badrabbit | 326bae0bd1398234dcef4c3d71f00e30cc9b447fa963e21d6f29605f42bb7e5b

Resubmissions

30-01-2025 07:49

250130-jnprkavmdz 10

30-01-2025 07:38

250130-jgrbtavlbs 8

Analysis

max time kernel
1200s
max time network
1202s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
30-01-2025 07:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Xeno.exe
Size

140KB
MD5

f0d6a8ef8299c5f15732a011d90b0be1
SHA1

5d2e6cc0bd4f1e810808f2a284f6c2a30b21edcf
SHA256

326bae0bd1398234dcef4c3d71f00e30cc9b447fa963e21d6f29605f42bb7e5b
SHA512

5b9f1517949a7fa9fdb7413146632d21a4208dc92823b673af85963ae5cc7f827b3ba27f3e9c5554c45e726ad159aac77d30306acc3559bd8712534e41ff0f27
SSDEEP

3072:2hK4Uay3XrQ8habqgp9pC9Z6p5uf3C6k0xuZ04ntfxDhBury:2hK4XycqgpfCup5sVxuZ04bhA

Score

10^/10

badrabbit aspackv2 defense_evasion discovery persistence ransomware upx

Malware Config

Signatures

BadRabbit
Ransomware family discovered in late 2017, mainly targeting Russia and Ukraine.
ransomware badrabbit
Badrabbit family
badrabbit

Blocklisted process makes network request 21 IoCs

flow	pid	Process
380	1048	rundll32.exe
391	1048	rundll32.exe
403	1048	rundll32.exe
414	1048	rundll32.exe
426	1048	rundll32.exe
438	1048	rundll32.exe
450	1048	rundll32.exe
461	1048	rundll32.exe
473	1048	rundll32.exe
484	1048	rundll32.exe
498	1048	rundll32.exe
510	1048	rundll32.exe
521	1048	rundll32.exe
533	1048	rundll32.exe
544	1048	rundll32.exe
555	1048	rundll32.exe
568	1048	rundll32.exe
579	1048	rundll32.exe
591	1048	rundll32.exe
602	1048	rundll32.exe
614	1048	rundll32.exe

Downloads MZ/PE file 12 IoCs

flow	pid	Process
42	2580	msedge.exe
42	2580	msedge.exe
42	2580	msedge.exe
42	2580	msedge.exe
42	2580	msedge.exe
42	2580	msedge.exe
42	2580	msedge.exe
42	2580	msedge.exe
42	2580	msedge.exe
42	2580	msedge.exe
42	2580	msedge.exe
42	2580	msedge.exe

ASPack v2.12-2.42 1 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral1/files/0x001b00000002abe9-1682.dat	aspack_v212_v242

Executes dropped EXE 35 IoCs

pid	Process
2216	ArcticBomb.exe
4976	ArcticBomb.exe
940	ArcticBomb.exe
4964	LoveYou.exe
2820	Gas.exe
2336	FreeYoutubeDownloader.exe
5020	Free YouTube Downloader.exe
4440	FreeYoutubeDownloader.exe
4620	Free YouTube Downloader.exe
2120	ColorBug.exe
3200	ColorBug.exe
328	Box.exe
1376	Box.exe
3260	BadRabbit.exe
1552	2CBB.tmp
2940	BadRabbit.exe
4144	ColorBug.exe
2584	BadRabbit.exe
1044	Gas.exe
1380	CookieClickerHack.exe
764	Box.exe
3204	Box.exe
3068	ChilledWindows.exe
3444	Box.exe
5080	Avoid.exe
1476	Box.exe
4304	DesktopBoom.exe
2388	Box.exe
916	Box.exe
2092	Box.exe
1896	Box.exe
2084	Box.exe
744	Box.exe
2132	Box.exe
4408	Box.exe

Loads dropped DLL 3 IoCs

pid	Process
1048	rundll32.exe
4696	rundll32.exe
1880	rundll32.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000\Software\Microsoft\Windows\CurrentVersion\Run\Free Youtube Downloader = "C:\\Windows\\Free Youtube Downloader\\Free Youtube Downloader\\Free YouTube Downloader.exe"	FreeYoutubeDownloader.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000\Software\Microsoft\Windows\CurrentVersion\Run\Free Youtube Downloader = "C:\\Windows\\Free Youtube Downloader\\Free Youtube Downloader\\Free YouTube Downloader.exe"	FreeYoutubeDownloader.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\~~CB = "cb.exe"	ColorBug.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\M:	ChilledWindows.exe
File opened (read-only)	\??\P:	ChilledWindows.exe
File opened (read-only)	\??\S:	ChilledWindows.exe
File opened (read-only)	\??\T:	ChilledWindows.exe
File opened (read-only)	\??\Y:	ChilledWindows.exe
File opened (read-only)	\??\Z:	ChilledWindows.exe
File opened (read-only)	\??\A:	ChilledWindows.exe
File opened (read-only)	\??\J:	ChilledWindows.exe
File opened (read-only)	\??\H:	ChilledWindows.exe
File opened (read-only)	\??\I:	ChilledWindows.exe
File opened (read-only)	\??\N:	ChilledWindows.exe
File opened (read-only)	\??\O:	ChilledWindows.exe
File opened (read-only)	\??\R:	ChilledWindows.exe
File opened (read-only)	\??\E:	ChilledWindows.exe
File opened (read-only)	\??\G:	ChilledWindows.exe
File opened (read-only)	\??\L:	ChilledWindows.exe
File opened (read-only)	\??\U:	ChilledWindows.exe
File opened (read-only)	\??\V:	ChilledWindows.exe
File opened (read-only)	\??\X:	ChilledWindows.exe
File opened (read-only)	\??\B:	ChilledWindows.exe
File opened (read-only)	\??\K:	ChilledWindows.exe
File opened (read-only)	\??\Q:	ChilledWindows.exe
File opened (read-only)	\??\W:	ChilledWindows.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
1	raw.githubusercontent.com
42	raw.githubusercontent.com

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x000400000000f375-498.dat	upx
behavioral1/memory/2216-557-0x0000000000400000-0x0000000000454000-memory.dmp	upx
behavioral1/memory/2216-559-0x0000000000400000-0x0000000000454000-memory.dmp	upx
behavioral1/memory/4976-561-0x0000000000400000-0x0000000000454000-memory.dmp	upx
behavioral1/memory/4976-563-0x0000000000400000-0x0000000000454000-memory.dmp	upx
behavioral1/memory/940-567-0x0000000000400000-0x0000000000454000-memory.dmp	upx

Drops file in Windows directory 17 IoCs

description	ioc	Process
File opened for modification	C:\Windows\infpub.dat	rundll32.exe
File opened for modification	C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Uninstall.exe	FreeYoutubeDownloader.exe
File created	C:\Windows\infpub.dat	BadRabbit.exe
File opened for modification	C:\Windows\infpub.dat	rundll32.exe
File opened for modification	C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Uninstall.ini	FreeYoutubeDownloader.exe
File created	C:\Windows\dispci.exe	rundll32.exe
File created	C:\Windows\infpub.dat	BadRabbit.exe
File opened for modification	C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Box.exe	FreeYoutubeDownloader.exe
File opened for modification	C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Free YouTube Downloader.exe	FreeYoutubeDownloader.exe
File opened for modification	C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Box.exe	FreeYoutubeDownloader.exe
File created	C:\Windows\cscc.dat	rundll32.exe
File created	C:\Windows\infpub.dat	BadRabbit.exe
File opened for modification	C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Uninstall.exe	FreeYoutubeDownloader.exe
File created	C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Uninstall.ini	FreeYoutubeDownloader.exe
File opened for modification	C:\Windows\infpub.dat	rundll32.exe
File opened for modification	C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Free YouTube Downloader.exe	FreeYoutubeDownloader.exe
File opened for modification	C:\Windows\2CBB.tmp	rundll32.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 12 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\LoveYou.exe:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\FreeYoutubeDownloader.exe:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\CookieClickerHack.exe:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\ChilledWindows.exe:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\DesktopBoom.exe:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Hydra.exe:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\ArcticBomb.exe:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Gas.exe:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\ColorBug.exe:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Cerber5.exe:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\BadRabbit.exe:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Avoid.exe:Zone.Identifier	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 33 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Box.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gas.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Box.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ColorBug.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Box.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Box.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Box.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Box.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Box.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ArcticBomb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BadRabbit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Box.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BadRabbit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BadRabbit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Box.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Avoid.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FreeYoutubeDownloader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Box.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Box.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Box.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FreeYoutubeDownloader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Box.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	LoveYou.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Box.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies Control Panel 63 IoCs

