a9cd3d966d453afd424d9ac54df414b80073bb51d249f4089185976fb316e254

Analysis

max time kernel
151s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
07-04-2023 01:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

MEMZ 3.0/MEMZ.exe
Size

12KB
MD5

a7bcf7ea8e9f3f36ebfb85b823e39d91
SHA1

761168201520c199dba68add3a607922d8d4a86e
SHA256

3ff64f10603f0330fa2386ff99471ca789391ace969bd0ec1c1b8ce1b4a6db42
SHA512

89923b669d31e590189fd06619bf27e47c5a47e82be6ae71fdb1b9b3b30b06fb7ca8ffed6d5c41ac410a367f2eb07589291e95a2644877d6bffd52775a5b1523
SSDEEP

192:HMDLTxWDf/pl3cIEiwqZKBktLe3P+qf2jhP6B5b2yL3:H4IDH3cIqqvUWq+jhyT2yL

Score

7^/10

bootkit persistence

Malware Config

Signatures

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

MEMZ.exeMEMZ.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\International\Geo\Nation	MEMZ.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\International\Geo\Nation	MEMZ.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
bootkit persistence

Bootkit
T1067

Processes:

MEMZ.exe

description ioc process

File opened for modification \??\PhysicalDrive0 MEMZ.exe

description	ioc	process
File opened for modification	\??\PhysicalDrive0	MEMZ.exe

Drops file in Program Files directory 2 IoCs

Processes:

setup.exe

description	ioc	process
File created	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\cd6bf4a3-8e97-4104-aed0-609ef79ef83b.tmp	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20230407030256.pma	setup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

Processes:

msedge.exe

description ioc process

Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ msedge.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

MEMZ.exeMEMZ.exeMEMZ.exeMEMZ.exeMEMZ.exe

pid	process
1344	MEMZ.exe
1344	MEMZ.exe
5044	MEMZ.exe
5044	MEMZ.exe
2164	MEMZ.exe
2164	MEMZ.exe
1344	MEMZ.exe
1344	MEMZ.exe
3700	MEMZ.exe
3700	MEMZ.exe
4084	MEMZ.exe
4084	MEMZ.exe
5044	MEMZ.exe
5044	MEMZ.exe
3700	MEMZ.exe
3700	MEMZ.exe
1344	MEMZ.exe
1344	MEMZ.exe
2164	MEMZ.exe
2164	MEMZ.exe
1344	MEMZ.exe
3700	MEMZ.exe
3700	MEMZ.exe
1344	MEMZ.exe
5044	MEMZ.exe
4084	MEMZ.exe
5044	MEMZ.exe
4084	MEMZ.exe
2164	MEMZ.exe
2164	MEMZ.exe
2164	MEMZ.exe
2164	MEMZ.exe
4084	MEMZ.exe
4084	MEMZ.exe
5044	MEMZ.exe
5044	MEMZ.exe
1344	MEMZ.exe
3700	MEMZ.exe
1344	MEMZ.exe
3700	MEMZ.exe
3700	MEMZ.exe
1344	MEMZ.exe
3700	MEMZ.exe
1344	MEMZ.exe
5044	MEMZ.exe
5044	MEMZ.exe
4084	MEMZ.exe
4084	MEMZ.exe
2164	MEMZ.exe
2164	MEMZ.exe
3700	MEMZ.exe
3700	MEMZ.exe
1344	MEMZ.exe
1344	MEMZ.exe
4084	MEMZ.exe
4084	MEMZ.exe
2164	MEMZ.exe
5044	MEMZ.exe
2164	MEMZ.exe
5044	MEMZ.exe
4084	MEMZ.exe
4084	MEMZ.exe
1344	MEMZ.exe
3700	MEMZ.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 16 IoCs

Processes:

msedge.exe

pid	process
2248	msedge.exe
2248	msedge.exe
2248	msedge.exe
2248	msedge.exe
2248	msedge.exe
2248	msedge.exe
2248	msedge.exe
2248	msedge.exe
2248	msedge.exe
2248	msedge.exe
2248	msedge.exe
2248	msedge.exe
2248	msedge.exe
2248	msedge.exe
2248	msedge.exe
2248	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

