hxxps://github[.]com/Endermanch/MalwareDatabase

Resubmissions

14-01-2025 19:21

250114-x2ytaawqdy 10

14-01-2025 19:15

250114-xybvcawpdy 10

14-01-2025 19:09

250114-xtsx3aylfm 7

Analysis

max time kernel
140s
max time network
141s
platform
windows10-ltsc 2021_x64
resource
win10ltsc2021-20250113-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20250113-enlocale:en-usos:windows10-ltsc 2021-x64system
submitted
14-01-2025 19:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/Endermanch/MalwareDatabase

Score

7^/10

discovery persistence

Malware Config

Signatures

Executes dropped EXE 8 IoCs

pid	Process
4216	Free YouTube Downloader.exe
3968	Free YouTube Downloader.exe
1680	Free YouTube Downloader.exe
3944	Free YouTube Downloader.exe
4800	Free YouTube Downloader.exe
1864	Free YouTube Downloader.exe
660	Free YouTube Downloader.exe
4360	Box.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-564748828-2201999071-3764224244-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Free Youtube Downloader = "C:\\Windows\\Free Youtube Downloader\\Free Youtube Downloader\\Free YouTube Downloader.exe"	[email protected]

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
68	raw.githubusercontent.com
69	raw.githubusercontent.com

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20250114190923.pma	setup.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\efdf6054-0ba2-4183-9938-89cfdb189d1b.tmp	setup.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Free YouTube Downloader.exe	[email protected]
File opened for modification	C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Box.exe	[email protected]
File opened for modification	C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Uninstall.exe	[email protected]
File created	C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Uninstall.ini	[email protected]

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Box.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	MusNotification.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	MusNotification.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-564748828-2201999071-3764224244-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-564748828-2201999071-3764224244-1000_Classes\Local Settings	taskmgr.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4932	msedge.exe
4932	msedge.exe
1468	msedge.exe
1468	msedge.exe
4584	identity_helper.exe
4584	identity_helper.exe
1820	msedge.exe
1820	msedge.exe
4552	taskmgr.exe
4552	taskmgr.exe
4552	taskmgr.exe
4552	taskmgr.exe
4552	taskmgr.exe
4552	taskmgr.exe
4552	taskmgr.exe
4552	taskmgr.exe
4552	taskmgr.exe
4552	taskmgr.exe
4552	taskmgr.exe
4552	taskmgr.exe
4552	taskmgr.exe
4552	taskmgr.exe
4552	taskmgr.exe
4552	taskmgr.exe
4552	taskmgr.exe
4552	taskmgr.exe
4552	taskmgr.exe
4552	taskmgr.exe
4552	taskmgr.exe
4552	taskmgr.exe
4552	taskmgr.exe
4552	taskmgr.exe
4552	taskmgr.exe
4552	taskmgr.exe
4552	taskmgr.exe
4552	taskmgr.exe
4552	taskmgr.exe
4552	taskmgr.exe
4552	taskmgr.exe
4552	taskmgr.exe
4552	taskmgr.exe
4552	taskmgr.exe
4552	taskmgr.exe
4552	taskmgr.exe
4552	taskmgr.exe
4552	taskmgr.exe
4552	taskmgr.exe
4552	taskmgr.exe
4552	taskmgr.exe
4552	taskmgr.exe
4552	taskmgr.exe
4552	taskmgr.exe
4552	taskmgr.exe
4552	taskmgr.exe
4552	taskmgr.exe
4552	taskmgr.exe
4552	taskmgr.exe
4552	taskmgr.exe
4552	taskmgr.exe
4552	taskmgr.exe
4552	taskmgr.exe
4552	taskmgr.exe
4552	taskmgr.exe
4552	taskmgr.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	4552	taskmgr.exe
Token: SeSystemProfilePrivilege	4552	taskmgr.exe
Token: SeCreateGlobalPrivilege	4552	taskmgr.exe
Token: SeShutdownPrivilege	4244	MusNotification.exe
Token: SeCreatePagefilePrivilege	4244	MusNotification.exe
Token: SeManageVolumePrivilege	2980	svchost.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
4216	Free YouTube Downloader.exe
4552	taskmgr.exe
4552	taskmgr.exe
4552	taskmgr.exe
4552	taskmgr.exe
4552	taskmgr.exe
4552	taskmgr.exe
4552	taskmgr.exe
4552	taskmgr.exe
4552	taskmgr.exe
4552	taskmgr.exe
4552	taskmgr.exe
4552	taskmgr.exe
4552	taskmgr.exe
4552	taskmgr.exe
4552	taskmgr.exe
4552	taskmgr.exe
4552	taskmgr.exe
4552	taskmgr.exe
4552	taskmgr.exe
4552	taskmgr.exe
4552	taskmgr.exe
4552	taskmgr.exe
4552	taskmgr.exe
4552	taskmgr.exe
4552	taskmgr.exe
4552	taskmgr.exe
4552	taskmgr.exe
4552	taskmgr.exe
4552	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
4216	Free YouTube Downloader.exe
4552	taskmgr.exe
4552	taskmgr.exe
4552	taskmgr.exe
4552	taskmgr.exe
4552	taskmgr.exe
4552	taskmgr.exe
4552	taskmgr.exe
4552	taskmgr.exe
4552	taskmgr.exe
4552	taskmgr.exe
4552	taskmgr.exe
4552	taskmgr.exe
4552	taskmgr.exe
4552	taskmgr.exe
4552	taskmgr.exe
4552	taskmgr.exe
4552	taskmgr.exe
4552	taskmgr.exe
4552	taskmgr.exe
4552	taskmgr.exe
4552	taskmgr.exe
4552	taskmgr.exe
4552	taskmgr.exe
4552	taskmgr.exe
4552	taskmgr.exe
4552	taskmgr.exe
4552	taskmgr.exe
4552	taskmgr.exe
4552	taskmgr.exe
4552	taskmgr.exe
4552	taskmgr.exe
4552	taskmgr.exe
4552	taskmgr.exe
4552	taskmgr.exe
4552	taskmgr.exe
4552	taskmgr.exe
4552	taskmgr.exe
4552	taskmgr.exe
4552	taskmgr.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1036	[email protected]

