hxxps://github[.]com/Da2dalus/The-MALWARE-Repo

Resubmissions

12-01-2025 20:22

250112-y52j1szpfq 10

12-01-2025 20:20

250112-y4hqhsxpct 8

12-01-2025 20:14

250112-y1akqszmhr 1

12-01-2025 20:12

250112-yyweeszmep 9

Analysis

max time kernel
112s
max time network
112s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
12-01-2025 20:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/Da2dalus/The-MALWARE-Repo

Score

8^/10

defense_evasion discovery

Malware Config

Signatures

Downloads MZ/PE file

Executes dropped EXE 2 IoCs

pid	Process
3592	EternalRocks.exe
904	EternalRocks.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
11	raw.githubusercontent.com
30	raw.githubusercontent.com

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 2 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\CodeRed.a.exe:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\EternalRocks.exe:Zone.Identifier	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	taskmgr.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 39 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292114432"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = 99ebff004cc2ff000091f8000078d4000067c000003e9200001a6800f7630c00	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365268"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365268"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "14"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4290799360"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292114432"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe

NTFS ADS 4 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 917119.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\EternalRocks.exe:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 5622.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\CodeRed.a.exe:Zone.Identifier	msedge.exe

Suspicious behavior: EnumeratesProcesses 58 IoCs

pid	Process
3080	msedge.exe
3080	msedge.exe
2052	msedge.exe
2052	msedge.exe
5108	msedge.exe
5108	msedge.exe
1128	identity_helper.exe
1128	identity_helper.exe
1696	msedge.exe
1696	msedge.exe
5032	msedge.exe
5032	msedge.exe
1552	taskmgr.exe
1552	taskmgr.exe
1552	taskmgr.exe
1552	taskmgr.exe
1552	taskmgr.exe
1552	taskmgr.exe
1552	taskmgr.exe
1552	taskmgr.exe
1552	taskmgr.exe
1552	taskmgr.exe
1552	taskmgr.exe
1552	taskmgr.exe
1552	taskmgr.exe
1552	taskmgr.exe
1552	taskmgr.exe
1552	taskmgr.exe
1552	taskmgr.exe
1552	taskmgr.exe
1552	taskmgr.exe
1552	taskmgr.exe
1552	taskmgr.exe
1552	taskmgr.exe
1552	taskmgr.exe
1552	taskmgr.exe
1552	taskmgr.exe
1552	taskmgr.exe
1552	taskmgr.exe
1552	taskmgr.exe
1552	taskmgr.exe
1552	taskmgr.exe
1552	taskmgr.exe
1552	taskmgr.exe
1552	taskmgr.exe
1552	taskmgr.exe
1552	taskmgr.exe
1552	taskmgr.exe
1552	taskmgr.exe
1552	taskmgr.exe
1552	taskmgr.exe
1552	taskmgr.exe
1552	taskmgr.exe
1552	taskmgr.exe
1552	taskmgr.exe
1552	taskmgr.exe
1552	taskmgr.exe
1552	taskmgr.exe

Suspicious behavior: LoadsDriver 64 IoCs

pid	Process
3116	Process not Found
2132	Process not Found
3936	Process not Found
632	Process not Found
3624	Process not Found
2860	Process not Found
4800	Process not Found
3532	Process not Found
4276	Process not Found
4268	Process not Found
5096	Process not Found
4340	Process not Found
2008	Process not Found
1992	Process not Found
3916	Process not Found
1152	Process not Found
1252	Process not Found
1264	Process not Found
1296	Process not Found
1320	Process not Found
1444	Process not Found
1236	Process not Found
752	Process not Found
976	Process not Found
704	Process not Found
4172	Process not Found
3124	Process not Found
3120	Process not Found
4188	Process not Found
2652	Process not Found
2332	Process not Found
5000	Process not Found
3200	Process not Found
4168	Process not Found
1104	Process not Found
572	Process not Found
2640	Process not Found
3752	Process not Found
4580	Process not Found
3764	Process not Found
4372	Process not Found
4220	Process not Found
4640	Process not Found
1684	Process not Found
4960	Process not Found
488	Process not Found
1012	Process not Found
504	Process not Found
592	Process not Found
4564	Process not Found
380	Process not Found
3576	Process not Found
2112	Process not Found
1084	Process not Found
4184	Process not Found
2528	Process not Found
1524	Process not Found
4956	Process not Found
2016	Process not Found
4980	Process not Found
1696	Process not Found
412	Process not Found
3116	Process not Found
2132	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe

Suspicious use of AdjustPrivilegeToken 37 IoCs

description	pid	Process
Token: SeDebugPrivilege	1552	taskmgr.exe
Token: SeSystemProfilePrivilege	1552	taskmgr.exe
Token: SeCreateGlobalPrivilege	1552	taskmgr.exe
Token: SeCreateGlobalPrivilege	4692	dwm.exe
Token: SeChangeNotifyPrivilege	4692	dwm.exe
Token: 33	4692	dwm.exe
Token: SeIncBasePriorityPrivilege	4692	dwm.exe
Token: SeCreateGlobalPrivilege	2980	dwm.exe
Token: SeChangeNotifyPrivilege	2980	dwm.exe
Token: 33	2980	dwm.exe
Token: SeIncBasePriorityPrivilege	2980	dwm.exe
Token: SeCreateGlobalPrivilege	2104	dwm.exe
Token: SeChangeNotifyPrivilege	2104	dwm.exe
Token: 33	2104	dwm.exe
Token: SeIncBasePriorityPrivilege	2104	dwm.exe
Token: SeCreateGlobalPrivilege	2640	dwm.exe
Token: SeChangeNotifyPrivilege	2640	dwm.exe
Token: 33	2640	dwm.exe
Token: SeIncBasePriorityPrivilege	2640	dwm.exe
Token: SeCreateGlobalPrivilege	3864	dwm.exe
Token: SeChangeNotifyPrivilege	3864	dwm.exe
Token: 33	3864	dwm.exe
Token: SeIncBasePriorityPrivilege	3864	dwm.exe
Token: SeCreateGlobalPrivilege	3076	dwm.exe
Token: SeChangeNotifyPrivilege	3076	dwm.exe
Token: 33	3076	dwm.exe
Token: SeIncBasePriorityPrivilege	3076	dwm.exe
Token: SeCreateGlobalPrivilege	1200	dwm.exe
Token: SeChangeNotifyPrivilege	1200	dwm.exe
Token: 33	1200	dwm.exe
Token: SeIncBasePriorityPrivilege	1200	dwm.exe
Token: SeCreateGlobalPrivilege	1696	dwm.exe
Token: SeChangeNotifyPrivilege	1696	dwm.exe
Token: 33	1696	dwm.exe
Token: SeIncBasePriorityPrivilege	1696	dwm.exe
Token: 33	4408	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	4408	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
1552	taskmgr.exe
1552	taskmgr.exe
1552	taskmgr.exe
1552	taskmgr.exe
1552	taskmgr.exe
1552	taskmgr.exe
1552	taskmgr.exe
1552	taskmgr.exe
1552	taskmgr.exe
1552	taskmgr.exe
1552	taskmgr.exe
1552	taskmgr.exe
1552	taskmgr.exe
1552	taskmgr.exe
1552	taskmgr.exe
1552	taskmgr.exe
1552	taskmgr.exe
1552	taskmgr.exe
1552	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
1552	taskmgr.exe
1552	taskmgr.exe
1552	taskmgr.exe
1552	taskmgr.exe
1552	taskmgr.exe
1552	taskmgr.exe
1552	taskmgr.exe
1552	taskmgr.exe
1552	taskmgr.exe
1552	taskmgr.exe
1552	taskmgr.exe
1552	taskmgr.exe
1552	taskmgr.exe
1552	taskmgr.exe
1552	taskmgr.exe
1552	taskmgr.exe
1552	taskmgr.exe
1552	taskmgr.exe
1552	taskmgr.exe
1552	taskmgr.exe
1552	taskmgr.exe
1552	taskmgr.exe
1552	taskmgr.exe
1552	taskmgr.exe
1552	taskmgr.exe
1552	taskmgr.exe
1552	taskmgr.exe
1552	taskmgr.exe
1552	taskmgr.exe
1552	taskmgr.exe
1552	taskmgr.exe
1552	taskmgr.exe
1552	taskmgr.exe
1552	taskmgr.exe
1552	taskmgr.exe
1552	taskmgr.exe
1552	taskmgr.exe
1552	taskmgr.exe
1552	taskmgr.exe
1552	taskmgr.exe
1552	taskmgr.exe
1552	taskmgr.exe
1552	taskmgr.exe
1552	taskmgr.exe
1552	taskmgr.exe
1552	taskmgr.exe
1552	taskmgr.exe
1552	taskmgr.exe
1552	taskmgr.exe
1552	taskmgr.exe
1552	taskmgr.exe
1552	taskmgr.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2052	msedge.exe
3944	LogonUI.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2052 wrote to memory of 3836	2052	msedge.exe	77
PID 2052 wrote to memory of 3836	2052	msedge.exe	77
PID 2052 wrote to memory of 3516	2052	msedge.exe	78