AUDIODG.EXE

description pid process

Token: 33 1892 AUDIODG.EXE
Token: SeIncBasePriorityPrivilege 1892 AUDIODG.EXE
Suspicious use of FindShellTrayWindow 3 IoCs

Processes:

msedge.exe

pid process

2248 msedge.exe
2248 msedge.exe
2248 msedge.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

MEMZ.exe

pid process

4288 MEMZ.exe

description	pid	process
Token: 33	1892	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1892	AUDIODG.EXE

pid	process
4288	MEMZ.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

MEMZ.exeMEMZ.exemsedge.exe

description	pid	process	target process
PID 1436 wrote to memory of 1344	1436	MEMZ.exe	MEMZ.exe
PID 1436 wrote to memory of 1344	1436	MEMZ.exe	MEMZ.exe
PID 1436 wrote to memory of 1344	1436	MEMZ.exe	MEMZ.exe
PID 1436 wrote to memory of 5044	1436	MEMZ.exe	MEMZ.exe
PID 1436 wrote to memory of 5044	1436	MEMZ.exe	MEMZ.exe
PID 1436 wrote to memory of 5044	1436	MEMZ.exe	MEMZ.exe
PID 1436 wrote to memory of 4084	1436	MEMZ.exe	MEMZ.exe
PID 1436 wrote to memory of 4084	1436	MEMZ.exe	MEMZ.exe
PID 1436 wrote to memory of 4084	1436	MEMZ.exe	MEMZ.exe
PID 1436 wrote to memory of 3700	1436	MEMZ.exe	MEMZ.exe
PID 1436 wrote to memory of 3700	1436	MEMZ.exe	MEMZ.exe
PID 1436 wrote to memory of 3700	1436	MEMZ.exe	MEMZ.exe
PID 1436 wrote to memory of 2164	1436	MEMZ.exe	MEMZ.exe
PID 1436 wrote to memory of 2164	1436	MEMZ.exe	MEMZ.exe
PID 1436 wrote to memory of 2164	1436	MEMZ.exe	MEMZ.exe
PID 1436 wrote to memory of 4288	1436	MEMZ.exe	MEMZ.exe
PID 1436 wrote to memory of 4288	1436	MEMZ.exe	MEMZ.exe
PID 1436 wrote to memory of 4288	1436	MEMZ.exe	MEMZ.exe
PID 4288 wrote to memory of 772	4288	MEMZ.exe	notepad.exe
PID 4288 wrote to memory of 772	4288	MEMZ.exe	notepad.exe
PID 4288 wrote to memory of 772	4288	MEMZ.exe	notepad.exe
PID 4288 wrote to memory of 2248	4288	MEMZ.exe	msedge.exe
PID 4288 wrote to memory of 2248	4288	MEMZ.exe	msedge.exe
PID 2248 wrote to memory of 2460	2248	msedge.exe	msedge.exe
PID 2248 wrote to memory of 2460	2248	msedge.exe	msedge.exe
PID 2248 wrote to memory of 3304	2248	msedge.exe	msedge.exe
PID 2248 wrote to memory of 3304	2248	msedge.exe	msedge.exe
PID 2248 wrote to memory of 3304	2248	msedge.exe	msedge.exe
PID 2248 wrote to memory of 3304	2248	msedge.exe	msedge.exe
PID 2248 wrote to memory of 3304	2248	msedge.exe	msedge.exe
PID 2248 wrote to memory of 3304	2248	msedge.exe	msedge.exe
PID 2248 wrote to memory of 3304	2248	msedge.exe	msedge.exe
PID 2248 wrote to memory of 3304	2248	msedge.exe	msedge.exe
PID 2248 wrote to memory of 3304	2248	msedge.exe	msedge.exe
PID 2248 wrote to memory of 3304	2248	msedge.exe	msedge.exe
PID 2248 wrote to memory of 3304	2248	msedge.exe	msedge.exe
PID 2248 wrote to memory of 3304	2248	msedge.exe	msedge.exe
PID 2248 wrote to memory of 3304	2248	msedge.exe	msedge.exe
PID 2248 wrote to memory of 3304	2248	msedge.exe	msedge.exe
PID 2248 wrote to memory of 3304	2248	msedge.exe	msedge.exe
PID 2248 wrote to memory of 3304	2248	msedge.exe	msedge.exe
PID 2248 wrote to memory of 3304	2248	msedge.exe	msedge.exe
PID 2248 wrote to memory of 3304	2248	msedge.exe	msedge.exe
PID 2248 wrote to memory of 3304	2248	msedge.exe	msedge.exe
PID 2248 wrote to memory of 3304	2248	msedge.exe	msedge.exe
PID 2248 wrote to memory of 3304	2248	msedge.exe	msedge.exe
PID 2248 wrote to memory of 3304	2248	msedge.exe	msedge.exe
PID 2248 wrote to memory of 3304	2248	msedge.exe	msedge.exe
PID 2248 wrote to memory of 3304	2248	msedge.exe	msedge.exe
PID 2248 wrote to memory of 3304	2248	msedge.exe	msedge.exe
PID 2248 wrote to memory of 3304	2248	msedge.exe	msedge.exe
PID 2248 wrote to memory of 3304	2248	msedge.exe	msedge.exe
PID 2248 wrote to memory of 3304	2248	msedge.exe	msedge.exe
PID 2248 wrote to memory of 3304	2248	msedge.exe	msedge.exe
PID 2248 wrote to memory of 3304	2248	msedge.exe	msedge.exe
PID 2248 wrote to memory of 3304	2248	msedge.exe	msedge.exe
PID 2248 wrote to memory of 3304	2248	msedge.exe	msedge.exe
PID 2248 wrote to memory of 3304	2248	msedge.exe	msedge.exe
PID 2248 wrote to memory of 3304	2248	msedge.exe	msedge.exe
PID 2248 wrote to memory of 3304	2248	msedge.exe	msedge.exe
PID 2248 wrote to memory of 3304	2248	msedge.exe	msedge.exe
PID 2248 wrote to memory of 3304	2248	msedge.exe	msedge.exe
PID 2248 wrote to memory of 3304	2248	msedge.exe	msedge.exe
PID 2248 wrote to memory of 3304	2248	msedge.exe	msedge.exe