defense_evasion

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000\Control Panel\Colors\Scrollbar = "23 152 114"	ColorBug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000\Control Panel\Colors\ActiveTitle = "188 79 41"	ColorBug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000\Control Panel\Colors\WindowText = "73 137 189"	ColorBug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000\Control Panel\Colors\InactiveTitle = "146 209 117"	ColorBug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000\Control Panel\Colors\TitleText = "37 179 32"	ColorBug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000\Control Panel\Colors\Hilight = "66 213 170"	ColorBug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000\Control Panel\Colors\ActiveTitle = "107 247 150"	ColorBug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000\Control Panel\Colors\ActiveBorder = "243 229 216"	ColorBug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000\Control Panel\Colors\GrayText = "93 119 217"	ColorBug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000\Control Panel\Colors\ActiveBorder = "228 109 80"	ColorBug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000\Control Panel\Colors\InactiveTitleText = "59 141 15"	ColorBug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000\Control Panel\Colors\AppWorkspace = "185 168 67"	ColorBug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000\Control Panel\Colors\Hilight = "77 6 244"	ColorBug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000\Control Panel\Colors\Scrollbar = "46 1 148"	ColorBug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000\Control Panel\Colors\Background = "209 62 13"	ColorBug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000\Control Panel\Colors\Menu = "234 158 117"	ColorBug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000\Control Panel\Colors\Window = "181 91 197"	ColorBug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000\Control Panel\Colors\ButtonFace = "217 22 66"	ColorBug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000\Control Panel\Colors\InactiveTitleText = "197 246 210"	ColorBug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000\Control Panel\Colors\GrayText = "56 150 181"	ColorBug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000\Control Panel\Colors\InactiveBorder = "24 197 158"	ColorBug.exe
Key created	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000\Control Panel\Colors	ColorBug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000\Control Panel\Colors\ButtonShadow = "64 122 172"	ColorBug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000\Control Panel\Colors\ButtonShadow = "159 116 40"	ColorBug.exe
Key created	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000\Control Panel\Colors	ColorBug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000\Control Panel\Colors\HilightText = "205 37 71"	ColorBug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000\Control Panel\Colors\MenuText = "76 131 87"	ColorBug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000\Control Panel\Colors\InactiveBorder = "127 128 235"	ColorBug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000\Control Panel\Colors\HilightText = "254 81 188"	ColorBug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000\Control Panel\Colors\Window = "66 61 178"	ColorBug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000\Control Panel\Colors\HilightText = "133 187 10"	ColorBug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000\Control Panel\Colors\Scrollbar = "64 25 201"	ColorBug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000\Control Panel\Colors\ActiveTitle = "66 95 101"	ColorBug.exe
Key created	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000\Control Panel\Colors	ColorBug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000\Control Panel\Colors\TitleText = "218 187 178"	ColorBug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000\Control Panel\Colors\ButtonText = "236 61 89"	ColorBug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000\Control Panel\Colors\InactiveTitle = "238 49 57"	ColorBug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000\Control Panel\Colors\ButtonFace = "229 52 11"	ColorBug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000\Control Panel\Colors\ButtonShadow = "108 191 147"	ColorBug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000\Control Panel\Colors\WindowFrame = "250 33 33"	ColorBug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000\Control Panel\Colors\TitleText = "66 165 110"	ColorBug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000\Control Panel\Colors\Window = "248 156 192"	ColorBug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000\Control Panel\Colors\Background = "122 164 62"	ColorBug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000\Control Panel\Colors\WindowText = "176 66 12"	ColorBug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000\Control Panel\Colors\ButtonText = "210 18 252"	ColorBug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000\Control Panel\Colors\WindowFrame = "58 145 94"	ColorBug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000\Control Panel\Colors\InactiveBorder = "74 156 70"	ColorBug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000\Control Panel\Colors\ActiveBorder = "234 31 61"	ColorBug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000\Control Panel\Colors\WindowFrame = "96 239 203"	ColorBug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000\Control Panel\Colors\MenuText = "221 238 38"	ColorBug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000\Control Panel\Colors\InactiveTitle = "199 220 191"	ColorBug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000\Control Panel\Colors\Menu = "66 104 122"	ColorBug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000\Control Panel\Colors\AppWorkspace = "85 18 240"	ColorBug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000\Control Panel\Colors\InactiveTitleText = "6 159 176"	ColorBug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000\Control Panel\Colors\Background = "149 179 236"	ColorBug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000\Control Panel\Colors\AppWorkspace = "139 76 83"	ColorBug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000\Control Panel\Colors\ButtonFace = "35 224 153"	ColorBug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000\Control Panel\Colors\MenuText = "201 247 123"	ColorBug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000\Control Panel\Colors\GrayText = "30 23 186"	ColorBug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000\Control Panel\Colors\WindowText = "10 176 97"	ColorBug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000\Control Panel\Colors\ButtonText = "161 9 160"	ColorBug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000\Control Panel\Colors\Menu = "44 29 58"	ColorBug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000\Control Panel\Colors\Hilight = "194 16 121"	ColorBug.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4249425805-3408538557-1766626484-1000\{065D4C4F-62D4-4411-8CFE-833BEF019B64}	ChilledWindows.exe
Key created	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\Local Settings\MuiCache	MiniSearchHost.exe

NTFS ADS 25 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 772924.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 999485.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Gas.exe:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\FreeYoutubeDownloader.exe:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 39199.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 901498.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\LoveYou.exe:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\ColorBug.exe:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Cerber5.exe:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 242805.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\ChilledWindows.exe:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 168005.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\BadRabbit.exe:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Avoid.exe:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 137206.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 35880.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\ArcticBomb.exe:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 117119.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 413291.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 596614.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 771650.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\CookieClickerHack.exe:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 935697.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\DesktopBoom.exe:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Hydra.exe:Zone.Identifier	msedge.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1480	schtasks.exe
4168	schtasks.exe

Suspicious behavior: EnumeratesProcesses 51 IoCs

pid	Process
4348	msedge.exe
4348	msedge.exe
2580	msedge.exe
2580	msedge.exe
2336	msedge.exe
2336	msedge.exe
1484	identity_helper.exe
1484	identity_helper.exe
4296	msedge.exe
4296	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
892	msedge.exe
892	msedge.exe
2892	msedge.exe
2892	msedge.exe
852	msedge.exe
852	msedge.exe
3160	msedge.exe
3160	msedge.exe
3244	msedge.exe
3244	msedge.exe
756	msedge.exe
756	msedge.exe
1048	rundll32.exe
1048	rundll32.exe
1048	rundll32.exe
1048	rundll32.exe
1552	2CBB.tmp
1552	2CBB.tmp
1552	2CBB.tmp
1552	2CBB.tmp
1552	2CBB.tmp
1552	2CBB.tmp
1552	2CBB.tmp
4696	rundll32.exe
4696	rundll32.exe
1880	rundll32.exe
1880	rundll32.exe
744	msedge.exe
744	msedge.exe
3392	msedge.exe
3392	msedge.exe
3776	msedge.exe
3776	msedge.exe
1876	msedge.exe
1876	msedge.exe
4960	msedge.exe
4960	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
4348	msedge.exe
4304	DesktopBoom.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 39 IoCs

pid	Process
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1048	rundll32.exe
Token: SeDebugPrivilege	1048	rundll32.exe
Token: SeTcbPrivilege	1048	rundll32.exe
Token: SeDebugPrivilege	1552	2CBB.tmp
Token: SeShutdownPrivilege	4696	rundll32.exe
Token: SeDebugPrivilege	4696	rundll32.exe
Token: SeTcbPrivilege	4696	rundll32.exe
Token: SeShutdownPrivilege	1880	rundll32.exe
Token: SeDebugPrivilege	1880	rundll32.exe
Token: SeTcbPrivilege	1880	rundll32.exe
Token: SeShutdownPrivilege	3068	ChilledWindows.exe
Token: SeCreatePagefilePrivilege	3068	ChilledWindows.exe
Token: 33	3780	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	3780	AUDIODG.EXE
Token: SeShutdownPrivilege	3068	ChilledWindows.exe
Token: SeCreatePagefilePrivilege	3068	ChilledWindows.exe
Token: SeShutdownPrivilege	3068	ChilledWindows.exe
Token: SeCreatePagefilePrivilege	3068	ChilledWindows.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe

Suspicious use of SendNotifyMessage 56 IoCs

pid	Process
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
5020	Free YouTube Downloader.exe
4620	Free YouTube Downloader.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
1384	MiniSearchHost.exe
2336	FreeYoutubeDownloader.exe
4440	FreeYoutubeDownloader.exe
1696	helppane.exe
1696	helppane.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4348 wrote to memory of 4012	4348	msedge.exe	80
PID 4348 wrote to memory of 4012	4348	msedge.exe	80
PID 4348 wrote to memory of 4288	4348	msedge.exe	81
PID 4348 wrote to memory of 4288	4348	msedge.exe	81
PID 4348 wrote to memory of 4288	4348	msedge.exe	81
PID 4348 wrote to memory of 4288	4348	msedge.exe	81
PID 4348 wrote to memory of 4288	4348	msedge.exe	81
PID 4348 wrote to memory of 4288	4348	msedge.exe	81
PID 4348 wrote to memory of 4288	4348	msedge.exe	81
PID 4348 wrote to memory of 4288	4348	msedge.exe	81
PID 4348 wrote to memory of 4288	4348	msedge.exe	81
PID 4348 wrote to memory of 4288	4348	msedge.exe	81
PID 4348 wrote to memory of 4288	4348	msedge.exe	81
PID 4348 wrote to memory of 4288	4348	msedge.exe	81
PID 4348 wrote to memory of 4288	4348	msedge.exe	81
PID 4348 wrote to memory of 4288	4348	msedge.exe	81
PID 4348 wrote to memory of 4288	4348	msedge.exe	81
PID 4348 wrote to memory of 4288	4348	msedge.exe	81
PID 4348 wrote to memory of 4288	4348	msedge.exe	81
PID 4348 wrote to memory of 4288	4348	msedge.exe	81
PID 4348 wrote to memory of 4288	4348	msedge.exe	81
PID 4348 wrote to memory of 4288	4348	msedge.exe	81
PID 4348 wrote to memory of 4288	4348	msedge.exe	81
PID 4348 wrote to memory of 4288	4348	msedge.exe	81
PID 4348 wrote to memory of 4288	4348	msedge.exe	81
PID 4348 wrote to memory of 4288	4348	msedge.exe	81
PID 4348 wrote to memory of 4288	4348	msedge.exe	81
PID 4348 wrote to memory of 4288	4348	msedge.exe	81
PID 4348 wrote to memory of 4288	4348	msedge.exe	81
PID 4348 wrote to memory of 4288	4348	msedge.exe	81
PID 4348 wrote to memory of 4288	4348	msedge.exe	81
PID 4348 wrote to memory of 4288	4348	msedge.exe	81
PID 4348 wrote to memory of 4288	4348	msedge.exe	81
PID 4348 wrote to memory of 4288	4348	msedge.exe	81
PID 4348 wrote to memory of 4288	4348	msedge.exe	81
PID 4348 wrote to memory of 4288	4348	msedge.exe	81
PID 4348 wrote to memory of 4288	4348	msedge.exe	81
PID 4348 wrote to memory of 4288	4348	msedge.exe	81
PID 4348 wrote to memory of 4288	4348	msedge.exe	81
PID 4348 wrote to memory of 4288	4348	msedge.exe	81
PID 4348 wrote to memory of 4288	4348	msedge.exe	81
PID 4348 wrote to memory of 4288	4348	msedge.exe	81
PID 4348 wrote to memory of 2580	4348	msedge.exe	82
PID 4348 wrote to memory of 2580	4348	msedge.exe	82
PID 4348 wrote to memory of 2308	4348	msedge.exe	83
PID 4348 wrote to memory of 2308	4348	msedge.exe	83
PID 4348 wrote to memory of 2308	4348	msedge.exe	83
PID 4348 wrote to memory of 2308	4348	msedge.exe	83
PID 4348 wrote to memory of 2308	4348	msedge.exe	83
PID 4348 wrote to memory of 2308	4348	msedge.exe	83
PID 4348 wrote to memory of 2308	4348	msedge.exe	83
PID 4348 wrote to memory of 2308	4348	msedge.exe	83
PID 4348 wrote to memory of 2308	4348	msedge.exe	83
PID 4348 wrote to memory of 2308	4348	msedge.exe	83
PID 4348 wrote to memory of 2308	4348	msedge.exe	83
PID 4348 wrote to memory of 2308	4348	msedge.exe	83
PID 4348 wrote to memory of 2308	4348	msedge.exe	83
PID 4348 wrote to memory of 2308	4348	msedge.exe	83
PID 4348 wrote to memory of 2308	4348	msedge.exe	83
PID 4348 wrote to memory of 2308	4348	msedge.exe	83
PID 4348 wrote to memory of 2308	4348	msedge.exe	83
PID 4348 wrote to memory of 2308	4348	msedge.exe	83
PID 4348 wrote to memory of 2308	4348	msedge.exe	83
PID 4348 wrote to memory of 2308	4348	msedge.exe	83