PID 2052 wrote to memory of 3516	2052	msedge.exe	78
PID 2052 wrote to memory of 3516	2052	msedge.exe	78
PID 2052 wrote to memory of 3516	2052	msedge.exe	78
PID 2052 wrote to memory of 3516	2052	msedge.exe	78
PID 2052 wrote to memory of 3516	2052	msedge.exe	78
PID 2052 wrote to memory of 3516	2052	msedge.exe	78
PID 2052 wrote to memory of 3516	2052	msedge.exe	78
PID 2052 wrote to memory of 3516	2052	msedge.exe	78
PID 2052 wrote to memory of 3516	2052	msedge.exe	78
PID 2052 wrote to memory of 3516	2052	msedge.exe	78
PID 2052 wrote to memory of 3516	2052	msedge.exe	78
PID 2052 wrote to memory of 3516	2052	msedge.exe	78
PID 2052 wrote to memory of 3516	2052	msedge.exe	78
PID 2052 wrote to memory of 3516	2052	msedge.exe	78
PID 2052 wrote to memory of 3516	2052	msedge.exe	78
PID 2052 wrote to memory of 3516	2052	msedge.exe	78
PID 2052 wrote to memory of 3516	2052	msedge.exe	78
PID 2052 wrote to memory of 3516	2052	msedge.exe	78
PID 2052 wrote to memory of 3516	2052	msedge.exe	78
PID 2052 wrote to memory of 3516	2052	msedge.exe	78
PID 2052 wrote to memory of 3516	2052	msedge.exe	78
PID 2052 wrote to memory of 3516	2052	msedge.exe	78
PID 2052 wrote to memory of 3516	2052	msedge.exe	78
PID 2052 wrote to memory of 3516	2052	msedge.exe	78
PID 2052 wrote to memory of 3516	2052	msedge.exe	78
PID 2052 wrote to memory of 3516	2052	msedge.exe	78
PID 2052 wrote to memory of 3516	2052	msedge.exe	78
PID 2052 wrote to memory of 3516	2052	msedge.exe	78
PID 2052 wrote to memory of 3516	2052	msedge.exe	78
PID 2052 wrote to memory of 3516	2052	msedge.exe	78
PID 2052 wrote to memory of 3516	2052	msedge.exe	78
PID 2052 wrote to memory of 3516	2052	msedge.exe	78
PID 2052 wrote to memory of 3516	2052	msedge.exe	78
PID 2052 wrote to memory of 3516	2052	msedge.exe	78
PID 2052 wrote to memory of 3516	2052	msedge.exe	78
PID 2052 wrote to memory of 3516	2052	msedge.exe	78
PID 2052 wrote to memory of 3516	2052	msedge.exe	78
PID 2052 wrote to memory of 3516	2052	msedge.exe	78
PID 2052 wrote to memory of 3516	2052	msedge.exe	78
PID 2052 wrote to memory of 3080	2052	msedge.exe	79
PID 2052 wrote to memory of 3080	2052	msedge.exe	79
PID 2052 wrote to memory of 4272	2052	msedge.exe	80
PID 2052 wrote to memory of 4272	2052	msedge.exe	80
PID 2052 wrote to memory of 4272	2052	msedge.exe	80
PID 2052 wrote to memory of 4272	2052	msedge.exe	80
PID 2052 wrote to memory of 4272	2052	msedge.exe	80
PID 2052 wrote to memory of 4272	2052	msedge.exe	80
PID 2052 wrote to memory of 4272	2052	msedge.exe	80
PID 2052 wrote to memory of 4272	2052	msedge.exe	80
PID 2052 wrote to memory of 4272	2052	msedge.exe	80
PID 2052 wrote to memory of 4272	2052	msedge.exe	80
PID 2052 wrote to memory of 4272	2052	msedge.exe	80
PID 2052 wrote to memory of 4272	2052	msedge.exe	80
PID 2052 wrote to memory of 4272	2052	msedge.exe	80
PID 2052 wrote to memory of 4272	2052	msedge.exe	80
PID 2052 wrote to memory of 4272	2052	msedge.exe	80
PID 2052 wrote to memory of 4272	2052	msedge.exe	80
PID 2052 wrote to memory of 4272	2052	msedge.exe	80
PID 2052 wrote to memory of 4272	2052	msedge.exe	80
PID 2052 wrote to memory of 4272	2052	msedge.exe	80
PID 2052 wrote to memory of 4272	2052	msedge.exe	80