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1468 wrote to memory of 4572	1468	msedge.exe	81
PID 1468 wrote to memory of 4572	1468	msedge.exe	81
PID 1468 wrote to memory of 236	1468	msedge.exe	82
PID 1468 wrote to memory of 236	1468	msedge.exe	82
PID 1468 wrote to memory of 236	1468	msedge.exe	82
PID 1468 wrote to memory of 236	1468	msedge.exe	82
PID 1468 wrote to memory of 236	1468	msedge.exe	82
PID 1468 wrote to memory of 236	1468	msedge.exe	82
PID 1468 wrote to memory of 236	1468	msedge.exe	82
PID 1468 wrote to memory of 236	1468	msedge.exe	82
PID 1468 wrote to memory of 236	1468	msedge.exe	82
PID 1468 wrote to memory of 236	1468	msedge.exe	82
PID 1468 wrote to memory of 236	1468	msedge.exe	82
PID 1468 wrote to memory of 236	1468	msedge.exe	82
PID 1468 wrote to memory of 236	1468	msedge.exe	82
PID 1468 wrote to memory of 236	1468	msedge.exe	82
PID 1468 wrote to memory of 236	1468	msedge.exe	82
PID 1468 wrote to memory of 236	1468	msedge.exe	82
PID 1468 wrote to memory of 236	1468	msedge.exe	82
PID 1468 wrote to memory of 236	1468	msedge.exe	82
PID 1468 wrote to memory of 236	1468	msedge.exe	82
PID 1468 wrote to memory of 236	1468	msedge.exe	82
PID 1468 wrote to memory of 236	1468	msedge.exe	82
PID 1468 wrote to memory of 236	1468	msedge.exe	82
PID 1468 wrote to memory of 236	1468	msedge.exe	82
PID 1468 wrote to memory of 236	1468	msedge.exe	82
PID 1468 wrote to memory of 236	1468	msedge.exe	82
PID 1468 wrote to memory of 236	1468	msedge.exe	82
PID 1468 wrote to memory of 236	1468	msedge.exe	82
PID 1468 wrote to memory of 236	1468	msedge.exe	82
PID 1468 wrote to memory of 236	1468	msedge.exe	82
PID 1468 wrote to memory of 236	1468	msedge.exe	82
PID 1468 wrote to memory of 236	1468	msedge.exe	82
PID 1468 wrote to memory of 236	1468	msedge.exe	82
PID 1468 wrote to memory of 236	1468	msedge.exe	82
PID 1468 wrote to memory of 236	1468	msedge.exe	82
PID 1468 wrote to memory of 236	1468	msedge.exe	82
PID 1468 wrote to memory of 236	1468	msedge.exe	82
PID 1468 wrote to memory of 236	1468	msedge.exe	82
PID 1468 wrote to memory of 236	1468	msedge.exe	82
PID 1468 wrote to memory of 236	1468	msedge.exe	82
PID 1468 wrote to memory of 236	1468	msedge.exe	82
PID 1468 wrote to memory of 4932	1468	msedge.exe	83
PID 1468 wrote to memory of 4932	1468	msedge.exe	83
PID 1468 wrote to memory of 3412	1468	msedge.exe	84
PID 1468 wrote to memory of 3412	1468	msedge.exe	84
PID 1468 wrote to memory of 3412	1468	msedge.exe	84
PID 1468 wrote to memory of 3412	1468	msedge.exe	84
PID 1468 wrote to memory of 3412	1468	msedge.exe	84
PID 1468 wrote to memory of 3412	1468	msedge.exe	84
PID 1468 wrote to memory of 3412	1468	msedge.exe	84
PID 1468 wrote to memory of 3412	1468	msedge.exe	84
PID 1468 wrote to memory of 3412	1468	msedge.exe	84
PID 1468 wrote to memory of 3412	1468	msedge.exe	84
PID 1468 wrote to memory of 3412	1468	msedge.exe	84
PID 1468 wrote to memory of 3412	1468	msedge.exe	84
PID 1468 wrote to memory of 3412	1468	msedge.exe	84
PID 1468 wrote to memory of 3412	1468	msedge.exe	84
PID 1468 wrote to memory of 3412	1468	msedge.exe	84
PID 1468 wrote to memory of 3412	1468	msedge.exe	84
PID 1468 wrote to memory of 3412	1468	msedge.exe	84
PID 1468 wrote to memory of 3412	1468	msedge.exe	84
PID 1468 wrote to memory of 3412	1468	msedge.exe	84
PID 1468 wrote to memory of 3412	1468	msedge.exe	84