C:\Users\Admin\AppData\Local\Temp\Xeno.exe
"C:\Users\Admin\AppData\Local\Temp\Xeno.exe"
1⤵
PID:3676

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
- Modifies registry class
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffe425a3cb8,0x7ffe425a3cc8,0x7ffe425a3cd8
  2⤵
  PID:4012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1916,16169934963548533756,11718837128135881426,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1928 /prefetch:2
  2⤵
  PID:4288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1916,16169934963548533756,11718837128135881426,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2312 /prefetch:3
  2⤵
  - Downloads MZ/PE file
  - Suspicious behavior: EnumeratesProcesses
  PID:2580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1916,16169934963548533756,11718837128135881426,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2564 /prefetch:8
  2⤵
  PID:2308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,16169934963548533756,11718837128135881426,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1
  2⤵
  PID:4696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,16169934963548533756,11718837128135881426,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:3572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,16169934963548533756,11718837128135881426,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4576 /prefetch:1
  2⤵
  PID:3972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,16169934963548533756,11718837128135881426,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4604 /prefetch:1
  2⤵
  PID:4552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1916,16169934963548533756,11718837128135881426,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5136 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2336
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1916,16169934963548533756,11718837128135881426,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5396 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,16169934963548533756,11718837128135881426,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
  2⤵
  PID:2072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,16169934963548533756,11718837128135881426,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,16169934963548533756,11718837128135881426,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5460 /prefetch:1
  2⤵
  PID:2460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,16169934963548533756,11718837128135881426,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3636 /prefetch:1
  2⤵
  PID:4888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,16169934963548533756,11718837128135881426,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3472 /prefetch:1
  2⤵
  PID:1160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,16169934963548533756,11718837128135881426,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3508 /prefetch:1
  2⤵
  PID:4168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,16169934963548533756,11718837128135881426,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5560 /prefetch:1
  2⤵
  PID:4204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,16169934963548533756,11718837128135881426,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4436 /prefetch:1
  2⤵
  PID:3568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,16169934963548533756,11718837128135881426,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4868 /prefetch:1
  2⤵
  PID:4928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,16169934963548533756,11718837128135881426,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5280 /prefetch:1
  2⤵
  PID:1284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1916,16169934963548533756,11718837128135881426,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6352 /prefetch:8
  2⤵
  PID:2744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1916,16169934963548533756,11718837128135881426,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4812 /prefetch:8
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:4296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1916,16169934963548533756,11718837128135881426,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=6048 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,16169934963548533756,11718837128135881426,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6292 /prefetch:1
  2⤵
  PID:3300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,16169934963548533756,11718837128135881426,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1332 /prefetch:1
  2⤵
  PID:1356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,16169934963548533756,11718837128135881426,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6316 /prefetch:1
  2⤵
  PID:4332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,16169934963548533756,11718837128135881426,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4908 /prefetch:1
  2⤵
  PID:2968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1916,16169934963548533756,11718837128135881426,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6820 /prefetch:8
  2⤵
  PID:3368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,16169934963548533756,11718837128135881426,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3492 /prefetch:1
  2⤵
  PID:4056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,16169934963548533756,11718837128135881426,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6868 /prefetch:1
  2⤵
  PID:2884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1916,16169934963548533756,11718837128135881426,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6552 /prefetch:8
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,16169934963548533756,11718837128135881426,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6588 /prefetch:1
  2⤵
  PID:2024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1916,16169934963548533756,11718837128135881426,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5984 /prefetch:8
  2⤵
  PID:700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,16169934963548533756,11718837128135881426,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3164 /prefetch:1
  2⤵
  PID:4520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1916,16169934963548533756,11718837128135881426,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6400 /prefetch:8
  2⤵
  PID:1996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1916,16169934963548533756,11718837128135881426,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6608 /prefetch:8
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:2892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1916,16169934963548533756,11718837128135881426,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5920 /prefetch:8
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,16169934963548533756,11718837128135881426,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:1
  2⤵
  PID:3876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1916,16169934963548533756,11718837128135881426,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5248 /prefetch:8
  2⤵
  PID:4688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1916,16169934963548533756,11718837128135881426,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6676 /prefetch:8
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:3160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,16169934963548533756,11718837128135881426,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3492 /prefetch:1
  2⤵
  PID:1684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1916,16169934963548533756,11718837128135881426,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5176 /prefetch:8
  2⤵
  PID:1592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1916,16169934963548533756,11718837128135881426,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7056 /prefetch:8
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:3244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,16169934963548533756,11718837128135881426,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6548 /prefetch:1
  2⤵
  PID:2124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,16169934963548533756,11718837128135881426,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6580 /prefetch:1
  2⤵
  PID:772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,16169934963548533756,11718837128135881426,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6724 /prefetch:1
  2⤵
  PID:740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,16169934963548533756,11718837128135881426,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7156 /prefetch:1
  2⤵
  PID:2056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,16169934963548533756,11718837128135881426,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=55 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5968 /prefetch:1
  2⤵
  PID:1476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1916,16169934963548533756,11718837128135881426,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6664 /prefetch:8
  2⤵
  PID:5000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1916,16169934963548533756,11718837128135881426,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5404 /prefetch:8
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:756
- C:\Users\Admin\Downloads\BadRabbit.exe
  "C:\Users\Admin\Downloads\BadRabbit.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  PID:3260
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\system32\rundll32.exe C:\Windows\infpub.dat,#1 15
    3⤵
    - Blocklisted process makes network request
    - Loads dropped DLL
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1048
  - - C:\Windows\SysWOW64\cmd.exe
      /c schtasks /Delete /F /TN rhaegal
      4⤵
      System Location Discovery: System Language Discovery
      PID:2332
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /Delete /F /TN rhaegal
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4560
  - - C:\Windows\SysWOW64\cmd.exe
      /c schtasks /Create /RU SYSTEM /SC ONSTART /TN rhaegal /TR "C:\Windows\system32\cmd.exe /C Start \"\" \"C:\Windows\dispci.exe\" -id 2534040249 && exit"
      4⤵
      System Location Discovery: System Language Discovery
      PID:1960
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /Create /RU SYSTEM /SC ONSTART /TN rhaegal /TR "C:\Windows\system32\cmd.exe /C Start \"\" \"C:\Windows\dispci.exe\" -id 2534040249 && exit"
        5⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:1480
  - - C:\Windows\SysWOW64\cmd.exe
      /c schtasks /Create /SC once /TN drogon /RU SYSTEM /TR "C:\Windows\system32\shutdown.exe /r /t 0 /f" /ST 08:14:00
      4⤵
      System Location Discovery: System Language Discovery
      PID:4208
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /Create /SC once /TN drogon /RU SYSTEM /TR "C:\Windows\system32\shutdown.exe /r /t 0 /f" /ST 08:14:00
        5⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:4168
  - - C:\Windows\2CBB.tmp
      "C:\Windows\2CBB.tmp" \\.\pipe\{560F7A84-1965-4586-B430-8CB02B13550A}
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,16169934963548533756,11718837128135881426,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=59 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6716 /prefetch:1
  2⤵
  PID:788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1916,16169934963548533756,11718837128135881426,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6608 /prefetch:8
  2⤵
  PID:1936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1916,16169934963548533756,11718837128135881426,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1820 /prefetch:8
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:744
- C:\Users\Admin\Downloads\CookieClickerHack.exe
  "C:\Users\Admin\Downloads\CookieClickerHack.exe"
  2⤵
  - Executes dropped EXE
  PID:1380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,16169934963548533756,11718837128135881426,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=63 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4860 /prefetch:1
  2⤵
  PID:2092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1916,16169934963548533756,11718837128135881426,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5976 /prefetch:8
  2⤵
  PID:1688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1916,16169934963548533756,11718837128135881426,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7224 /prefetch:8
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:3392
- C:\Users\Admin\Downloads\ChilledWindows.exe
  "C:\Users\Admin\Downloads\ChilledWindows.exe"
  2⤵
  - Executes dropped EXE
  - Enumerates connected drives
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  PID:3068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,16169934963548533756,11718837128135881426,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=67 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5704 /prefetch:1
  2⤵
  PID:1952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1916,16169934963548533756,11718837128135881426,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=7276 /prefetch:8
  2⤵
  PID:2008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1916,16169934963548533756,11718837128135881426,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5988 /prefetch:8
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:3776
- C:\Users\Admin\Downloads\Avoid.exe
  "C:\Users\Admin\Downloads\Avoid.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,16169934963548533756,11718837128135881426,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=71 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7360 /prefetch:1
  2⤵
  PID:3412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1916,16169934963548533756,11718837128135881426,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5944 /prefetch:8
  2⤵
  PID:3560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1916,16169934963548533756,11718837128135881426,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4804 /prefetch:8
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:1876
- C:\Users\Admin\Downloads\DesktopBoom.exe
  "C:\Users\Admin\Downloads\DesktopBoom.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: GetForegroundWindowSpam
  PID:4304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,16169934963548533756,11718837128135881426,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=74 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7504 /prefetch:1
  2⤵
  PID:852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,16169934963548533756,11718837128135881426,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=76 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4300 /prefetch:1
  2⤵
  PID:4920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,16169934963548533756,11718837128135881426,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=78 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7508 /prefetch:1
  2⤵
  PID:1620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,16169934963548533756,11718837128135881426,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=80 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7240 /prefetch:1
  2⤵
  PID:2124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,16169934963548533756,11718837128135881426,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=82 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6872 /prefetch:1
  2⤵
  PID:2336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1916,16169934963548533756,11718837128135881426,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=2096 /prefetch:8
  2⤵
  PID:2056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,16169934963548533756,11718837128135881426,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=85 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2604 /prefetch:1
  2⤵
  PID:2856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1916,16169934963548533756,11718837128135881426,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4868 /prefetch:8
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:4960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1916,16169934963548533756,11718837128135881426,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=7692 /prefetch:8
  2⤵
  PID:4528

