote to memory of 3560	3500	msedge.exe	85
PID 3500 wrote to memory of 3196	3500	msedge.exe	86
PID 3500 wrote to memory of 3196	3500	msedge.exe	86
PID 3500 wrote to memory of 3196	3500	msedge.exe	86
PID 3500 wrote to memory of 3196	3500	msedge.exe	86
PID 3500 wrote to memory of 3196	3500	msedge.exe	86
PID 3500 wrote to memory of 3196	3500	msedge.exe	86
PID 3500 wrote to memory of 3196	3500	msedge.exe	86
PID 3500 wrote to memory of 3196	3500	msedge.exe	86
PID 3500 wrote to memory of 3196	3500	msedge.exe	86
PID 3500 wrote to memory of 3196	3500	msedge.exe	86
PID 3500 wrote to memory of 3196	3500	msedge.exe	86
PID 3500 wrote to memory of 3196	3500	msedge.exe	86
PID 3500 wrote to memory of 3196	3500	msedge.exe	86
PID 3500 wrote to memory of 3196	3500	msedge.exe	86
PID 3500 wrote to memory of 3196	3500	msedge.exe	86
PID 3500 wrote to memory of 3196	3500	msedge.exe	86
PID 3500 wrote to memory of 3196	3500	msedge.exe	86
PID 3500 wrote to memory of 3196	3500	msedge.exe	86
PID 3500 wrote to memory of 3196	3500	msedge.exe	86
PID 3500 wrote to memory of 3196	3500	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://normalnastrona.rf.gd
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb062446f8,0x7ffb06244708,0x7ffb06244718
  2⤵
  PID:556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1992,11865857897375083465,8979672049101674782,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2080 /prefetch:2
  2⤵
  PID:1816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1992,11865857897375083465,8979672049101674782,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2520 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1992,11865857897375083465,8979672049101674782,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2688 /prefetch:8
  2⤵
  PID:3196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1992,11865857897375083465,8979672049101674782,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:1128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1992,11865857897375083465,8979672049101674782,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3388 /prefetch:1
  2⤵
  PID:4104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1992,11865857897375083465,8979672049101674782,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5160 /prefetch:1
  2⤵
  PID:232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1992,11865857897375083465,8979672049101674782,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6040 /prefetch:1
  2⤵
  PID:3604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1992,11865857897375083465,8979672049101674782,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6084 /prefetch:1
  2⤵
  PID:4124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1992,11865857897375083465,8979672049101674782,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5240 /prefetch:1
  2⤵
  PID:796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1992,11865857897375083465,8979672049101674782,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5164 /prefetch:1
  2⤵
  PID:988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1992,11865857897375083465,8979672049101674782,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5996 /prefetch:8
  2⤵
  PID:1760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=1992,11865857897375083465,8979672049101674782,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=3360 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:4912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1992,11865857897375083465,8979672049101674782,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5304 /prefetch:1
  2⤵
  PID:4984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1992,11865857897375083465,8979672049101674782,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3796 /prefetch:1
  2⤵
  PID:3496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1992,11865857897375083465,8979672049101674782,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6412 /prefetch:1
  2⤵
  PID:4872
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1992,11865857897375083465,8979672049101674782,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6388 /prefetch:8
  2⤵
  PID:4504
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1992,11865857897375083465,8979672049101674782,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6388 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1992,11865857897375083465,8979672049101674782,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5272 /prefetch:1
  2⤵
  PID:1128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1992,11865857897375083465,8979672049101674782,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=180 /prefetch:1
  2⤵
  PID:2096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1992,11865857897375083465,8979672049101674782,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2976 /prefetch:1
  2⤵
  PID:2032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1992,11865857897375083465,8979672049101674782,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3576 /prefetch:1
  2⤵
  PID:4520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=1992,11865857897375083465,8979672049101674782,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=6996 /prefetch:8
  2⤵
  PID:4044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1992,11865857897375083465,8979672049101674782,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4700 /prefetch:1
  2⤵
  PID:4504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1992,11865857897375083465,8979672049101674782,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4068 /prefetch:8
  2⤵
  PID:3192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1992,11865857897375083465,8979672049101674782,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5100 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1776
- C:\Users\Admin\Downloads\ChilledWindows.exe
  "C:\Users\Admin\Downloads\ChilledWindows.exe"
  2⤵
  - Executes dropped EXE
  - Enumerates connected drives
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:5168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1992,11865857897375083465,8979672049101674782,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4888 /prefetch:1
  2⤵
  PID:5696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1992,11865857897375083465,8979672049101674782,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=7200 /prefetch:8
  2⤵
  PID:5728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1992,11865857897375083465,8979672049101674782,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=7228 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1992,11865857897375083465,8979672049101674782,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6924 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5792
- C:\Users\Admin\Downloads\rickroll.exe
  "C:\Users\Admin\Downloads\rickroll.exe"
  2⤵
  - Executes dropped EXE
  PID:5856
- C:\Users\Admin\Downloads\rickroll.exe
  "C:\Users\Admin\Downloads\rickroll.exe"
  2⤵
  - Executes dropped EXE
  PID:5192
- C:\Users\Admin\Downloads\rickroll.exe
  "C:\Users\Admin\Downloads\rickroll.exe"
  2⤵
  - Executes dropped EXE
  PID:4212
- C:\Users\Admin\Downloads\rickroll.exe
  "C:\Users\Admin\Downloads\rickroll.exe"
  2⤵
  - Executes dropped EXE
  PID:5980
- C:\Users\Admin\Downloads\rickroll.exe
  "C:\Users\Admin\Downloads\rickroll.exe"
  2⤵
  - Executes dropped EXE
  PID:2292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1992,11865857897375083465,8979672049101674782,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2132 /prefetch:1
  2⤵
  PID:932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1992,11865857897375083465,8979672049101674782,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4124 /prefetch:8
  2⤵
  PID:5092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1992,11865857897375083465,8979672049101674782,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6952 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5316
- C:\Users\Admin\Downloads\CrazyNCS.exe
  "C:\Users\Admin\Downloads\CrazyNCS.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:6120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1992,11865857897375083465,8979672049101674782,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6012 /prefetch:1
  2⤵
  PID:1860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1992,11865857897375083465,8979672049101674782,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4916 /prefetch:8
  2⤵
  PID:5892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1992,11865857897375083465,8979672049101674782,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6920 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2636
- C:\Users\Admin\Downloads\Melting.exe
  "C:\Users\Admin\Downloads\Melting.exe"
  2⤵
  - Executes dropped EXE
  PID:3624