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://github.com/Endermanch/MalwareDatabase
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x124,0x128,0x12c,0x100,0x130,0x7fffd15b46f8,0x7fffd15b4708,0x7fffd15b4718
  2⤵
  PID:4572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,11702434316198167733,12572376750700374731,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2088 /prefetch:2
  2⤵
  PID:236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2064,11702434316198167733,12572376750700374731,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2248 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2064,11702434316198167733,12572376750700374731,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2772 /prefetch:8
  2⤵
  PID:3412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,11702434316198167733,12572376750700374731,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3436 /prefetch:1
  2⤵
  PID:836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,11702434316198167733,12572376750700374731,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3448 /prefetch:1
  2⤵
  PID:4628
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2064,11702434316198167733,12572376750700374731,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5620 /prefetch:8
  2⤵
  PID:3124
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
  2⤵
  - Drops file in Program Files directory
  PID:4820
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x248,0x24c,0x250,0x108,0x254,0x7ff6b8855460,0x7ff6b8855470,0x7ff6b8855480
    3⤵
    PID:4868
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2064,11702434316198167733,12572376750700374731,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5620 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,11702434316198167733,12572376750700374731,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5876 /prefetch:1
  2⤵
  PID:3976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,11702434316198167733,12572376750700374731,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5932 /prefetch:1
  2⤵
  PID:1528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,11702434316198167733,12572376750700374731,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5776 /prefetch:1
  2⤵
  PID:2484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,11702434316198167733,12572376750700374731,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5892 /prefetch:1
  2⤵
  PID:3184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2064,11702434316198167733,12572376750700374731,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=6204 /prefetch:8
  2⤵
  PID:2128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,11702434316198167733,12572376750700374731,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5992 /prefetch:1
  2⤵
  PID:3984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2064,11702434316198167733,12572376750700374731,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1988 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,11702434316198167733,12572376750700374731,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5040 /prefetch:2
  2⤵
  PID:2384

