Analysis
-
max time kernel
151s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
07-04-2023 01:02
Static task
static1
Behavioral task
behavioral1
Sample
MEMZ 3.0/MEMZ.bat
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
MEMZ 3.0/MEMZ.bat
Resource
win10v2004-20230220-en
Behavioral task
behavioral3
Sample
MEMZ 3.0/MEMZ.exe
Resource
win7-20230220-en
Behavioral task
behavioral4
Sample
MEMZ 3.0/MEMZ.exe
Resource
win10v2004-20230220-en
General
-
Target
MEMZ 3.0/MEMZ.exe
-
Size
12KB
-
MD5
a7bcf7ea8e9f3f36ebfb85b823e39d91
-
SHA1
761168201520c199dba68add3a607922d8d4a86e
-
SHA256
3ff64f10603f0330fa2386ff99471ca789391ace969bd0ec1c1b8ce1b4a6db42
-
SHA512
89923b669d31e590189fd06619bf27e47c5a47e82be6ae71fdb1b9b3b30b06fb7ca8ffed6d5c41ac410a367f2eb07589291e95a2644877d6bffd52775a5b1523
-
SSDEEP
192:HMDLTxWDf/pl3cIEiwqZKBktLe3P+qf2jhP6B5b2yL3:H4IDH3cIqqvUWq+jhyT2yL
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
MEMZ.exeMEMZ.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\International\Geo\Nation MEMZ.exe Key value queried \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\International\Geo\Nation MEMZ.exe -
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
Processes:
MEMZ.exedescription ioc process File opened for modification \??\PhysicalDrive0 MEMZ.exe -
Drops file in Program Files directory 2 IoCs
Processes:
setup.exedescription ioc process File created C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\cd6bf4a3-8e97-4104-aed0-609ef79ef83b.tmp setup.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20230407030256.pma setup.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
msedge.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Modifies registry class 1 IoCs
Processes:
msedge.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ msedge.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
MEMZ.exeMEMZ.exeMEMZ.exeMEMZ.exeMEMZ.exepid process 1344 MEMZ.exe 1344 MEMZ.exe 5044 MEMZ.exe 5044 MEMZ.exe 2164 MEMZ.exe 2164 MEMZ.exe 1344 MEMZ.exe 1344 MEMZ.exe 3700 MEMZ.exe 3700 MEMZ.exe 4084 MEMZ.exe 4084 MEMZ.exe 5044 MEMZ.exe 5044 MEMZ.exe 3700 MEMZ.exe 3700 MEMZ.exe 1344 MEMZ.exe 1344 MEMZ.exe 2164 MEMZ.exe 2164 MEMZ.exe 1344 MEMZ.exe 3700 MEMZ.exe 3700 MEMZ.exe 1344 MEMZ.exe 5044 MEMZ.exe 4084 MEMZ.exe 5044 MEMZ.exe 4084 MEMZ.exe 2164 MEMZ.exe 2164 MEMZ.exe 2164 MEMZ.exe 2164 MEMZ.exe 4084 MEMZ.exe 4084 MEMZ.exe 5044 MEMZ.exe 5044 MEMZ.exe 1344 MEMZ.exe 3700 MEMZ.exe 1344 MEMZ.exe 3700 MEMZ.exe 3700 MEMZ.exe 1344 MEMZ.exe 3700 MEMZ.exe 1344 MEMZ.exe 5044 MEMZ.exe 5044 MEMZ.exe 4084 MEMZ.exe 4084 MEMZ.exe 2164 MEMZ.exe 2164 MEMZ.exe 3700 MEMZ.exe 3700 MEMZ.exe 1344 MEMZ.exe 1344 MEMZ.exe 4084 MEMZ.exe 4084 MEMZ.exe 2164 MEMZ.exe 5044 MEMZ.exe 2164 MEMZ.exe 5044 MEMZ.exe 4084 MEMZ.exe 4084 MEMZ.exe 1344 MEMZ.exe 3700 MEMZ.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 16 IoCs
Processes:
msedge.exepid process 2248 msedge.exe 2248 msedge.exe 2248 msedge.exe 2248 msedge.exe 2248 msedge.exe 2248 msedge.exe 2248 msedge.exe 2248 msedge.exe 2248 msedge.exe 2248 msedge.exe 2248 msedge.exe 2248 msedge.exe 2248 msedge.exe 2248 msedge.exe 2248 msedge.exe 2248 msedge.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
AUDIODG.EXEdescription pid process Token: 33 1892 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 1892 AUDIODG.EXE -