C:\Users\Admin\AppData\Local\Temp\MEMZ 3.0\MEMZ.exe
"C:\Users\Admin\AppData\Local\Temp\MEMZ 3.0\MEMZ.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1436

C:\Users\Admin\AppData\Local\Temp\MEMZ 3.0\MEMZ.exe
"C:\Users\Admin\AppData\Local\Temp\MEMZ 3.0\MEMZ.exe" /watchdog
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1344

C:\Users\Admin\AppData\Local\Temp\MEMZ 3.0\MEMZ.exe
"C:\Users\Admin\AppData\Local\Temp\MEMZ 3.0\MEMZ.exe" /watchdog
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:5044

C:\Users\Admin\AppData\Local\Temp\MEMZ 3.0\MEMZ.exe
"C:\Users\Admin\AppData\Local\Temp\MEMZ 3.0\MEMZ.exe" /watchdog
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4084

C:\Users\Admin\AppData\Local\Temp\MEMZ 3.0\MEMZ.exe
"C:\Users\Admin\AppData\Local\Temp\MEMZ 3.0\MEMZ.exe" /watchdog
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3700

C:\Users\Admin\AppData\Local\Temp\MEMZ 3.0\MEMZ.exe
"C:\Users\Admin\AppData\Local\Temp\MEMZ 3.0\MEMZ.exe" /watchdog
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2164

C:\Users\Admin\AppData\Local\Temp\MEMZ 3.0\MEMZ.exe
"C:\Users\Admin\AppData\Local\Temp\MEMZ 3.0\MEMZ.exe" /main
2⤵
- Checks computer location settings
- Writes to the Master Boot Record (MBR)
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4288

C:\Windows\SysWOW64\notepad.exe
"C:\Windows\System32\notepad.exe" \note.txt
3⤵
PID:772

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://google.co.ck/search?q=how+to+get+money
3⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2248

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x114,0x118,0x11c,0xf0,0x120,0x7ffa4fe146f8,0x7ffa4fe14708,0x7ffa4fe14718
4⤵
PID:2460