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3924

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:560

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x474 0x300
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4988

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\1bd46691-580b-44c0-aafa-8b916cab6f39.tmp

Filesize
10KB

MD5
72462a8bf4054bd990e1725a46de87d0

SHA1
707499a1ecdba5c1d7746d68140e89357caa2a31

SHA256
0c4289900349c2bd7629a684e12479a5f511d55831918bf56c3519bca779f878

SHA512
3a6cb872077e232066bc7a5c798cfd29702d2ed979fd0135a1ef6b7f99d59656d84c15b41139b222176056c21470a8b8278eb08bc76b8c73bacd8b2efbb7ba90

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
eeaa8087eba2f63f31e599f6a7b46ef4

SHA1
f639519deee0766a39cfe258d2ac48e3a9d5ac03

SHA256
50fe80c9435f601c30517d10f6a8a0ca6ff8ca2add7584df377371b5a5dbe2d9

SHA512
eaabfad92c84f422267615c55a863af12823c5e791bdcb30cabe17f72025e07df7383cf6cf0f08e28aa18a31c2aac5985cf5281a403e22fbcc1fb5e61c49fc3c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b9569e123772ae290f9bac07e0d31748

SHA1
5806ed9b301d4178a959b26d7b7ccf2c0abc6741

SHA256
20ab88e23fb88186b82047cd0d6dc3cfa23422e4fd2b8f3c8437546a2a842c2b

SHA512
cfad8ce716ac815b37e8cc0e30141bfb3ca7f0d4ef101289bddcf6ed3c579bc34d369f2ec2f2dab98707843015633988eb97f1e911728031dd897750b8587795

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
2a0591afe83bc73ed4b1ebfb099ee772

SHA1
9791c2ebe11aa3516fa6400ba79f87de41e8efe1

SHA256
379c4f9b5582b7cb179e27297ade2775c25f4c6d4d6cd3395370cba9074a2ad8

SHA512
b346fa3152eedd1831fda6c2bcdca0121c2a72280f7393b825d4c575ce03ca17825e6cf5806f0488a8aa77ae59cb6d56ca9f0465aafa136f39e66c23f3e55269

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
8c151d4325a8b373bc03345c9147aeab