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://github.com/Da2dalus/The-MALWARE-Repo
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffcc0903cb8,0x7ffcc0903cc8,0x7ffcc0903cd8
  2⤵
  PID:3836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1892,7525251434828383638,5088443222869700572,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1888 /prefetch:2
  2⤵
  PID:3516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1892,7525251434828383638,5088443222869700572,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2388 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1892,7525251434828383638,5088443222869700572,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2600 /prefetch:8
  2⤵
  PID:4272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,7525251434828383638,5088443222869700572,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:1
  2⤵
  PID:3648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,7525251434828383638,5088443222869700572,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1
  2⤵
  PID:2644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1892,7525251434828383638,5088443222869700572,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5352 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5108
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1892,7525251434828383638,5088443222869700572,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5516 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,7525251434828383638,5088443222869700572,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4948 /prefetch:1
  2⤵
  PID:2480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,7525251434828383638,5088443222869700572,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5284 /prefetch:1
  2⤵
  PID:4644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,7525251434828383638,5088443222869700572,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
  2⤵
  PID:3028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,7525251434828383638,5088443222869700572,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5496 /prefetch:1
  2⤵
  PID:2500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,7525251434828383638,5088443222869700572,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5100 /prefetch:1
  2⤵
  PID:5060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1892,7525251434828383638,5088443222869700572,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5580 /prefetch:8
  2⤵
  PID:1596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1892,7525251434828383638,5088443222869700572,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5972 /prefetch:8
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:1696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,7525251434828383638,5088443222869700572,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1
  2⤵
  PID:1468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1892,7525251434828383638,5088443222869700572,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6380 /prefetch:8
  2⤵
  PID:2464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1892,7525251434828383638,5088443222869700572,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6420 /prefetch:8
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:5032
- C:\Users\Admin\Downloads\EternalRocks.exe
  "C:\Users\Admin\Downloads\EternalRocks.exe"
  2⤵
  - Executes dropped EXE
  PID:3592
- C:\Users\Admin\Downloads\EternalRocks.exe
  "C:\Users\Admin\Downloads\EternalRocks.exe"
  2⤵
  - Executes dropped EXE
  PID:904