Suspicious use of FindShellTrayWindow 3 IoCs
Processes:
msedge.exepid process 2248 msedge.exe 2248 msedge.exe 2248 msedge.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
MEMZ.exepid process 4288 MEMZ.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
MEMZ.exeMEMZ.exemsedge.exedescription pid process target process PID 1436 wrote to memory of 1344 1436 MEMZ.exe MEMZ.exe PID 1436 wrote to memory of 1344 1436 MEMZ.exe MEMZ.exe PID 1436 wrote to memory of 1344 1436 MEMZ.exe MEMZ.exe PID 1436 wrote to memory of 5044 1436 MEMZ.exe MEMZ.exe PID 1436 wrote to memory of 5044 1436 MEMZ.exe MEMZ.exe PID 1436 wrote to memory of 5044 1436 MEMZ.exe MEMZ.exe PID 1436 wrote to memory of 4084 1436 MEMZ.exe MEMZ.exe PID 1436 wrote to memory of 4084 1436 MEMZ.exe MEMZ.exe PID 1436 wrote to memory of 4084 1436 MEMZ.exe MEMZ.exe PID 1436 wrote to memory of 3700 1436 MEMZ.exe MEMZ.exe PID 1436 wrote to memory of 3700 1436 MEMZ.exe MEMZ.exe PID 1436 wrote to memory of 3700 1436 MEMZ.exe MEMZ.exe PID 1436 wrote to memory of 2164 1436 MEMZ.exe MEMZ.exe PID 1436 wrote to memory of 2164 1436 MEMZ.exe MEMZ.exe PID 1436 wrote to memory of 2164 1436 MEMZ.exe MEMZ.exe PID 1436 wrote to memory of 4288 1436 MEMZ.exe MEMZ.exe PID 1436 wrote to memory of 4288 1436 MEMZ.exe MEMZ.exe PID 1436 wrote to memory of 4288 1436 MEMZ.exe MEMZ.exe PID 4288 wrote to memory of 772 4288 MEMZ.exe notepad.exe PID 4288 wrote to memory of 772 4288 MEMZ.exe notepad.exe PID 4288 wrote to memory of 772 4288 MEMZ.exe notepad.exe PID 4288 wrote to memory of 2248 4288 MEMZ.exe msedge.exe PID 4288 wrote to memory of 2248 4288 MEMZ.exe msedge.exe PID 2248 wrote to memory of 2460 2248 msedge.exe msedge.exe PID 2248 wrote to memory of 2460 2248 msedge.exe msedge.exe PID 2248 wrote to memory of 3304 2248 msedge.exe msedge.exe PID 2248 wrote to memory of 3304 2248 msedge.exe msedge.exe PID 2248 wrote to memory of 3304 2248 msedge.exe msedge.exe PID 2248 wrote to memory of 3304 2248 msedge.exe msedge.exe PID 2248 wrote to memory of 3304 2248 msedge.exe msedge.exe PID 2248 wrote to memory of 3304 2248 msedge.exe msedge.exe PID 2248 wrote to memory of 3304 2248 msedge.exe msedge.exe PID 2248 wrote to memory of 3304 2248 msedge.exe msedge.exe PID 2248 wrote to memory of 3304 2248 msedge.exe msedge.exe PID 2248 wrote to memory of 3304 2248 msedge.exe msedge.exe PID 2248 wrote to memory of 3304 2248 msedge.exe msedge.exe PID 2248 wrote to memory of 3304 2248 msedge.exe msedge.exe PID 2248 wrote to memory of 3304 2248 msedge.exe msedge.exe PID 2248 wrote to memory of 3304 2248 msedge.exe msedge.exe PID 2248 wrote to memory of 3304 2248 msedge.exe msedge.exe PID 2248 wrote to memory of 3304 2248 msedge.exe msedge.exe PID 2248 wrote to memory of 3304 2248 msedge.exe msedge.exe PID 2248 wrote to memory of 3304 2248 msedge.exe msedge.exe PID 2248 wrote to memory of 3304 2248 msedge.exe msedge.exe PID 2248 wrote to memory of 3304 2248 msedge.exe msedge.exe PID 2248 wrote to memory of 3304 2248 msedge.exe msedge.exe PID 2248 wrote to memory of 3304 2248 msedge.exe msedge.exe PID 2248 wrote to memory of 3304 2248 msedge.exe msedge.exe PID 2248 wrote to memory of 3304 2248 msedge.exe msedge.exe PID 2248 wrote to memory of 3304 2248 