SHA1
245175d763001dbd60580345893966031699e3c6

SHA256
f1f4a6394b08836d342f3b9e54eb2f6552a70beac285852dff061c9baff2bcc4

SHA512
19ce59640c7b2f6d26fdbaa6642991e519a3cd65ef98683dce40ba31a10508e32c0b0283dd44f0f3ed31b7724e841c1e9ae3510ae327afa69f65cf95fb110f13

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
64c60e6d304749c141c6b9f665a11a33

SHA1
6b0434beaf09c9d41a4baa988afd9de125e16baa

SHA256
ffe334a731bbe65f4ee56c5a159280e7fd9babbd74f347a89e3208eb16fb893a

SHA512
4d3811d358053dcb9e5aabc56280833d5a8165af76063e6477884f03087b582116367e42c0be211066345a66f5459cef14210cdfd2ef44e19a083f687b3dc884

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
a3108d3683766aab77361cc1b18c5a5a

SHA1
2debd84ab6a3e3bc56013d07efa2970237f2ae96

SHA256
980c934bccd741c95fd3293c15edd99bdb8b638d0f10e65a42b2a7e53411abf0

SHA512
f4e74476ebb72b156ebd43b2c8591a3463faaa87d12ffa555f513caa9aa9b28dfa842256fab590fef7c1d325b2b61556db637f8d15154081b3c122d13b2f3e2e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
f39147e50f89a245807f073894d5de61

SHA1
56089cb698d67ed9fb041a04f4caecd8fe602a50

SHA256
be584f6dfb631b187b1903e09500862712efc85c7a98d336e96bc2a252137a6b

SHA512
30ddd42022b3d9e089e5f9bace6c2dce3cf535ef9a751c6582e88c64b6945b5a4a6d7094294841072098db14b964a04db492ec90262423a619ab39a55fc40032

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
ef71b0beee11059b92aa3b340f39c589

SHA1
57cc05e722d2a46fa545df389847e86f0ad7ebdc

SHA256
6404b0962e847fe18c4efdb6816e65a227911675baf634891b3e4102c17b4e1b

SHA512
90cd505fe05e0563d2395bd9c618e62e4d2455eadce55707ca114ef75921acfa839014c7168eba89a8ae420315bd2d9755590357b2bc8f874240fa590ede0f45

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
50cae42bdd08c9f38b07dc925ddd2a8c

SHA1
cbb9c0f5977b94568355e933acbe8788a179d52c

SHA256
6d379e37971f7481781746bfdd48be36cb9b5d336286c490e5ec6cb940027258

SHA512
024b9a0ebbfe31151405f6de79a2594c09aefbeec7936897b302cbbd3f312378c2258a1b919e8e348891fe1cbb3a346329ec571021a4b5addefc7d6182c824e9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
d24ba958e036ab0c0576322f8ffa2b3a

SHA1
0e8ee50ee0ca8874a847dbaee2801218a26f0862

SHA256
fdb600b0984065e0a3873d8338e06521ed8aed110e202de78f32b3d2830555fb

SHA512
167c8f348c4b0d9f91cfd79a5af8f43516f3dd22fa1300e73904f76620d1613de38cf43c8df49050745654c733d61d7b6227b63289d9063f87880a86cdf614c6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
84c99685678ae41ae2ed6b80f9f17a22

SHA1
e8d2ab421e1d06ff5852053304308def48e6e9f8

SHA256
611a0ba2043af45b5fa0b53fd7004a0f9bb804c760a7a6cac802634acddb8f94

SHA512
9d003e4bf5d255d188fcbc24c24934fbd1f50b683a80e087a1d044c159a0ffd627c1f7806b95f3df92967560c1e027c8ccc6869597be10d668f1f71a3c20c97b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
f6393740195c0355c828245761ae9f4d

SHA1
30ea1f70f38c33a2eeb36416cae43ad9f6c8018d

SHA256
0a6ff44317270afbd77b6f966031dcf174d51bb5be613ab2bb33cc7a7019d4d0

SHA512
78b84e3684ecc8488054a142441fd5d24dda3df3e8109f58d502c19dcb6c6f36ffbc3bc08b618cd683fcfd6eb68f8a7cebcd370fc08ac7c011bc6b0b55127271

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
f7a463adaaa903a1dbabb9e910993ee8

SHA1
8d07c2559bb79ec305e4d69f96d061c8d5208fc7

SHA256
4b7c9a166102effc82fe1b91808155744bcadbe82aa86d53cdeb4813559bf446

SHA512
a52afdda03f36b509726d402a241155d261e71d9d8c36f027e4788ff3af0ba7b7e96b023f7a86a28cecccafecc59d82f47a21a41574f1e1b567fd1db7a36e4ab