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1304

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1104

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2920

C:\Users\Admin\Downloads\FakeActivation\[email protected]
"C:\Users\Admin\Downloads\FakeActivation\[email protected]"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1036
- C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Free YouTube Downloader.exe
  "C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Free YouTube Downloader.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:4216

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4552

C:\Windows\system32\MusNotification.exe
"C:\Windows\system32\MusNotification.exe"
1⤵
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4244

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k UnistackSvcGroup
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2980

C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Free YouTube Downloader.exe
"C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Free YouTube Downloader.exe"
1⤵
- Executes dropped EXE
PID:3968

C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Free YouTube Downloader.exe
"C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Free YouTube Downloader.exe"
1⤵
- Executes dropped EXE
PID:1680

C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Free YouTube Downloader.exe
"C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Free YouTube Downloader.exe"
1⤵
- Executes dropped EXE
PID:3944

C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Free YouTube Downloader.exe
"C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Free YouTube Downloader.exe"
1⤵
- Executes dropped EXE
PID:4800

C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Free YouTube Downloader.exe
"C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Free YouTube Downloader.exe"
1⤵
- Executes dropped EXE
PID:1864

C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Free YouTube Downloader.exe
"C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Free YouTube Downloader.exe"
1⤵
- Executes dropped EXE
PID:660

C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Box.exe
"C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Box.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4360

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9d9e89a46ea1c979d600d8ecff95392f

SHA1
a03b20076c4a9bd34d03af90e43d5815943d187b

SHA256
7d5e0d521951eff280f780f5134b8f1b4c614bb4e96ce15577201272a1e4478c

SHA512
7bd673c3e908e62928b35bb2ca183a79e575775a1b76b1bd3e584c9da331d4a4c213b3de25fe209090504ce0af3f3823a27767196ed81cceb7f881106e068429

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
5e66a3d46ce02326d71914c69bb1ff5e

SHA1
91ccf10b11a8c2d127fe825840b0f5a3c5a51513

SHA256
8408d688778cfc5151fd454f1182175674719a8a5709dd36aaac95512c7b1054

SHA512
3fc4c3299a000fd48b25ec9fa88d87892fe60b3e82005195d0afc80e028ff270e1429bb2a4fc07cfcfd5d8c23a44283c92a11f9ff11d28ec951331e3df05326c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
48B

MD5
c40beed3cbca4ddc6afc9edf42047e9f

SHA1
ab6e60cbdf31333eda76d78c0c9e81eade77cead

SHA256
5d8cee0f40b89bc5ffbb21e29105bf31d5b3565de90baa66f04ddd22d69f7ebe

SHA512
64f2a43a092e936a15ac3b7b90d197a374697e3bd10a9f3f638e4cf333dd2032e18bc22e2b5b8eb580141bf65519a1db82dc316c1ba5ffdc98a6b389773d823f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
f99ec1455314abba10f3417ab9731477

SHA1
7254bda5bea413af3b5921eaa1461f117b8f3e75

SHA256
4d4ac3e8575174f016f4a7f78d42e12404a006711e043cb09629bc86f142f4cb

SHA512
5451d1bd5fdf7c55b6890aba52d920e9085cc460c3bfd31334f66583a7b340f34e5e59644fea9ebb8b20c67a278f8e7f7d4b7476b86bd9f6e08901772eefcd4b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
dcb5af1d4e16d924fc9aa7deea8cb68e

SHA1
79ca4739766ec82f49f41912c0ef34444d3dce75

SHA256
12d920c1f28a3e9c58768f3ef759e32a1303e1b00c2b289dc3bb262ec1cc8fd9

SHA512
70e8590f20914a2400dc8ad8f56ac2f22d854338c142da58bb890ea8faac146984e7ba89dc31f658aaa77381790ac4c87670617abe7a65e485ceb25587792db3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico

Filesize
70KB

MD5
e5e3377341056643b0494b6842c0b544

SHA1
d53fd8e256ec9d5cef8ef5387872e544a2df9108

SHA256
e23040951e464b53b84b11c3466bbd4707a009018819f9ad2a79d1b0b309bc25

SHA512
83f09e48d009a5cf83fa9aa8f28187f7f4202c84e2d0d6e5806c468f4a24b2478b73077381d2a21c89aa64884df3c56e8dc94eb4ad2d6a8085ac2feb1e26c2ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
678B

MD5
280b92f19a2240b2adbda1d878d39f14

SHA1
728448c823fed1d4926768c7bade953c0478d01c

SHA256
7270a4feedfd9a7dd1f363b99ef836b2428be8231d53296f869668b9f7cab00f

SHA512
8c6803c30ed0e73812c97c4e471137130b7bc82d4aad5df875ccd2710a402a8fb942001cbd57fe9e4531fc249248160cb6c1f0c5fe23e37537f6bed5eaf83c20

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
9caa29fc09542d6bf9cd9cbef520972f

SHA1
067d0ac0c4666645a70e2e950f1a5c92de430a70

SHA256
fd0b8772b5a1eeb36c1a717b2444434ba6ffac39d6e78a089ef1b7f0ba4770d3

SHA512
8b0006d446c8f99b4544e8cf07a2c242a12a9c4094db8878e0720bdb9281ce19b832da1a77f77ed02e493f8223943c2abb991106ad6be5a4941272150ec85098

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
e383b28ffe2732be1347424a7c3f6227

SHA1
78f4505d7be4a43a4014db68ea1a6a874a52dcfe

SHA256
57b8bfa1e0aacf8413784cd35bbc70a9c6f78835e1076ea03cb2fd42647eef13

SHA512
51068b1933a9e0cf2c4aed38857c2643336c7cf8ad8703792bbcb7e2b79d0beb3f36d27451721877ab8c6048677b7a71a38d3bf80084a2fd0c7d9df0a99e6eb6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
6edce9626fe5dcbfd6ecc409e92cc141

SHA1
48ae45c9aec296637119540fe3178a5d44df7506

SHA256
5d20de3f223638e5a134dc59e01d12b7a7793563d4b9097a1b7e3c77cdd7d95b

SHA512
964096c921a7eef007faff2bc89034876bfdab067cbd71fab3bf0fe9d0d38a5b232bf77f985d38c89043a2b4af29267fe6f721b979702c305dceadddbb79c59c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
4bc948a53b89c94ee2180ecd3d4b100b

SHA1
1b88e34ff3215298bc052607293175ebee7cde4b

SHA256
eae248043886fb16224f65c93be1e56794cc861070d898a733a05c7454705d6a

SHA512
3f8e9ce1eefdfc5d4e3b87407845efbea6db8f5ecd07bae259ba2f3b0cdfbb495550be1a8a54ff558dfdaefd2b163ff019e31613bccb63998d773061724d7f14

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
32db4ac46345a7e0b693220de0d36301

SHA1
07a4c34997031efa494db9fde57c8d21a0e844a5

SHA256
5ec643fb8518d7f7f4bfdcbafeafd0264121466343024b5b5289e48b574a3c34

SHA512
0167161ecc92a6e826969620ed18a6225375317688f635d0a45bfab233d597034bd232b95383c851eea8e3ff92615254cf648107b18759693f358896d5c72f93

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
8bbb70b63ea38955801783c83b928cf0

SHA1
91e76aa432aa9b323f7f8efb7dc94fe0b9587496

SHA256
e31be9b1110c9d3f71b40293c8f3d21fbdb1d53910d91dad2ed1f29c363102cb

SHA512
1172db8453c8902fe6ab8e417ae44da691b72e8e05a50c85d5bda1ae3cd6b54407b1393d9707cd152bc37ad56b1c380ef23dae445f8f27e35844f6233132804c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
ff5dd20177add5f2fb07a017c096ccce

SHA1
7afe60457ca44419c3421847c4202a50fd4b80a8

SHA256
0e18c1f1f59aefdb789413aefaeaa005421e9369195f7c35929008ec30b50cb0

SHA512
3bbbb7e4af49e8a92b5dba457567a249db23b50a1b4a79c33bc38a14e5dc4ae9dbf480b6f42abfd3da28af57c06aeaf4b0b7f3da39b712ca49981c8c7973c77a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
562735c12316f2e9fc48f0a62226eb13

