hxxps://youtube[.]com/@boffy/

Resubmissions

20-01-2025 05:23

250120-f3dfastmap 7

20-01-2025 05:07

31-12-2024 05:12

31-12-2024 04:49

31-12-2024 04:46

31-12-2024 04:31

Analysis

max time kernel
139s
max time network
149s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
31-12-2024 04:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://youtube.com/@boffy/

Score

7^/10

discovery phishing

Malware Config

Signatures

A potential corporate email address has been identified in the URL: httpswww.youtube.com@boffycbrd1
phishing

Drops file in Program Files directory 40 IoCs

description	ioc	Process
File created	C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.6.3102.0_x64__8wekyb3d8bbwe\Microsoft.Advertising\vpaid.html	WScript.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2020.503.58.0_x64__8wekyb3d8bbwe\LensSDK\Assets\ThirdPartyNotices\ThirdPartyNotices.html	WScript.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsStore_12104.1001.1.0_x64__8wekyb3d8bbwe\Store.Purchase\Controls\Xbox360PurchaseHostPage.html	WScript.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\index.html	WScript.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\Welcome.html	WScript.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\mobile_equalizer.html	WScript.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\browse_window.html	WScript.exe
File created	C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.6.3102.0_x64__8wekyb3d8bbwe\Microsoft.Advertising\bootstrap.html	WScript.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsStore_12104.1001.1.0_x64__8wekyb3d8bbwe\WebviewOffline.html	WScript.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PersonaSpy\PersonaSpy.html	WScript.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\mobile_view.html	WScript.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\view.html	WScript.exe
File opened for modification	C:\Program Files\SwitchCompress.htm	WScript.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\README.html	WScript.exe
File opened for modification	C:\Program Files\Microsoft Office\Office16\OSPP.HTM	WScript.exe
File opened for modification	C:\Program Files\Microsoft Office\Office16\OSPP.VBS	WScript.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\index.html	WScript.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\mobile_browse.html	WScript.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\batch_window.html	WScript.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\equalizer_window.html	WScript.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\stream_window.html	WScript.exe
File created	C:\Program Files\WindowsApps\Microsoft.Windows.Photos_21.21030.25003.0_x64__8wekyb3d8bbwe\PhotosApp\Assets\ThirdPartyNotices\ThirdPartyNotices.html	WScript.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsStore_12104.1001.1.0_x64__8wekyb3d8bbwe\Microsoft.Membership.MeControl\Assets\OfflinePages\WebviewOffline.html	WScript.exe
File created	C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\wwwroot\app.html	WScript.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\1033\MCABOUT.HTM	WScript.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\vlm.html	WScript.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\offset_window.html	WScript.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\stream_config_window.html	WScript.exe
File created	C:\Program Files\WindowsApps\Microsoft.StorePurchaseApp_12008.1001.1.0_x64__8wekyb3d8bbwe\Store.Purchase\Controls\Xbox360PurchaseHostPage.html	WScript.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.6.10571.0_x64__8wekyb3d8bbwe\NOTICE.html	WScript.exe
File opened for modification	C:\Program Files\Java\jre-1.8\Welcome.html	WScript.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\vlm_export.html	WScript.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\ENU\license.html	WScript.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\ReadMe.htm	WScript.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\1033\README.HTM	WScript.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\mobile.html	WScript.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\create_stream.html	WScript.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\error_window.html	WScript.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\mosaic_window.html	WScript.exe
File created	C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.2104.12721.0_x64__8wekyb3d8bbwe\msapp-error.html	WScript.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\Local Settings	msedge.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\The-MALWARE-Repo-master.zip:Zone.Identifier	msedge.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
3616	msedge.exe
3616	msedge.exe
1500	msedge.exe
1500	msedge.exe
3000	msedge.exe
3000	msedge.exe
3360	identity_helper.exe
3360	identity_helper.exe
2280	msedge.exe
2280	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 18 IoCs