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3656

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2232

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /0
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1552

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4692

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2980

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2104

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2640

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:3864

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:3076

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1200

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1696

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004EC 0x00000000000004F0
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4408

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x0 /state0:0xa39d4055 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:3944

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:228

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
554d6d27186fa7d6762d95dde7a17584

SHA1
93ea7b20b8fae384cf0be0d65e4295097112fdca

SHA256
2fa6145571e1f1ece9850a1ac94661213d3e0d82f1cef7ac1286ff6b2c2017cb

SHA512
57d9008ccabc315bd0e829b19fe91e24bab6ef20bcfab651b937b0f38eec840b58d0aed092a3bbedd2d6a95d5c150372a1e51087572de55672172adc1fc468a7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a28bb0d36049e72d00393056dce10a26

SHA1
c753387b64cc15c0efc80084da393acdb4fc01d0

SHA256
684d797e28b7fd86af84bfb217d190e4f5e03d92092d988a6091b2c7bbbd67c1

SHA512
20940fee33aa2194c36a3db92d4fd314ce7eacc2aa745abec62aa031c2a53ba4ff89f2568626e7bd2536090175f8d045c3bb52c5faa5ecc8da8410ab5fc519f7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
a6f952cdb63bb14f65d89b6d77fb5b81

SHA1
c76c676e41d84474997fa5f99b38e6a8fc0d7a41

SHA256
6d2a28a27b71184179c5f648e73c2a31332c7d8abc8fa8bf8512e0ac6c899bbe

SHA512
bb2c9f79ee6123bf0c66c8a2bc5a4c4cd49cbdafc56601b799ab43790786b88f46d0b5fd9d6a58db35e83608193619b910fc544361e0c317dedfa27f9618daf5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
579B

MD5
b8fdc8d04b83beb089126efbce00f896

SHA1
971ff6e70884b2cdf229be5a0cad066e3bdb085b

SHA256
c3084bc354488bb98cea934da0e3d6a462b574774df7f3b4fe289688acf3ebfe

SHA512
f5f0033e6bc47a723773fb221dbb2d5b684209ffc7a8046e708df1f5cade52b05158d2fc09fdb3867ca1922734f64fc5cb3bb7224da24df348085092385a45fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
36a220d587220203e4bace4ca295667f

SHA1
bc7ce3d78c954cdde44a95df1c49dcea5252cc1f

SHA256
c2c293dcfbeb4652a76cf10c1d8967cd54b1095de47b485a0c3d04025ad910db

SHA512
22ea3efad82a38c2426918b32634beab8f607d4014930ce3b2ce5f4fea1eacedb690d604197e41ab88c9e9c3dd2dc73a279dbb06bc76baf26dfa993c20ac91e9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
b7fc5df137fe8434e6618043f1cbb8d6

SHA1
52c87734101335c7aeb58430e34578c44bb9f140

SHA256
ba35614acb145fc796c36f9675ff11ce129b43223ed3cb86d718ccde1c4589d7

SHA512
3ebe23848699a39a16c3c48075ca68f61eaef3eaa7f21b4eb60306af93ed0c5b8a3e7b1f5759cb80b99ce7909029c6ab894ecb34423a5a4cdb3120264d5d30b4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
740e7ecfa9618ae4706a36267ac67940

SHA1
627a6e37594053f8378aea63d5a9af36392fa355

SHA256
6b9c07a4857bb0750ca1d6138db6128e68a9af5d7eee5fc900a8cd7125de5df0

SHA512
7713139a967016479df2c2e6061d23375f74d212c7d17915b63ac323051bad4e50c2c2467da2daca0fcb9adb2a251dae517183633619db074132fe25e8644bb1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
e4a4e6e68f7722e8a955c084644a1852