msedge.exe msedge.exe PID 2248 wrote to memory of 3304 2248 msedge.exe msedge.exe PID 2248 wrote to memory of 3304 2248 msedge.exe msedge.exe PID 2248 wrote to memory of 3304 2248 msedge.exe msedge.exe PID 2248 wrote to memory of 3304 2248 msedge.exe msedge.exe PID 2248 wrote to memory of 3304 2248 msedge.exe msedge.exe PID 2248 wrote to memory of 3304 2248 msedge.exe msedge.exe PID 2248 wrote to memory of 3304 2248 msedge.exe msedge.exe PID 2248 wrote to memory of 3304 2248 msedge.exe msedge.exe PID 2248 wrote to memory of 3304 2248 msedge.exe msedge.exe PID 2248 wrote to memory of 3304 2248 msedge.exe msedge.exe PID 2248 wrote to memory of 3304 2248 msedge.exe msedge.exe PID 2248 wrote to memory of 3304 2248 msedge.exe msedge.exe PID 2248 wrote to memory of 3304 2248 msedge.exe msedge.exe PID 2248 wrote to memory of 3304 2248 msedge.exe msedge.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\MEMZ 3.0\MEMZ.exe"C:\Users\Admin\AppData\Local\Temp\MEMZ 3.0\MEMZ.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\MEMZ 3.0\MEMZ.exe"C:\Users\Admin\AppData\Local\Temp\MEMZ 3.0\MEMZ.exe" /watchdog2⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\MEMZ 3.0\MEMZ.exe"C:\Users\Admin\AppData\Local\Temp\MEMZ 3.0\MEMZ.exe" /watchdog2⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\MEMZ 3.0\MEMZ.exe"C:\Users\Admin\AppData\Local\Temp\MEMZ 3.0\MEMZ.exe" /watchdog2⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\MEMZ 3.0\MEMZ.exe"C:\Users\Admin\AppData\Local\Temp\MEMZ 3.0\MEMZ.exe" /watchdog2⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\MEMZ 3.0\MEMZ.exe"C:\Users\Admin\AppData\Local\Temp\MEMZ 3.0\MEMZ.exe" /watchdog2⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\MEMZ 3.0\MEMZ.exe"C:\Users\Admin\AppData\Local\Temp\MEMZ 3.0\MEMZ.exe" /main2⤵
- Checks computer location settings
- Writes to the Master Boot Record (MBR)
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\notepad.exe"C:\Windows\System32\notepad.exe" \note.txt3⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://google.co.ck/search?q=how+to+get+money3⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x114,0x118,0x11c,0xf0,0x120,0x7ffa4fe146f8,0x7ffa4fe14708,0x7ffa4fe147184⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,7940657447396842502,11273105093539710310,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2168 /prefetch:24⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2104,7940657447396842502,11273105093539710310,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2228 /prefetch:34⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2104,7940657447396842502,11273105093539710310,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2756 /prefetch:84⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,7940657447396842502,11273105093539710310,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3660 /prefetch:14⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,7940657447396842502,11273105093539710310,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1484 /prefetch:14⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,7940657447396842502,11273105093539710310,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5160 /prefetch:14⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,7940657447396842502,11273105093539710310,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5576 /prefetch:14⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,7940657447396842502,11273105093539710310,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3956 /prefetch:14⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,7940657447396842502,11273105093539710310,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5944 /prefetch:84⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings4⤵