SHA1
323da2f7da09adf9530205a93515e880b82a2544

SHA256
8d8ea4239fc69b793bc93746330d47bb067847fe4629a6222d5192d8ab04860e

SHA512
5cee6eefa8e9872548b89d4430d73d297627b4a28f9ea41269be2f98ac720be03ec26bfd87b2d4b15c3f898fe74eacf8d274796ab5c72b0de5e19badc7a1bdf0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
d67c82374545c8c0ef60e520dedabbca

SHA1
eced5a7d187ed6705b7275f47da8c95d461977fc

SHA256
c7d56f7d23e6af8f985396ca1dc7f0ddd9ecebc4afa7214a9a1b80eb1e6f7f6b

SHA512
509191cff79cd791ae42a9e23659f9f56fdb94dc8fa130954c80f5d687c576e1deb1feb24ed3d3b6f6692c94efa6e90da152173aa78b375a6b388f7a62f78adc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
96b54a433b774e285bed531930c692d4

SHA1
28a5b9a6c7e4ae205222b5deba5be8d3593dcd61

SHA256
dcc4c6f76ac67070adecde52f2231eb7884306a522dc8b72ab665cda98056123

SHA512
8c204dfcf6832fb2b3204b66e020b22d9f9c4c5d570d573de6fc1f66bb5f7547a903912fb7d8f18907d6c56b34087e1fea292e9b78999d1d9fea7042c4e32477

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57f5ca.TMP

Filesize
1KB

MD5
46b7b2b542f5d40d5334bcf63e650e0b

SHA1
a756ff05ac11e83057114bb68b9153086c10754c

SHA256
6f82681c095229056720b1da2acdf9d43057a2ce0698abe105050a5535fe78e3

SHA512
c88c8b85b5f1d55c4013d7ec4c3f4f4aa303c3ae891071b13e3444d807be25243f8f1913d50bfac075458f381c52eaaa375564567834087bc6442d2822032195

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
f7fb1e06803926141b247520c65b4fc7

SHA1
026d52edc86b131e35ee16dd6e0c9d2561a40965

SHA256
6607efb021be617e5425f11e281558df9195130051051f8ab6ab9ae2ba7015a3

SHA512
82d114d5044b86aad9893b54dc1fc0fdfab2b995b11cd705e7b59b5f4550bc6fcdcb29ffaba64229fc7f4a73e43b6073c4c561a41266e936627886bf0ff111a6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
8KB

MD5
72e0e1dbfda16268f21ecdd1d10dac74

SHA1
d29e6fb96db6964256f4d4d7669cdf747ab8f8a0

SHA256
8f1f097972b99f8c9e11f4c7923944f0c39ea347d5a08f6f987c3b4964586291

SHA512
cb8f604a6c8a43cf27c38cf3b09d830b7404ed67aaf16b1f9d8c38beb048357996986d2436bd33ea2adf652e73ddc0fa09d836340c7f048a9d649442fc21569b

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
3KB

MD5
839256819d9cb8c0e43cf98882dc616b

SHA1
32a75739331161b3528c723e58116ee5fa530ea0

SHA256
642a555544af6b686ca1ad9f1a0c612dcc2bd1e2a9618e0a4d4ccc9f60358747

SHA512
d9f1619bb9a9977a72c72e130d78e6f6f0d247b358b025a795b8875b690995385690dea039bb9a9054a67f78dd34abce6a492db1bc73921acddce8bd80c64ac6

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
3KB

MD5
9be0f8bf9bc09ca8052d8a13a186f291

SHA1
500eb75337d7a8b4a73eedb9a578870057bca7a2

SHA256
69bf36a2b408d4529a32c8306997f1c3eaf9e996577adc776b5c7964f0491323

SHA512
f1a41a460e1da668592b6eca675bb465baa7e892f43ce4a1ead91deeb8e8d4a6028958f53e0e5c83caea6ac0f16a6538835fb036a58c1237a1f5415803cc7b90