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:948

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1976

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1384

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2120

C:\Users\Admin\Downloads\ArcticBomb.exe
"C:\Users\Admin\Downloads\ArcticBomb.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2216

C:\Users\Admin\Downloads\ArcticBomb.exe
"C:\Users\Admin\Downloads\ArcticBomb.exe"
1⤵
- Executes dropped EXE
PID:4976

C:\Users\Admin\Downloads\ArcticBomb.exe
"C:\Users\Admin\Downloads\ArcticBomb.exe"
1⤵
- Executes dropped EXE
PID:940

C:\Users\Admin\Downloads\LoveYou.exe
"C:\Users\Admin\Downloads\LoveYou.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4964

C:\Users\Admin\Downloads\Gas.exe
"C:\Users\Admin\Downloads\Gas.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2820

C:\Users\Admin\Downloads\FreeYoutubeDownloader.exe
"C:\Users\Admin\Downloads\FreeYoutubeDownloader.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2336
- C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Free YouTube Downloader.exe
  "C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Free YouTube Downloader.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SendNotifyMessage
  PID:5020
- - C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Box.exe
    "C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Box.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:328
- - C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Box.exe
    "C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Box.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:764
- - C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Box.exe
    "C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Box.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3444
- - C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Box.exe
    "C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Box.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2388
- - C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Box.exe
    "C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Box.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2092
- - C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Box.exe
    "C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Box.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2084
- - C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Box.exe
    "C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Box.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2132

C:\Users\Admin\Downloads\FreeYoutubeDownloader.exe
"C:\Users\Admin\Downloads\FreeYoutubeDownloader.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4440
- C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Free YouTube Downloader.exe
  "C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Free YouTube Downloader.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SendNotifyMessage
  PID:4620
- - C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Box.exe
    "C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Box.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1376
- - C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Box.exe
    "C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Box.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3204
- - C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Box.exe
    "C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Box.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1476
- - C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Box.exe
    "C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Box.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:916
- - C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Box.exe
    "C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Box.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1896
- - C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Box.exe
    "C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Box.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:744
- - C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Box.exe
    "C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Box.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4408

C:\Users\Admin\Downloads\ColorBug.exe
"C:\Users\Admin\Downloads\ColorBug.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies Control Panel
PID:2120

C:\Users\Admin\Downloads\ColorBug.exe
"C:\Users\Admin\Downloads\ColorBug.exe"
1⤵
- Executes dropped EXE
- Modifies Control Panel
PID:3200

C:\Windows\helppane.exe
C:\Windows\helppane.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:1696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument microsoft-edge:https://go.microsoft.com/fwlink/?LinkId=517009
  2⤵
  PID:2120
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffe425a3cb8,0x7ffe425a3cc8,0x7ffe425a3cd8
    3⤵
    PID:480

C:\Users\Admin\Downloads\BadRabbit.exe
"C:\Users\Admin\Downloads\BadRabbit.exe"
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2940
- C:\Windows\SysWOW64\rundll32.exe
  C:\Windows\system32\rundll32.exe C:\Windows\infpub.dat,#1 15
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4696

C:\Users\Admin\Downloads\ColorBug.exe
"C:\Users\Admin\Downloads\ColorBug.exe"
1⤵
- Executes dropped EXE
- Modifies Control Panel
PID:4144

C:\Users\Admin\Downloads\BadRabbit.exe
"C:\Users\Admin\Downloads\BadRabbit.exe"
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2584
- C:\Windows\SysWOW64\rundll32.exe
  C:\Windows\system32\rundll32.exe C:\Windows\infpub.dat,#1 15
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1880

C:\Users\Admin\Downloads\Gas.exe
"C:\Users\Admin\Downloads\Gas.exe"
1⤵
- Executes dropped EXE
PID:1044

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004C0 0x00000000000004DC
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3780

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\1B1401C7EC8E96BC79CBFD92F9DF762D_5398732881722BDE3E78D6CA6BB2B78B

Filesize
5B

MD5
5bfa51f3a417b98e7443eca90fc94703

SHA1
8c015d80b8a23f780bdd215dc842b0f5551f63bd

SHA256
bebe2853a3485d1c2e5c5be4249183e0ddaff9f87de71652371700a89d937128

SHA512
4cd03686254bb28754cbaa635ae1264723e2be80ce1dd0f78d1ab7aee72232f5b285f79e488e9c5c49ff343015bd07bb8433d6cee08ae3cea8c317303e3ac399

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d7145ec3fa29a4f2df900d1418974538

SHA1
1368d579635ba1a53d7af0ed89bf0b001f149f9d

SHA256
efc56eb46cf3352bf706c0309d5d740bca6ac06142f9bdc5e8344b81d4d83d59

SHA512
5bb663ede88f8b7c96b09c1214aac68eda99bc09525ac383baa96914ff7d553ea1aed09e3c9d16893d791c81ddb164c682dfbb4759ac0bc751221f3e36558a91

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d91478312beae099b8ed57e547611ba2

SHA1
4b927559aedbde267a6193e3e480fb18e75c43d7

SHA256
df43cd7779d9fc91fd0416155d6771bc81565e98be38689cb17caece256bf043

SHA512
4086c4ebe410a37d0124fc8bd00c58775e70ab2b7b5a39b4e49b332ce5b4866c6775707436395467aff9596507c96fb4896f3bf0249c5b9c99a927f31dcc1a96

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000003

Filesize
62KB

MD5
c813a1b87f1651d642cdcad5fca7a7d8

SHA1
0e6628997674a7dfbeb321b59a6e829d0c2f4478

SHA256
df670e09f278fea1d0684afdcd0392a83d7041585ba5996f7b527974d7d98ec3

SHA512
af0d024ba1faafbd6f950c67977ed126827180a47cea9758ee51a95d13436f753eb5a7aa12a9090048a70328f6e779634c612aebde89b06740ffd770751e1c5b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000004

Filesize
70KB

MD5
3b06aa689e8bf1aed00d923a55cfdd49

SHA1
ca186701396ba24d747438e6de95397ed5014361

SHA256
cd1569510154d7fa83732ccf69e41e833421f4e5ec7f70a5353ad07940ec445c

SHA512
0422b94ec68439a172281605264dede7b987804b3acfdeeb86ca7b12249e0bd90e8e625f9549a9635165034b089d59861260bedf7676f9fa68c5b332123035ed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000005

Filesize
19KB

MD5
1bd4ae71ef8e69ad4b5ffd8dc7d2dcb5

SHA1
6dd8803e59949c985d6a9df2f26c833041a5178c

SHA256
af18b3681e8e2a1e8dc34c2aa60530dc8d8a9258c4d562cbe20c898d5de98725

SHA512
b3ff083b669aca75549396250e05344ba2f1c021468589f2bd6f1b977b7f11df00f958bbbd22f07708b5d30d0260f39d8de57e75382b3ab8e78a2c41ef428863

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000006

Filesize
63KB

MD5
226541550a51911c375216f718493f65

SHA1
f6e608468401f9384cabdef45ca19e2afacc84bd

SHA256
caecff4179910ce0ff470f9fa9eb4349e8fb717fa1432cf19987450a4e1ef4a5

SHA512
2947b309f15e0e321beb9506861883fde8391c6f6140178c7e6ee7750d6418266360c335477cae0b067a6a6d86935ec5f7acdfdacc9edffa8b04ec71be210516

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
0a1fa57d8abb8c646d9c3906944e566b

SHA1
81834eac8febdb4f382835978fac25fc4e0f91f0

SHA256
d2ba9ec668ae1cbd90ae8c02c28cdf4ad1bd952ff9d9539d440092c270024968

SHA512
9f519150b8f7f41ea3e1fa8e9af7b5d53d58dc85f7c5b1b16ceb584f9bef2e6c7c0d39b39b1dc54f1d9663ff201dddff3ebd24d312e7088d7f5971ae97426f87

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
753d661296fdd0931383758b02e29b8e

SHA1
707c8f46f8adcd4a98f46f8a045afb6f303c7dc3

SHA256
8a9a4b7ead6be4dbc5f91cbdd23b263ce96b3422e9f48da3e42329c1c33df501

SHA512
d0804fa8964c8f154e83c03b7aa755b63b57d3193d638765126305b27291d93ab723c9eb75e959e537be2d7792030db86bf6ca57ffad9d5b1ee6c0a44e7b53f9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
a3a3098bef355b0c650c0c2ee899203b

SHA1
9c1018cc3a834e63d4f80a974d583b4540347b24

SHA256
b08e702a6539525a89aa5f3caa1a524732afa8196dad4668d73824fb7092bc81

SHA512
79491151cc38ce8033b8285e46454b936846757934d9181204a4de9680300cdf5eec6e36c420f7148403a26676a76da5e17a10ea47109f0a03a9d2329dc1df4f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
854B

MD5
3d1c57ec6d8c1b7ddd62ee788b93b839

SHA1
f936619774d8d90add61fad11af279097716e359

SHA256
5c0c400273f2e0ebab392cfe65a6f537c1e0e71b7a544373effef51183e9e571

SHA512
20bfc2da15aabbf2c16784efe4e457868a689c86e38cfad18521c66ac6160cf1c63ff2abc94beff8acbf0debb5d919c8e686e5f62f41e8a71fc22bc487394396

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
f3c29dc2e75a867dba165ac927f0928a