- Drops file in Program Files directory
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x238,0x23c,0x240,0x214,0x244,0x7ff62d0b5460,0x7ff62d0b5470,0x7ff62d0b54805⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,7940657447396842502,11273105093539710310,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5944 /prefetch:84⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,7940657447396842502,11273105093539710310,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5364 /prefetch:14⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,7940657447396842502,11273105093539710310,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5836 /prefetch:14⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,7940657447396842502,11273105093539710310,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5256 /prefetch:14⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,7940657447396842502,11273105093539710310,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5776 /prefetch:14⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,7940657447396842502,11273105093539710310,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6128 /prefetch:14⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,7940657447396842502,11273105093539710310,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6160 /prefetch:14⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,7940657447396842502,11273105093539710310,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6452 /prefetch:14⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,7940657447396842502,11273105093539710310,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6292 /prefetch:14⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,7940657447396842502,11273105093539710310,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6232 /prefetch:14⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,7940657447396842502,11273105093539710310,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6220 /prefetch:14⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,7940657447396842502,11273105093539710310,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6212 /prefetch:14⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://google.co.ck/search?q=batch+virus+download3⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffa4fe146f8,0x7ffa4fe14708,0x7ffa4fe147184⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://google.co.ck/search?q=virus.exe3⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffa4fe146f8,0x7ffa4fe14708,0x7ffa4fe147184⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://google.co.ck/search?q=virus+builder+legit+free+download3⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffa4fe146f8,0x7ffa4fe14708,0x7ffa4fe147184⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://google.co.ck/search?q=how+2+remove+a+virus3⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffa4fe146f8,0x7ffa4fe14708,0x7ffa4fe147184⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x508 0x4e41⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5aaeb1f5e097ab38083674077b84b8ed6