SHA1
8b55a43f0ed1f7632a07c3ef03bb13a9edfd77b0

SHA256
d5cf483c3c6b4994ac8b5bba002d51fddea589c2a3c7b20e8cfcfee296be5e44

SHA512
1ce348667d0a6c62f8bd17a7fd84881e6ea844b38f7146d27bf089795313458cd10b8a5e17b36feacd3009757f70ac0b7b627fdc963df6dbd0fba680e41c0cb0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
88fdd541c6fc1798154ec62d5d4d2cca

SHA1
d3152b050bcab83265563267ab7d834399eb2f87

SHA256
68583e1bddc94f7a2221bd4e368d9d906f11e37e560a8220547aa76dc70362d4

SHA512
41bcdbdd0443a56c07634c9bd4ddd3700ddd2e467cac8abbc8c46e7a3404c36b023534422aa444dadb9ff02fc8acb529686bf1eae3f2704b58d8276ad922cff9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57f712.TMP

Filesize
874B

MD5
b50805076962395857b8a48434bf4795

SHA1
1fd828384b300a88ac9f4c40573e02d31bc86c3f

SHA256
a654681a7e96a88cd948f6b93a8673085ed1d9277789dd4d51d8c79472fe5567

SHA512
3eff94e354a2559539687b7af91e448e8ead7a8d3db27a281ba8c8e2911a78f1225f20ba4c2dd8f501c644957613e2d03458e6d9c72e4d23d2e6aaaa054dafc6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\aef840ed-64a5-45d0-9fab-b23acfb8bebf.tmp

Filesize
6KB

MD5
10d07234a5651e42a4284e97b5b39c7a

SHA1
6fc644ce1825228fe1ccbfda7c1ea00f92bbaa35

SHA256
f8032aefd127ea0f8ba9242843ed61b8ee3dbd193a9f202fabfcc9534b47d7a6

SHA512
f6b035cad78d9af5e7c497f8f991da6ba84c6439a960788b4900d74a480010ef0b054e253649f03048d6e1f1e390167f23c99ca526a5d25d37aa61bac38f41f7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
44e0f02870ce515c61c03eafa940c71f

SHA1
0879ba12931ca900b04bdeaeaac85b9cc13f8d08

SHA256
f001e99cea5fbfb4d54985e2dfe8c4fe6a11e44260cbed608c828d2e8b1c91b4

SHA512
7e9e90d0654b98f20fb146ba35f2ef45be31de1c8698c80ffd24c7383a22d0634a48f8a3184ecd1d08bde767039f240f4cec394188056eebc7fe2c59b85e2c81

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
22ae0160c5a99dff2cc9d84f3abdcd53

SHA1
b1c3389068f5b576e6b51c39f52bf76b8c9d3c76

SHA256
3839c0ba10799cde2ebdebbf1a6c8573fe4db1e6ac3b123f8960cfc43a4d1a93

SHA512
4a028677c2c9419fec3639936c2156dbcb0a22a86a57c420bccb74106edf959ed3098d6e7271fd58aa67f172011a82744ccc61439f661d83ff2c4dc2930bbb11

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
fe59bd6fc407c2d4ac9da79c9a8ae378

SHA1
98feaaaf0782004907489c634b6a6f13d0a3f091

SHA256
a3f308223a63e46fc785c11083b7e86276bf485f4f910ddfbd76ce731afa6e8d

SHA512
e0c7235f437635c68cf1edfb80c17ca1cac455ae8df11ef0e3543f6fe9f49b3803a957d3ec6fe0a34cd06b873d81b6fe86f623523faf48112d002533f663af69

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
7818bebe370869cea19a63ab9f6c6dd2

SHA1
6d3afe20d109e7f64f2292cc43093ab56281fd23

SHA256
e35b071ffee47ab55dccb3d65beb216fd2bc49fd0cd73cf80cfedafed756d52f

SHA512
a7fcd0dd710caf385d260ff1904006fa9c6e1bc09a4293e545a2f84cc4043d3e3bbb7dc80bf44a99f2fd7cc2efe53e2410f77bb172f67ca75eeedfbe03ac0475