Download Submit
C:\Users\Admin\Downloads\FakeActivation.zip

Filesize
275KB

MD5
6db8a7da4e8dc527d445b7a37d02d5d6

SHA1
4fcc7cff8b49a834858d8c6016c3c6f109c9c794

SHA256
7cc43d4259f9dbe6806e1c067ebd1784eaaf56a026047d9380be944b71e5b984

SHA512
b1b4269da8a0648747c4eee7a26619b29d8d1182fe12446c780091fef205a7b5e6fb93c9b74c710cca5d2e69600579b9d470e31a32689ecc570d0c4bbe4fe718

Download Submit
C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Box.exe

Filesize
438KB

MD5
1bb4dd43a8aebc8f3b53acd05e31d5b5

SHA1
54cd1a4a505b301df636903b2293d995d560887e

SHA256
a2380a5f503bc6f5fcfd4c72e5b807df0740a60a298e8686bf6454f92e5d3c02

SHA512
94c70d592e806bb426760f61122b8321e8dc5cff7f793d51f9d5650821c502c43096f41d3e61207ca6989df5bfdbff57bc23328de16e99dd56e85efc90affdce

Download Submit
C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Free YouTube Downloader.exe

Filesize
153KB

MD5
f33a4e991a11baf336a2324f700d874d

SHA1
9da1891a164f2fc0a88d0de1ba397585b455b0f4

SHA256
a87524035509ff7aa277788e1a9485618665b7da35044d70c41ec0f118f3dfd7

SHA512
edf066968f31451e21c7c21d3f54b03fd5827a8526940c1e449aad7f99624577cbc6432deba49bb86e96ac275f5900dcef8d7623855eb3c808e084601ee1df20

Download Submit
memory/1036-444-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2980-525-0x00000254EE9E0000-0x00000254EE9E1000-memory.dmp

Filesize
4KB

Download
memory/2980-526-0x00000254EE9E0000-0x00000254EE9E1000-memory.dmp

Filesize
4KB

Download
memory/2980-527-0x00000254EEAF0000-0x00000254EEAF1000-memory.dmp

Filesize
4KB

Download
memory/2980-491-0x00000254E6540000-0x00000254E6550000-memory.dmp

Filesize
64KB

Download
memory/2980-507-0x00000254E6640000-0x00000254E6650000-memory.dmp

Filesize
64KB

Download
memory/2980-523-0x00000254EE9B0000-0x00000254EE9B1000-memory.dmp

Filesize
4KB

Download
memory/4216-445-0x0000025F49340000-0x0000025F4936E000-memory.dmp

Filesize
184KB

Download
memory/4360-557-0x0000000004EB0000-0x0000000004EBA000-memory.dmp

Filesize
40KB

Download
memory/4360-556-0x0000000004E00000-0x0000000004E92000-memory.dmp

Filesize
584KB

Download
memory/4360-555-0x0000000005480000-0x0000000005A26000-memory.dmp

Filesize
5.6MB

Download
memory/4360-554-0x00000000003B0000-0x0000000000424000-memory.dmp

Filesize
464KB

Download
memory/4552-466-0x00000185AA9C0000-0x00000185AA9C1000-memory.dmp

Filesize
4KB

Download
memory/4552-457-0x00000185AA9C0000-0x00000185AA9C1000-memory.dmp

Filesize
4KB

Download
memory/4552-464-0x00000185AA9C0000-0x00000185AA9C1000-memory.dmp

Filesize
4KB

Download
memory/4552-458-0x00000185AA9C0000-0x00000185AA9C1000-memory.dmp

Filesize
4KB

Download
memory/4552-459-0x00000185AA9C0000-0x00000185AA9C1000-memory.dmp

Filesize
4KB

Download
memory/4552-463-0x00000185AA9C0000-0x00000185AA9C1000-memory.dmp

Filesize
4KB

Download
memory/4552-467-0x00000185AA9C0000-0x00000185AA9C1000-memory.dmp

Filesize
4KB

Download
memory/4552-468-0x00000185AA9C0000-0x00000185AA9C1000-memory.dmp

Filesize
4KB

Download
memory/4552-465-0x00000185AA9C0000-0x00000185AA9C1000-memory.dmp

Filesize
4KB

Download
memory/4552-469-0x00000185AA9C0000-0x00000185AA9C1000-memory.dmp

Filesize
4KB

Download