pid	Process
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	1112	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1112	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1500 wrote to memory of 1200	1500	msedge.exe	77
PID 1500 wrote to memory of 1200	1500	msedge.exe	77
PID 1500 wrote to memory of 2456	1500	msedge.exe	78
PID 1500 wrote to memory of 2456	1500	msedge.exe	78
PID 1500 wrote to memory of 2456	1500	msedge.exe	78
PID 1500 wrote to memory of 2456	1500	msedge.exe	78
PID 1500 wrote to memory of 2456	1500	msedge.exe	78
PID 1500 wrote to memory of 2456	1500	msedge.exe	78
PID 1500 wrote to memory of 2456	1500	msedge.exe	78
PID 1500 wrote to memory of 2456	1500	msedge.exe	78
PID 1500 wrote to memory of 2456	1500	msedge.exe	78
PID 1500 wrote to memory of 2456	1500	msedge.exe	78
PID 1500 wrote to memory of 2456	1500	msedge.exe	78
PID 1500 wrote to memory of 2456	1500	msedge.exe	78
PID 1500 wrote to memory of 2456	1500	msedge.exe	78
PID 1500 wrote to memory of 2456	1500	msedge.exe	78
PID 1500 wrote to memory of 2456	1500	msedge.exe	78
PID 1500 wrote to memory of 2456	1500	msedge.exe	78
PID 1500 wrote to memory of 2456	1500	msedge.exe	78
PID 1500 wrote to memory of 2456	1500	msedge.exe	78
PID 1500 wrote to memory of 2456	1500	msedge.exe	78
PID 1500 wrote to memory of 2456	1500	msedge.exe	78
PID 1500 wrote to memory of 2456	1500	msedge.exe	78
PID 1500 wrote to memory of 2456	1500	msedge.exe	78
PID 1500 wrote to memory of 2456	1500	msedge.exe	78
PID 1500 wrote to memory of 2456	1500	msedge.exe	78
PID 1500 wrote to memory of 2456	1500	msedge.exe	78
PID 1500 wrote to memory of 2456	1500	msedge.exe	78
PID 1500 wrote to memory of 2456	1500	msedge.exe	78
PID 1500 wrote to memory of 2456	1500	msedge.exe	78
PID 1500 wrote to memory of 2456	1500	msedge.exe	78
PID 1500 wrote to memory of 2456	1500	msedge.exe	78
PID 1500 wrote to memory of 2456	1500	msedge.exe	78
PID 1500 wrote to memory of 2456	1500	msedge.exe	78
PID 1500 wrote to memory of 2456	1500	msedge.exe	78
PID 1500 wrote to memory of 2456	1500	msedge.exe	78
PID 1500 wrote to memory of 2456	1500	msedge.exe	78
PID 1500 wrote to memory of 2456	1500	msedge.exe	78
PID 1500 wrote to memory of 2456	1500	msedge.exe	78
PID 1500 wrote to memory of 2456	1500	msedge.exe	78
PID 1500 wrote to memory of 2456	1500	msedge.exe	78
PID 1500 wrote to memory of 2456	1500	msedge.exe	78
PID 1500 wrote to memory of 3616	1500	msedge.exe	79
PID 1500 wrote to memory of 3616	1500	msedge.exe	79
PID 1500 wrote to memory of 680	1500	msedge.exe	80
PID 1500 wrote to memory of 680	1500	msedge.exe	80
PID 1500 wrote to memory of 680	1500	msedge.exe	80
PID 1500 wrote to memory of 680	1500	msedge.exe	80
PID 1500 wrote to memory of 680	1500	msedge.exe	80
PID 1500 wrote to memory of 680	1500	msedge.exe	80
PID 1500 wrote to memory of 680	1500	msedge.exe	80
PID 1500 wrote to memory of 680	1500	msedge.exe	80
PID 1500 wrote to memory of 680	1500	msedge.exe	80
PID 1500 wrote to memory of 680	1500	msedge.exe	80
PID 1500 wrote to memory of 680	1500	msedge.exe	80
PID 1500 wrote to memory of 680	1500	msedge.exe	80
PID 1500 wrote to memory of 680	1500	msedge.exe	80
PID 1500 wrote to memory of 680	1500	msedge.exe	80
PID 1500 wrote to memory of 680	1500	msedge.exe	80
PID 1500 wrote to memory of 680	1500	msedge.exe	80
PID 1500 wrote to memory of 680	1500	msedge.exe	80
PID 1500 wrote to memory of 680	1500	msedge.exe	80
PID 1500 wrote to memory of 680	1500	msedge.exe	80
PID 1500 wrote to memory of 680	1500	msedge.exe	80