Download Submit
C:\Users\Admin\Downloads\CodeRed.a.exe:Zone.Identifier

Filesize
55B

MD5
0f98a5550abe0fb880568b1480c96a1c

SHA1
d2ce9f7057b201d31f79f3aee2225d89f36be07d

SHA256
2dfb5f4b33e4cf8237b732c02b1f2b1192ffe4b83114bcf821f489bbf48c6aa1

SHA512
dbc1150d831950684ab37407defac0177b7583da0fe13ee8f8eeb65e8b05d23b357722246888189b4681b97507a4262ece96a1c458c4427a9a41d8ea8d11a2f6

Download Submit
C:\Users\Admin\Downloads\EternalRocks.exe:Zone.Identifier

Filesize
26B

MD5
fbccf14d504b7b2dbcb5a5bda75bd93b

SHA1
d59fc84cdd5217c6cf74785703655f78da6b582b

SHA256
eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913

SHA512
aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 5622.crdownload

Filesize
3KB

MD5
6f5767ec5a9cc6f7d195dde3c3939120

SHA1
4605a2d0aae8fa5ec0b72973bea928762cc6d002

SHA256
59fe169797953f2046b283235fe80158ebf02ba586eabfea306402fba8473dae

SHA512
c0fbba6ecaef82d04157c5fcf458817bf11ce29cdaf3af6cac56724efcf4305565c6e665cdcf2106c675ba0574c60606be81d9baafe804fc7d2d3a50fed0baf6

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 917119.crdownload

Filesize
5.0MB

MD5
c52f20a854efb013a0a1248fd84aaa95

SHA1
8a2cfe220eebde096c17266f1ba597a1065211ab

SHA256
cf8533849ee5e82023ad7adbdbd6543cb6db596c53048b1a0c00b3643a72db30

SHA512
07b057d4830d3e2d17c7400d56f969c614a8bae4ba1a13603bb53decd1890ddcfbaad452c59cc88e474e2fd3abd62031bf399c2d7cf6dc69405dc8afcea55b9a

Download Submit
memory/1552-416-0x00000284B49D0000-0x00000284B49D1000-memory.dmp

Filesize
4KB

Download
memory/1552-418-0x00000284B49D0000-0x00000284B49D1000-memory.dmp

Filesize
4KB

Download
memory/1552-412-0x00000284B49D0000-0x00000284B49D1000-memory.dmp

Filesize
4KB

Download
memory/1552-411-0x00000284B49D0000-0x00000284B49D1000-memory.dmp

Filesize
4KB

Download
memory/1552-410-0x00000284B49D0000-0x00000284B49D1000-memory.dmp

Filesize
4KB

Download
memory/1552-419-0x00000284B49D0000-0x00000284B49D1000-memory.dmp

Filesize
4KB

Download
memory/1552-417-0x00000284B49D0000-0x00000284B49D1000-memory.dmp

Filesize
4KB

Download
memory/1552-420-0x00000284B49D0000-0x00000284B49D1000-memory.dmp

Filesize
4KB

Download
memory/1552-422-0x00000284B49D0000-0x00000284B49D1000-memory.dmp

Filesize
4KB

Download
memory/1552-421-0x00000284B49D0000-0x00000284B49D1000-memory.dmp

Filesize
4KB

Download
memory/3592-394-0x000000001C030000-0x000000001C038000-memory.dmp

Filesize
32KB

Download
memory/3592-393-0x000000001E520000-0x000000001E5BC000-memory.dmp

Filesize
624KB

Download
memory/3592-392-0x000000001DF70000-0x000000001E480000-memory.dmp

Filesize
5.1MB

Download
memory/3592-308-0x000000001CC40000-0x000000001D10E000-memory.dmp

Filesize
4.8MB

Download
memory/3592-307-0x000000001C080000-0x000000001C4AE000-memory.dmp

Filesize
4.2MB

Download