SHA17d9191cb2277c30f1147c9d29d75fc8e6aa0a4f2
SHA2561654b27bfaeee49bfe56e0c4c0303418f4887f3ea1933f03cafce10352321aef
SHA512130f1b62134626959f69b13e33c42c3182e343d7f0a5b6291f7bb0c2f64b60885f5e6331e1866a4944e9b7b2e49fe798e073316fde23927ede2c348ba0e56eda
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD51db53baf44edd6b1bc2b7576e2f01e12
SHA1e35739fa87978775dcb3d8df5c8d2063631fa8df
SHA2560d73ba3eea4c552ce3ffa767e4cd5fff4e459e543756987ab5d55f1e6d963f48
SHA51284f544858803ac14bac962d2df1dbc7ed6e1134ecf16d242d7ee7316648b56b5bc095241363837bf0bf0afd16ca7deebe7afb7d40057604acbf09821fd5a9912
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD56137c2c472f24cc8c4192697350642a4
SHA12f16311487e67559548e5a44f21b4c20affebacb
SHA256469b03395742b09c20c943838ce17c2eef91132fe7af2f3f7f232523b5519a5b
SHA512bc774c5dd7ebc1d3c6d84b840d19f06155e1350dd6cd5f2aaa844acc8aef9ed4f16509be7a36024f3bf36b65d95c07d452653ce052894d738f4b868648bb2d39
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD56137c2c472f24cc8c4192697350642a4
SHA12f16311487e67559548e5a44f21b4c20affebacb
SHA256469b03395742b09c20c943838ce17c2eef91132fe7af2f3f7f232523b5519a5b
SHA512bc774c5dd7ebc1d3c6d84b840d19f06155e1350dd6cd5f2aaa844acc8aef9ed4f16509be7a36024f3bf36b65d95c07d452653ce052894d738f4b868648bb2d39
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD56137c2c472f24cc8c4192697350642a4
SHA12f16311487e67559548e5a44f21b4c20affebacb
SHA256469b03395742b09c20c943838ce17c2eef91132fe7af2f3f7f232523b5519a5b
SHA512bc774c5dd7ebc1d3c6d84b840d19f06155e1350dd6cd5f2aaa844acc8aef9ed4f16509be7a36024f3bf36b65d95c07d452653ce052894d738f4b868648bb2d39
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD56137c2c472f24cc8c4192697350642a4
SHA12f16311487e67559548e5a44f21b4c20affebacb
SHA256469b03395742b09c20c943838ce17c2eef91132fe7af2f3f7f232523b5519a5b
SHA512bc774c5dd7ebc1d3c6d84b840d19f06155e1350dd6cd5f2aaa844acc8aef9ed4f16509be7a36024f3bf36b65d95c07d452653ce052894d738f4b868648bb2d39
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD56137c2c472f24cc8c4192697350642a4
SHA12f16311487e67559548e5a44f21b4c20affebacb
SHA256469b03395742b09c20c943838ce17c2eef91132fe7af2f3f7f232523b5519a5b
SHA512bc774c5dd7ebc1d3c6d84b840d19f06155e1350dd6cd5f2aaa844acc8aef9ed4f16509be7a36024f3bf36b65d95c07d452653ce052894d738f4b868648bb2d39
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000001Filesize
20KB
MD5923a543cc619ea568f91b723d9fb1ef0
SHA16f4ade25559645c741d7327c6e16521e43d7e1f9
SHA256bf7344209edb1be5a2886c425cf6334a102d76cbea1471fd50171e2ee92877cd
SHA512a4153751761cd67465374828b0514d7773b8c4ed37779d1ecfd4f19be4faa171585c8ee0b4db59b556399d5d2b9809ba87e04d4715e9d090e1f488d02219d555
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000005Filesize
64KB
MD51067041b8fa46bae06ebeac837cb67ed
SHA19a1e51cfe25d04692592f1dc13ce75058db813d3
SHA256e6f3a928b555e72664e65ac8d3455b7ace51ce76f205975f98daff89b3a5d533
SHA512d16c71f87ebcdc4553cb5aa4283f84ba02178e80d237a99d56ec416377031af4354582d459abac88df5b06239e3fb4625466b478bbf67ac5f6f001e82fa58882