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://youtube.com/@boffy/
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff8feab3cb8,0x7ff8feab3cc8,0x7ff8feab3cd8
  2⤵
  PID:1200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1868,16689715645479098268,4823002740692224832,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1912 /prefetch:2
  2⤵
  PID:2456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1868,16689715645479098268,4823002740692224832,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2352 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1868,16689715645479098268,4823002740692224832,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2684 /prefetch:8
  2⤵
  PID:680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1868,16689715645479098268,4823002740692224832,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:4612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1868,16689715645479098268,4823002740692224832,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
  2⤵
  PID:2232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1868,16689715645479098268,4823002740692224832,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4632 /prefetch:1
  2⤵
  PID:1480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1868,16689715645479098268,4823002740692224832,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4056 /prefetch:1
  2⤵
  PID:4552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1868,16689715645479098268,4823002740692224832,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4848 /prefetch:1
  2⤵
  PID:4860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1868,16689715645479098268,4823002740692224832,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5180 /prefetch:1
  2⤵
  PID:1640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1868,16689715645479098268,4823002740692224832,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5244 /prefetch:1
  2⤵
  PID:1472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1868,16689715645479098268,4823002740692224832,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4892 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3000
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1868,16689715645479098268,4823002740692224832,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5620 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1868,16689715645479098268,4823002740692224832,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3848 /prefetch:1
  2⤵
  PID:3656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1868,16689715645479098268,4823002740692224832,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5700 /prefetch:1
  2⤵
  PID:3104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1868,16689715645479098268,4823002740692224832,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4724 /prefetch:8
  2⤵
  PID:5116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1868,16689715645479098268,4823002740692224832,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5704 /prefetch:1
  2⤵
  PID:4716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1868,16689715645479098268,4823002740692224832,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4648 /prefetch:1
  2⤵
  PID:3232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1868,16689715645479098268,4823002740692224832,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5996 /prefetch:1
  2⤵
  PID:4656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1868,16689715645479098268,4823002740692224832,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4632 /prefetch:1
  2⤵
  PID:3800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1868,16689715645479098268,4823002740692224832,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5936 /prefetch:1
  2⤵
  PID:2336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1868,16689715645479098268,4823002740692224832,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6124 /prefetch:1
  2⤵
  PID:4888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1868,16689715645479098268,4823002740692224832,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4512 /prefetch:1
  2⤵
  PID:4504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1868,16689715645479098268,4823002740692224832,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7068 /prefetch:1
  2⤵
  PID:224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1868,16689715645479098268,4823002740692224832,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7064 /prefetch:1
  2⤵
  PID:3624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1868,16689715645479098268,4823002740692224832,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3392 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:2280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1868,16689715645479098268,4823002740692224832,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=2932 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4748

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4276

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1964

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004C0 0x00000000000004D8
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1112

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3204

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2676

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2392

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Temp1_The-MALWARE-Repo-master.zip\The-MALWARE-Repo-master\Worm\HeadTail.vbs"
1⤵
- Drops file in Program Files directory
PID:2448

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Microsoft Office\root\Office16\PersonaSpy\PersonaSpy.html

Filesize
34KB

MD5
17fc6b7a3f43bb78c44cad6c1a035787

SHA1
c8c3197e356e4cafe9b5e0b44fbcbd853cb6f0fb

SHA256
233d0fdd3c2253626f64aa8de974f1f1341284ff339002eeaf430608ca12dc19

SHA512
e27993e18e371172fac7d4303106495008bff95d00072fc97302866e3b7bffc8aa37acc42c5bd5700eb98c1f1c620b4da11334d7f75f047b54f7cc5f49e2cada

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d7145ec3fa29a4f2df900d1418974538

SHA1
1368d579635ba1a53d7af0ed89bf0b001f149f9d

SHA256
efc56eb46cf3352bf706c0309d5d740bca6ac06142f9bdc5e8344b81d4d83d59

SHA512
5bb663ede88f8b7c96b09c1214aac68eda99bc09525ac383baa96914ff7d553ea1aed09e3c9d16893d791c81ddb164c682dfbb4759ac0bc751221f3e36558a91

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d91478312beae099b8ed57e547611ba2