SHA1
5fcf459a7f994f1385f8324b0f5954fd49c47216

SHA256
50934d63be4e92bd6ef50908152bae9e5bdaba2d1e91300f3805268c73c5b617

SHA512
eb792a493a227bf8a7d4f04f0e2b18f2fbc41e8123140ae78aa5098795d11526dd290c675f6d3a79ab846563f3cf096d038a8dc3545a4f9c7bf962c7f458b83b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
937B

MD5
9753515944ab76074bb6794f967e1353

SHA1
979e3d35ebc4ec6ef177c56490792f65a7cc660c

SHA256
81983121257d8f60476d37dad44ddd37bbfbf05a399d8be4579e1341d6bc8fda

SHA512
d34477e2d2815987c340b308ebe336cd6685ca69a94d894660dfe4707f8b8078f9a4648a330a3a064dcf398fca2fe79939fa56a9df0531e1de4a5940048e7480

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
a864124db9d5e000949b79bae429f52d

SHA1
1b263c6fd6022f15e80d10ddf1695449788a8b7e

SHA256
ec123114f35e3004bc315c4d935108397094088cfa4f9de24a9729ec2a9156b4

SHA512
f9cc8c015c91cc331555384eebbc50e76836cf8b7f54322c8e3056df5ca96e5991093ccec6538b2ca765197fcbb09e6205e7a9c9920ccbb74385b8f7298f6976

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
0672ea574c58418f4c239532b5fd6692

SHA1
c6afea9649f14f4a078c0c06bc355b695f2f3f20

SHA256
0535f04b309c073ce8e0a609fb9312a3cf21f73278c1d5e8400d0aeaf3a714c2

SHA512
58b7d7c5e5478bf3b831fe0fd81652c931c43feba6952c59794682751657e699689f82843ba646e268a120832874ea6c3008d0ef2fa94ebe1cfc82c3bc78326f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
2d3206e5d15695cff7f0a5e81de9f947

SHA1
b15b96f7dcd5935cd9028980e601fe6dfe462ce6

SHA256
20fe53f6253a0fd518863bfe2a6de6de190b7de4284e965fe41a2d64064bcf6f

SHA512
874f7e36b8d21346b130b3d93081f62686155b0a4bfdbb9f704ca9b7a1d08854a5ce3fa1625cc88722ffc6b94725ce2aa06d6d785871fcf74bdf9961d2302084

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
8bd8723558a575931899c51e675c4f20

SHA1
e8ab12d8f477abf5e554a89b62d76c151c8e13f8

SHA256
a94a61b4ed58153b30b001f00043e681726e0d24e322bab412f9f2f6dfbf5faf

SHA512
d9e38a0cdbabeace360d2c9bfcd9322ec937e5ef47ce13c758bbad1a94a4dd8d120bb4a8e681854f1aed3782ba161ce9b0c4964a6adff8376499ccf4912001b3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
e9caa6e92109ec45d552a248d4877c2e

SHA1
c5f50e965d76e20a62a1e768340b2c7cbdd0cbdd

SHA256
0026e46339964285b6f559870163ba981c2a6bace23c7081d8ec8ef004e71efa

SHA512
f4ab7b539b9746c216f60a8b0f922b6cc1ae51fefe9234d9f1842f3955f1a1e15acc4c9ab0fa3781ae6843d9bb7005f7ca5b2b3e0ae4cba04f470457be3289fb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
6e980e172b4c31dee9f5152cea94386f

SHA1
926456ad519789e2cb58566110a1a2fda333f7a8

SHA256
49150c747126b79e6ca5a1d8f6260eed408c40b46a173412abc3fea419423a8a

SHA512
ff1c9420d5f55cfe7fe1541d34ef8072cb111eb1bef3483361a051e68414623db7af0d63c10aca7d43de8971f090267a1ffb16d19d8281d84a4f42b5839c48dc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
8e24e460b519167255a0173b7fbc03d5

SHA1
e3202c98d4fa916cbf32361b4b4165dd03103ab2

SHA256
2d10e829845ae0e3fb13b3b3758cb5902effd0dc3e22a37ccf85445e7619a8d4

SHA512
55de99ba9969fabedcb52840f44b7b0bd488a4469e828f53d7095d9404f98d82fccc4f344a4e8bd5e39d9a796ea5f7a11e5fc562bf2f4156e5044580bd99df2d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
9a3c884bf1ffbc7c75a9435f48b717ac

SHA1
2b3d30510a694b7d9287667c8e7bfc06a80c723e

SHA256
255eb5fe36ce1d121c821e05741b000e62f6d91fd68b0c1d11343947dbfa5351

SHA512
c5deecb1bfccbc3ecc69590d4ccdb0b5e54dc42cd7089f2c348a9cd42780e2eecfb73ed4854b487f9e147bed7d1a8b4113689c7b34f56d48f7b279474f040952

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
24a3596fc629e39b5f6cbcf2681efb90

SHA1
f48dcf6bbac48fec81a05d860b76c8914d624c85

SHA256
ab4204cbd442a976665d5a24a8a7ef8787c7dfc32fcbfeb18e09733dc35db3a9

SHA512
fdc33c7f562b5e8c044ffc2b8df90f33184e978312f13dcff594d5e0d306aefd142116f4d2574cd0d3c4eddd3c70efc47ec8b1282356a66e458173f6c9c5257c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
6d2f3bcf11c1be5b34b96019d39a386d

SHA1
c2a80aec8bd92ae746de6161b312623ba51d76d5

SHA256
bdeb78a53770140f03c21e4740230bd35747bde2b2a41515da7fc7977ebe377e

SHA512
92e1f3333b0eee716e4b3b79be5b8efb1ad4452a688d50ced06d5760e737cb1bdb44bf96372e401bbf7f2482fd923c4ad8e1c2e096eb60f08c2469eea57206ec

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
d34427aa6c692631afe27819a8619de4

SHA1
bd8cf284df6df2efc9133d489a53887d39129d42

SHA256
0400fc9299a3b1292ff0fa88f46ca0bd3352e356f90ea1e83881781c56a26d88

SHA512
e94009240f11e3aaf9819fe00a5bb4e4305e0ac431026ad2af28607b8a4c31029c73ca07c71a6fbeeaef2c3fd271cbc079e60c551196b7c219dda727d4651641

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
855901487baa72866447906bcc297315

SHA1
b18392b802f9654ad5f11542780885d453b91a68

SHA256
8e7786c2689a332ae9834383cf72b1a079d14f0a2977e2f12b4614d94c1217b5

SHA512
e33534576de1f425f1e4a889b11157a1f71b2638b1208c3ef77034fc714a656cc130a86cf95e58d154729c0b9b162bcbe2c1cee83cf64ee77d9e3c39cbca267c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
5536a7cbd467975baaf85dc40a800a2c

SHA1
0984b37102d5418cbbeccdb50e1cf981b2c5a5a5

SHA256
2468757c548eb532e315b59f36cd7666c1de9e785f2f4488b6057197e203df96

SHA512
7d16f507e7023f40e54f715cfe027f895a8907586c362fb091739ad3e934e6f4e16c86f7dd0a1031e8e287103d309a5e433a7aa6c26ae9c20e96afac6d05af3a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
c5924643eedefc3ae3617fd5e2562c2f

SHA1
6e222a983a426ff5ffd596935d6c8bdaa537f9e1

SHA256
9d5ffb8574a8f00fe415a4ce66fa2e834c7850b585243915ff4c128b50866fce

SHA512
75b4ce83ee2e5cc9d56fc37b028fa5d2aa16b7493bfe0f5a0f84af7cdd1a4e6cc98db7a5042a0358a5f0f69d3b9c800778c6f5cb4d10e637bdb1760904c26dc1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
f15faa576d77355449956ae7b28d1110

SHA1
10295579d5ee0241acd769afb6456562c8590ee9

SHA256
2e74ca31441d96a2ff062dc7488d0dc3f4878cd54660a92f1e9757c0c95cb7ec

SHA512
d1d91e1ada218043e2878f426d982b99fe4201025fb7ccc409808d0061e862b91512ad38aebd3e3d91f9846aac5f56984f215425a39ec4b5c24ef072d824c3bd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
ab97cba7e5ab4007268e8d5720c4699c

SHA1
b02ccd55f7a92ef0e5841cd3b0b41b41cc48b639

SHA256
0e197035dc7258659417abb354c6d9cded3606b76d32dcee26b25440895b9dc6

SHA512
0661708f746132498c75e8056397f44f901d789be82925ce212f139b420604ea92d66e122d2532ce05738d82ec54f308d2dec85a0dd6f6604394447e836dfdfd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
486359a736ed8469aae03441e3fffaea

SHA1
8b46bb6bac1b3e8dd59438d3e8eea8bcd585cc0f

SHA256
76c4b08d2332bef03912c7874e1fae58277b66cbf2b40c7b1df988e6e5783e12

SHA512
1cf39e5127d326c0765559cbe3f42867c62e8f63c77e9846ef150225e86ce7a095689b959605e88f29b0733843e2857391450a3958a733244c79ec415406d71e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
41c9ca22de6f75ce3ef007d148f82c28

SHA1
271cc01bb236c4a05779f27b6819d9fefd71ce21

SHA256
925d533c93a6f020a459a1e8ed7e5a1d2bec10c8cc46e715ce72effc155efc61

SHA512
e5343922618bc4ad62afb0ce05bfb9f731c94a9c831434a02c3251ebd42b0c954a1e8c58447a078855e81d412980004378e94916c5cf1980595141ac6c69e0b8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
64eec1a67a9f7140d921364943a5df3b

SHA1
aadbe649e27a705ba89ed82502bd23c2ca76f4f4

SHA256
d17af91d2cc3b870bc6d2f2530a557dde3ce1e2b9aa7668d78f0f0c7ee35d74d

SHA512
b406835b770732dc2edcf1d6e2cc4cae08af175bf14a1af90eea7217d998a3ee55062a6d355018f7673c238b4cf498b4f1a5ef3c7d5f2182a6721ba8bb9f5179

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
674e4dc278b8196aed071eeb2081c9c4

SHA1
748cfb9ecd5221cb46cc097abe76316807209528

SHA256
4e3aac671139f095a25e1f31d4881baa8b32866fc14d336a1914d477ea3dcf96

SHA512
ef0dd448c96dce409953613be02e1ecef48e67e4cd2e038d4ebcae176a5841d920ce960ced19722317848a4d8b0e0bd73f627234a78559a97cdbac2f3f2cd35b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
dd652b30ab57ebd62338a172de42bb8b