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000007Filesize
37KB
MD547ae9b25af86702d77c7895ac6f6b57c
SHA1f56f78729b99247a975620a1103cac3ee9f313a5
SHA2569bde79a1b0866f68d6baa43f920e971b5feb35a8e0af7ffadc114366f8538224
SHA51272b5296e3dd1c5b4c42d8c3e4a56693819779167b9f02bc2d5f5a626b519a9cf10bee59846d614c929c42094b65d13039f6024f6cb1c023e740969aaefd060c4
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000eFilesize
331KB
MD5249a87fd14881756dec8b0edcec1f58f
SHA107976831daa447c8fe94544b3551c0205a20dc13
SHA256e3619e4decb67815f7c47e5445109b2613d4126f14832e78f6beb02ee64c717d
SHA51253b011d2001b00446be3dce149f9e3e92f1977c8c3fdc1b232fc0329410f5d113280059f73a93d8c20316ba42bbd0bd7eeacfa87a589add7eeaf28e7e9dbfa5c
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000011Filesize
70KB
MD565c90de75715d45021e9dff37e21691e
SHA107626436526e8ece4d2e8af393a5bda2c8284581
SHA256afe134c131b561971d2fd838f1cb9cacd3d2d03a1943fcad75284dfc73900f4f
SHA512d65de7aec05dbe5292c15744926f83d5409b3fedadd6bb73866b00a9b95fc300de451a4243bea3e82253005de454c35c4e58582931528426f6244d377e7448b0
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-indexFilesize
888B
MD56888308ce587a3a0c72ae2a4580810e3
SHA1d9dd47cabf9cfa6b783f84909170d5ccfcd79ce4
SHA2568698bd68ff472c67d572a0d6ab6d30e312d28f3768e078846a589de0bd18b71f
SHA51251bdf44503b41aa0d005823153f34e4c9325dc5def3f289b3798d2aed0367cc46af3939bb2a150622d23c238bab21feff2885d8398240149f603c3f9bdd6585f
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe582110.TMPFilesize
48B
MD59e708b79f327bd4579c539f5e7abfc4a
SHA13a5d395f68669b794705597ebe148b2ac0ed3490
SHA2568cac33fee17795f5adacc8124298a414e854584d1b451366732f9148bc808332
SHA5126e2a99f1061eef08fff2e9310438af80d97a1cd0d7d64416f88cb41f78683861d9dfd0fc7c5a92a42d1a531d2071ff016adb6d10c8cc5ddbda73d5faa37ad707
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.icoFilesize
70KB
MD5e5e3377341056643b0494b6842c0b544
SHA1d53fd8e256ec9d5cef8ef5387872e544a2df9108
SHA256e23040951e464b53b84b11c3466bbd4707a009018819f9ad2a79d1b0b309bc25
SHA51283f09e48d009a5cf83fa9aa8f28187f7f4202c84e2d0d6e5806c468f4a24b2478b73077381d2a21c89aa64884df3c56e8dc94eb4ad2d6a8085ac2feb1e26c2ef
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\CURRENTFilesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\MANIFEST-000001Filesize
41B
MD55af87dfd673ba2115e2fcf5cfdb727ab
SHA1d5b5bbf396dc291274584ef71f444f420b6056f1
SHA256f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
SHA512de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Microsoft Edge.lnkFilesize
2KB
MD54f9a0391af04dfd60f7a170a2a7265ed
SHA160a6e357e15d74154953aa93da8994dcd5e02205
SHA25683771a975de242218f8c3e3c79eebef48091a52de2e1b56a8b135056635d93a3
SHA51224f85e45c657507963f7ed89ba0b701b0e7989772322f0c6930f913d7efbad3a677112cde88984e3ab395d836356eb28d83c981c6b06b24395079a565601fbfe
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent StateFilesize
111B
MD5285252a2f6327d41eab203dc2f402c67
SHA1acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA2565dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
SHA51211ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent StateFilesize
2KB
MD535223f8793163e7f24ffb8d8a317046e
SHA129190fae6b1f371bc3b3dd2017263feb6570fc83