SHA1
4b927559aedbde267a6193e3e480fb18e75c43d7

SHA256
df43cd7779d9fc91fd0416155d6771bc81565e98be38689cb17caece256bf043

SHA512
4086c4ebe410a37d0124fc8bd00c58775e70ab2b7b5a39b4e49b332ce5b4866c6775707436395467aff9596507c96fb4896f3bf0249c5b9c99a927f31dcc1a96

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
c3338d07b6b7ae786b674c27849b69e4

SHA1
a52eeaa37bb0dca5c6f436bf4bed516441acda8f

SHA256
a3e83eba4a75a22629c41786636b28dc220dc43004a0c8014d11d834c55bd247

SHA512
5dd163c95f6a6ff41d2bb0933e668d077350b26f6c8fd094f9c31c630fb79dbcc200bad8b79b6c1761484d33b2358a4d197473307a6b5dbd1ab1d715f74d4e9a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
9494f5db685b4ca525eae96372497b7c

SHA1
d0979c445490ff970975f9100acd2dae8607fb46

SHA256
032b933bd348fdb5a9669480266190180d8564b2c38aa997fb251d76f039250e

SHA512
e3746aea78f5f44f5c9cd4df5760955de4e5e4e121867e43e264287fc71999427fd8b177336f856488597913276df163889ca40eea0719853d1e505939c5e3a5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
25520b391283ae7e1decfc674fb887cd

SHA1
3d1f0739792bd615a0b5007cdbcffe8132c3802d

SHA256
e222ea494318bc882390ea9c9406fd7d455d45224b6d60d95e0339cfb923ad94

SHA512
f41d8d2373c3a352d637acb39c7352e66562ecc6d23cbed0ad3b3d58670209019ba689cb084e7b5560b2f7bce6c2f2b43d112b0c3325b384d95c74ce91b21088

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
716f2d756f0eb5a09f673f0b06f107ff

SHA1
87f7b3e10808bb35474be8fc38d1084c217c9025

SHA256
1b82899da6cb0a964b903e313506e3ae7e7a51a61ea7865f2502d53c4530c9c4

SHA512
0af20913380057752e7cfcf8c65a8e1374747902d61a8b71facfdf34000a95a3c817327b3438186bc9a308513d3d0469a9585b4c00127390f5e780c9659b038a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
e5ad1e4c22419490bf7acb167081955a

SHA1
e9456c91825fcd065da22e82006c895cf22de2c2

SHA256
658f70f4c18005396bd0fcf896f92f2f93f8e94c858553b63f25df2c7c980337

SHA512
8b037dc5a98412749b876f7308a5836a4f849da024e90c86eb9efced13bf044e93e6d0cada4abd8deb92ed64f69b34a37e1bebf9d5d575c5c54824a20dea9be3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
efcbd755e0a86e2a761226cf0c1c0669

SHA1
63467a632ca99fe86c45397a095a02b0aef1df15

SHA256
32869cccc1ff984c3ac41093ccf0d647aa533dc8cc3a1369ca50135907457a77

SHA512
a6832bfa439c42d4560446e5bd485f54b3a5465964bcf748ce333492ac146e4e782cb801c2a3b2aad78887f127d78809cc59540696887341a48284dde394c019

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
9254b6e9991c53c309a8f7375add7c73

SHA1
ab2bafe6650712a386c40c6a41e2ed96b6d132b9

SHA256
727e70c466a4f1374706a8d5ecacfbeb0e4ddfd3749eed9b6de3240eaa828637

SHA512
4c0a9b025fbcabbbb41a731d9f54be667e5e7f81f0b354617aae440225b1527dbfbbcf83f609f37398ccd7fc611ff56ab1a5c6af8430cfec77b888b669327a63

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
fa41db4a397532eb10236d1f4f490180

SHA1
e3b911cf497ef488c5dd35524c129a62cc15817e

SHA256
ad09d59b568a11cd9a749060f5d1c8bf04723fb81cf2c6cf2db222c570ecd0ee

SHA512
4e3fb7521ec024e9513fd3905b20459bd9bf37d07c544d150acd544853097c5686d71917603e15b90f279c71bf434218f0f300817c31b86204208edf12ce1000

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\8826d164-6756-4592-9e24-dd686f5d7b02\index