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
a95c42866360dc786c13ba34203bb1e9

SHA1
881d254fddd9e860469c052b5f04d2e2f03b14a9

SHA256
5f3a333e086ae8d74265105987f61583eb0509241a9cee7ebca99522a477be14

SHA512
4f70619a94fb138ba3eceadd08a8225f0881cf2fe25dfc0c402bc96cf197ea5f23aabc8e5bfc8b2835c52327d5515822ab992128af606f4a5c2e7b98cc922e75

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
c24e9014164458651b4f381dc49dcf59

SHA1
0d16636b5ee91a8ffe5d78214d6203c7862327e2

SHA256
959c649e344c180d1b4f29d615f2796f19e8fa0d1b6718c45869a5b7dbb8466f

SHA512
6bdeda798c27dae02cc00886fda6775ed0bb834c5ed2f7d04b73d4780d58388f3933637180d5e2b8a50beb9a853acbcd04c2d4d1ba9b372a42a6b8d23359b04a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
7f26d46491fde57174aa26ef3cdecad8

SHA1
c191222c109ceb8143896393e85e50b2c4d1ee5a

SHA256
aa835a87ffe5f75299c4e32438c481476650fadde95cec9e8ef3e2f583f9c382

SHA512
c705f67590fca38978d7be59efe31ece13da393eb95cb81894905a14496acd067baf6bee13f7f1459da42a092465512b42aaac61f09fc65ba73f0789294d7819

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
abbc4b3fc6f0bbc0dea95b998a1b4cce

SHA1
9ef017f9fc197d2c7e251b4dab4169e1cb6a9489

SHA256
dfdb86d71e47a95889bc21d80d1b41251aca44079b08c8aa818bac15727f0d07

SHA512
4b81029345ac57536487c272b9bb4df7da8cfce39f3f831f344cd5a4150c1783c09fb7b40d720df071b99cbca52ab40b9e5aa6516e039dae99ddd99468478974

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
33b1dc1633f96cb41ffd8abf6db5d8e4

SHA1
bd74b6f03d55d6d3e8caaea9702fc55f0477c8d9

SHA256
3aab178947a583daeb5968b0fca640e7ad5503b256f4c42dba6b38f6e708843a

SHA512
dd8096ee4ca0fd5133339d020e9d1641fc91935d4fd7078afad63eee9deb67f085931ceb7a8c74f5a2008591e363e669d67901cd49f7f65b58c4b1338d640c4a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe63efd4.TMP

Filesize
370B

MD5
16e9f31bb35a821a84a0a3c3069cf733

SHA1
c8356a90841a689e31982fac7fcbd9af87c7b4f1

SHA256
eb9d3259cbc68e59ceef5f6501d74d3f3f1d404cabb7afe2aa88367b708daf6e

SHA512
df1e4e719ba593d202ea782b366f59e90db740583cccc8668d3925f79d2eda216e4ce89e90458875d83b757b7afea72d89f518b386a2e358c39ba64e5ba25a69

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
a8b540b0dd4149cda2be554b5917fd3a

SHA1
e1fa387907b9b7b5917bcf45e6f4f715ad3deee7

SHA256
a0ac27a094b1599e90f270933802a535eb699569087fe2e4c00527e8adaff0be

SHA512
596bb9ede3d8d8b3dc184f313f6aff19116367b82faf39b783d91e4635b5c34a862b9239823857ffdeaa6f7955c7e566d84d6022cd58ef3024118d8aeae55e0e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
27f4cc8d88a0d30ffc0e50a1dfd6e46a

SHA1
a4012a855ea1eba117da03f4ef3981ec4a47267f

SHA256
7607f0f8d836d477287dc9f82b6e4929ff5a41184b74eb40fa974a709673b51b

SHA512
3fa2d569dcd1bae5a9be5432ac5f3e9436b22270d36c451667493490c5a078f67b26d5be63f8a7f4ffe632f94e145c2f641e7e62c9586b01a379e84b3fa88172

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
a63dac3f8cdff198ef204bd53ac14e3d

SHA1
bbada1955bc4be168cfc9131d5451f42ad968a3e

SHA256
d275b82d81c54154e70c3979833a2ce4150c5385c3602f22eb6484fccec026ce

SHA512
488a8a50ac3119c9c5fe18755c01aae9ac4df35d7e70ff855468d9dd2db4248790f7793118083c45b88e68949e0df823e757244763090476e98438337e5eea11