SHA25699d82b1870fef7d360f1bae0d0cfdd25a5c98be8eef637a20c4d9adfcfeeec12
SHA512c90b268900c0f2cdf3f27579fc13fb822840a9ba21380618c6dd52356afead629687e35d11adc4920299d8d8e9efcea9fac1495921ed46b634d2d896c84adc8b
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
4KB
MD5ba881e90d3cbe789da82c674fd53b362
SHA169e5cc6ea8b513ef9ffab55c830f848402e22c02
SHA256d999ec4bf1317b09cc4fdd08a38163969022d60b95d0baa16d1339168fd27f99
SHA5122caab8498bb973df35889039f96eb7acfe9f7d1e4510aee788e722a55a7a0cd47f0826898be4edda1d4645c8bc27d09d9d4748e1cc906a20d5ff0bfcb9e5c089
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
5KB
MD5f7fa8a2b411d1dfd5ac5bafcac8c7adf
SHA15fef67a6a2bb111035359ca4a19dd7ff03a1d6f9
SHA256f3292634ee3a5af030256b9ac72f8c5650a1f4b79dabde15bceb451ea1221fb0
SHA5126479ed529a6d184fa86dd2d79dc49887a878e7ed9bbbd11a691a80bc70308ef5fac04992263f34b24785ccf4e636b773c5bfd5c286af28cf551a05a1af868bfc
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
5KB
MD5021d8bbf70168ec4aa8052a4eb639cd6
SHA1f00cc4c37d9560ac41c3df0e6842678a4e09e3b0
SHA256bc71d3d65cf86e57de29c37fff64348f83a843eead7b5134f006d4d869981429
SHA512b4b1574d3645122c0ff464af21a5108ae4820e18c6ddce24bf8c2c77b2b090d206cc3c34b9e86af62c127fd8fd843ebc2844417a91f75b2141ccd774ec3289b7
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
5KB
MD54bb49619f1aa0903518cabbf89f87f80
SHA1648938f2b61264b712d35f5db55e80b357b3becf
SHA25688af670f50e0605748996e415737d1188dc60da638de52ef7bc96b26dc29eb51
SHA512545e4f131a36e52b22666217c101ef8a14e40d6f72c9b47ebe10c33efed52d08ced99ac9bb61431dee8c8ac0f4f7826d6226857aaf61337ed46521467dd57ca8
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
6KB
MD5604ebf2cd3a33e3b867f2f1e0c47005a
SHA17dd1a525b7fa2985fb6bfe07d6ed1bf3971ee258
SHA256720a925223a356df3e8f636c797b86803caeb22ceb5ae06b8594c5a8518ac274
SHA5122c912afce702b5b7c4d211c4aa95771735efeeeb06d8fd772f65b44b216832e66e7e5330cff23f02ad659f9c80ff53bbc7237f2a291bca4cf88cdfe1976a0a58
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
6KB
MD5559a64cc6206b739ad63207f3b9390ce
SHA15eca0d804788c3a9b5480f59625050a1cd66a465
SHA2569849762b2c1d6dba42c4895d828557185ad61453c3b9ff490cd37bbe0fb4376b
SHA5122e746ff925145aae7bdc565db2c4ec176bf528d1cff6937618463f4b2dd9eb8956cb72555a6c10a7b5a527eba4e8912eef7d45d5ae60d1ea86237e3886481eca
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
6KB
MD54b32d569f5814d5f0b65182bc4b2735c
SHA11f1f53ccdd249d087b14a91c1690b92d52e9754b
SHA25688a4745f38e7d60e57cd12e4a761eaccea19715c0db8d43356e3e5a72eb6dc86
SHA512b1dfb9b948f41b226baf99d9d093a54533efa787c1186a7efd2077d7b21e6fab5766b98b75fcc6cb0971d28d159141a95abf0c8a057eb315ff9ff507849071a9
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure PreferencesFilesize
24KB
MD547e94a96372e6f095b8a3fd7edc48ec0
SHA1377b68f34e5964ca8be1b1b0c1507dd7f0e5f005
SHA25615c77bafd922bd085317fd544d0fa129e3b8c814e3ba0d48936366004427732e
SHA5125bd63de2e831805b723d7ddf1343c3b721ef5b757d9ab01bf8554ef8e29ac2cc09fa104fc85d530f27d66b67280774b3ebbef6729ea3ab61ce8028ab4ba5bdad
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurityFilesize
204B
MD5a629c33191f58e7593aacfeb6260d9a7
SHA1be8042ac611f01781aa232a0ad3733c3c5186325
SHA256fd37c9c18fcb478bfdc3aa9dec0e026489185cff0bd9f54756d575e797fdd152