Filesize
24B

MD5
54cb446f628b2ea4a5bce5769910512e

SHA1
c27ca848427fe87f5cf4d0e0e3cd57151b0d820d

SHA256
fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d

SHA512
8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\8826d164-6756-4592-9e24-dd686f5d7b02\index-dir\the-real-index

Filesize
624B

MD5
bce383b6e78d3b97f0f9927c440a34f6

SHA1
fc68f658f74fa57571dc177833071360238bb769

SHA256
575823505ead65ca2bb680b10a73fc8d10e818e458297e93d35f5cd7a42e115b

SHA512
8d3692699a94cacd7169633e0a095e3253bf2a5c868063a70b28c1a8c1e15bd558fef1fe8e0f6d9b0638392886304b883b7eacdd1b7fb77fae44972c35d11aa2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\8826d164-6756-4592-9e24-dd686f5d7b02\index-dir\the-real-index~RFe58178a.TMP

Filesize
48B

MD5
3050a3c69bb96872967e69ec855e6f79

SHA1
362c88feb0a329b2f638d70c732d9c941ab822e0

SHA256
df446a99f950f158e079a36ea156493d7ca9da86b6df87d298f3e628801db8a1

SHA512
6d09b2a1610ea44a3d77f0682b14a9e202e55a5febc5b55b7f0de44b873df44b2192a6847e81f0e367e115b6109a7d9d1c0131ebdb6094fbc375d5d960c6f1a4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\d7c4612f-d2b0-4bbf-9816-f3d157c732ab\index-dir\the-real-index

Filesize
2KB

MD5
ad7c75336fbbfba0cd72e61df614efed

SHA1
f71df78bf8641e1662b8f8e20f200d1ee6fa1b64

SHA256
6bae7e25a2ee9d5a253c6589300918c54172dbe23c2fc8b46c48972cb19303bc

SHA512
34c8a1ac0623b9482ef024c9884c6cf52a5d9fbb67051cafe4477e37602a06b54ebd936bdcbab2cac0f0deaabe060983d82b68cfe6324d4fde6b84dd991e65d3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\d7c4612f-d2b0-4bbf-9816-f3d157c732ab\index-dir\the-real-index

Filesize
2KB

MD5
ff19222d62de7f1912dd3580c8535230

SHA1
e8b213f09088d14fb9f0de4738c52317a08bacb8

SHA256
9db38be0d5c3aa92e801972b22e8ad3c42a4d3b3e972d3f39967c58a322b7903

SHA512
d0b70319064ecf2a8e260ec2a380e169845a191d1f4576322c73ba41ce6c9ebc9377d5ce7c00e23c6aee6cfb5fc95c4733aefe17d27d057e3743a772c595aa2a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\d7c4612f-d2b0-4bbf-9816-f3d157c732ab\index-dir\the-real-index~RFe581875.TMP

Filesize
48B

MD5
a58a5a5669658287f0beda9f95c61bdd

SHA1
7bef193719e05f0c548cec8589dff50c676aa8cd

SHA256
19ea8b876600ad81da4e97a1c51074afb68e18d49fd10439c566c11d8ac6d37b

SHA512
53c4f78425f6157e9c53581a9082ae29f631c27055338464921bd30ed91a8fc4e8e3c0f6edf434734b92050716eb98a469891e5013d54572b797ac34fc7a73e7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
217B

MD5
71656a78ec475a122044ce6273e2056f

SHA1
49bf7f449641ca1b0c6b8f4087cf0d86f0d1c683

SHA256
6b77cc6b1b8204dd8082cd58e09f303d18047fbe56398b5770044ad297dddcf6

SHA512
1a8397eab8eb74330682a6e154054153ea6c6a3b3954c23e200cf5578b6050c4820d5c5f00d75166dc4e0397acd089d18ded19223f84c230e3b4fb0cfb33ee78

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
153B

MD5
68093d63c44d1943cca57a22dc11b1b1

SHA1
0d10b82de77a54c1031b8840b4a422eaaac132d4

SHA256
8f2a1034c5f62673980eeb26140251208ef878675665fa07fb818452dda13944

SHA512
15793a192a4e6d5bd1a0729f5a05016db54010b551fd747574ea769279ff5c6432b705d17f3f1e1cfc04681dec24090742dcbf9be080905a3ac7181c16e47570