SHA1
20c9733920eba2ec0a3d82eb5fa3b33b9b858fe8

SHA256
bca8efc70e027e8847777369ae8a130492b826aca109019b32c6ad9c2ce361be

SHA512
69bddcf0f446e2e3271c0ad00c784aa368b3be61b903093e16639d6891b6dc22695b731cd40dc4fae66059beb8c1d4f3d8aa67bb7aab371fa4b1ba1edef178a5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
21a4b3edbfb3e67d16fa5e2e678cd8ce

SHA1
547e89574e77f40e7aa42f2fce704fd41ded50d1

SHA256
3479df2f5a2dad314ebec5e2b895c8a351fc602147c4e0caf33102ed4a780cde

SHA512
23932c61e23f1d73cc695400e2df7ebaf667c2323fd475adf4aa60932db4dfd2241c45f5053c831624c07ea4c1b20e5fe8994dfd61c369b8e7f583b6d027fd36

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
692df199afd6d4c4a78671129a53e88b

SHA1
4f0b7ff749a933cc5144e63da9ce76f0fef2fd1e

SHA256
76d46942b04d2267b66b0935ce4c194167a9bc6f6fe2d451cc30392e19035f46

SHA512
ebb299409aca640eaa07133334a79aba44a33079d03906f94ef4ca93748af3da35451a28c158c25d1ce0a8f015ad3b205ba300aaa73111cd0f9e938616f33eb6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
b3955dd3c8ea78fe5bc5449413acda5f

SHA1
823abe1e9e70b8d47dde066040abf9f3da4bbf75

SHA256
1016e93f5999bc04b63ed4246a588bffbff02f85147dcff7b6eb93b3f36c6479

SHA512
9a80e1024b60e49789410c82f601f346691873fb12da892ea5a2f1aa08a05bda742e9eb76ed5e9882512543bb2eec0d30a91fb380f606bb2c1ff961e198b5961

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
0bd0b6c3090c756aef7ee39f124e05bc

SHA1
667aa98c791dd02c1edb85a38ff3f71572bb4b02

SHA256
38a540751c613a31282e7fe8a95261e6d31bf805b9f97e4d44ad2cc480157317

SHA512
a32ce52a0ab3ed391858cbbdef085ed09187d2bb49f835b975bb8ed10d3620de505ae220859de1c8a753e38f700114a7a4ebbf11ad1f17c99622898bc9ab86d6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
a0a9df4bf1abb57d8d070a47622deb40

SHA1
4fce3974ca6fe8db37fa73154af7592e77e75944

SHA256
ea2fa6cae31f6ad5c0361d5fb37d1ead1e002694026fbfe3354108085dc458b0

SHA512
0b21b066320818bdc4c0ffa410f76e6fddaecae42c4309a0afb21b1ed231c7f09464054edc64cb42bd2cc62cda700d42697b6567437e39d7373b44415bb54111

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
9ca3a048c8dd5df06c7df27356b1aabc

SHA1
a78283e5457606841351aa37c3c62c143b8b88cd

SHA256
12352e7e5118c2f85b0b8d30ae70d5aeb8a7a51ef35ee5ec3a2f2fee96ae44b0

SHA512
6e97157ec8a14cf329b850a16f70ac07fee72a983fe34a00686c64aec2ea212c373c48bf25ffb7b16eac0856c51b8d3cd6f613f65a49b555d18629c24d948340

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
27dfd69055b0c9bcf7a66398e16e3af8

SHA1
03a9434faa2066e9b4e5f83b56188cf125910323

SHA256
ab22ce78360486c4619c51d50cf5f251c1f37b2aef94e62018957def423f2850

SHA512
fb1b9680f3515aa2ee4f5f145e6a12eb0cb0cce0b1c03eb4425179d4222f5611c61e850cae999359a50353a3c950c752fe85d992f2b169939415fe316c534904

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
1418f34c2bf1e3dd0cf5b8bdb6495efa

SHA1
d73978a1b92b2b7784d478c703675d011a477991

SHA256
caeabb03ec9d0e04c6bf0dde76c2b0bd6eef5d57a4d084f091dad134f435206e

SHA512
b3656d39810d446351730ce51941171f2df84c4d6e0eac7b087f2a26ebe36f39b4613b92f8c5cbb1f5facb001dcb2b6b3d3b51d68e6b25608f7b8d5c8812490f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
8aa6cbf4c0a40fa4c82adee5909fae76

SHA1
c0e3e608c5f20c8a3f6b2863dd6db987be5b8b81

SHA256
64fca7a883818ef7c2d0d6e2c3b60a005a619cf438eee77f584db06ed54eb206

SHA512
8387164c1f681fa4ef4d569ec73c364b6942923ff9ad898d941c56bd8e446a82b065a045529ca0dd0738b0b70235689ab098056141a57eec982015f22723dffd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
a55f839249fe7dde45f4fb7c67cc8834

SHA1
84422580629e43f88bf3771f0d8c09a78adb9cfc

SHA256
c9438535259dc5c09a2c858c59ad5739923b91b3019ab58a614bb5cb462eddbd

SHA512
0cf397ebd97c5a0e41cb05f5c8515843be0365c26892d75e122433aa068ae68aafb27d45b88281961dd1884fe47b96da81ab9b82f22ef5731bbe2eb8bc847b2f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
143054761c01388503e5d4005ba554a7

SHA1
1149558cc6706dc5eccb18441a7e39059e579a4b

SHA256
66735ddf28be3ab01fa8d144507216ee72184e41c581e1a91bc75cee4a1538b8

SHA512
1d7fc9a39c82dc7798fb4052d77fee2f908cc6eb7b14c9b07879b5e7edfc025b8406d85cbb6a8f15a740b42a3bf5b6081619a729aa750210ad6d984b70550ba0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
dab10d49f6055e4a63a01e42c0b8eb46

SHA1
eab14a1bc1b87aab5d3c4e7f3a5ea1a8d44044f0

SHA256
0380872b44c1f8e15396af3faf6f508a4af7b404904f41c47a28fc0591eee149

SHA512
96621c66c97b87f97e11230895207a3e3f960a5f21e0cadfc15dfd8353b6e6d0566642da703d3d496526177867d8ffed17c74570485237d33b1d2a96af4bba2c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
02480f61238f097b7b73017fc036e1f4

SHA1
84700114295e466b61279d6d86f0075081a7f253

SHA256
083a07635c5437aa1131cf950177fd65cb4a9c9bfa3bc1d9c3d69ba1745c6348

SHA512
22a3ad54316d04dd4a435fbb62822733126f842369db90af5e952dd6c3575d553960c3905827c094d4b13daf14e868f4cbaf9c37f9bb0882ddfb03ead2858951

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
7a346307fa96f3bfa08cbd3d5920d645

SHA1
75c6e58aa674261b1e37bddc5e4794e12ecee762

SHA256
5db35c4ac34a0c241a876b770882d13a000dfae4ab994710da1825c9b73f2cc6

SHA512
329c988a01f0cc7e384314bd568313c8527bb06d84e2e0fce4ef228fe1d784909b61cc1eb50f086ce3f49401dd0b7a64a6b1a617388a13a25e2a644c979b4165

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
4fd8454770c587d55449b9f7aa4de9c3

SHA1
1f77eda9a068dc5e8b8d7e27a5cce3ca80949f6e

SHA256
0091076d03883471cfe3e0fee20bfb9a22ac1351a1fc96bcc14a6c6f017524b6

SHA512
f90b74ee1fba4dadbb557f2123b9a8358b4b01db30e75fff2ee14ea1e05fd6e61c54a0352a801dbd3fdea6e5e18b79742365e14aaa30704c3851d3702d8369a3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe583e6b.TMP

Filesize
538B

MD5
bd573644086d9a82b3e4cf432a69480f

SHA1
add52913344bc85297f6c6db3ec05796cee1fd82

SHA256
1b6065e222ff96ddd5318ea69d8954ad7703443d6eedb396f4b1c690495d08b4

SHA512
3d44ba14ae9d54d2d4d28cf797092ae5d8188a0f26e40dd8b3d7574d7bc6af0a55cb332d4e8861978954ba625f11bce0d24f772b0820b4bc4f6854a9fade0db4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
2842ada7bf70b1f4aed5cb2c5c9a429d

SHA1
b0ad5b2f853fc5430d83beeb63668fa7c7d19929

SHA256
3eccb94ccaec5563a736a240ed4fad9444229e6e86c371ac2115543e6fbe90c7

SHA512
86bf20ac4f86276d8596d92055f5f4d23a501f079cd91cee1be5658b7a0ec4bda032ced646a9605ec1eef8afa7c978bdb7288af090c22f385807b14f347e46dc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
0c81c2a8415412c26d0765c0f19cd17b

SHA1
f94ef8efd5e3a39719242233220657bd361da61a

SHA256
f631432f71eb0f81c547b8d012431536f61204e94e53bf5bf51a16ba15e9aa57

SHA512
3e702548abfe7c06623e95b9e58c8aed450b4c5a77f6df7ab8ec669c8acc4c833586c7d6523fddc8806de37c74531fb5ec23d30804b954b4b957c61b73795aa8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
389bf8d5809dc931f5eae90625b12a50

SHA1
1fcb27632fd66e7a92375f4fcd358a1525715b1c

SHA256
eef7b96e849a6f2d7c9ba262de9ce937c6286ac8082eeadfc784ff8e22efec71

SHA512
dd5a508b78a69ac7dc813c6a4b77d68ab4bf37c66ee0946cc25b7869f5b18dd9bc8ef430f3e263ec9ad737054caf5b249ba9c3ea4cb71dc7f12b7181426ad993

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
a0a8bdbc0d2ecd31516a1c50b41aba19

SHA1
e840c68c5711da7fead64234c622103c0e826e49

SHA256
d432d2db51cf6ec0c21a6406d14695723e9ba892e31f263a697f5b935aca3c7d

SHA512
b96b29fe32eaff6d3c2a42d5225794a2fd3d689e664234f6cf147938143bb8800523f93f3622eb9d575ffba59c90ddc5cf87e1c77338b42a4656323e0d03fc15