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,7940657447396842502,11273105093539710310,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2168 /prefetch:2
4⤵
PID:3304

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2104,7940657447396842502,11273105093539710310,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2228 /prefetch:3
4⤵
PID:3984

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2104,7940657447396842502,11273105093539710310,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2756 /prefetch:8
4⤵
PID:1580

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,7940657447396842502,11273105093539710310,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3660 /prefetch:1
4⤵
PID:1064

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,7940657447396842502,11273105093539710310,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1484 /prefetch:1
4⤵
PID:4868

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,7940657447396842502,11273105093539710310,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5160 /prefetch:1
4⤵
PID:3520

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,7940657447396842502,11273105093539710310,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5576 /prefetch:1
4⤵
PID:1692

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,7940657447396842502,11273105093539710310,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3956 /prefetch:1
4⤵
PID:4176

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,7940657447396842502,11273105093539710310,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5944 /prefetch:8
4⤵
PID:2060

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
4⤵
- Drops file in Program Files directory
PID:4420

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x238,0x23c,0x240,0x214,0x244,0x7ff62d0b5460,0x7ff62d0b5470,0x7ff62d0b5480
5⤵
PID:4108

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,7940657447396842502,11273105093539710310,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5944 /prefetch:8
4⤵
PID:2672

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,7940657447396842502,11273105093539710310,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5364 /prefetch:1
4⤵
PID:4528

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,7940657447396842502,11273105093539710310,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5836 /prefetch:1
4⤵
PID:2708

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,7940657447396842502,11273105093539710310,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5256 /prefetch:1
4⤵
PID:2336

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,7940657447396842502,11273105093539710310,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5776 /prefetch:1
4⤵
PID:4456

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,7940657447396842502,11273105093539710310,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6128 /prefetch:1
4⤵
PID:3244

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,7940657447396842502,11273105093539710310,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6160 /prefetch:1
4⤵
PID:3768

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,7940657447396842502,11273105093539710310,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6452 /prefetch:1
4⤵
PID:1928

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,7940657447396842502,11273105093539710310,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6292 /prefetch:1
4⤵
PID:3328

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,7940657447396842502,11273105093539710310,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6232 /prefetch:1
4⤵
PID:4332

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,7940657447396842502,11273105093539710310,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6220 /prefetch:1
4⤵
PID:3084

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,7940657447396842502,11273105093539710310,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6212 /prefetch:1
4⤵
PID:2116

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://google.co.ck/search?q=batch+virus+download
3⤵
PID:2696

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffa4fe146f8,0x7ffa4fe14708,0x7ffa4fe14718
4⤵
PID:3688

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://google.co.ck/search?q=virus.exe
3⤵
PID:2752

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffa4fe146f8,0x7ffa4fe14708,0x7ffa4fe14718
4⤵
PID:2476

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://google.co.ck/search?q=virus+builder+legit+free+download
3⤵
PID:3748

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffa4fe146f8,0x7ffa4fe14708,0x7ffa4fe14718
4⤵
PID:3692

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://google.co.ck/search?q=how+2+remove+a+virus
3⤵
PID:2828

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffa4fe146f8,0x7ffa4fe14708,0x7ffa4fe14718
4⤵
PID:2656

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:416

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x508 0x4e4
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1892

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2492

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Bootkit

T1067

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
aaeb1f5e097ab38083674077b84b8ed6

SHA1
7d9191cb2277c30f1147c9d29d75fc8e6aa0a4f2

SHA256
1654b27bfaeee49bfe56e0c4c0303418f4887f3ea1933f03cafce10352321aef

SHA512
130f1b62134626959f69b13e33c42c3182e343d7f0a5b6291f7bb0c2f64b60885f5e6331e1866a4944e9b7b2e49fe798e073316fde23927ede2c348ba0e56eda

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
1db53baf44edd6b1bc2b7576e2f01e12

SHA1
e35739fa87978775dcb3d8df5c8d2063631fa8df

SHA256
0d73ba3eea4c552ce3ffa767e4cd5fff4e459e543756987ab5d55f1e6d963f48

SHA512
84f544858803ac14bac962d2df1dbc7ed6e1134ecf16d242d7ee7316648b56b5bc095241363837bf0bf0afd16ca7deebe7afb7d40057604acbf09821fd5a9912