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
89B

MD5
a0b3fef0ef33af6c667e645ab28ceb8a

SHA1
f12e1342f62a73797e80bce1707abe5c23f77909

SHA256
a1efb3930fa1095fd9e879509c11d1544f2b9ce50aa0e39f97b999582b5b2dfc

SHA512
27284c2b06bdf1328a11257961a6e0d14391fd6e941c1b44b9d6e25e4bc878f020aa0f9c9971081789c532c016fa1d57dc68d044960d9f1771c7e6f71f5311ff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
155B

MD5
a0a60e1e93ac81572cbf5b80c2e2217e

SHA1
c6b2f0a1175ce3370f4da7376f6406448deddad2

SHA256
28632ec996e03f2fbdecfbacadaba2347baa2e38453b4af91c8e50003a87b0c8

SHA512
db03a629421863478859046f3181d546eb283d6c156c76bb25c7dd7c16916e80e8370fe23e6640d72fbdfd5a7a3a7e42df38d4cba28015c10be71189ae3a8956

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
153B

MD5
372d888c4099a093a998f5949b2775e1

SHA1
e6df9be5bb3026b58fe236184d083bd07f98e0e1

SHA256
5883a23302809973fdaa0cc7ecf215be4e4955ed80f88bb3fed8aae77163982f

SHA512
dff0a7f9d8f8b763303c28cdb331fad01a660a324389a1082fc3b8d4b6527694e6e7b6d5df0c1e6d285a9dbdf65e5d76aab1d6432137a2218df30e75b0da6daa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
146B

MD5
4ccc5005c447bc49d778da6e1f9e8a42

SHA1
984a6f52de941d9377ed38c9b6aa14704b10e609

SHA256
1aba0efa127defebc0b095dd3516f476d23a3df007dc92f7ca39e32310480b98

SHA512
a9dad8761402998b896e7401985a17814a1d54ffe9a5c76e6b67dad6a3e74f735721c42e685a8e2b45c6af6cc3b5c90977a99e5a56f3fbf59b1c53be4a26ddb5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
82B

MD5
cdc6545d753a737ac577297adce39924

SHA1
d16d304e946bd1f3a6d68e80ee2242bd7ebdb610

SHA256
1fc3c2a1095e620a725d81e21efcf7bb8c06231216e23deffacf5d4520cfff4a

SHA512
674d9530682292bcec31268bbb97070a4afd098264fc2bb3e79df57b9265ebea72560331b3ec1a049d1418d74c1f44c1414b208c24dda846075638e9a84ef431

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\2cc80dabc69f58b6_0

Filesize
17KB

MD5
a7a09b44136eca95ca54c9a13e2661dc

SHA1
b82a80e4aec27d6799d0ab0044eeb6d1a1b4cce6

SHA256
5e04fdb8e65cb4555ae846c88626d4a81a661480e1427787ddadfe4d055e9780

SHA512
b374f9f29cb712c849369943d8397c560389f75688d15f19a3c64683818036cb8d879c11064f3a9fd20b7ccf3d52833946994442eba1b0c89d258501e4e8118c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\4cb013792b196a35_0

Filesize
163KB

MD5
707d556d51cf46089ddaf038ed542c65

SHA1
978059dc337593ddfaf89c671aca1da783eddaa9

SHA256
c1439290b7b4b75c343e9e90775d9d3ca8f95d5c6817cc061cc432bba6ae7370

SHA512
d3b028b01bf8d7d0806986463b9c7deac95d4537c97337d8dd857b2b63955ab99fef380406000213974ff3fa05ed145ee4bb6b2925e0d882a1e59e4251ae9b76

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
96B

MD5
16fd3f19411c6f3e3a4199031ba5d077

SHA1
a4bdda10044abe62cee97a6e405dc443147c29b0

SHA256
31e4e0c592beb8a789ee0312ecc6e3f55d379060085da71785a670998e6a8464

SHA512
59a021c2d2e2d4deb4752e3be409a3ba08c6ddfd76c83a9727a7729c916ff1990d91d584193fba5146f93bdf77c419a7ef2ff433d1995c69b72945e8f876c0ae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe580de6.TMP