SHA5123a1085436c71d5b3288469e5d5ed9f57ca81691b502f9b0c7a59a3c8254337e3addf42a91de77fe6b265cd0ee63e2ed04b8f83187b0e4bbfdbb623d6541a6e2a
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurityFilesize
204B
MD5b480df755d23dd14c41ed2424d1017b1
SHA1cc29e5761d3573c42945a8c1d253b4ed1efb7d4f
SHA256280fdaeb180a4830a305bec5acc0f67335774c6df98e01f1b8cc7b87e3f5d9c8
SHA51261a2c94e6da9aa06f496e0ac82a8a420880479ec896a51054a7df72b448291e0f3fd75e77923dc19287d3714907a644ae4b695553505687502c9e2407eb0a408
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurityFilesize
204B
MD51e0e028e4e9c76de6d72789a2064d86d
SHA16c27f5ecb9e888435242c1463d3ce5bc85bdf1f3
SHA25679ba74b9e15b545e8f649fb2abec10d7fd067fd3e0401452debd55ef31edc588
SHA51224b69506997e4c0eba08ad2381d2775d4a58f7a327c4d9f88ab98f6f66770b65e3ad749968e7ddf494f1deae5544e871c386ff8719b48cb97b2c9b005f28dea2
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurityFilesize
372B
MD59e5a1b5413f54b7017bd9e84e3653dfe
SHA15bc2dd3fee797e5006fb596d98be4a4badeacee4
SHA25666a4f9d5f6770e5009d36eff1a5982b897b06c51cd205178eb95b234d33b8b72
SHA51201816c717f1730c5fcc9fa464e87f926a85b97d8c91d9f0e7ca9f0368e55327a8e277e3dded351f32c19142dee503290ace6a31a66af13670380b0d199ef8082
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe579673.TMPFilesize
204B
MD53350e2e59717fc33d754255f27ef526b
SHA13dd7d75e5b65651b7738c8e6601a51b71c919b8f
SHA2566af218370cda4aff458192ca18582559b76849d029d6a8e79dd6f77f2759970f
SHA512751bdda11208509afca7c701678a7efc22f5dcf08874ebbda019582333b38dc246ee5a25a0d133648384fdf962ffcbf279744dd43be6777eba11728fa6d87797
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENTFilesize
16B
MD5206702161f94c5cd39fadd03f4014d98
SHA1bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA2561005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA5120af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
9KB
MD52215a3f207f6c068c796bb69944e2f8b
SHA159bfdf874a0b685434e534c19ff5538ddeb957ee
SHA256c2014bb27bef950f13e75759dba04b079ca93dc017460ca459ebe1bd44c4d824
SHA51288db89c891c96080f92b30decf957ec072580da5815cc32e1d994806920fd08e135ac3fdefffca8250586ef1fb012c57415279c0200a6f970719f7657d5ceedd
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ccd73623-fe28-40f3-a191-4bfeb5db1edb.tmpFilesize
12KB
MD5a6e270283a9fe37706fa82a662acb4d5
SHA126537c764b079aceb31b57895ad828746b541dd3
SHA25622d2cb91b398296031c9d671d77d3a1e037000a6fd5e203d3b222b7005962b02
SHA512673c855c4cfb6c5b3498ac292b9907a8048cfbe2f4fce8bb9bb87fe71e2cd7eb8ff20dee0b09e68d5122fffde12c62043ba9051edc23f99510bbe859dc6db31a
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-msFilesize
3KB
MD52582f6dba87777c16615101b6ac95340
SHA1f9fbe42e6a2b53df3196115fb12b03d79e8908cf
SHA256fe4f94940cdd34c752c2f7a95fb4f0ef74bf9d7bd16861fd390bc4b060977781
SHA5124ad84cba471823c9a02eef36d84c8c40defcfa0209abeb8df21bac07d4d910895a71531d1eb17bf03fcf5602d247216dc5425c49a813d3430c5155334ce38e99
-
C:\note.txtFilesize
218B
MD5afa6955439b8d516721231029fb9ca1b
SHA1087a043cc123c0c0df2ffadcf8e71e3ac86bbae9
SHA2568e9f20f6864c66576536c0b866c6ffdcf11397db67fe120e972e244c3c022270
SHA5125da21a31fbc4e8250dffed30f66b896bdf007ac91948140334fe36a3f010e1bac3e70a07e9f3eb9da8633189091fd5cadcabbaacd3e01da0fe7ae28a11b3dddf
-
\??\pipe\LOCAL\crashpad_2248_UTUCHFSGEUGCCICOMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e