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
6137c2c472f24cc8c4192697350642a4

SHA1
2f16311487e67559548e5a44f21b4c20affebacb

SHA256
469b03395742b09c20c943838ce17c2eef91132fe7af2f3f7f232523b5519a5b

SHA512
bc774c5dd7ebc1d3c6d84b840d19f06155e1350dd6cd5f2aaa844acc8aef9ed4f16509be7a36024f3bf36b65d95c07d452653ce052894d738f4b868648bb2d39

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
6137c2c472f24cc8c4192697350642a4

SHA1
2f16311487e67559548e5a44f21b4c20affebacb

SHA256
469b03395742b09c20c943838ce17c2eef91132fe7af2f3f7f232523b5519a5b

SHA512
bc774c5dd7ebc1d3c6d84b840d19f06155e1350dd6cd5f2aaa844acc8aef9ed4f16509be7a36024f3bf36b65d95c07d452653ce052894d738f4b868648bb2d39

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
6137c2c472f24cc8c4192697350642a4

SHA1
2f16311487e67559548e5a44f21b4c20affebacb

SHA256
469b03395742b09c20c943838ce17c2eef91132fe7af2f3f7f232523b5519a5b

SHA512
bc774c5dd7ebc1d3c6d84b840d19f06155e1350dd6cd5f2aaa844acc8aef9ed4f16509be7a36024f3bf36b65d95c07d452653ce052894d738f4b868648bb2d39

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
6137c2c472f24cc8c4192697350642a4

SHA1
2f16311487e67559548e5a44f21b4c20affebacb

SHA256
469b03395742b09c20c943838ce17c2eef91132fe7af2f3f7f232523b5519a5b

SHA512
bc774c5dd7ebc1d3c6d84b840d19f06155e1350dd6cd5f2aaa844acc8aef9ed4f16509be7a36024f3bf36b65d95c07d452653ce052894d738f4b868648bb2d39

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
6137c2c472f24cc8c4192697350642a4

SHA1
2f16311487e67559548e5a44f21b4c20affebacb

SHA256
469b03395742b09c20c943838ce17c2eef91132fe7af2f3f7f232523b5519a5b

SHA512
bc774c5dd7ebc1d3c6d84b840d19f06155e1350dd6cd5f2aaa844acc8aef9ed4f16509be7a36024f3bf36b65d95c07d452653ce052894d738f4b868648bb2d39

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000001
Filesize
20KB

MD5
923a543cc619ea568f91b723d9fb1ef0

SHA1
6f4ade25559645c741d7327c6e16521e43d7e1f9

SHA256
bf7344209edb1be5a2886c425cf6334a102d76cbea1471fd50171e2ee92877cd

SHA512
a4153751761cd67465374828b0514d7773b8c4ed37779d1ecfd4f19be4faa171585c8ee0b4db59b556399d5d2b9809ba87e04d4715e9d090e1f488d02219d555

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000005
Filesize
64KB

MD5
1067041b8fa46bae06ebeac837cb67ed

SHA1
9a1e51cfe25d04692592f1dc13ce75058db813d3

SHA256
e6f3a928b555e72664e65ac8d3455b7ace51ce76f205975f98daff89b3a5d533

SHA512
d16c71f87ebcdc4553cb5aa4283f84ba02178e80d237a99d56ec416377031af4354582d459abac88df5b06239e3fb4625466b478bbf67ac5f6f001e82fa58882

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000007
Filesize
37KB

MD5
47ae9b25af86702d77c7895ac6f6b57c

SHA1
f56f78729b99247a975620a1103cac3ee9f313a5

SHA256
9bde79a1b0866f68d6baa43f920e971b5feb35a8e0af7ffadc114366f8538224

SHA512
72b5296e3dd1c5b4c42d8c3e4a56693819779167b9f02bc2d5f5a626b519a9cf10bee59846d614c929c42094b65d13039f6024f6cb1c023e740969aaefd060c4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000e
Filesize
331KB