Filesize
48B

MD5
35de4223ac15c9aa3a907dbec1d823e1

SHA1
5b8f953bbdfd0085c31b33729fb7f56a631fe768

SHA256
ef5db1532c6383fc1a484ee226bfa3877ee2b5135fcdff272c53e052b8f21ca8

SHA512
8de96c6d38756e4ba79249016abf2789716cdec1874e8e45d4f1285119572fd918ad1e6abb87120519e32d281d16de38f959e55093f8a390235362e6d8fc874f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
bd529bdbaab6a1cf3c493bbe68aea879

SHA1
73d112d77df5bc23e00122522a9dfe55c60a99f2

SHA256
9915c0890a3b63a801879d125349bf6d854b7422d4d30b945c21c63236f2cc42

SHA512
7c7bb61038f2dad89a003ec1534d8c76225500868e5376b3eac2287471f93f91a0a31e2f6acadd7f6c334ac6db7db981168fed61a0aaaa8e6fa51b18f8e0d19f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
704B

MD5
1832a6e35e1df578e22b6d5265dc9f47

SHA1
b45d7a6b24101e9f36c1d564dcd075af7ddd087a

SHA256
457471df7c105ff2af280cb5c2441e3d4631b9eb56bfdd602a0565e2d60e2559

SHA512
744133fccb930e473fc2eed8aa3fdf1ad2a3344d2aef73d6649e13ad596f3634e2c3930007348dce0bbe26898c48e754e82b08a9e72e08a0708c3cf70a0e7e50

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
09b775bb00a991fbb1617f930aa84dcb

SHA1
e51d16c87877d1de96e888f36fe899162f219357

SHA256
402dcb7ca14dd4d57868b76797f5df8d793e096db4b2df99dc2753aa37ebd493

SHA512
d7df26f6deb2ad7680fa56ce7c78983f84a62a216be1b97acf78be5511e595be5b40da6b21ec096133e155f2520d85b6a7b083ddd0a5473b1db31af9e74d3270

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
bcd294e50bf3c3d252e72ddf3f435a20

SHA1
8b4cca006d5309a0f8e9ebdf26e0fcca0e3648b8

SHA256
66a3206a25fe5e4d1e6371c8045a41851158c0f6411fed83c68204fcbf2167a8

SHA512
78dbaf8795c7f82f2f24a344d1c3c994210bb8335f837936991b952ccdf5163446d3413bf09e8bee7ecd916c5591534adc532b0cec2414c0794011481d88dbdd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57e3c8.TMP

Filesize
706B

MD5
016a7251d08c373e416caeaa657afc40

SHA1
d3e79e9212a2b771708b6ef5f01f841265b9bc27

SHA256
2923b20d30050b2a4ed332956688f28aaa7d7d1c3393ea447bbb1381efa92e29

SHA512
4813ab81626e4c90ddce1e23201acaa338938df01e8196ab714261e8fe6c905ecf0bac168345f68156f2739408c92ec4463a72148a26390d768c1f411149b555

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
2fc535bb494cac7a0dac85db21399431

SHA1
aaf36b91535ab44e802ef700361ec0174c45fbf5

SHA256
9a298c9f12bcb30cb517d2cb93e2ea3022f102e6111ed26116e7f76b0d3aface

SHA512
954de45b7dc340a73077c6528a9d963a51e17431ef00ccd8b7a244f1964d319ec7d0172f061d61879744a07024423b67e128fc32cdcbf0c258ee0b4805303504

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
87b30ee6fb6f59f3a0c479e00da2cded

SHA1
e79f5e20b9e7405533148b943aaece394f24dc42

SHA256
50664dab6b1e7f5bd5250ec23add176015c967757085d7620ffca107bc4a5b6b

SHA512
a3e615e041658db85ecd23cbb424df45db3c4f04c748d34e35d5b55d73c1815078d36971565bc16912ebfe5adf633dd0a7f1b1be3ae374981628215a04038622

Download Submit
C:\Users\Admin\Downloads\The-MALWARE-Repo-master.zip:Zone.Identifier

Filesize
26B

MD5
fbccf14d504b7b2dbcb5a5bda75bd93b

SHA1
d59fc84cdd5217c6cf74785703655f78da6b582b

SHA256
eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913

SHA512
aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98

Download Submit