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb

Filesize
256KB

MD5
29bd18035ac3468ed8ee41ba90d66f22

SHA1
36e76825c5aff3f599ec16a85b14ee487595a69d

SHA256
eca587e1d30a5a9c65a7f3d69272ebc2890a0ec954d1ee4ad7d5ac45bd95ddc8

SHA512
b1b8a231de045c227d430c9edd5996b882153fd848fc319ba2dfbfc7aa309bce8a3551889f735f6de6d6fdfc09a1ffad4dcb4fd7ff2d4017eeb2c97f7a83f7d0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML

Filesize
9KB

MD5
7050d5ae8acfbe560fa11073fef8185d

SHA1
5bc38e77ff06785fe0aec5a345c4ccd15752560e

SHA256
cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b

SHA512
a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b

Download Submit
C:\Users\Admin\Downloads\Melting.exe

Filesize
12KB

MD5
833619a4c9e8c808f092bf477af62618

SHA1
b4a0efa26f790e991cb17542c8e6aeb5030d1ebf

SHA256
92a284981c7ca33f1af45ce61738479fbcbb5a4111f5498e2cb54931c8a36c76

SHA512
4f231fc16339d568b5cf9353133aeae835eb262dab68bc80d92f37b43df64dce4fae0e913cbaa3bb61351a759aeecf9d280bc5779b0853c980559a654d6cca11

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 551981.crdownload

Filesize
4.4MB

MD5
6a4853cd0584dc90067e15afb43c4962

SHA1
ae59bbb123e98dc8379d08887f83d7e52b1b47fc

SHA256
ccb9502bf8ba5becf8b758ca04a5625c30b79e2d10d2677cc43ae4253e1288ec

SHA512
feb223e0de9bd64e32dc4f3227e175b58196b5e614bca8c2df0bbca2442a564e39d66bcd465154149dc7ebbd3e1ca644ed09d9a9174b52236c76e7388cb9d996

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 613112.crdownload

Filesize
129KB

MD5
0ec108e32c12ca7648254cf9718ad8d5

SHA1
78e07f54eeb6af5191c744ebb8da83dad895eca1

SHA256
48b08ea78124ca010784d9f0faae751fc4a0c72c0e7149ded81fc03819f5d723

SHA512
1129e685f5dd0cb2fa22ef4fe5da3f1e2632e890333ce17d3d06d04a4097b4d9f4ca7d242611ffc9e26079900945cf04ab6565a1c322e88e161f1929d18a2072

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 669809.crdownload

Filesize
122KB

MD5
d043ba91e42e0d9a68c9866f002e8a21

SHA1
e9f177e1c57db0a15d1dc6b3e6c866d38d85b17c

SHA256
6820c71df417e434c5ad26438c901c780fc5a80b28a466821b47d20b8424ef08

SHA512
3e9783646e652e9482b3e7648fb0a5f7c8b6c386bbc373d5670d750f6f99f6137b5501e21332411609cbcc0c20f829ab8705c2835e2756455f6754c9975ac6bd

Download Submit
C:\Users\Admin\Downloads\chilledwindows.mp4

Filesize
3.6MB

MD5
698ddcaec1edcf1245807627884edf9c

SHA1
c7fcbeaa2aadffaf807c096c51fb14c47003ac20

SHA256
cde975f975d21edb2e5faa505205ab8a2c5a565ba1ff8585d1f0e372b2a1d78b

SHA512
a2c326f0c653edcd613a3cefc8d82006e843e69afc787c870aa1b9686a20d79e5ab4e9e60b04d1970f07d88318588c1305117810e73ac620afd1fb6511394155

Download Submit
memory/2292-676-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/4212-674-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/5168-455-0x0000000021870000-0x0000000021878000-memory.dmp

Filesize
32KB

Download
memory/5168-456-0x0000000021940000-0x0000000021978000-memory.dmp

Filesize
224KB

Download
memory/5168-457-0x00000000218D0000-0x00000000218DE000-memory.dmp

Filesize
56KB

Download
memory/5168-443-0x0000000000A60000-0x0000000000EC4000-memory.dmp

Filesize
4.4MB

Download
memory/5192-673-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/5856-657-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/5980-675-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/6120-752-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/6120-777-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/6120-776-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download