MD5
249a87fd14881756dec8b0edcec1f58f

SHA1
07976831daa447c8fe94544b3551c0205a20dc13

SHA256
e3619e4decb67815f7c47e5445109b2613d4126f14832e78f6beb02ee64c717d

SHA512
53b011d2001b00446be3dce149f9e3e92f1977c8c3fdc1b232fc0329410f5d113280059f73a93d8c20316ba42bbd0bd7eeacfa87a589add7eeaf28e7e9dbfa5c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000011
Filesize
70KB

MD5
65c90de75715d45021e9dff37e21691e

SHA1
07626436526e8ece4d2e8af393a5bda2c8284581

SHA256
afe134c131b561971d2fd838f1cb9cacd3d2d03a1943fcad75284dfc73900f4f

SHA512
d65de7aec05dbe5292c15744926f83d5409b3fedadd6bb73866b00a9b95fc300de451a4243bea3e82253005de454c35c4e58582931528426f6244d377e7448b0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
888B

MD5
6888308ce587a3a0c72ae2a4580810e3

SHA1
d9dd47cabf9cfa6b783f84909170d5ccfcd79ce4

SHA256
8698bd68ff472c67d572a0d6ab6d30e312d28f3768e078846a589de0bd18b71f

SHA512
51bdf44503b41aa0d005823153f34e4c9325dc5def3f289b3798d2aed0367cc46af3939bb2a150622d23c238bab21feff2885d8398240149f603c3f9bdd6585f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe582110.TMP
Filesize
48B

MD5
9e708b79f327bd4579c539f5e7abfc4a

SHA1
3a5d395f68669b794705597ebe148b2ac0ed3490

SHA256
8cac33fee17795f5adacc8124298a414e854584d1b451366732f9148bc808332

SHA512
6e2a99f1061eef08fff2e9310438af80d97a1cd0d7d64416f88cb41f78683861d9dfd0fc7c5a92a42d1a531d2071ff016adb6d10c8cc5ddbda73d5faa37ad707

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Filesize
70KB

MD5
e5e3377341056643b0494b6842c0b544

SHA1
d53fd8e256ec9d5cef8ef5387872e544a2df9108

SHA256
e23040951e464b53b84b11c3466bbd4707a009018819f9ad2a79d1b0b309bc25

SHA512
83f09e48d009a5cf83fa9aa8f28187f7f4202c84e2d0d6e5806c468f4a24b2478b73077381d2a21c89aa64884df3c56e8dc94eb4ad2d6a8085ac2feb1e26c2ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\CURRENT
Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\MANIFEST-000001
Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Microsoft Edge.lnk
Filesize
2KB

MD5
4f9a0391af04dfd60f7a170a2a7265ed

SHA1
60a6e357e15d74154953aa93da8994dcd5e02205

SHA256
83771a975de242218f8c3e3c79eebef48091a52de2e1b56a8b135056635d93a3

SHA512
24f85e45c657507963f7ed89ba0b701b0e7989772322f0c6930f913d7efbad3a677112cde88984e3ab395d836356eb28d83c981c6b06b24395079a565601fbfe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
2KB

MD5
35223f8793163e7f24ffb8d8a317046e

SHA1
29190fae6b1f371bc3b3dd2017263feb6570fc83

SHA256
99d82b1870fef7d360f1bae0d0cfdd25a5c98be8eef637a20c4d9adfcfeeec12

SHA512
c90b268900c0f2cdf3f27579fc13fb822840a9ba21380618c6dd52356afead629687e35d11adc4920299d8d8e9efcea9fac1495921ed46b634d2d896c84adc8b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
4KB

MD5
ba881e90d3cbe789da82c674fd53b362

SHA1
69e5cc6ea8b513ef9ffab55c830f848402e22c02

SHA256
d999ec4bf1317b09cc4fdd08a38163969022d60b95d0baa16d1339168fd27f99

SHA512
2caab8498bb973df35889039f96eb7acfe9f7d1e4510aee788e722a55a7a0cd47f0826898be4edda1d4645c8bc27d09d9d4748e1cc906a20d5ff0bfcb9e5c089