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
e3084513ccab90bee09d5070932082ea

SHA1
8f6406cd5d738a45ad909a865b98722e279b787a

SHA256
0029349a629b873c7c60cb032a71a43d46a961b988711c615b0ee1d54cb01473

SHA512
b0e9955563d9c6744670811661b059cff7d221b4845a7dd27261489de915146d8d46c46f46a76500d53bdc747f44bb6c535339dc2b070fa87f67207725a112d7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
b6bf9d25a4576e86754317f0e2f808ae

SHA1
fdddb40eeb3a2c29758f6ec588cd10d03a2f1eda

SHA256
0f853401b18edd7bd96966b0403ae72950e9f2baae10b664f183392981705ae5

SHA512
c6eac609063d9f9985417e8d5cb86ed9e7c61ffdcd99357278c76664543280da24eb70493f99792b662e44ee773e81407aa7d85f1142af29531dd438c50cb238

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
c691966e7ae356d4d1100ac350caa4b1

SHA1
181e9816d140ea8956b88114ee8fc0073ae99182

SHA256
e1e623866b227a2f5a01d7ba723429dce05315e45d9423b36110bf4605440480

SHA512
2e1e38060dc3e436453baf37054f8dafb3f3895eaf10e55281305d8e6e70743b06cf3461ca7296ef647f08919740c08a60b1f53c8e278c669fcfc83e5d414cf8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
7317fc09d0a86bea16179ba1a6eb31bc

SHA1
046e9efac12e229cef9548d6918289c4154befb5

SHA256
1b631427fa29a24cd6e50e058d335284e0cf03605568938d93037bcb2170d9c5

SHA512
2c559a8c028dc0468ac81a86271b9f8f18a006b7fcc9146404edc0b4bc358e4b39800dd59fbd91456c4e028b1fc19b5e2214d47b8805b9eb836586c1bebb2886

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
42c43a955d51b6a0414aa6b1333415fe

SHA1
0a09901d0a93fc6d6f78494756b59dbeecf8adee

SHA256
c45620d3f834519ecd89e8ecc8bda2bebeed565d49ecaf610f08c8c273b3c985

SHA512
90e2b46a2c475549e37353b712f114c51ec70379542e6f716a361701bc9155eea7356edb41425843d86739bb6c1810abcc57b12779c261316109a33d2ac03582

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
edd9a30376b57b1dd6724f115ffc5277

SHA1
2b745f5847b0d1daa3c2aece0ba0f43e3886725d

SHA256
c866c30e55829f172b8237ebceb0624b38688ce3bebf958ddf64138b62773fad

SHA512
8c1ae9d5403752671e1f105806ad8964385bee1e3ee412394f9c31c3e49b2a8c2b79923ed67ca2298b467fec00faed967546b40a6da11d7f1d4390bea1c3003d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
370dd4955e1df2c804e8ef6cf932a1b6

SHA1
265e1f26e71618f8537aac3b5c4311658d21f75f

SHA256
8c648c2b04e33ea1fb18b073d3a976c0627b8826aea70d240eff593c7c75e196

SHA512
48e9bf1f722edddbab7a7b3df55a7d17501c14e3909b976c1114ff8ef1e60b7b8571637f2032bb1ea1bcf7db0129a9b447ba62f3a822c0b9d61815429b1f0f6e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
69b872fe054a1f730b5eaffcb57a82ca

SHA1
f1719fb96bb1c887ef5dd51ddb9c32e3de0fecb9

SHA256
4f8a02dff2173cc141b32b96f4870991aedcbf018454837ac44c9ad68e5e1e93

SHA512
36a651026ab67b7cc6d4b4f2f06a445dcb2d27827f69fac7d2d8f9b1c891f64717d7dc49e13eba50aa625abdfcf78370ec1dd390ed6975c74f041d57cb931459

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
dea6dfd9cb185b9f71db8d016a93c959

SHA1
17f169d922b4db6a4e8213628948c0ba1e958610

SHA256
646dcf85fffa45a400df261ac355e28e858df0adefe3e6d1c0c30b7ed36612b5

SHA512
ecb05127e5e6b291841439b4d1fce174aab5f597ea209aa4b2a11a4910067978cc45d95ef76379155d85109a5c43aa84c7f8799309905279ca193974f1ff1952

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb

Filesize
576KB

MD5
9fc0b7408585d0a4dd42a81505dd44e3

SHA1
db0119f045e144c1fab255b47c2348e8b74e41b4

SHA256
bfbc584d630b79274909fcd7633c54268cd5e6e0d5a07ae243a383144837e024

SHA512
ae6b3c1a0a0288135fa6e60d33ade744394923d9cb9e51b34f2c91b1c58cb726cab539df658b673cb293cc004c6a5b6c0c3675e23cb720fd67009a6372dd0b03

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML

Filesize
9KB

MD5
7050d5ae8acfbe560fa11073fef8185d

SHA1
5bc38e77ff06785fe0aec5a345c4ccd15752560e

SHA256
cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b

SHA512
a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b

Download Submit
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchHoverUnifiedTileModelCache.dat

Filesize
10KB

MD5
96329c73cc49cd960e2485210d01c4d2

SHA1
a496b98ad2f2bbf26687b5b7794a26aa4470148e

SHA256
4c159cab6c9ef5ff39e6141b0ccb5b8c6251a3d637520609dfbdd852fa94d466

SHA512
e98736a879cad24c693d6c5939654b2fd25bf9d348f738668624214f22d541a9b781c967201ab2d43cbac9207946824a0299d482485f4b63c48d5d2a839e5baf

Download Submit
C:\Users\Admin\AppData\Local\Temp\$inst\2.tmp

Filesize
36B

MD5
8708699d2c73bed30a0a08d80f96d6d7

SHA1
684cb9d317146553e8c5269c8afb1539565f4f78

SHA256
a32e0a83001d2c5d41649063217923dac167809cab50ec5784078e41c9ec0f0f

SHA512
38ece3e441cc5d8e97781801d5b19bdede6065a0a50f7f87337039edeeb4a22ad0348e9f5b5542b26236037dd35d0563f62d7f4c4f991c51020552cfae03b264

Download Submit
C:\Users\Admin\AppData\Local\Temp\$inst\temp_0.tmp

Filesize
176KB

MD5
bc82784f4aa47bcfed93e81a3b9950f2

SHA1
f5f2238d45733a6dde53c7b7dfe3645ee8ae3830

SHA256
dd47684334f0a2b716e96f142e8915266d5bc1725853fd0bdc6d06148db6167f

SHA512
d2378f324d430f16ce7dcf1f656b504009b005cdb6df9d5215fe0786c112e8eba8c1650a83192b6a9afad5892a1a456714665233f6767765619ccb5ff28e2b8a

Download Submit
C:\Users\Admin\Downloads\ArcticBomb.exe:Zone.Identifier

Filesize
55B

MD5
0f98a5550abe0fb880568b1480c96a1c

SHA1
d2ce9f7057b201d31f79f3aee2225d89f36be07d

SHA256
2dfb5f4b33e4cf8237b732c02b1f2b1192ffe4b83114bcf821f489bbf48c6aa1

SHA512
dbc1150d831950684ab37407defac0177b7583da0fe13ee8f8eeb65e8b05d23b357722246888189b4681b97507a4262ece96a1c458c4427a9a41d8ea8d11a2f6

Download Submit
C:\Users\Admin\Downloads\FreeYoutubeDownloader.exe:Zone.Identifier

Filesize
26B

MD5
fbccf14d504b7b2dbcb5a5bda75bd93b

SHA1
d59fc84cdd5217c6cf74785703655f78da6b582b

SHA256
eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913

SHA512
aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 117119.crdownload

Filesize
22KB

MD5
31420227141ade98a5a5228bf8e6a97d

SHA1
19329845635ebbc5c4026e111650d3ef42ab05ac

SHA256
1edc8771e2a1a70023fc9ddeb5a6bc950380224b75e8306eb70da8eb80cb5b71

SHA512
cbb18a6667b377eb68395cfd8df52b7d93c4554c3b5ab32c70e73b86e3dedb7949122fe8eea9530cd53944b45a1b699380bf1e9e5254af04d8409c594a52c0e7

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 137206.crdownload

Filesize
4.4MB

MD5
6a4853cd0584dc90067e15afb43c4962

SHA1
ae59bbb123e98dc8379d08887f83d7e52b1b47fc

SHA256
ccb9502bf8ba5becf8b758ca04a5625c30b79e2d10d2677cc43ae4253e1288ec

SHA512
feb223e0de9bd64e32dc4f3227e175b58196b5e614bca8c2df0bbca2442a564e39d66bcd465154149dc7ebbd3e1ca644ed09d9a9174b52236c76e7388cb9d996

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 168005.crdownload

Filesize
43KB

MD5
b2eca909a91e1946457a0b36eaf90930

SHA1
3200c4e4d0d4ece2b2aadb6939be59b91954bcfa

SHA256
0b6c0af51cde971b3e5f8aa204f8205418ab8c180b79a5ac1c11a6e0676f0f7c

SHA512
607d20e4a46932c7f4d9609ef9451e2303cd79e7c4778fe03f444e7dc800d6de7537fd2648c7c476b9f098588dc447e8c39d8b21cd528d002dfa513a19c6ebbf

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 242805.crdownload

Filesize
431KB

MD5
fbbdc39af1139aebba4da004475e8839

SHA1
de5c8d858e6e41da715dca1c019df0bfb92d32c0

SHA256
630325cac09ac3fab908f903e3b00d0dadd5fdaa0875ed8496fcbb97a558d0da

SHA512
74eca8c01de215b33d5ceea1fda3f3bef96b513f58a750dba04b0de36f7ef4f7846a6431d52879ca0d8641bfd504d4721a9a96fa2e18c6888fd67fa77686af87

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 35880.crdownload

Filesize
248KB

MD5
20d2c71d6d9daf4499ffc4a5d164f1c3

SHA1
38e5dcd93f25386d05a34a5b26d3fba1bf02f7c8

SHA256
3ac8cc58dcbceaec3dab046aea050357e0e2248d30b0804c738c9a5b037c220d

SHA512
8ffd56fb3538eb60da2dde9e3d6eee0dac8419c61532e9127f47c4351b6e53e01143af92b2e26b521e23cdbbf15d7a358d3757431e572e37a1eede57c7d39704

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 39199.crdownload

Filesize
68KB

MD5
bc1e7d033a999c4fd006109c24599f4d

SHA1
b927f0fc4a4232a023312198b33272e1a6d79cec

SHA256
13adae722719839af8102f98730f3af1c5a56b58069bfce8995acd2123628401

SHA512
f5d9b8c1fd9239894ec9c075542bff0bcef79871f31038e627ae257b8c1db9070f4d124448a78e60ccc8bc12f138102a54825e9d7647cd34832984c7c24a6276

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 413291.crdownload

Filesize
396KB

MD5
13f4b868603cf0dd6c32702d1bd858c9

SHA1
a595ab75e134f5616679be5f11deefdfaae1de15

SHA256
cae57a60c4d269cd1ca43ef143aedb8bfc4c09a7e4a689544883d05ce89406e7

SHA512
e0d7a81c9cdd15a4ef7c8a9492fffb2c520b28cebc54a139e1bffa5c523cf17dfb9ffe57188cf8843d74479df402306f4f0ce9fc09d87c7cca92aea287e5ff24

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 596614.crdownload

Filesize
53KB

MD5
6536b10e5a713803d034c607d2de19e3

SHA1
a6000c05f565a36d2250bdab2ce78f505ca624b7

SHA256
775ba68597507cf3c24663f5016d257446abeb66627f20f8f832c0860cad84de

SHA512
61727cf0b150aad6965b4f118f33fd43600fb23dde5f0a3e780cc9998dfcc038b7542bfae9043ce28fb08d613c2a91ff9166f28a2a449d0e3253adc2cb110018

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 596614.crdownload:SmartScreen

Filesize
7B

MD5
4047530ecbc0170039e76fe1657bdb01

SHA1
32db7d5e662ebccdd1d71de285f907e3a1c68ac5

SHA256
82254025d1b98d60044d3aeb7c56eed7c61c07c3e30534d6e05dab9d6c326750

SHA512
8f002af3f4ed2b3dfb4ed8273318d160152da50ee4842c9f5d9915f50a3e643952494699c4258e6af993dc6e1695d0dc3db6d23f4d93c26b0bc6a20f4b4f336e

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 771650.crdownload

Filesize
313KB

MD5
fe1bc60a95b2c2d77cd5d232296a7fa4

SHA1
c07dfdea8da2da5bad036e7c2f5d37582e1cf684

SHA256
b3e1e9d97d74c416c2a30dd11858789af5554cf2de62f577c13944a19623777d

SHA512
266c541a421878e1e175db5d94185c991cec5825a4bc50178f57264f3556080e6fe984ed0380acf022ce659aa1ca46c9a5e97efc25ff46cbfd67b9385fd75f89

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 772924.crdownload

Filesize
125KB

MD5
ea534626d73f9eb0e134de9885054892

SHA1
ab03e674b407aecf29c907b39717dec004843b13

SHA256
322eb96fc33119d8ed21b45f1cd57670f74fb42fd8888275ca4879dce1c1511c

SHA512
c8cda90323fd94387a566641ec48cb086540a400726032f3261151afe8a981730688a4dcd0983d9585355e22833a035ef627dbd1f643c4399f9ddce118a3a851

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 935697.crdownload

Filesize
1.1MB

MD5
f0a661d33aac3a3ce0c38c89bec52f89

SHA1
709d6465793675208f22f779f9e070ed31d81e61

SHA256
c20e78ce9028299d566684d35b1230d055e5ea0e9b94d0aff58f650e0468778a

SHA512
57cdb3c38f2e90d03e6dc1f9d8d1131d40d3919f390bb1783343c82465461319e70483dc3cd3efdbd9a62dfc88d74fc706f05d760ffd8506b16fd7686e414443

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 999485.crdownload

Filesize
18KB

MD5
e7af185503236e623705368a443a17d9

SHA1
863084d6e7f3ed1ba6cc43f0746445b9ad218474

SHA256
da3f40b66cc657ea33dbf547eb05d8d4fb5fb5cf753689d0222039a3292c937a

SHA512
8db51d9029dfb0a1a112899ca1f1dacfd37ae9dec4d07594900c5725bc0f60212ab69395f560b30b20f6e1dffba84d585ef5ae2b43f77c3d5373fe481a8b8fc3

Download Submit
C:\Users\Admin\Downloads\chilledwindows.mp4

Filesize
3.6MB

MD5
698ddcaec1edcf1245807627884edf9c

SHA1
c7fcbeaa2aadffaf807c096c51fb14c47003ac20

SHA256
cde975f975d21edb2e5faa505205ab8a2c5a565ba1ff8585d1f0e372b2a1d78b

SHA512
a2c326f0c653edcd613a3cefc8d82006e843e69afc787c870aa1b9686a20d79e5ab4e9e60b04d1970f07d88318588c1305117810e73ac620afd1fb6511394155

Download Submit
C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Box.exe

Filesize
438KB

MD5
1bb4dd43a8aebc8f3b53acd05e31d5b5

SHA1
54cd1a4a505b301df636903b2293d995d560887e

SHA256
a2380a5f503bc6f5fcfd4c72e5b807df0740a60a298e8686bf6454f92e5d3c02

SHA512
94c70d592e806bb426760f61122b8321e8dc5cff7f793d51f9d5650821c502c43096f41d3e61207ca6989df5bfdbff57bc23328de16e99dd56e85efc90affdce

Download Submit
C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Free YouTube Downloader.exe

Filesize
153KB

MD5
f33a4e991a11baf336a2324f700d874d

SHA1
9da1891a164f2fc0a88d0de1ba397585b455b0f4

SHA256
a87524035509ff7aa277788e1a9485618665b7da35044d70c41ec0f118f3dfd7

SHA512
edf066968f31451e21c7c21d3f54b03fd5827a8526940c1e449aad7f99624577cbc6432deba49bb86e96ac275f5900dcef8d7623855eb3c808e084601ee1df20

Download Submit
C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Uninstall.exe

Filesize
110KB

MD5
ab648a0df4fe7a47fe9d980c545b065d

SHA1
ce28ea7dd117289daf467467a592bc304c72d4e6

SHA256
905a849721ec95ab08754aeee9a60b3ed435d36962466fcbe5cfca63dfc455cd

SHA512
7ae99da55fbf1c31c5281e5f4e10ab2bc33b89effeee82b574eb4b60541c5ea2913d5d99836608873da372c78e75436ae7e535568f48d81cb9dd26d2cc1b3a8c

Download Submit
C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Uninstall.exe

Filesize
110KB

MD5
139df873521412f2aebc4b45da0bc3e9

SHA1
3fd72fd5bad8ee9422fb9efa5f601f6b485404df

SHA256
efe6bd2e0fc7030994fc2837b389da22c52a7b0bbdbd41852fcaf4308a23da10

SHA512
d85cf83d3b2cf9af3076e40d7419be42a561bce1160376ba580b3078b581ed2bd6d274fb2a0767aa81a9e92052762f39c1c391ca0cac3043ad85a72862713bd3

Download Submit
C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Uninstall.ini

Filesize
3KB

MD5
c92a1d4d0755c886dd137c6cab43c35e

SHA1
fc16175e58ad1f67c57e7fdf55333fdd0e01d936

SHA256
6ab1ee65e6c9c5e31fe3680fc92a2a0ae73f216e966f5582a2d9c265357238d4

SHA512
0525880a1f4cc7dd912ca4006fe4bd02bf1218931fcb56489a0ec728a682fdf1ecd35e8797c665c63dc19d8236942d9b832a6a8c46e00df02afa2c65327dd9de

Download Submit
memory/328-1198-0x00000000058B0000-0x00000000058BA000-memory.dmp

Filesize
40KB

Download
memory/328-1177-0x0000000000D60000-0x0000000000DD4000-memory.dmp

Filesize
464KB

Download
memory/328-1187-0x0000000005DE0000-0x0000000006386000-memory.dmp

Filesize
5.6MB

Download
memory/328-1188-0x00000000058D0000-0x0000000005962000-memory.dmp

Filesize
584KB

Download
memory/940-567-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/1048-1309-0x0000000000D90000-0x0000000000DF8000-memory.dmp

Filesize
416KB

Download
memory/1048-1326-0x0000000000D90000-0x0000000000DF8000-memory.dmp

Filesize
416KB

Download
memory/1048-1330-0x0000000000D90000-0x0000000000DF8000-memory.dmp

Filesize
416KB

Download
memory/1380-1491-0x000000001C7E0000-0x000000001C82C000-memory.dmp

Filesize
304KB

Download
memory/1380-1490-0x0000000001540000-0x0000000001548000-memory.dmp

Filesize
32KB

Download
memory/1380-1489-0x000000001C580000-0x000000001C61C000-memory.dmp

Filesize
624KB

Download
memory/1380-1488-0x000000001BFF0000-0x000000001C4BE000-memory.dmp

Filesize
4.8MB

Download
memory/1380-1487-0x000000001BA30000-0x000000001BAD6000-memory.dmp

Filesize
664KB

Download
memory/1880-1432-0x0000000002750000-0x00000000027B8000-memory.dmp

Filesize
416KB

Download
memory/1880-1424-0x0000000002750000-0x00000000027B8000-memory.dmp

Filesize
416KB

Download
memory/2120-980-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2216-557-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/2216-559-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/2336-895-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/3068-1582-0x0000000000300000-0x0000000000764000-memory.dmp

Filesize
4.4MB

Download
memory/3068-1596-0x000000001BC10000-0x000000001BC1E000-memory.dmp

Filesize
56KB

Download
memory/3068-1594-0x0000000002A70000-0x0000000002A78000-memory.dmp

Filesize
32KB

Download
memory/3068-1595-0x000000001BC40000-0x000000001BC78000-memory.dmp

Filesize
224KB

Download
memory/3200-991-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/4144-1401-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/4440-928-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/4696-1373-0x0000000002660000-0x00000000026C8000-memory.dmp

Filesize
416KB

Download
memory/4696-1365-0x0000000002660000-0x00000000026C8000-memory.dmp

Filesize
416KB

Download
memory/4976-563-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/4976-561-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/5020-896-0x000002C5C38B0000-0x000002C5C38DE000-memory.dmp

Filesize
184KB

Download