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
5KB

MD5
f7fa8a2b411d1dfd5ac5bafcac8c7adf

SHA1
5fef67a6a2bb111035359ca4a19dd7ff03a1d6f9

SHA256
f3292634ee3a5af030256b9ac72f8c5650a1f4b79dabde15bceb451ea1221fb0

SHA512
6479ed529a6d184fa86dd2d79dc49887a878e7ed9bbbd11a691a80bc70308ef5fac04992263f34b24785ccf4e636b773c5bfd5c286af28cf551a05a1af868bfc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
5KB

MD5
021d8bbf70168ec4aa8052a4eb639cd6

SHA1
f00cc4c37d9560ac41c3df0e6842678a4e09e3b0

SHA256
bc71d3d65cf86e57de29c37fff64348f83a843eead7b5134f006d4d869981429

SHA512
b4b1574d3645122c0ff464af21a5108ae4820e18c6ddce24bf8c2c77b2b090d206cc3c34b9e86af62c127fd8fd843ebc2844417a91f75b2141ccd774ec3289b7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
5KB

MD5
4bb49619f1aa0903518cabbf89f87f80

SHA1
648938f2b61264b712d35f5db55e80b357b3becf

SHA256
88af670f50e0605748996e415737d1188dc60da638de52ef7bc96b26dc29eb51

SHA512
545e4f131a36e52b22666217c101ef8a14e40d6f72c9b47ebe10c33efed52d08ced99ac9bb61431dee8c8ac0f4f7826d6226857aaf61337ed46521467dd57ca8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
604ebf2cd3a33e3b867f2f1e0c47005a

SHA1
7dd1a525b7fa2985fb6bfe07d6ed1bf3971ee258

SHA256
720a925223a356df3e8f636c797b86803caeb22ceb5ae06b8594c5a8518ac274

SHA512
2c912afce702b5b7c4d211c4aa95771735efeeeb06d8fd772f65b44b216832e66e7e5330cff23f02ad659f9c80ff53bbc7237f2a291bca4cf88cdfe1976a0a58

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
559a64cc6206b739ad63207f3b9390ce

SHA1
5eca0d804788c3a9b5480f59625050a1cd66a465

SHA256
9849762b2c1d6dba42c4895d828557185ad61453c3b9ff490cd37bbe0fb4376b

SHA512
2e746ff925145aae7bdc565db2c4ec176bf528d1cff6937618463f4b2dd9eb8956cb72555a6c10a7b5a527eba4e8912eef7d45d5ae60d1ea86237e3886481eca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
4b32d569f5814d5f0b65182bc4b2735c

SHA1
1f1f53ccdd249d087b14a91c1690b92d52e9754b

SHA256
88a4745f38e7d60e57cd12e4a761eaccea19715c0db8d43356e3e5a72eb6dc86

SHA512
b1dfb9b948f41b226baf99d9d093a54533efa787c1186a7efd2077d7b21e6fab5766b98b75fcc6cb0971d28d159141a95abf0c8a057eb315ff9ff507849071a9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Filesize
24KB

MD5
47e94a96372e6f095b8a3fd7edc48ec0

SHA1
377b68f34e5964ca8be1b1b0c1507dd7f0e5f005

SHA256
15c77bafd922bd085317fd544d0fa129e3b8c814e3ba0d48936366004427732e

SHA512
5bd63de2e831805b723d7ddf1343c3b721ef5b757d9ab01bf8554ef8e29ac2cc09fa104fc85d530f27d66b67280774b3ebbef6729ea3ab61ce8028ab4ba5bdad

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
204B

MD5
a629c33191f58e7593aacfeb6260d9a7

SHA1
be8042ac611f01781aa232a0ad3733c3c5186325

SHA256
fd37c9c18fcb478bfdc3aa9dec0e026489185cff0bd9f54756d575e797fdd152

SHA512
3a1085436c71d5b3288469e5d5ed9f57ca81691b502f9b0c7a59a3c8254337e3addf42a91de77fe6b265cd0ee63e2ed04b8f83187b0e4bbfdbb623d6541a6e2a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
204B

MD5
b480df755d23dd14c41ed2424d1017b1

SHA1
cc29e5761d3573c42945a8c1d253b4ed1efb7d4f

SHA256
280fdaeb180a4830a305bec5acc0f67335774c6df98e01f1b8cc7b87e3f5d9c8

SHA512
61a2c94e6da9aa06f496e0ac82a8a420880479ec896a51054a7df72b448291e0f3fd75e77923dc19287d3714907a644ae4b695553505687502c9e2407eb0a408

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
204B

MD5
1e0e028e4e9c76de6d72789a2064d86d

SHA1
6c27f5ecb9e888435242c1463d3ce5bc85bdf1f3

SHA256
79ba74b9e15b545e8f649fb2abec10d7fd067fd3e0401452debd55ef31edc588

SHA512
24b69506997e4c0eba08ad2381d2775d4a58f7a327c4d9f88ab98f6f66770b65e3ad749968e7ddf494f1deae5544e871c386ff8719b48cb97b2c9b005f28dea2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
372B

MD5
9e5a1b5413f54b7017bd9e84e3653dfe

SHA1
5bc2dd3fee797e5006fb596d98be4a4badeacee4

SHA256
66a4f9d5f6770e5009d36eff1a5982b897b06c51cd205178eb95b234d33b8b72

SHA512
01816c717f1730c5fcc9fa464e87f926a85b97d8c91d9f0e7ca9f0368e55327a8e277e3dded351f32c19142dee503290ace6a31a66af13670380b0d199ef8082

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe579673.TMP
Filesize
204B

MD5
3350e2e59717fc33d754255f27ef526b

SHA1
3dd7d75e5b65651b7738c8e6601a51b71c919b8f

SHA256
6af218370cda4aff458192ca18582559b76849d029d6a8e79dd6f77f2759970f

SHA512
751bdda11208509afca7c701678a7efc22f5dcf08874ebbda019582333b38dc246ee5a25a0d133648384fdf962ffcbf279744dd43be6777eba11728fa6d87797

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
9KB

MD5
2215a3f207f6c068c796bb69944e2f8b

SHA1
59bfdf874a0b685434e534c19ff5538ddeb957ee

SHA256
c2014bb27bef950f13e75759dba04b079ca93dc017460ca459ebe1bd44c4d824

SHA512
88db89c891c96080f92b30decf957ec072580da5815cc32e1d994806920fd08e135ac3fdefffca8250586ef1fb012c57415279c0200a6f970719f7657d5ceedd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ccd73623-fe28-40f3-a191-4bfeb5db1edb.tmp
Filesize
12KB

MD5
a6e270283a9fe37706fa82a662acb4d5

SHA1
26537c764b079aceb31b57895ad828746b541dd3

SHA256
22d2cb91b398296031c9d671d77d3a1e037000a6fd5e203d3b222b7005962b02

SHA512
673c855c4cfb6c5b3498ac292b9907a8048cfbe2f4fce8bb9bb87fe71e2cd7eb8ff20dee0b09e68d5122fffde12c62043ba9051edc23f99510bbe859dc6db31a

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms
Filesize
3KB

MD5
2582f6dba87777c16615101b6ac95340

SHA1
f9fbe42e6a2b53df3196115fb12b03d79e8908cf

SHA256
fe4f94940cdd34c752c2f7a95fb4f0ef74bf9d7bd16861fd390bc4b060977781

SHA512
4ad84cba471823c9a02eef36d84c8c40defcfa0209abeb8df21bac07d4d910895a71531d1eb17bf03fcf5602d247216dc5425c49a813d3430c5155334ce38e99

Download Submit
C:\note.txt
Filesize
218B

MD5
afa6955439b8d516721231029fb9ca1b

SHA1
087a043cc123c0c0df2ffadcf8e71e3ac86bbae9

SHA256
8e9f20f6864c66576536c0b866c6ffdcf11397db67fe120e972e244c3c022270

SHA512
5da21a31fbc4e8250dffed30f66b896bdf007ac91948140334fe36a3f010e1bac3e70a07e9f3eb9da8633189091fd5cadcabbaacd3e01da0fe7ae28a11b3dddf

Download Submit
\??\pipe\LOCAL\crashpad_2248_UTUCHFSGEUGCCICO
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit