Resubmissions
07-04-2023 08:11
230407-j3f3zaae2s 707-04-2023 08:08
230407-j1q56aad91 707-04-2023 07:42
230407-jj2wbsad6z 7Analysis
-
max time kernel
441s -
max time network
452s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
07-04-2023 07:42
Static task
static1
Behavioral task
behavioral1
Sample
MEMZ 3.0/MEMZ.bat
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
MEMZ 3.0/MEMZ.bat
Resource
win10v2004-20230220-en
General
-
Target
MEMZ 3.0/MEMZ.bat
-
Size
12KB
-
MD5
13a43c26bb98449fd82d2a552877013a
-
SHA1
71eb7dc393ac1f204488e11f5c1eef56f1e746af
-
SHA256
5f52365accb76d679b2b3946870439a62eb8936b9a0595f0fb0198138106b513
-
SHA512
602518b238d80010fa88c2c88699f70645513963ef4f148a0345675738cf9b0c23b9aeb899d9f7830cc1e5c7e9c7147b2dc4a9222770b4a052ee0c879062cd5a
-
SSDEEP
384:nnLhRNiqt0kCH2LR0GPXxGiZgCz+KG/yKhLdW79HOli+lz3:nLhRN9t0SR4iZtzlREBWhuF
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
MEMZ.exeMEMZ.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Control Panel\International\Geo\Nation MEMZ.exe Key value queried \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Control Panel\International\Geo\Nation MEMZ.exe -
Executes dropped EXE 7 IoCs
Processes:
MEMZ.exeMEMZ.exeMEMZ.exeMEMZ.exeMEMZ.exeMEMZ.exeMEMZ.exepid process 4512 MEMZ.exe 4876 MEMZ.exe 4956 MEMZ.exe 5096 MEMZ.exe 2312 MEMZ.exe 4908 MEMZ.exe 948 MEMZ.exe -
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
Processes:
MEMZ.exedescription ioc process File opened for modification \??\PhysicalDrive0 MEMZ.exe -
Drops file in System32 directory 1 IoCs
Processes:
mmc.exedescription ioc process File opened for modification C:\Windows\System32\devmgmt.msc mmc.exe -
Drops file in Program Files directory 2 IoCs
Processes:
setup.exedescription ioc process File created C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\c4e6de7b-20ce-4e43-93bd-097acd762970.tmp setup.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20230407094445.pma setup.exe -
Drops file in Windows directory 57 IoCs
Processes:
mmc.exedescription ioc process File created C:\Windows\INF\c_linedisplay.PNF mmc.exe File created C:\Windows\INF\c_fsopenfilebackup.PNF mmc.exe File created C:\Windows\INF\rdcameradriver.PNF mmc.exe File created C:\Windows\INF\c_fsvirtualization.PNF mmc.exe File created C:\Windows\INF\c_smrvolume.PNF mmc.exe File created C:\Windows\INF\rawsilo.PNF mmc.exe File created C:\Windows\INF\c_camera.PNF mmc.exe File created C:\Windows\INF\c_firmware.PNF mmc.exe File created C:\Windows\INF\c_fscopyprotection.PNF mmc.exe File created C:\Windows\INF\c_fsencryption.PNF mmc.exe File created C:\Windows\INF\c_barcodescanner.PNF mmc.exe File created C:\Windows\INF\c_fscompression.PNF mmc.exe File created C:\Windows\INF\PerceptionSimulationSixDof.PNF mmc.exe File created C:\Windows\INF\ts_generic.PNF mmc.exe File created C:\Windows\INF\oposdrv.PNF mmc.exe File created C:\Windows\INF\c_fsquotamgmt.PNF mmc.exe File created C:\Windows\INF\c_processor.PNF mmc.exe File created C:\Windows\INF\c_volume.PNF mmc.exe File created C:\Windows\INF\miradisp.PNF mmc.exe File created C:\Windows\INF\c_fscontentscreener.PNF mmc.exe File created C:\Windows\INF\c_diskdrive.PNF mmc.exe File created C:\Windows\INF\c_holographic.PNF mmc.exe File created C:\Windows\INF\c_proximity.PNF mmc.exe File created C:\Windows\INF\c_fssecurityenhancer.PNF mmc.exe File created C:\Windows\INF\c_fscfsmetadataserver.PNF mmc.exe File created C:\Windows\INF\c_extension.PNF mmc.exe File created C:\Windows\INF\c_fsphysicalquotamgmt.PNF mmc.exe File created C:\Windows\INF\c_cashdrawer.PNF mmc.exe File created C:\Windows\INF\xusb22.PNF mmc.exe File created C:\Windows\INF\c_media.PNF mmc.exe File created C:\Windows\INF\c_smrdisk.PNF mmc.exe File created C:\Windows\INF\c_fsantivirus.PNF mmc.exe File created C:\Windows\INF\c_ucm.PNF mmc.exe File created C:\Windows\INF\c_magneticstripereader.PNF mmc.exe File created C:\Windows\INF\c_apo.PNF mmc.exe File created C:\Windows\INF\c_fsinfrastructure.PNF mmc.exe File created C:\Windows\INF\c_fsreplication.PNF mmc.exe File created C:\Windows\INF\c_fsactivitymonitor.PNF mmc.exe File created C:\Windows\INF\c_computeaccelerator.PNF mmc.exe File created C:\Windows\INF\c_display.PNF mmc.exe File created C:\Windows\INF\c_fscontinuousbackup.PNF mmc.exe File created C:\Windows\INF\c_fssystem.PNF mmc.exe File created C:\Windows\INF\c_fsundelete.PNF mmc.exe File created C:\Windows\INF\c_monitor.PNF mmc.exe File created C:\Windows\INF\wsdprint.PNF mmc.exe File created C:\Windows\INF\remoteposdrv.PNF mmc.exe File created C:\Windows\INF\c_fssystemrecovery.PNF mmc.exe File created C:\Windows\INF\c_scmdisk.PNF mmc.exe File created C:\Windows\INF\c_scmvolume.PNF mmc.exe File created C:\Windows\INF\c_netdriver.PNF mmc.exe File created C:\Windows\INF\c_receiptprinter.PNF mmc.exe File created C:\Windows\INF\c_sslaccel.PNF mmc.exe File created C:\Windows\INF\c_mcx.PNF mmc.exe File created C:\Windows\INF\c_swcomponent.PNF mmc.exe File created C:\Windows\INF\c_fshsm.PNF mmc.exe File created C:\Windows\INF\dc1-controller.PNF mmc.exe File created C:\Windows\INF\digitalmediadevice.PNF mmc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks SCSI registry key(s) 3 TTPs 23 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
mmc.exeTaskmgr.exedescription ioc process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom mmc.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName mmc.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName mmc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 mmc.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A\ mmc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 Taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A mmc.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom mmc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002 mmc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000 mmc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000 mmc.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags mmc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 mmc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 mmc.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName Taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001 mmc.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName mmc.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName mmc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A Taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\ConfigFlags mmc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 mmc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A mmc.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A\ mmc.exe -
Enumerates system info in registry 2 TTPs 6 IoCs
Processes:
msedge.exemsedge.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe -
Processes:
explorer.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Software\Microsoft\Internet Explorer\Toolbar explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\Locked = "1" explorer.exe -
Modifies registry class 64 IoCs
Processes:
explorer.exeMEMZ.exeexplorer.exemsedge.execontrol.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\netcenter.dll,-2#immutable1 = "Check network status, change network settings and set preferences for sharing files and printers." explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\fhcpl.dll,-52#immutable1 = "File History" explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\FirewallControlPanel.dll,-12122#immutable1 = "Windows Defender Firewall" explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\main.cpl,-102#immutable1 = "Keyboard" explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\system32\appwiz.cpl,-160#immutable1 = "Uninstall or change programs on your computer." explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\mmsys.cpl,-301#immutable1 = "Configure your audio devices or change the sound scheme for your computer." explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\sud.dll,-1#immutable1 = "Default Programs" explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\system32\DeviceCenter.dll,-1000#immutable1 = "Devices and Printers" explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\timedate.cpl,-52#immutable1 = "Set the date, time, and time zone for your computer." explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\accessibilitycpl.dll,-10#immutable1 = "Ease of Access Center" explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\fvecpl.dll,-1#immutable1 = "BitLocker Drive Encryption" explorer.exe Key created \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000_Classes\Local Settings MEMZ.exe Set value (str) \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\recovery.dll,-101#immutable1 = "Recovery" explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\recovery.dll,-2#immutable1 = "Recovery" explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\telephon.cpl,-1#immutable1 = "Phone and Modem" explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\autoplay.dll,-2#immutable1 = "Change default settings for CDs, DVDs, and devices so that you can automatically play music, view pictures, install software, and play games." explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\sud.dll,-10#immutable1 = "Choose which programs you want Windows to use for activities like web browsing, editing photos, sending e-mail, and playing music." explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\autoplay.dll,-1#immutable1 = "AutoPlay" explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\inetcpl.cpl,-4312#immutable1 = "Internet Options" explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\system32\DeviceCenter.dll,-2000#immutable1 = "View and manage devices, printers, and print jobs" explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\srchadmin.dll,-601#immutable1 = "Indexing Options" explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\srchadmin.dll,-602#immutable1 = "Change how Windows indexes to search faster" explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\powercpl.dll,-2#immutable1 = "Conserve energy or maximize performance by choosing how your computer manages power." explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\RADCUI.dll,-15301#immutable1 = "Manage your RemoteApp and Desktop Connections" explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\netcenter.dll,-1#immutable1 = "Network and Sharing Center" explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\accessibilitycpl.dll,-45#immutable1 = "Make your computer easier to use." explorer.exe Key created \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ msedge.exe Set value (str) \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\Speech\SpeechUX\speechuxcpl.dll,-2#immutable1 = "Configure how speech recognition works on your computer." explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\usercpl.dll,-1#immutable1 = "User Accounts" explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\Speech\SpeechUX\speechuxcpl.dll,-1#immutable1 = "Speech Recognition" explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\intl.cpl,-2#immutable1 = "Customize settings for the display of languages, numbers, times, and dates." explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\fhcpl.dll,-2#immutable1 = "Keep a history of your files" explorer.exe Key created \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\system32\Vault.dll,-1#immutable1 = "Credential Manager" explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\timedate.cpl,-51#immutable1 = "Date and Time" explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\mmsys.cpl,-300#immutable1 = "Sound" explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\RADCUI.dll,-15300#immutable1 = "RemoteApp and Desktop Connections" explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\usercpl.dll,-2#immutable1 = "Change user account settings and passwords for people who share this computer." explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\fvecpl.dll,-2#immutable1 = "Protect your PC using BitLocker Drive Encryption." explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\SyncCenter.dll,-3001#immutable1 = "Sync files between your computer and network folders" explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\inetcpl.cpl,-4313#immutable1 = "Configure your Internet display and connection settings." explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\DiagCpl.dll,-1#immutable1 = "Troubleshooting" explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\DiagCpl.dll,-15#immutable1 = "Troubleshoot and fix common computer problems." explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\main.cpl,-100#immutable1 = "Mouse" explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\devmgr.dll,-4#immutable1 = "Device Manager" explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\devmgr.dll,-5#immutable1 = "View and update your device hardware settings and driver software." explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\system32\colorcpl.exe,-7#immutable1 = "Change advanced color management settings for displays, scanners, and printers." explorer.exe Key created \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000_Classes\Local Settings control.exe Set value (str) \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\telephon.cpl,-2#immutable1 = "Configure your telephone dialing rules and modem settings." explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\intl.cpl,-3#immutable1 = "Region" explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\powercpl.dll,-1#immutable1 = "Power Options" explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\FirewallControlPanel.dll,-12123#immutable1 = "Set firewall security options to help protect your computer from hackers and malicious software." explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\SyncCenter.dll,-3000#immutable1 = "Sync Center" explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\system32\Vault.dll,-2#immutable1 = "Manage your Windows credentials." explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\main.cpl,-103#immutable1 = "Customize your keyboard settings, such as the cursor blink rate and the character repeat rate." explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\system32\appwiz.cpl,-159#immutable1 = "Programs and Features" explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\system32\colorcpl.exe,-6#immutable1 = "Color Management" explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\sdcpl.dll,-101#immutable1 = "Backup and Restore (Windows 7)" explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\sdcpl.dll,-100#immutable1 = "Recover copies of your files backed up in Windows 7" explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\systemcpl.dll,-1#immutable1 = "System" explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\systemcpl.dll,-2#immutable1 = "View information about your computer, and change settings for hardware, performance, and remote connections." explorer.exe -
Runs regedit.exe 1 IoCs
Processes:
regedit.exepid process 3992 regedit.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
explorer.exepid process 1936 explorer.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
MEMZ.exeMEMZ.exeMEMZ.exeMEMZ.exeMEMZ.exepid process 4876 MEMZ.exe 4876 MEMZ.exe 4956 MEMZ.exe 5096 MEMZ.exe 4956 MEMZ.exe 5096 MEMZ.exe 4876 MEMZ.exe 4876 MEMZ.exe 5096 MEMZ.exe 4956 MEMZ.exe 5096 MEMZ.exe 4956 MEMZ.exe 4876 MEMZ.exe 4876 MEMZ.exe 4956 MEMZ.exe 4956 MEMZ.exe 5096 MEMZ.exe 4876 MEMZ.exe 5096 MEMZ.exe 4876 MEMZ.exe 5096 MEMZ.exe 5096 MEMZ.exe 4908 MEMZ.exe 4956 MEMZ.exe 4956 MEMZ.exe 2312 MEMZ.exe 2312 MEMZ.exe 4908 MEMZ.exe 4876 MEMZ.exe 4876 MEMZ.exe 2312 MEMZ.exe 2312 MEMZ.exe 4956 MEMZ.exe 4956 MEMZ.exe 5096 MEMZ.exe 5096 MEMZ.exe 4876 MEMZ.exe 4908 MEMZ.exe 4876 MEMZ.exe 4908 MEMZ.exe 2312 MEMZ.exe 2312 MEMZ.exe 4876 MEMZ.exe 4876 MEMZ.exe 5096 MEMZ.exe 4956 MEMZ.exe 5096 MEMZ.exe 4956 MEMZ.exe 4908 MEMZ.exe 4908 MEMZ.exe 2312 MEMZ.exe 2312 MEMZ.exe 4876 MEMZ.exe 4876 MEMZ.exe 4908 MEMZ.exe 4908 MEMZ.exe 5096 MEMZ.exe 5096 MEMZ.exe 4956 MEMZ.exe 4956 MEMZ.exe 5096 MEMZ.exe 5096 MEMZ.exe 4908 MEMZ.exe 4908 MEMZ.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
regedit.exepid process 3992 regedit.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 45 IoCs
Processes:
msedge.exemsedge.exepid process 4688 msedge.exe 4688 msedge.exe 4688 msedge.exe 4688 msedge.exe 4688 msedge.exe 4688 msedge.exe 4688 msedge.exe 4688 msedge.exe 4688 msedge.exe 4688 msedge.exe 4688 msedge.exe 4688 msedge.exe 4688 msedge.exe 4688 msedge.exe 4688 msedge.exe 4688 msedge.exe 4688 msedge.exe 4688 msedge.exe 4688 msedge.exe 4688 msedge.exe 4688 msedge.exe 5604 msedge.exe 5604 msedge.exe 5604 msedge.exe 5604 msedge.exe 5604 msedge.exe 5604 msedge.exe 5604 msedge.exe 5604 msedge.exe 5604 msedge.exe 5604 msedge.exe 5604 msedge.exe 5604 msedge.exe 5604 msedge.exe 5604 msedge.exe 5604 msedge.exe 5604 msedge.exe 5604 msedge.exe 5604 msedge.exe 5604 msedge.exe 5604 msedge.exe 5604 msedge.exe 5604 msedge.exe 5604 msedge.exe 5604 msedge.exe -
Suspicious use of AdjustPrivilegeToken 11 IoCs
Processes:
AUDIODG.EXEmmc.exeexplorer.exeTaskmgr.exedescription pid process Token: 33 3760 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 3760 AUDIODG.EXE Token: 33 4508 mmc.exe Token: SeIncBasePriorityPrivilege 4508 mmc.exe Token: 33 4508 mmc.exe Token: SeIncBasePriorityPrivilege 4508 mmc.exe Token: SeShutdownPrivilege 1936 explorer.exe Token: SeCreatePagefilePrivilege 1936 explorer.exe Token: SeDebugPrivilege 1792 Taskmgr.exe Token: SeSystemProfilePrivilege 1792 Taskmgr.exe Token: SeCreateGlobalPrivilege 1792 Taskmgr.exe -
Suspicious use of FindShellTrayWindow 35 IoCs
Processes:
msedge.exeexplorer.exemsedge.exeTaskmgr.exepid process 4688 msedge.exe 4688 msedge.exe 4688 msedge.exe 4688 msedge.exe 1936 explorer.exe 5604 msedge.exe 1792 Taskmgr.exe 1792 Taskmgr.exe 1792 Taskmgr.exe 1792 Taskmgr.exe 1792 Taskmgr.exe 1792 Taskmgr.exe 1792 Taskmgr.exe 1792 Taskmgr.exe 1792 Taskmgr.exe 1792 Taskmgr.exe 1792 Taskmgr.exe 1792 Taskmgr.exe 1792 Taskmgr.exe 1792 Taskmgr.exe 1792 Taskmgr.exe 1792 Taskmgr.exe 1792 Taskmgr.exe 1792 Taskmgr.exe 1792 Taskmgr.exe 1792 Taskmgr.exe 1792 Taskmgr.exe 1792 Taskmgr.exe 1792 Taskmgr.exe 1792 Taskmgr.exe 1792 Taskmgr.exe 1792 Taskmgr.exe 1792 Taskmgr.exe 1792 Taskmgr.exe 1792 Taskmgr.exe -
Suspicious use of SendNotifyMessage 29 IoCs
Processes:
Taskmgr.exepid process 1792 Taskmgr.exe 1792 Taskmgr.exe 1792 Taskmgr.exe 1792 Taskmgr.exe 1792 Taskmgr.exe 1792 Taskmgr.exe 1792 Taskmgr.exe 1792 Taskmgr.exe 1792 Taskmgr.exe 1792 Taskmgr.exe 1792 Taskmgr.exe 1792 Taskmgr.exe 1792 Taskmgr.exe 1792 Taskmgr.exe 1792 Taskmgr.exe 1792 Taskmgr.exe 1792 Taskmgr.exe 1792 Taskmgr.exe 1792 Taskmgr.exe 1792 Taskmgr.exe 1792 Taskmgr.exe 1792 Taskmgr.exe 1792 Taskmgr.exe 1792 Taskmgr.exe 1792 Taskmgr.exe 1792 Taskmgr.exe 1792 Taskmgr.exe 1792 Taskmgr.exe 1792 Taskmgr.exe -
Suspicious use of SetWindowsHookEx 17 IoCs
Processes:
MEMZ.exemmc.exemmc.exepid process 948 MEMZ.exe 3944 mmc.exe 4508 mmc.exe 4508 mmc.exe 948 MEMZ.exe 948 MEMZ.exe 948 MEMZ.exe 948 MEMZ.exe 948 MEMZ.exe 948 MEMZ.exe 948 MEMZ.exe 948 MEMZ.exe 948 MEMZ.exe 948 MEMZ.exe 948 MEMZ.exe 948 MEMZ.exe 948 MEMZ.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
cmd.exeMEMZ.exeMEMZ.exemsedge.exedescription pid process target process PID 5016 wrote to memory of 928 5016 cmd.exe cscript.exe PID 5016 wrote to memory of 928 5016 cmd.exe cscript.exe PID 5016 wrote to memory of 4512 5016 cmd.exe MEMZ.exe PID 5016 wrote to memory of 4512 5016 cmd.exe MEMZ.exe PID 5016 wrote to memory of 4512 5016 cmd.exe MEMZ.exe PID 4512 wrote to memory of 4876 4512 MEMZ.exe MEMZ.exe PID 4512 wrote to memory of 4876 4512 MEMZ.exe MEMZ.exe PID 4512 wrote to memory of 4876 4512 MEMZ.exe MEMZ.exe PID 4512 wrote to memory of 4956 4512 MEMZ.exe MEMZ.exe PID 4512 wrote to memory of 4956 4512 MEMZ.exe MEMZ.exe PID 4512 wrote to memory of 4956 4512 MEMZ.exe MEMZ.exe PID 4512 wrote to memory of 5096 4512 MEMZ.exe MEMZ.exe PID 4512 wrote to memory of 5096 4512 MEMZ.exe MEMZ.exe PID 4512 wrote to memory of 5096 4512 MEMZ.exe MEMZ.exe PID 4512 wrote to memory of 2312 4512 MEMZ.exe MEMZ.exe PID 4512 wrote to memory of 2312 4512 MEMZ.exe MEMZ.exe PID 4512 wrote to memory of 2312 4512 MEMZ.exe MEMZ.exe PID 4512 wrote to memory of 4908 4512 MEMZ.exe MEMZ.exe PID 4512 wrote to memory of 4908 4512 MEMZ.exe MEMZ.exe PID 4512 wrote to memory of 4908 4512 MEMZ.exe MEMZ.exe PID 4512 wrote to memory of 948 4512 MEMZ.exe MEMZ.exe PID 4512 wrote to memory of 948 4512 MEMZ.exe MEMZ.exe PID 4512 wrote to memory of 948 4512 MEMZ.exe MEMZ.exe PID 948 wrote to memory of 2332 948 MEMZ.exe notepad.exe PID 948 wrote to memory of 2332 948 MEMZ.exe notepad.exe PID 948 wrote to memory of 2332 948 MEMZ.exe notepad.exe PID 948 wrote to memory of 3992 948 MEMZ.exe regedit.exe PID 948 wrote to memory of 3992 948 MEMZ.exe regedit.exe PID 948 wrote to memory of 3992 948 MEMZ.exe regedit.exe PID 948 wrote to memory of 436 948 MEMZ.exe cmd.exe PID 948 wrote to memory of 436 948 MEMZ.exe cmd.exe PID 948 wrote to memory of 436 948 MEMZ.exe cmd.exe PID 948 wrote to memory of 4688 948 MEMZ.exe msedge.exe PID 948 wrote to memory of 4688 948 MEMZ.exe msedge.exe PID 4688 wrote to memory of 4032 4688 msedge.exe msedge.exe PID 4688 wrote to memory of 4032 4688 msedge.exe msedge.exe PID 4688 wrote to memory of 4520 4688 msedge.exe msedge.exe PID 4688 wrote to memory of 4520 4688 msedge.exe msedge.exe PID 4688 wrote to memory of 4520 4688 msedge.exe msedge.exe PID 4688 wrote to memory of 4520 4688 msedge.exe msedge.exe PID 4688 wrote to memory of 4520 4688 msedge.exe msedge.exe PID 4688 wrote to memory of 4520 4688 msedge.exe msedge.exe PID 4688 wrote to memory of 4520 4688 msedge.exe msedge.exe PID 4688 wrote to memory of 4520 4688 msedge.exe msedge.exe PID 4688 wrote to memory of 4520 4688 msedge.exe msedge.exe PID 4688 wrote to memory of 4520 4688 msedge.exe msedge.exe PID 4688 wrote to memory of 4520 4688 msedge.exe msedge.exe PID 4688 wrote to memory of 4520 4688 msedge.exe msedge.exe PID 4688 wrote to memory of 4520 4688 msedge.exe msedge.exe PID 4688 wrote to memory of 4520 4688 msedge.exe msedge.exe PID 4688 wrote to memory of 4520 4688 msedge.exe msedge.exe PID 4688 wrote to memory of 4520 4688 msedge.exe msedge.exe PID 4688 wrote to memory of 4520 4688 msedge.exe msedge.exe PID 4688 wrote to memory of 4520 4688 msedge.exe msedge.exe PID 4688 wrote to memory of 4520 4688 msedge.exe msedge.exe PID 4688 wrote to memory of 4520 4688 msedge.exe msedge.exe PID 4688 wrote to memory of 4520 4688 msedge.exe msedge.exe PID 4688 wrote to memory of 4520 4688 msedge.exe msedge.exe PID 4688 wrote to memory of 4520 4688 msedge.exe msedge.exe PID 4688 wrote to memory of 4520 4688 msedge.exe msedge.exe PID 4688 wrote to memory of 4520 4688 msedge.exe msedge.exe PID 4688 wrote to memory of 4520 4688 msedge.exe msedge.exe PID 4688 wrote to memory of 4520 4688 msedge.exe msedge.exe PID 4688 wrote to memory of 4520 4688 msedge.exe msedge.exe
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\MEMZ 3.0\MEMZ.bat"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cscript.execscript x.js2⤵
-
C:\Users\Admin\AppData\Roaming\MEMZ.exe"C:\Users\Admin\AppData\Roaming\MEMZ.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\MEMZ.exe"C:\Users\Admin\AppData\Roaming\MEMZ.exe" /watchdog3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Roaming\MEMZ.exe"C:\Users\Admin\AppData\Roaming\MEMZ.exe" /watchdog3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Roaming\MEMZ.exe"C:\Users\Admin\AppData\Roaming\MEMZ.exe" /watchdog3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Roaming\MEMZ.exe"C:\Users\Admin\AppData\Roaming\MEMZ.exe" /watchdog3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Roaming\MEMZ.exe"C:\Users\Admin\AppData\Roaming\MEMZ.exe" /watchdog3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Roaming\MEMZ.exe"C:\Users\Admin\AppData\Roaming\MEMZ.exe" /main3⤵
- Checks computer location settings
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\notepad.exe"C:\Windows\System32\notepad.exe" \note.txt4⤵
-
C:\Windows\SysWOW64\regedit.exe"C:\Windows\System32\regedit.exe"4⤵
- Runs regedit.exe
- Suspicious behavior: GetForegroundWindowSpam
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe"4⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://google.co.ck/search?q=my+computer+is+doing+weird+things+wtf+is+happenin+plz+halp4⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x114,0x118,0x11c,0xfc,0x120,0x7fff971246f8,0x7fff97124708,0x7fff971247185⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2164,4267382118395972544,13619965577222863919,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2220 /prefetch:25⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2164,4267382118395972544,13619965577222863919,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2268 /prefetch:35⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2164,4267382118395972544,13619965577222863919,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2772 /prefetch:85⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,4267382118395972544,13619965577222863919,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3656 /prefetch:15⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,4267382118395972544,13619965577222863919,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3672 /prefetch:15⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,4267382118395972544,13619965577222863919,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5228 /prefetch:15⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,4267382118395972544,13619965577222863919,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5416 /prefetch:15⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,4267382118395972544,13619965577222863919,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5716 /prefetch:15⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,4267382118395972544,13619965577222863919,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5692 /prefetch:15⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,4267382118395972544,13619965577222863919,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5628 /prefetch:15⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,4267382118395972544,13619965577222863919,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5224 /prefetch:15⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2164,4267382118395972544,13619965577222863919,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5884 /prefetch:85⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings5⤵
- Drops file in Program Files directory
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x23c,0x240,0x244,0x218,0x248,0x7ff7eb6e5460,0x7ff7eb6e5470,0x7ff7eb6e54806⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2164,4267382118395972544,13619965577222863919,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5884 /prefetch:85⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,4267382118395972544,13619965577222863919,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6032 /prefetch:15⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,4267382118395972544,13619965577222863919,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5756 /prefetch:15⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,4267382118395972544,13619965577222863919,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1760 /prefetch:15⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,4267382118395972544,13619965577222863919,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5372 /prefetch:15⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,4267382118395972544,13619965577222863919,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1800 /prefetch:15⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,4267382118395972544,13619965577222863919,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3940 /prefetch:15⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,4267382118395972544,13619965577222863919,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6376 /prefetch:15⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2164,4267382118395972544,13619965577222863919,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3260 /prefetch:25⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,4267382118395972544,13619965577222863919,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6148 /prefetch:15⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,4267382118395972544,13619965577222863919,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7132 /prefetch:15⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2164,4267382118395972544,13619965577222863919,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=7028 /prefetch:85⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,4267382118395972544,13619965577222863919,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6164 /prefetch:15⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,4267382118395972544,13619965577222863919,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7624 /prefetch:15⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,4267382118395972544,13619965577222863919,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6420 /prefetch:15⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,4267382118395972544,13619965577222863919,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5596 /prefetch:15⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://google.co.ck/search?q=how+2+remove+a+virus4⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7fff971246f8,0x7fff97124708,0x7fff971247185⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe"4⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://google.co.ck/search?q=internet+explorer+is+the+best+browser4⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7fff971246f8,0x7fff97124708,0x7fff971247185⤵
-
C:\Windows\SysWOW64\mmc.exe"C:\Windows\system32\mmc.exe" "C:\Windows\System32\devmgmt.msc"4⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\mmc.exe"C:\Windows\System32\devmgmt.msc" "C:\Windows\System32\devmgmt.msc"5⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://google.co.ck/search?q=g3t+r3kt4⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7fff971246f8,0x7fff97124708,0x7fff971247185⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://google.co.ck/search?q=how+to+remove+memz+trojan+virus4⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7fff971246f8,0x7fff97124708,0x7fff971247185⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://google.co.ck/search?q=facebook+hacking+tool+free+download+no+virus+working+20164⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7fff971246f8,0x7fff97124708,0x7fff971247185⤵
-
C:\Windows\SysWOW64\control.exe"C:\Windows\System32\control.exe"4⤵
- Modifies registry class
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://google.co.ck/search?q=how+2+remove+a+virus4⤵
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x124,0x128,0x12c,0x100,0x90,0x7fff971246f8,0x7fff97124708,0x7fff971247185⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2148,14511171755251665172,9379945111900017065,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2200 /prefetch:35⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2148,14511171755251665172,9379945111900017065,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2800 /prefetch:85⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,14511171755251665172,9379945111900017065,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3468 /prefetch:15⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,14511171755251665172,9379945111900017065,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3436 /prefetch:15⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2148,14511171755251665172,9379945111900017065,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2140 /prefetch:25⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,14511171755251665172,9379945111900017065,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4364 /prefetch:15⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,14511171755251665172,9379945111900017065,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3636 /prefetch:15⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2148,14511171755251665172,9379945111900017065,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5176 /prefetch:85⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2148,14511171755251665172,9379945111900017065,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5176 /prefetch:85⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,14511171755251665172,9379945111900017065,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5452 /prefetch:15⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,14511171755251665172,9379945111900017065,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5436 /prefetch:15⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,14511171755251665172,9379945111900017065,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5784 /prefetch:15⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,14511171755251665172,9379945111900017065,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3988 /prefetch:15⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,14511171755251665172,9379945111900017065,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5084 /prefetch:15⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,14511171755251665172,9379945111900017065,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5828 /prefetch:15⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,14511171755251665172,9379945111900017065,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1728 /prefetch:15⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,14511171755251665172,9379945111900017065,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6096 /prefetch:15⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,14511171755251665172,9379945111900017065,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5596 /prefetch:15⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,14511171755251665172,9379945111900017065,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6184 /prefetch:15⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,14511171755251665172,9379945111900017065,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6588 /prefetch:15⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,14511171755251665172,9379945111900017065,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5756 /prefetch:15⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,14511171755251665172,9379945111900017065,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4028 /prefetch:15⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,14511171755251665172,9379945111900017065,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6120 /prefetch:15⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,14511171755251665172,9379945111900017065,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6680 /prefetch:15⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,14511171755251665172,9379945111900017065,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6184 /prefetch:15⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2148,14511171755251665172,9379945111900017065,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=7064 /prefetch:25⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,14511171755251665172,9379945111900017065,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5356 /prefetch:15⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,14511171755251665172,9379945111900017065,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7028 /prefetch:15⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,14511171755251665172,9379945111900017065,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6720 /prefetch:15⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,14511171755251665172,9379945111900017065,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7216 /prefetch:15⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://google.co.ck/search?q=how+2+buy+weed4⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7fff971246f8,0x7fff97124708,0x7fff971247185⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://pcoptimizerpro.com/4⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7fff971246f8,0x7fff97124708,0x7fff971247185⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://pcoptimizerpro.com/4⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7fff971246f8,0x7fff97124708,0x7fff971247185⤵
-
C:\Windows\SysWOW64\explorer.exe"C:\Windows\System32\explorer.exe"4⤵
- Modifies registry class
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://google.co.ck/search?q=how+to+code+a+virus+in+visual+basic4⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7fff971246f8,0x7fff97124708,0x7fff971247185⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://google.co.ck/search?q=batch+virus+download4⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf4,0x128,0x7fff971246f8,0x7fff97124708,0x7fff971247185⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://google.co.ck/search?q=how+to+get+money4⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x118,0x11c,0x120,0xf8,0x124,0x7fff971246f8,0x7fff97124708,0x7fff971247185⤵
-
C:\Windows\SysWOW64\notepad.exe"C:\Windows\System32\notepad.exe"4⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://google.co.ck/search?q=how+to+create+your+own+ransomware4⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x124,0x128,0x12c,0xf4,0x130,0x7fff971246f8,0x7fff97124708,0x7fff971247185⤵
-
C:\Windows\SysWOW64\Taskmgr.exe"C:\Windows\System32\Taskmgr.exe"4⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://google.co.ck/search?q=how+2+buy+weed4⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7fff971246f8,0x7fff97124708,0x7fff971247185⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x394 0x4a81⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{5BD95610-9434-43C2-886C-57852CC8A120} -Embedding1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}1⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5dfeee58d8e9ccc6ffa537d5b4782ed65
SHA1995bd4512e107fe1274eba41e49984403e075f31
SHA2561a35071ba780d220a4e2d5c2c696563b316ba36993191563953059f70f6ae884
SHA5123f598ed40475c4ebc65df2b9d1ce35bd29792cd0bddc2c02ab4a1776cf8a814523261bd130118ce5f5b16f111fe060ec185397fc7a6dd5539f442f8fb1444ad6
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5dfeee58d8e9ccc6ffa537d5b4782ed65
SHA1995bd4512e107fe1274eba41e49984403e075f31
SHA2561a35071ba780d220a4e2d5c2c696563b316ba36993191563953059f70f6ae884
SHA5123f598ed40475c4ebc65df2b9d1ce35bd29792cd0bddc2c02ab4a1776cf8a814523261bd130118ce5f5b16f111fe060ec185397fc7a6dd5539f442f8fb1444ad6
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5dfeee58d8e9ccc6ffa537d5b4782ed65
SHA1995bd4512e107fe1274eba41e49984403e075f31
SHA2561a35071ba780d220a4e2d5c2c696563b316ba36993191563953059f70f6ae884
SHA5123f598ed40475c4ebc65df2b9d1ce35bd29792cd0bddc2c02ab4a1776cf8a814523261bd130118ce5f5b16f111fe060ec185397fc7a6dd5539f442f8fb1444ad6
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5dfeee58d8e9ccc6ffa537d5b4782ed65
SHA1995bd4512e107fe1274eba41e49984403e075f31
SHA2561a35071ba780d220a4e2d5c2c696563b316ba36993191563953059f70f6ae884
SHA5123f598ed40475c4ebc65df2b9d1ce35bd29792cd0bddc2c02ab4a1776cf8a814523261bd130118ce5f5b16f111fe060ec185397fc7a6dd5539f442f8fb1444ad6
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD57abc6e597d5861b4bd2797073d353fdf
SHA12301fa6b712087c765caa84095151477f99f02eb
SHA25625e94de5069effa8bac56a77caa6f00b9595183b78b01409079acf1695156535
SHA5123ac3bc0bd2186e71cee273e12c7944800dbf106e50b10d76bdbc0d722ab366c14b97256829031a1b561d23c5e155492cc75a263450dfd7bd8d328782b65c4f05
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5a5fd05a46763e9667be6722d46909b14
SHA175a32cf26f7faa82285869d79bfdf596cec6e71e
SHA2569d0c60043b6c8fca3ab768d25107a5aff7451bd360c3f9ccc47765cfda98f711
SHA51213f3e27529931bb87d85e78528da18e8cb32234cb9da5f1fa7d096433b1dd87a73f18dc29b65be6d43343af09697dea271ed6bea263f0cfe894db17bb2022290
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5cd4f5fe0fc0ab6b6df866b9bfb9dd762
SHA1a6aaed363cd5a7b6910e9b3296c0093b0ac94759
SHA2563b803b53dbd3d592848fc66e5715f39f6bc02cbc95fb2452cd5822d98c6b8f81
SHA5127072630ec28cf6a8d5b072555234b5150c1e952138e5cdc29435a6242fda4b4217b81fb57acae927d2b908fa06f36414cb3fab35110d63107141263e3bba9676
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD51d40312629d09d2420e992fdb8a78c1c
SHA1903950d5ba9d64ec21c9f51264272ca8dfae9540
SHA2561e7c6aa575c3ec46cd1fdf6df51063113d277012ed28f5f6b37aea95cd3a64ac
SHA512a7073247ae95e451ed32ceeae91c6638192c15eaad718875c1272eff51c0564016d9f84690543f27df509a7d579de329d101fbf82fed7cbeb27af57393de24ac
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5dfeee58d8e9ccc6ffa537d5b4782ed65
SHA1995bd4512e107fe1274eba41e49984403e075f31
SHA2561a35071ba780d220a4e2d5c2c696563b316ba36993191563953059f70f6ae884
SHA5123f598ed40475c4ebc65df2b9d1ce35bd29792cd0bddc2c02ab4a1776cf8a814523261bd130118ce5f5b16f111fe060ec185397fc7a6dd5539f442f8fb1444ad6
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5dfeee58d8e9ccc6ffa537d5b4782ed65
SHA1995bd4512e107fe1274eba41e49984403e075f31
SHA2561a35071ba780d220a4e2d5c2c696563b316ba36993191563953059f70f6ae884
SHA5123f598ed40475c4ebc65df2b9d1ce35bd29792cd0bddc2c02ab4a1776cf8a814523261bd130118ce5f5b16f111fe060ec185397fc7a6dd5539f442f8fb1444ad6
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5dfeee58d8e9ccc6ffa537d5b4782ed65
SHA1995bd4512e107fe1274eba41e49984403e075f31
SHA2561a35071ba780d220a4e2d5c2c696563b316ba36993191563953059f70f6ae884
SHA5123f598ed40475c4ebc65df2b9d1ce35bd29792cd0bddc2c02ab4a1776cf8a814523261bd130118ce5f5b16f111fe060ec185397fc7a6dd5539f442f8fb1444ad6
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5dfeee58d8e9ccc6ffa537d5b4782ed65
SHA1995bd4512e107fe1274eba41e49984403e075f31
SHA2561a35071ba780d220a4e2d5c2c696563b316ba36993191563953059f70f6ae884
SHA5123f598ed40475c4ebc65df2b9d1ce35bd29792cd0bddc2c02ab4a1776cf8a814523261bd130118ce5f5b16f111fe060ec185397fc7a6dd5539f442f8fb1444ad6
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000001Filesize
20KB
MD5923a543cc619ea568f91b723d9fb1ef0
SHA16f4ade25559645c741d7327c6e16521e43d7e1f9
SHA256bf7344209edb1be5a2886c425cf6334a102d76cbea1471fd50171e2ee92877cd
SHA512a4153751761cd67465374828b0514d7773b8c4ed37779d1ecfd4f19be4faa171585c8ee0b4db59b556399d5d2b9809ba87e04d4715e9d090e1f488d02219d555
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000003Filesize
335KB
MD5fcc028327a1f47d7847d253aaf25f5c6
SHA19f46c5032ecca6ca7abc7826cacc091cebbafcaf
SHA25678a542df9c4df44a8a4336b547bcf953e8e4112d6ace06ca294167257e1e7b62
SHA51259cddd85cea5f5af87c19de0110bfd510295b9cde46b170305bdb9ed95239186caa360fd03819e8f0242087d48d367511689918aaa5e3d838f0ba1cc22bfa252
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000005Filesize
64KB
MD51067041b8fa46bae06ebeac837cb67ed
SHA19a1e51cfe25d04692592f1dc13ce75058db813d3
SHA256e6f3a928b555e72664e65ac8d3455b7ace51ce76f205975f98daff89b3a5d533
SHA512d16c71f87ebcdc4553cb5aa4283f84ba02178e80d237a99d56ec416377031af4354582d459abac88df5b06239e3fb4625466b478bbf67ac5f6f001e82fa58882
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000007Filesize
37KB
MD547ae9b25af86702d77c7895ac6f6b57c
SHA1f56f78729b99247a975620a1103cac3ee9f313a5
SHA2569bde79a1b0866f68d6baa43f920e971b5feb35a8e0af7ffadc114366f8538224
SHA51272b5296e3dd1c5b4c42d8c3e4a56693819779167b9f02bc2d5f5a626b519a9cf10bee59846d614c929c42094b65d13039f6024f6cb1c023e740969aaefd060c4
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000008Filesize
70KB
MD5bf60e369a13f6aa51d9709ff1d1b560f
SHA1c24ef96b3a1c339644145ac06709704b31e259ee
SHA2560f48079fd06018af3f3309da572441b103caeb8df8454dca1e309e9173472a3a
SHA5127ecc9025c482b30cf2ce41f4005be41692a0749a313f62d54f694de9ba18f89852e0a010c9ede7a123937643482842b29d45a98c6c9926ca242db00c9f563fef
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000aFilesize
209KB
MD54efa911c670ebb49df94768a642c0e9d
SHA1b6b23fbf8ebba2acde63650a9727f5108b50912a
SHA256c61bd4151c7745d1c4f724e78a334364d0fc9a726a208c035096f4e543ea37bf
SHA5122c9b48623290de9ba212103df27c70c8595f8a591415174c012ed46ecc004ee23a911d844dac7b0a5fb761cce12e8e5b983266545566d8817307c433dde6c40b
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000cFilesize
408KB
MD510ffed64f20be5f93f5ba4d04d1c3486
SHA1ce7e1619c6107d30f24ec74eaeb6d04cbe329491
SHA256c225e7599667f36665dddef4ce236584cd7d73046a521cb57f2573fa10ee4479
SHA512000cf588b50a5979cebc05270d1f3feecfb462978a45224022203c907eae8ea0dae10ba3411fa707e318021d783369788550ebe9bc5e3d19cb2c6040beec2474
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000dFilesize
61KB
MD5f71b0894d35d9dffdcc3db2be42fa0df
SHA1abfcb6ffe0b38228fcf03fcfd01e5ae7d363d9af
SHA256bc12e3374035e04abc80bec91a6abccbc6f736c3f91ec29fcc5b715fb1b3dfd2
SHA512bfb99588b5a33da1d78a2b79d0734029cf16cc85cba2c353361fd1187ea4fe3ad9baf250548edd96980ae07167a1026fae106c2f0fee8792d36479aa3b3350ef
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000eFilesize
50KB
MD56d81cd0d857a5d1728e08c77b9b0ae22
SHA13cc0e10ffa948e94df63f20a66f5190224c57d07
SHA256703521ee76a6b56c41ea6bec08e91e25e64705acfce7abfc2ff9e75c3d92b2b4
SHA5129d0cea67338db2e97b58f30e25c702aaeaa41ea0f480a5b2b0c8e9d2935e4ae65c10b1186507a5bcd86540c6b333b5856fe0902146e1a9ce57cd4ed0eb67d959
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000011Filesize
35KB
MD5aef13a646c7327cbd4a6d3bcebb034db
SHA17d9ee720386efcddc69c6d6f810732f5debfd067
SHA256e22cf8b805411472bc63a30289ad2fddf603a0d4fb1f7ad6ba5a72511da75412
SHA512ded8aad01610fd13228905f618dc5f6954fc4a175f4ddafb681bb504b1990d75b6c00d55907f8b25ee8aefbe35fbcd3966dd5de8d69351c83bc725ff554416b7
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000021Filesize
613KB
MD5117a24f8df93cb18f513ca58d426ad41
SHA1cfc25336c98be31856a0d4a064c9119033a95ea8
SHA2566914dd9ba2bdc56c2dc31ffa487b61b71240d238445d99d1cfd1ff395dc0692d
SHA512406bfcf17969f06e17dab79005db344ea3bf6bfde4a0891fd4314aebf7e0f21e49364a7c4c3a160908b9f5d2dba6c93ed481ce32139cb7d17540f0eb84aa8285
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000037Filesize
21KB
MD5805321a7ab08b098c7e60353dd915cb4
SHA184b5c3f64adf6a3b4f2a1c400d31625d3086e509
SHA25637db7a8a979ff0dd017e502271e3a4dc6fdb1415a721979352865fa073173bbe
SHA5122c5e8b232bf0ca61bfcc39a426535b7a09f2b277617e511ef6785723f1beab6cf6cea36d4937bdddf82b3dd3465326c49d5bf7b8a68cebbb441f71c9373a5d53
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00003cFilesize
63KB
MD59532d6cfa45799456b447d26fe0f8b20
SHA1dca8a98ad97e8af759860bc6dfa47e050f0daae2
SHA2560bb31d364405d0dc6c166e77ac4ac26a5b9b7383462234f50536da58a2f49546
SHA5125ced5b8a6278c679f8e2f430c5af46fafd863cc5431107be1c1df02be243563a24f75551bd76c7eeab2bbe48afadd7f9c03fbf13fe7d8dceed7d21eca14fb4fd
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00003dFilesize
121KB
MD52ed606346e09f5459aae4962da201015
SHA1e76aa356acb7a4cbc0853d4cf222e53d601858f5
SHA2566c3eb207f4875f19774cd2f065e6f8717d74317960c3c8c25b0c0bd54ac2d233
SHA51265e98434c426705dc9b01b4cc41c89d74eb29e26194acbd041083237ac2675cf291828f98668a0d2e136db9a0f7dec93b014117d3fd69e9465a8433fbd7d8114
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00003eFilesize
278KB
MD58ca5b4c94bdb9059b420f716c641beae
SHA16d0b9ffbeddf43792d909d697c9d893287b5c89b
SHA256dea24dda6399ee36e9e3a9a330025d87ef7857412e9851945b053f19727ca695
SHA512c744b390521f9b575a88de078986b701f20aef1ddd1bc7d050ab63188b2fa23f6f22729206f97d1058c7d4f7b2eefa1591a22ccd1ca9c9b7c2f70f329ff02819
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\53ccae0f086ff811_0Filesize
388B
MD5a49c7869c81cce37c6e3dcf169e57f21
SHA1bcef941281033e51cbe424f88d1693baae32000b
SHA256d9271a0f4d059d6991b4a381d9e0a0377eecf442ad918cfbdd3d5c54fe76d48b
SHA5125b5b2b547dbbe1f594ad52c8e836c57c401d712885d6ba0ace1040cdf7bfa0da8c641bcd66159322fcc4fc993468604b03c14f798b280c560adcd4efff779961
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\85752563213f5225_0Filesize
136KB
MD59f88d05deba19b279291afa5d1a21ef3
SHA1770d36e4815085c115aa2c25be5ed76e529bac60
SHA2562798a9e7e75cca3b57c6750675d4a05d78caa1f0da34aa4496c6ce88d0b5f495
SHA512c68b990fc424ac57ff3528315d03bf3aecc84b0497ce8c0994e12334c27d68e0abd7bb69a41dae174232976fd217850550e2efcbda815bed590cb10c9c760256
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\9a0dcca5a4fb02ce_0Filesize
1.5MB
MD52a387494e9906d4c6c0ce8cdd178a10e
SHA1369349d34c8929c071f590043ad8b1884b2a7ff6
SHA25602ef831b031bb8d43e30c91c0cb646f8794c693e680b79aa7cc87c9434082867
SHA5121e0f72fbe21fd03192e11deb488c56bdfe588a85656add87cf6f13ff13b8583fb6074e7332f80fb19d134b1c4e34b36583becc3f2cc3331f27d49b5dc848c520
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\9b011c5c25d4f0ba_0Filesize
413B
MD5294de65ed324c95de2338fecfefb2137
SHA1abd2e38ea648ecc4fed9cd354e9567dde49a37e5
SHA25619d076ff86469c1b028e093019605e25c796314dda0db24d24ed3afa52333463
SHA512ee7750567e3e72ede16db51bc0a0092b10a9b00eb633562302ed21cdfe447fea2e2bbb1cc28b317380d99066aba18ee787635588e65ff8c5a0567de96936c1c5
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\a7e51d4e7dba1fcc_0Filesize
205KB
MD5d206168b41f1341b0e529a039c53b25e
SHA10e8f7e6e7b6461e04b32269dc64141021deeb490
SHA256dea96484ec143c01a66ce89eef40195325e1534380abc8e47745ac21ef477efb
SHA51273f55d0cfc1c604caabe513e14eec39df208027374f156d1d2ea7da6aa4e278aeeda89ce0931fe4accf805da649c70e41837a1776b952e16e95700fb562eb917
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\cb126f066a015e90_0Filesize
505B
MD5f2e2690983e009ac23617bd64fb6459f
SHA113eb4fe0f4c3f1ce8c259c497cbbf00f10668eab
SHA256df60db2c929872c8d7f35b13c46aa418ea0f81a146c3d8fe002bbb3378cfec74
SHA5121690768a4c1a8c7110ee01d9ac0e1978c2f01cd9bca351c9a246e1767c466a26206a66538200b77c7e069f7681d0f46e041ef4643d488f086da3a6d3d15a4b70
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-indexFilesize
1KB
MD534248609c0150067d4d07d2af268e3f4
SHA1acc8a327fc7a91d3642256e48d74cfdd5ad96231
SHA2569be053c18aaf6eb20f3000526e07e90ecb3764c1f87d967d29a2917060673e1c
SHA512613bb0c91be6a90b7be47174df395da680d71a08e3d9e98f4d2b07509470647678add10c00a9d8a77bbb09ce73f1d06c1fcfd001947ee17675a6f3f6cddae74c
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-indexFilesize
1008B
MD532214dd9c57861a36bd75067d140964a
SHA14464b0d70bd26bd13f1e6f8fd336bcb2e348c591
SHA256dc45a38421d677c2aeaa558cc182cc6a53f5b8c656eadc83d1a2923a4420a5d1
SHA51230fbfc49eef021f045de5428956674da90aeff53c99aec4a06fee2d72991bf00274f9559917d411e8089c879b4bb72648b67afea8b52d4521eb2645b69ada24e
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-indexFilesize
2KB
MD50133fc21adc46e487f8d670bf9bdb06d
SHA13677880cad9fa74bc5b97d89ca0c9fe3eff64fbd
SHA2568139b3cf5fbfc54ad5bcb025008d70431c5939ab920e532943724493d0836f21
SHA5120bb65b42455a2d50e6bc8fddbf78a86cfcaf89422b799ae97caf63ec1189de567117e2854173a769928d261e512f6b46a1f03e475029e97b61ca522120fba98b
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-indexFilesize
912B
MD50b8cc48879c858856c0c53f4a3273cdf
SHA18b205457f52dd78ebf7143b407c2bb2dea2e58a6
SHA25682c0eb8968a5079b804392c1cf3b62493bdae8bd036410ab867d09ae76f878cd
SHA512062cbc07d60bc8083b7ab60d7f4b202fa75fcc863543e7476a575380858dc304f95853ea9191992f5d5bd21c4b9564c3cd49fd0bc2801836b4dab71089737f8f
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-indexFilesize
2KB
MD507c4fc141733bde8a5f9cec2dc40166c
SHA16f23a8db40d9bf6b4d3941eb2f1699927ccc95af
SHA256cff41976469da2913400558389d8d5c453ea5ba44ca2a5f006c9557311527753
SHA5126ad0c513533fbd772e04a99244bb7f5546f14d442142065e97bd79644a785f9dc1608d9041ec3962b95fea5c77b86f72300a9c95c5fcd25a6c6fa23d36687afe
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-indexFilesize
2KB
MD5816ea409b88279befbf4392adff38fca
SHA10bcb9dddd522f4e533520917a6d893817c92162e
SHA256fab5b8a7586e419fa22aaf6678be9d47451df5b33bdc7ec8e6149c1f29942283
SHA512b2ca28ca3ad0a97e2480b60be17ea5339ef3961af0cd35f6ebfbda4ca1c17ce31430968e889299673180e89d9abea2a11d4b534dc847bec059d28a19abb46265
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5894b9.TMPFilesize
48B
MD573e17ba5db700ba0a5d89d5fe66e0ae4
SHA1521b54971b9d75caa5168a6f9990ceeaf36538d2
SHA256d13d3a3bb2a6f2a0ff5bc8e02b2c00b5fc9ccdad4e342ea901bcd0df6e859865
SHA512b3b77991c56748cdfcd1062e76519b682bb135f33ae04a0274b4d1068695bde518a6fec372edf50af6e0700c7502c6f8092e8bfb5ee3c24779065538ef8c7bd6
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.icoFilesize
70KB
MD5e5e3377341056643b0494b6842c0b544
SHA1d53fd8e256ec9d5cef8ef5387872e544a2df9108
SHA256e23040951e464b53b84b11c3466bbd4707a009018819f9ad2a79d1b0b309bc25
SHA51283f09e48d009a5cf83fa9aa8f28187f7f4202c84e2d0d6e5806c468f4a24b2478b73077381d2a21c89aa64884df3c56e8dc94eb4ad2d6a8085ac2feb1e26c2ef
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\FaviconsFilesize
24KB
MD58ae97d55dc54e0ac7dc1caf52004de2f
SHA1c14e3449579350e0052d2dcac46fca59857022a3
SHA25627b1914dfe5525e028ef0496aa5c7926a8297fcbcc72daa1a0337555c7f1f09a
SHA512e9da2b787d4aa60061ead0a108ede5411c94880b05cde0265a013632904edb320b6aebfd4dc36c79bf369f694707013a1387890bbfc2dfc5528541836371cf64
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HistoryFilesize
124KB
MD5128974046c411533c682ad577206a7db
SHA1cb9fce95b00f405d58abd5f38708235e64c2b6ab
SHA256c99a0fb6b3e233b01f242ee06482a6abb61201953934a2769da8d91589f5ba1b
SHA512c04edffab7cb2c232f274793643bc902cba61c825a2e937d18d1f097225e3929ab189c4d120356637f948240420faf7e33ddebc0b5903fb2dc0ed0fb9827f1dd
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Microsoft Edge.lnkFilesize
2KB
MD5717cbb3b012f784024c53f73d4bc375c
SHA18381b7b5b0482fc75a0e418477193d7939a3c777
SHA256f04dd3ad50e09b29b0ec051acbe87c079d0cf7216b6089d045ce5bbc3ec4b840
SHA51243f9193e858a7c98ea6bbfe36f3bea1512d29ecc5001bb0b3b17a4cfd4b28f412e5bc3f09a990f7c06de99a5a3d486488f5725e30bdee7bab892e7e577d639c2
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent StateFilesize
111B
MD5285252a2f6327d41eab203dc2f402c67
SHA1acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA2565dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
SHA51211ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent StateFilesize
3KB
MD591816113737e053c01c202948fb40719
SHA148d898a2dfa2f810d0d99140602f63b08c7a70f3
SHA256831824766a257a4f20e3f661d1152195976144407b1c5a043f130d092b867e40
SHA51284c9c867d7660672795066704765eebea531fd7e324b4febc3f197ef731bbf10c2bc7980dc3eb83deb94af33aee5b63ed38eabdf69689a3a588e1a73f017838c
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent StateFilesize
4KB
MD5d8785d1bcc7f0576a00b2f219a8b7d21
SHA1bc22cf0439e5f89b06b18b178c776eaa6af02db3
SHA25691f76d7f1e7af5a41f7a7914b11637e69ed0c22b9d653a116aca94de8c9d67c4
SHA51242e97484107643d75011f6359d524485854d4146438fdd8541f16a4d9b52a8cc3de101ca65601e3e3a0a561041481561a1a4caa5e28a46dbde3ff036e8e38234
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent StateFilesize
8KB
MD5151bbe650881eacf49308f97b4beeb6c
SHA10cd5a755fefa68a8dd4e9af3145a73ef14b40532
SHA256f08c98d5dd938931415efd28a9e512a0444cc7a75aee98847177b9d246da5543
SHA512a05173f8e49bf0ee4207c4e1b4c42d340c607bdb2e1590379a59b6e5d5d0257175b743738610f8b6723e09d617768d4090a3394e81a525248a7094f9f97199b7
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent StateFilesize
8KB
MD5eb27eb9412139303b79e5df607df2d4f
SHA14210d12eb9743e99f95c596aa4379c9d13a46246
SHA256675d956a2564dce84cf705c6b0b01ab72d580ab18de8b9fdd50030bc7582b2a0
SHA5129e2067b53b3f48907539aba5633f152e13d9a169ba19d3cc7c817281770ab63aedf01f07c5d1bed9862103d03c592d5eed235eb259d5524ed85a240777352174
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent StateFilesize
5KB
MD55cf8bd12dcbdd49364d7b48e3513b34f
SHA1c3a7489e65a8cc90d8d7e64fdc40a69fc66431c3
SHA2565e2143264b0f2f4d3815dbdb06cca2d8769b42461149208b3f4b7d058867f7a3
SHA5123696d650681b3aab4af224cf0d7fcfb121cd8e5a0627ea6f8ec16df92b2077b67c17cf3bbd1f6855350c66ce17f6556e94d7ed3b513dbea6627a4d99afe7bb16
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
4KB
MD5718711aa779a805ef51be44cd4ee2cec
SHA176e4bc8d189bab0a858da62f9bdbb15d2f4b7f38
SHA2563d8acb856b94646be6c6577292580cc4843b01602a98002e60dc010fc72d1da7
SHA512ed9b73889b021d979ad6dd527819eaaddef027072180a273e6b794e7a7bdc83af9d29fda1e40ccdcc8e31e98f21d5161a3fd5755a0ded8d8c81c8bba3a77fcc5
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
5KB
MD519551693870a692f7a0b3661d4e8cecf
SHA17b817650931e154ceea400938984cc6df32cf182
SHA256f67b3455f23b6b3b3d0a0e6411f6925230784df22c52d03e1a05e707295fff50
SHA5120de9046c64e4e4573c5d3229bbd9da339ac10b1dac7e7251c10246e0ff65c93886305c4717decf5910ecf7b59f0b1a0fa5621dc8571bcd18d5254de9d48a065c
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
6KB
MD534ccaad802e725641b1e36578704862a
SHA1af44bb07ecdac277be38eb5f8cd417e26884bafd
SHA25670b6ca3b0a860b34e7476d7b01108a0aa9a64f06c71864796e131efd0ced383f
SHA51265ecc8bd92ac9d1b74aaea9c1eab74fbd760dad45bc327a65c862fb0f7fa6d21b7ba34eb0fa97aeae4415f608f1bac8693e40fad69f93c4200a0fb15a5c479c3
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
7KB
MD5631cee154410d0b699a32aab21c2bd6e
SHA15211d2a818c96c438513bf0c30f52b21a4594e1b
SHA2566ad45e9c72d0cf4bb5cc0735cd1a823b2e3260d0e8a88b28592b3d1e2120cf2a
SHA512e7e5c73b70fba6ee31aa6d3455f321e6cbbaf92fc1117fd754a5bddf4526883a5ec6329002a9eebec88a35fca7b31ee51b881c0e4f7b4adf86b9c062315c5843
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
8KB
MD532196ec1aa839430f43421ba914e454d
SHA18b8fa2a995cdc129d0d7385637161924dcafb834
SHA256f457f577773655a5ae2afa26a74ab7281e13a76db9c97bce9b6c7963848f6239
SHA51239201f6be4aab165e17ed03052061185edcdafe31c4a8188a6cb79c22bd385cb125c66fd6c29420c74034e8d915e9599ed573168bdc2d4abfb41a352c3403017
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
9KB
MD5c9b718c4b4e783ad4ed0e9a83c149d46
SHA102c440c2a2c8de013327fd05b819b63f7771cb77
SHA25636947d456f4c623118d46b22fc165359c29189a1fbf1eae3c3b282ae48c82f13
SHA512ae9494bc2bbb87960f2a59a0b484ac8e1c04cbe207eeb9972730f96051da54477f6b422320b59aded8706ffe76193c183655dc13538a8f305cd734a5049417d9
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
9KB
MD569d42cd609123178ac0baf2367a6a3c0
SHA17964f413ca609c705a7d0e38d4f961e79000b677
SHA256eba37110bdc96d9f21aa778a10643233a4f2f71649d71a6604774279fc87c470
SHA512781fc1ae76ab30ff61c1a51bb90e237f8511e17a88cc2afca0d834432170239912f3b9093ceeec85c1ae8cd2123d5b3442547bf20f22314fdb775ec3b33c8b91
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
9KB
MD5a7e5a311cba1514715cd7b88da4fe921
SHA1f0db0e64e00b09b8b9e5a8921b3651ca78a82a3a
SHA25657b888ec2156c4647211c7dfa32265a7cda62b31d61a2b016480dc83ec25540c
SHA5122bd5ca02e4b3bedde25c9f7dcaf508a718657513a21c9cac109198d61efa04d2bc077d906f64b4266e672c97696a44bc03e8ab7157de6dbde275e87cf9720581
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
9KB
MD52dffd144ecb0fe4d19413043f70e0efa
SHA16be969c6b74e5de029dcb4987218532cbddf4aac
SHA2563318c8931cf3b4de08ad85b2d02a0911e9a32ce7f6fb944213de1d626f9746fe
SHA5120eea820e4794a8332b53d0075e3393e0eaa6bd38e754b23077865649c76131ebe0ac84c39aee9e228b134d5c0e1917fd1ba5ca6be9ac1dc9edf3b14cfd80d6b9
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
9KB
MD5410e49af46d45c2699fc53127c3f682c
SHA13d61e0d8a9f648d10f74e2895b1270ac0d49c839
SHA256b6233a5e7eb53ff536928697479c29871b2d5f75082af1284280fce4d0a62074
SHA512cf04dd05f0598e667673f50a5b3bcee88bd35399a8cbbdec59e681555303a3dc04e99a71b03f1f99215e08832b958640ee26c138156412cef3c5c383c4bc0420
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
6KB
MD5e4f600ccf0043d17629e7854f1f53350
SHA132fe5bc4b092897eb7031c00c0c91c8cabc282ec
SHA256e5271bf4c97508d41784be18e3d61e48b3514096412965a633fb74e367762470
SHA51261a9407d55bfd4c257e8ac115312aa247f3ee4556d45517e0ee70079726921395006be729e12d2c62f1730744440760f516048e48d1413c870d1c29dee85713e
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
6KB
MD59d199a9440322a635b61839a8bc78610
SHA14f97897d5780d88d5ec58a4022ea2a5f3b26c5ab
SHA256fab8a34b94bda1919dfd1056f8915b82be2dc949cdb6f92906740c39b1b1b7ac
SHA51228a7e7261a0b357e8e4b2230e9be7be248b74f1971eadf71f63e290a358309488231fc52eaf22f578f100b3dbfdc81e8192b440d75324f10abbf1e925b51c544
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
8KB
MD5b90baf53969b8cb791570300ac6f99bc
SHA1b82fb59a4fa58d9cd5288dccbd4e7428c784d32c
SHA2564743f71863a841bd5edad2bd12fb5c714c2fd7b18a4aa290bf8cbde1a8ae6673
SHA512c20a9da0dcb0966510d552826922be4198114cd9aa45191f535e3016c7823fecf60d2d24fbf88098f854dfa1d0afb26d3447cb5d3daf864ef4fa0cdf91ff7a4e
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
9KB
MD53fafc1f551a4a66b3e91933bd3140e11
SHA16e0d9043c1f0457e5265b4994e3b28ea92279562
SHA256eede54dfddf18d0475b347bcc19d19b853173291c644270366042449419a142a
SHA5124cd43e03124b2e0548c161c72435f9893049c83681d0954cf80bad66f8054281c13516f32fdd6ba7e3f71bec57249b1e5f7b15e35cf31cec4d46e798445fb6d7
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
9KB
MD53c19a96b201a9c46f9e3b8e31f6f0921
SHA1b79a229e84ed9aea922888a7f27dd1764e417c36
SHA2563fe86d04dbe5bd5702990bcd19adfbcc85d4992efc7fb23e7c8ca85b108d5251
SHA5123e0f077b74f29e6cb0b69b875a7c2f009ca09c06ce3faf4d92ce103ee586d0157726e782e6a95e199f0a13d75684b1a26ccc063aa2224bfa00369047b5f1ad05
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
7KB
MD5799f7fe02c5368e91e6a264b3635fb89
SHA11611167029dd71745340fb6fd95529de24fbfde2
SHA25644a846fb365ab74fec43e9c1e9c2f509f29c163c447f2e0f12b7473e459a2aae
SHA5126f2f401be3bbe1f422ce7c701f103d6d08ea07b46df1e703db764d5b8411f8704e51b3144b8ae21f903077de39a6a6d48ad1ec8b66f6e534458e17a8f09d7dd3
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
8KB
MD556d08fa784bde80782b8f0901afb1be6
SHA1aa1ba67402f9e9de8defb878f21f2aa0f853e5a8
SHA256ef6e29ccbdfdf96171765bfdd44a007b54c39d9f7276d343bdb993ecbb1bd3f3
SHA51273cc1e7a57564ce737d337bd5935f1130dfb61ea6b15999ad26677ccc7419bdfda4e1a2eeed1bd3a7d40c557cd651ca7af5791f31f62cc7a09aae5d2c616a29e
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
8KB
MD556d08fa784bde80782b8f0901afb1be6
SHA1aa1ba67402f9e9de8defb878f21f2aa0f853e5a8
SHA256ef6e29ccbdfdf96171765bfdd44a007b54c39d9f7276d343bdb993ecbb1bd3f3
SHA51273cc1e7a57564ce737d337bd5935f1130dfb61ea6b15999ad26677ccc7419bdfda4e1a2eeed1bd3a7d40c557cd651ca7af5791f31f62cc7a09aae5d2c616a29e
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
8KB
MD55ed81f6939a371615780f4a31af1a9e6
SHA169874b5aecce2bb2b408b852d96e540cc2aad38e
SHA256008a130f617e083edb179736c78785f3a5dbb9d4f76ea4b301e73c9ce28b2423
SHA51259ab902b78c19701b0e1aca3ba39cd1c75202e7c5a7e2a6c9e4a9f04b60cd7cd02f94972b26bd9e2eaae8c8e6879f070298f67009401510d0ebd067239c9bb29
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure PreferencesFilesize
24KB
MD51463bf2a54e759c40d9ad64228bf7bec
SHA12286d0ac3cfa9f9ca6c0df60699af7c49008a41f
SHA2569b4fd2eea856352d8fff054b51ea5d6141a540ca253a2e4dc28839bc92cbf4df
SHA51233e0c223b45acac2622790dda4b59a98344a89094c41ffdb2531d7f1c0db86a0ea4f1885fea7c696816aa4ceab46de6837cc081cd8e63e3419d9fcb8c5a0eb66
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure PreferencesFilesize
24KB
MD5166f524689f2340f93af075a9a6ef88c
SHA1c44b971082ef72b93638930735a39a3b94302ce8
SHA256b80f3ee893ad9a930823b3e8d370c076e112c4e8b68f784dc28542ff0fa9f9ec
SHA512c1f14e787a1f69dc596586d87df2e2359a105d74d717d04bef03d58e32eb1c95068f3ce114c54b2a767c1c36c4c4f2681359199eaaeb38437b87c00394ca6868
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\3a8fb06e-7115-4815-b0c8-27f5ed056a83\indexFilesize
24B
MD554cb446f628b2ea4a5bce5769910512e
SHA1c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA256fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
SHA5128f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\3ab927a5-bf97-4723-b187-0ccb9cbe716a\index-dir\the-real-indexFilesize
624B
MD5dabb73c5ba4f6ce483b704ae17aa9f78
SHA184700f6f7b6d52296979e8d30d1f1d63991f6406
SHA25699dc05f4430a0f9cb99ea705604c801cb8151e3f01a8465bd95670aedce17400
SHA5127b6963650405d66a2179351c9498fe1b62f423ede80697620beeebe3690806984626152fca21e1dc3c79c7911337fa79ccba413995d15ae1c9638b8f9c32c9ca
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\3ab927a5-bf97-4723-b187-0ccb9cbe716a\index-dir\the-real-index~RFe5a18f8.TMPFilesize
48B
MD5775f030068348a5b541c8b95bc45a049
SHA136475cb3b3258913f6e4cc0ce27e29464c3718a3
SHA256f664fe7eeea46d4372e8f9c5c63f42c30f73f724389b501a26308858c5b925be
SHA51299f066be058f1d96873c4b75055011f90bf11441439d74aafde1676060f713065ddc476b9f8b92e06ea339ff12532ddedb2498e535999d9ac8875957762092ec
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txtFilesize
90B
MD59596b5897e18951123d98982d055d2e7
SHA16cee9ed46eafc452fa07748820cd7768486fa733
SHA256301af408d61aeedd0f92859e2b495468155ca5028cbbf4b74e50a72f7d1eee30
SHA512ae99a84d288ef047e7cfc44003d006ba7cac2f6e3f547cc0e233db7c041bb79ff5001980f5f50ad8e6cf3fd39cc7e16b40106f3c4d7ed7a8823a22b180e8f0f2
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txtFilesize
26B
MD52892eee3e20e19a9ba77be6913508a54
SHA17c4ef82faa28393c739c517d706ac6919a8ffc49
SHA2564f110831bb434c728a6895190323d159df6d531be8c4bb7109864eeb7c989ff2
SHA512b13a336db33299ab3405e13811e3ed9e5a18542e5d835f2b7130a6ff4c22f74272002fc43e7d9f94ac3aa6a4d53518f87f25d90c29e0d286b6470667ea9336ae
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txtFilesize
90B
MD54dfae2b4291c3f9d850c10cc0e439ca2
SHA11dceed89e6d09d74ee26e2edadaf588ef9184fef
SHA256ea01ce614043ba951c913960dce98f06970b5c3f57db1014b8de01be018a2440
SHA512dc4ba2e0a4dc9942de9d11a24c441b60c446530121b177fb045e19b5dba11bdd3ba83fd5c020219c53a9f40de0cbd4d5b78cb9c7f208549207d57fe3d2ead925
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txtFilesize
90B
MD555fb85464f9e54d487c55bedd50a1c2d
SHA1fc61b0ae54c4cb3747d9297d21b8e8f8c730d959
SHA256858659b463e298a7e12a6e7d47f29a7b0a4271cb63d1143e8a5784bc18e0df61
SHA512194f05b096df7ddd2ca543b21975c20c68221df8587a4610e8284ab1baadb2a165927f077d8006c5bc2a96e49a2a95335b6dc7f042b5400e116d8015fad92794
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txtFilesize
90B
MD571812b03f1d0532a89afd50c1761e318
SHA1db7417c937f2b2dc04653ced3cc802421df6ae14
SHA256ff6d00a464bb59bb272e98371fa4a51dfb368da2ad7fec1418fab88e08fe93ac
SHA5126a168804515eaa4da3e7c5228ff138e5a7b1b8eb66498ff5d0f9e0ef25124e96baefbc44528992985d590e8dc5caba9c80469557857c32b681898cb7212b4e56
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txtFilesize
159B
MD5833ed7c33292c55e6644856ca1d7dd0b
SHA19cc8f75bd84ff9362733a893fec49523719a6990
SHA256108f9ed6a341e41ee28494966c7d94fbd4633a0fd1b612c5570f10d3a7c4100c
SHA51295e6e47e91a5ce624d6eb27de5beec7f2830aae24cc11654288f8f9f563231bc5dc61d3a6b7f816449166f9b610fb125c62b702a10fbb151a2301c4c3062fde4
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txtFilesize
95B
MD50ceb79224d3eb4a7236061383456c46b
SHA150e38b08e4d660638041798daa944f9ad9b8bcb8
SHA256fd4b871f5c4a928cac4bdf4623892bd95910a6057c345fb14706048ac2c1f99e
SHA512eeef87960757b3b07a760a9fd7b5d93a4b20d955992359c7022bd192a4ac948e15d064f0abdcd3b36cbebf021257e8847b5128049b7821c6941e1871399602a2
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txtFilesize
159B
MD5d60d531866f7953385ee824f5c9410c7
SHA1381b90c319aeb9697444cf53a0bee32df6055e6a
SHA2569c3fe596677faac025f69cfcdf4289437732d98c5aada62895fcdf7cd718f7f8
SHA5120167ab54a405d46f74dcf9303e74a25fcfe226aca2c9c957483f905a3ecd1c2aaac148ae2428fdc824f72266c45a95f7fe40319d784cdaf1b27d60fc356d71e5
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txtFilesize
159B
MD57c1dce670788864105b4e3c5a326769c
SHA16d6860de89f2a10c94688e5ab19891923166edc5
SHA256b3de2b973d32376bcddba0ce17d3684dd9139ed601c19e75c88118a4ea1efdff
SHA5128a55bcc55b841d9fd1d968f043d70b55fe1d46392f4d5bb6cc8e559dcd2802d34f8cd928de9992d9d0f6d4ba7523aa859100f6c347f4e602a6e9b0289610e61a
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txtFilesize
159B
MD59de9287adc4de66d6320782a0319a419
SHA10b5d81e7cbaee1ce8cab343c84a7defdd11c9542
SHA256fe79940adf04a24f0c44095cf2dfa94da4fd1468615972953fb89ad3c8672efe
SHA51273e3029d3f66c5e3c0c3b2382518c275c8b04c20a879180c3805d3e249f077fe860d3194d73421d92b886e6931771e01a2c04164647110f7c3bc791035df7b5f
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txtFilesize
159B
MD5cbea621fbfaa12f8d88fe6d9edf2c02a
SHA1a80d0e49ec93cf94a9646c7cca2928c81bec974a
SHA25635d566f8cd88c976e09847e0efb773995a36a3d6ad41a59858a8c0444b2c4eab
SHA5123ad49eeef31fbd42d31375645741608d31110910940057ba4aa735200014dd38132c988b7e6879053123694dea39cf953f9b5b3135458b1b5f2078b600dd2fd8
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txtFilesize
99B
MD5aa035cc8ec2067c46f04f1669f78c494
SHA1e235cfb999a91d9fd7d596e6de19b3f9a0f20ed9
SHA2569a387eed800df7b8992a280416cefb07de25c3d711d9d377d6a5f574f141ff27
SHA512a6787d65d0da9baa1c451ab48fcbbf4c54df6da5d06d25fc05b32b06ad5a31c5cc60fd495b1994410431657987403248069e6499f441847734804d39e50d0fd7
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt.tmpFilesize
90B
MD5500db70392d6f776f42b9c43261469bc
SHA10a7ad641903014113ce13792bc8177914a0a5ba3
SHA2568e22a108d9385e2d5201984efaa1998087becdffd1d0b1613e83dba666e0bcbe
SHA51236f03d3535e81e144292ca3a783e3a24d6710e89ea20476516d589dcb65d1ef0b97b627c1be68b1a3c0ed2bc909bd5a192919e51bc12fe7e0be453fc534bd008
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-indexFilesize
96B
MD56ee5f5250d45c0e0c8f0a30fd9238c5d
SHA1b1af59a792f5889ec8fcf4fb1e94fbbe8bbfe2f9
SHA256a38ffb93650396f94655f69484fb197e1d1c1f563676475cc09eeedff42a9f5d
SHA5129665317b3f4c29f3150e8a50ea1dc5697165fab6c0cfbdc83fcad10d59dc53111cd711c7c7a7a137bc59e586fb1b374dc0fe7c97db0d00af67133cc94977d765
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5a0725.TMPFilesize
48B
MD51df4b50ab8971b2ad2423cb70a9c428c
SHA1e8fde49dfe581868e8da3dc69aec96ffedcbaf4c
SHA256f1002973c34e2cd43057fb3ad4226220c8193319c1bde30ade1425c50840f085
SHA5128ab2db18326878479df2806d592cc72a7c7b3b7fc1ba3895288cb793758bd566b2b39d16c4f5437e3676b485352a2c68c4d1edc9772c4d520abc35a4ab9717df
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sessions\Tabs_13325334404280004Filesize
20KB
MD500119866f742fd54fff2fd1343e17c27
SHA1bc27a0befa167adb06387d86367849ee494cbd0c
SHA256c862f9de55a8c64d7b2f1113197e84a2f2e55a9e447be83367c4d57519ce9af2
SHA512d9de450f120a345cf83e7bc742457ac11f9a1556b144cea3c8b275a1ea2f6cb2633f5b1afce9a3c52cee72561d1ba125b5523df4062e8fdb2ce3572ba2611283
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\000003.logFilesize
187B
MD5cbc9e636e7cb701ce757bdc8d1c6aa96
SHA1688557df22fe1114dc65dc285dd7f24b6f773bdc
SHA256bea6d891ddd2647611d614dafacb9718d191a8d597265736dbe9d2984e87694b
SHA5124733b04a8dfa33083226af1e9e2427d8563fb3d5e5b3f14fd01cc28780d8320cd361a9efe5cbf52e90007899d09b607c60b297a402d2d1e572c9b67d01bf548e
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOGFilesize
341B
MD5e8f8d2760490542d6e422ed85c5d199e
SHA145b2492a5e222dd4d0ffbb3ac42d09d99c7250a3
SHA256120ad7630ea3301047a9afdcda19a8563a42b62a997bfb5d1f16c6fb1bf56c72
SHA512b68e7ed01d269c4b855d439515ee6dde9c696cc164aecea320c3cc11f7af724fc8b88cd7c16164ae1a1a28795e312de66005b1e25ed5ea65d15a1bc271a3ffc4
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOGFilesize
326B
MD5bc03894c56fadc25809cf7b5c6a9836c
SHA1c6289af59fb3b255981f0566006365674ff63f40
SHA256138d19cd4a2aa1b80b2bc2905e02705455a9f3db8adeaf4b8b06de098ce19e01
SHA512a84c04475715e16c36a8d22f1fc7fbaa88a3139bfe6ac550c125de617d0f839d661261dfbac432284d1b1d57629306f7c7a4f2fdfade018764debe27e6d1eae0
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurityFilesize
372B
MD551f1ea09f63d669afa05d07186a4e4cc
SHA1eacffbe3c3ba0a8bf745d3ef6b189798f71657f0
SHA2562c1b781cdd6e2efedc0253b7a053043a3cb09c3e11181287b4fb2580f8ad74e2
SHA5123c69255af6b5d937d4f08f246a1e765a66e4e6450338064fb1c79ac1b45a987ee3a2c6cbc16cdc6d3ffb24d2bac0d9bb598cb6eebb39f6d65c3f146071f668e4
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurityFilesize
705B
MD58c23badc9e7e7f5c056959c2d72fa97a
SHA1aea0ae66e0a7c74e33940126c1263c0ee1548897
SHA256f1067ce0786ee99fe4b92ed8fb58a4b3d0f92c00174f83477d1244c1128e62a2
SHA5121910afc011a41eab0a7906267008b0b68e2dd1548442c907f9ffc613413db8130a583a185b0232ad133ae3bb40264acd276ca3162523cbfe0aae329988246fc5
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurityFilesize
372B
MD554d293617d4928d0d4a320b78283eecf
SHA1b6c7a1e9060950f82616cf846592363220bd078c
SHA256a6d0e94cdda3f3ddf85ebd780dbe7d5381651561bb3982474cfe3dd8dcb858a9
SHA512e3a224ac2170e254ddfcb0d4f791ee833857fe6347705f62d26328c8e39c86573c64085448645abbc423dad97a6313a25a1ed5631ad5fabb18d15d7ab9b9312b
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurityFilesize
872B
MD5a2123eecee724f576bf85381e56cc251
SHA12a7c57992255c3d1c07ecf977e50dd820998f66b
SHA256fdef7de2ce869b0ecc4fad34adf35afb96688bf2fb7b8a0cd694be5a3ad0de9c
SHA512764ba9c0d8136b85cf01b83870f7b365cd127114444677aee7da9dc395f515136b4b98a2d03b994f61fbfc296c95eed2e6047a9a4223b43a5446eb057db12ead
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurityFilesize
872B
MD5ffe8323a217506084ba5a459e50e7a05
SHA1ccecabcb58e65c9ea1d08d5637f585585200562a
SHA2567c4e085f92174edb7729f609b5baf3ef23c40ca5133d4bdca50f85320aa0ce99
SHA512f2b342ecf1e81470fa51be4952b0e844c710cd5c6a8343a21a66e8954c2413af0f7573862eae02851d590474ff923ed14612bfa9ad5d1665b9ff3d6e2a528f8d
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurityFilesize
872B
MD5c47f3985b3749a44f42c7c6d383e3186
SHA1558494dd0eac16846aaf23ab0bfd56978f8440d0
SHA256d038e49c3f6180f304e829062b9088132e30ad321000c59fa22abe2a581173d3
SHA51282cc3906c6074344df933aa77bfd53342dccbda47f7b9429994f78ab8440d667295de3b52e30a5c089c340329352555f84ff379c3a3c8f4421f058d580c78db0
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurityFilesize
1KB
MD555adf9957dbaee9d288581eeeb1bc67a
SHA12bb90c2049a84998d3a905a06f7d0528d02e0077
SHA2567f107e85506a0de9ed4b74057721663aeefd1da370b0ffbfe7e1c83329845ec3
SHA5123e12dc41871419e2f25809d0379a64413db5bc272d1869a8a95f3bdb06d72c32cafb356ef561b8c9b72f9e0267c9963919043f66eddd342f9de9e3d252b30fb6
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurityFilesize
1KB
MD5af16aeacd15478bab243d04278819985
SHA1717efdfa68f9a6a0ff9f4a2fb912cfa1768b9529
SHA256270107678dd284c74bc162735827667f2cd61445ccd5630bb351c39f8cfd44a3
SHA5122f196bafc3562c6570cf107b0626ce7536ca42991ec56be319ff4c896730d47e244e0914b43dace019b9fbb08f01fc08237f1ce9a6cd968f2c90c8322ca13c87
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurityFilesize
1KB
MD55bab629139d95f498e0557a0e787845f
SHA11259fbf0ffc6087e5135cac15a7f9460aaa8f964
SHA256748c68e6e3eb2538ccc024150d94c495f5365c01f3b74cf2ff5b7007de5dc71d
SHA512ce7a33fb52c3bdd187daab31a7756026c98781661a54744e99be3c6abe39bdc2dc90675cf4239bf95d1c893bb9e9099f6a4f91f36073baae6c5d4d6bb8980cfd
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurityFilesize
872B
MD534ad6dd9a8288786687dd28c27aba9ba
SHA10993f8fbb1835cf04e04a8c204b716066f7e24bf
SHA256e6dd0949e144356651bd34191ba0a044b46f76c4d8e5ea5ac20c1be4859a5a42
SHA512fbed5f73243ad03a060a603ec2bed9e6f1e3e22cfbfc8005a711c46e2688becd88882486b25d0f9d7dbdff4d4deacb57524419cf433a06684d9b997190b7e77a
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurityFilesize
872B
MD519cd3916489cb99e38483c247fdf8cc6
SHA142f8720e81c4d0c3d6bca6b056dbd89d68f1f70d
SHA2567e60070846cd4b846d5d40fc7d10a36321297c6c04fba02d1773d4d29cc27d07
SHA512a71246041ffb9b80c4a116e2edb38c4f89d091542ee13ad0c2f94f528e8048cb9717005b20ee715ff213677e2a7b8df2b003e975c3fca0d428ce2b0ede306788
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurityFilesize
1KB
MD51da157af45c2a1773f77faf4e5a668f6
SHA1b94dbafa96a58efd91d0f311dc9a1aadfdf30c3e
SHA256a585bf0cb04272740bf16d9b4e9f914a27fcda4da170ce4fa219fa08e95b0ae7
SHA512b25f35ab2b4c05b1b4f247559d8bd6a88d885ad4ffd56865a52c068fddb1eee72352b0cb10e7c20afa92e3b9d543a3219b43e0e91594a256b1f034613096052f
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurityFilesize
1KB
MD5cda63f18d73c1e5cefa96765dcf41beb
SHA1d0c171cbbf977ad01d29f5680dce02dd0dd335c1
SHA256fd0ec1e6fd784780a1648df3b53f14dc268319376a1b46ddd7b72d13f8f757d7
SHA512daf961c54884e9ee355eab4f932c6d32d1987c3031d28ea7da7d6d79063d4517e68570e6c79f9f456714a176297e46609dec98452ca2887cefc34fd2d3a6c115
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurityFilesize
1KB
MD5af48786005d08a2261ce6f82b173f4a5
SHA1e7987305a85980bbc617e28a61d7f8f69067c4c9
SHA256bac0ad91947492277b1841b3d274a7ba617b50df7bafda2102f350f41dbd2fb7
SHA512acd0b7ff1d2ed5914acb26f6fc8d89fbda4b4200df7a2af9f4567193426a006277434f5315fc1790aa4855b3d76cb3b607f68f2eea2ec1a421b84d81b411399a
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe585f32.TMPFilesize
372B
MD5d3d50ed79c662ab92283c5f375e7016c
SHA17853d89fad71a8f07f1072579a9fb4e6c81efc8e
SHA256b9e9941f18715f7b216c4420eddb1386c416d0c4c78f602bfcf3ad08cf902b49
SHA5129313081cf061b790227170291154ffe25914a7f73db2c072571d87ad20d141bda16c25c6b68198e542eb98ae609ff186444c648929fd223144fa97b9245ee8ee
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Visited LinksFilesize
128KB
MD5029c46619750766658d3b6bf1c29926a
SHA1e63fafe5281ba6f47a6ca3869e1aa22ed1baf513
SHA256a71678e4d560093deb6403dcb2a701b0b83568bf7b733197cce586bd663ab2c7
SHA512084000a9f0b003dff4506f5353827d93cac837a2d7a287ad42fcc46cc2f982eafb6421dd7ac348ea9f6e41aca841a1f7add605cad86b608b4d34d7f35a5a91f7
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web DataFilesize
116KB
MD5f70aa3fa04f0536280f872ad17973c3d
SHA150a7b889329a92de1b272d0ecf5fce87395d3123
SHA2568d782aa65de6db3538a14da82216e96d5e0a3c60496726e3541a8165bccc65f8
SHA51230675c5c610d9aa32a4c4a4d9c3af7570823cd197f8d2a709222c78e2cd15304bbed80e233e3674ec2f6e33d1961c67fd6a46dc8ba8b1a301cd0722932c03c84
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\b469414f-38fc-4799-9af6-828a06c43fa7.tmpFilesize
5KB
MD581eb31222adf31cd413786416fc3ce44
SHA12b2e908a19ee8c6c06bf63d9d26970cacac90a9b
SHA25631cd49d183ed8ff4fae0566436594f8bd226a997ace5c8b9ce98c6995064e7e4
SHA5120d5678870ecb7aaa562fbd4edad90ffe82d1b770589c959d8857d3c991cd8a06a9fbf98fdef6073bec588694e45f633f1e9fe1059dc9c891e78f6c4802d612c0
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENTFilesize
16B
MD5206702161f94c5cd39fadd03f4014d98
SHA1bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA2561005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA5120af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENTFilesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\CURRENTFilesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\MANIFEST-000001Filesize
41B
MD55af87dfd673ba2115e2fcf5cfdb727ab
SHA1d5b5bbf396dc291274584ef71f444f420b6056f1
SHA256f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
SHA512de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last VersionFilesize
11B
MD5838a7b32aefb618130392bc7d006aa2e
SHA15159e0f18c9e68f0e75e2239875aa994847b8290
SHA256ac3dd2221d90b09b795f1f72e72e4860342a4508fe336c4b822476eb25a55eaa
SHA5129e350f0565cc726f66146838f9cebaaa38dd01892ffab9a45fe4f72e5be5459c0442e99107293a7c6f2412c71f668242c5e5a502124bc57cbf3b6ad8940cb3e9
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
9KB
MD5fed306c58112b75d0b31748a4bea8723
SHA1beb53d1b2236bc84703951dfd6d4d8802d9e5703
SHA2569562a6deaf599d08f1590d871508569dab8d196505d8cc733be3581a6e1ef9b5
SHA512dd5147d6a1dbdb76ba14e49a99281a78686c73916e078bd86313f2399bf9a21d8a8a18d2e2d0b990f808e17f9edf4558a15eaee293674c7e2db8f14ed44d3365
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
12KB
MD5a1d465744ab239e3957ba8ac81241cdb
SHA15f5485a0eb00333ae9bf39bc739c78a1718796a7
SHA256a71cf8d6243fb097f999b7cef389119edbf287ca0a77caf7ed46c70428dd49a0
SHA512f5d89a6558c07b454015ebaade43335084ba64011bebf08b4c1ad0a954ba182045740ae02dace55796ed717e7a3fc073b851641201a00f8f7dad738083a9f5cd
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
13KB
MD5bd2a9b1fb1a37bfdb96dbb0b2e77f205
SHA1ffa39714a75383120e3eac6a0cf8e79f864a71c9
SHA2568eb2c61a8871766c086f778b55ab3ac45981d7062ab3613c6ee2e5b5ba0a81c3
SHA512ba1abd12ee77dc175c749f930a67b1aee078667708049a5ca55109ac3ac4b7d47b7da472d1d6e55d659733f048abeed274b4428ee503779ba5fc93e2af37b414
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
13KB
MD59e949d6bbadab5bee29d70bfee8c4183
SHA17e46cc3eedbecab7a745f751666f5a3947e1576d
SHA256bfeabcb538a5620f356da4e0395f414e3d6ad9196212e76e0e046ed4236cb290
SHA5127d252111135fed5c1caae748d8410e0d7168332c008d26f747c426414e21291401ebcf10b92351455323b55475e377668393aa2b703e3e275ebce1d4bfb7d0ef
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
13KB
MD52e33e969ed7936fa660428ddda06aa6c
SHA1140003b240de3c9e62d8b90013ff49b398fb9a5c
SHA256d30958b16fcbacfaf4f91bd110512ed82eb009e428fbf5ce4bd1a15c35d36ba0
SHA51263a1587844f6abcc315382b760a024dcc06fcf9aa74de9f109ac6fb0d0bd3306e641f1312f07a7be6191e6fd87bdd0a49d9e9bbef561e8d9fb6b15420df89099
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
13KB
MD5a3de6c16782a0535773343d615577b84
SHA1f37aa54d6d59b9a26dbd790f5017e2f0c7d6156a
SHA256b9cf26d420221b1a8754091eb6a5f24aa76f2a44af823fa5ea01665eac04b436
SHA512e3731880e6df608644a5da727e9eaae6dd99115b1e5d01c986831f222c36b20982db98d61e603f43e4bbc2082e92c8b50249b7ca7fe2f38a5aae35fd2f04daf4
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
13KB
MD592bc7cd7da566becf21f2f3e104414c5
SHA1193697ad15f0f3816f792cb34ca51e862ee58962
SHA2569c3389bf26534e39aa93cbf85fd86c8a360eda70538450f211905176432af8c5
SHA5128575298249a739288ad5cc3dbb289937d3e21782871ac90e383e9a86362081d0083ad12e15da321c5502c3c7ac58cfb47aaa2d4e1bd05542b926bbb4f75c6cd2
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
12KB
MD5564eec36e85fdf1cc13a9a31ad31a002
SHA1b104607dac6370d50c87521384346c3d2bd9e70c
SHA25682b4a31331f29ecb7d839a2fdad700b3071db4208b283315ff6201bee0f079c3
SHA512faf205b0e618f51b8130ac77a6097f17b8f6fd5b0eab5fcdfdd99b121f0c3d7e8e5667e3dd813af08380ccae04364fbf8d410dce13753fc1604b7aed711a662d
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
13KB
MD5cc27c4404f75693a77768d9966f12609
SHA1106df7284fc683cadcd7b9ef3e9ef972c0a5e758
SHA256db1ad458699b7e9ad967c1dc1a25c834e51be641ce4752cbd6a12f88097ccf30
SHA512092e659842f3bedbc3f8ea9a307668d1c2dff5516622b56b51352f7c0317f6f5b889488b925497fd7cb27594919094dce610d49e3ae7c2ea03ca0abaa75172cf
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
13KB
MD5e636a981730fa623a4d678e704a1186e
SHA19c1d15434b7710def1d8bf50d2673a3320f20a5d
SHA256eab827ebc72dc86cb3d68fe896933da650848fa9919a4c796430d16b350b9a14
SHA512fde4e0910ea98f694f119a7eb1f8af460b6ebb039c8d6bd3c77ca233fd98f36bc0e0ef3f5bed05e9804dedc2e17b0cf9f94da24457d887a88c246ec54f968cd7
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
13KB
MD5c4a09dc3e1a6262490b5c1b2fe03a4c2
SHA1048e41ef2bfa865f76b6fe8c659c8bbcc27eb6d5
SHA25655f63ae79956449f66814c464f000a8835f52070103f334cdb9fee42d184237f
SHA512ca95f24e712a99b120a608647b08b9298d66f0039fb0ffcf7b30ec8f13b5d17ff42983e03b36cb27da5975b8eb833c84b023842938b87ad1cbd211ae14777614
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
13KB
MD53e98e81c9d25879ccd273d08e12c5245
SHA13bd965512c345b9559bd5ed9e6cbede426111bdf
SHA2566e10ddb2af63f558c28381f67cd61d432681deb3f56998412e93dbed9209e59d
SHA5124da5da5160af75f4b134234123213df0755f68dcdfc1b3545181e9c973388bba32ed5fd02860e60c82d8d3329eba6d5e2a2da12aab8b1f9ead5c11a490c5bf5d
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
13KB
MD5e636a981730fa623a4d678e704a1186e
SHA19c1d15434b7710def1d8bf50d2673a3320f20a5d
SHA256eab827ebc72dc86cb3d68fe896933da650848fa9919a4c796430d16b350b9a14
SHA512fde4e0910ea98f694f119a7eb1f8af460b6ebb039c8d6bd3c77ca233fd98f36bc0e0ef3f5bed05e9804dedc2e17b0cf9f94da24457d887a88c246ec54f968cd7
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\GPUCache\data_1Filesize
264KB
MD59e05dfdcb270c6cf5d54888582f51480
SHA1815b8882df203a41d51c8d562fee916d2edacbd6
SHA2566cf4c2878ce248145d6ca698964cdc0571e596d90e5b9f5e102a1d98570409f5
SHA51281a8a8a2572455d21c7bedd4ee52e63f4b9078984c6802a49b774db29ec991d7240b531427990abd742c8f1579f8b846948c57c99c78b88631952e89b14dc951
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\GPUCache\data_1Filesize
264KB
MD59e05dfdcb270c6cf5d54888582f51480
SHA1815b8882df203a41d51c8d562fee916d2edacbd6
SHA2566cf4c2878ce248145d6ca698964cdc0571e596d90e5b9f5e102a1d98570409f5
SHA51281a8a8a2572455d21c7bedd4ee52e63f4b9078984c6802a49b774db29ec991d7240b531427990abd742c8f1579f8b846948c57c99c78b88631952e89b14dc951
-
C:\Users\Admin\AppData\Local\Temp\MEMZ 3.0\xFilesize
4KB
MD5c6e68ff1dc039af122429c3c5418630f
SHA1771938ab02aaf6714782ea1c70420794848b1d9c
SHA256b18e0bb23b9b78ca561b9499853ec5be84f67fcb7db5c7e207c6da1b89c17dbb
SHA512837b8b31d381030b79a1b85449238b8770999dde21dd705aec81a0205cfc40cb2f65fb7877de479bae9ca96c1233a62078332c93db764389bd6f26985b61c9b7
-
C:\Users\Admin\AppData\Local\Temp\MEMZ 3.0\xFilesize
10KB
MD5fc59b7d2eb1edbb9c8cb9eb08115a98e
SHA190a6479ce14f8548df54c434c0a524e25efd9d17
SHA256a05b9be9dd87492f265094146e18d628744c6b09c0e7efaabf228a9f1091a279
SHA5123392cfc0dbddb37932e76da5a49f4e010a49aaa863c882b85cccab676cd458cfc8f880d8a0e0dc7581175f447e6b0a002da1591ecd14756650bb74996eacd2b1
-
C:\Users\Admin\AppData\Local\Temp\MEMZ 3.0\x.jsFilesize
448B
MD58eec8704d2a7bc80b95b7460c06f4854
SHA11b34585c1fa7ec0bd0505478ac9dbb8b8d19f326
SHA256aa01b8864b43e92077a106ed3d4656a511f3ba1910fba40c78a32ee6a621d596
SHA512e274b92810e9a30627a65f87448d784967a2fcfbf49858cbe6ccb841f09e0f53fde253ecc1ea0c7de491d8cc56a6cf8c79d1b7c657e72928cfb0479d11035210
-
C:\Users\Admin\AppData\Local\Temp\MEMZ 3.0\z.zipFilesize
7KB
MD5cf0c19ef6909e5c1f10c8460ba9299d8
SHA1875b575c124acfc1a4a21c1e05acb9690e50b880
SHA256abb834ebd4b7d7f8ddf545976818f41b3cb51d2b895038a56457616d3a2c6776
SHA512d930a022a373c283f35d103e277487c2034a0b0814913b8f6ec695b45e20528667aa830eeab58e4483d523bd6a755a16a5379095cb137db6c91909a545a19a2f
-
C:\Users\Admin\AppData\Local\Temp\MEMZ 3.0\z.zipFilesize
7KB
MD5cf0c19ef6909e5c1f10c8460ba9299d8
SHA1875b575c124acfc1a4a21c1e05acb9690e50b880
SHA256abb834ebd4b7d7f8ddf545976818f41b3cb51d2b895038a56457616d3a2c6776
SHA512d930a022a373c283f35d103e277487c2034a0b0814913b8f6ec695b45e20528667aa830eeab58e4483d523bd6a755a16a5379095cb137db6c91909a545a19a2f
-
C:\Users\Admin\AppData\Roaming\MEMZ.exeFilesize
12KB
MD5a7bcf7ea8e9f3f36ebfb85b823e39d91
SHA1761168201520c199dba68add3a607922d8d4a86e
SHA2563ff64f10603f0330fa2386ff99471ca789391ace969bd0ec1c1b8ce1b4a6db42
SHA51289923b669d31e590189fd06619bf27e47c5a47e82be6ae71fdb1b9b3b30b06fb7ca8ffed6d5c41ac410a367f2eb07589291e95a2644877d6bffd52775a5b1523
-
C:\Users\Admin\AppData\Roaming\MEMZ.exeFilesize
12KB
MD5a7bcf7ea8e9f3f36ebfb85b823e39d91
SHA1761168201520c199dba68add3a607922d8d4a86e
SHA2563ff64f10603f0330fa2386ff99471ca789391ace969bd0ec1c1b8ce1b4a6db42
SHA51289923b669d31e590189fd06619bf27e47c5a47e82be6ae71fdb1b9b3b30b06fb7ca8ffed6d5c41ac410a367f2eb07589291e95a2644877d6bffd52775a5b1523
-
C:\Users\Admin\AppData\Roaming\MEMZ.exeFilesize
12KB
MD5a7bcf7ea8e9f3f36ebfb85b823e39d91
SHA1761168201520c199dba68add3a607922d8d4a86e
SHA2563ff64f10603f0330fa2386ff99471ca789391ace969bd0ec1c1b8ce1b4a6db42
SHA51289923b669d31e590189fd06619bf27e47c5a47e82be6ae71fdb1b9b3b30b06fb7ca8ffed6d5c41ac410a367f2eb07589291e95a2644877d6bffd52775a5b1523
-
C:\Users\Admin\AppData\Roaming\MEMZ.exeFilesize
12KB
MD5a7bcf7ea8e9f3f36ebfb85b823e39d91
SHA1761168201520c199dba68add3a607922d8d4a86e
SHA2563ff64f10603f0330fa2386ff99471ca789391ace969bd0ec1c1b8ce1b4a6db42
SHA51289923b669d31e590189fd06619bf27e47c5a47e82be6ae71fdb1b9b3b30b06fb7ca8ffed6d5c41ac410a367f2eb07589291e95a2644877d6bffd52775a5b1523
-
C:\Users\Admin\AppData\Roaming\MEMZ.exeFilesize
12KB
MD5a7bcf7ea8e9f3f36ebfb85b823e39d91
SHA1761168201520c199dba68add3a607922d8d4a86e
SHA2563ff64f10603f0330fa2386ff99471ca789391ace969bd0ec1c1b8ce1b4a6db42
SHA51289923b669d31e590189fd06619bf27e47c5a47e82be6ae71fdb1b9b3b30b06fb7ca8ffed6d5c41ac410a367f2eb07589291e95a2644877d6bffd52775a5b1523
-
C:\Users\Admin\AppData\Roaming\MEMZ.exeFilesize
12KB
MD5a7bcf7ea8e9f3f36ebfb85b823e39d91
SHA1761168201520c199dba68add3a607922d8d4a86e
SHA2563ff64f10603f0330fa2386ff99471ca789391ace969bd0ec1c1b8ce1b4a6db42
SHA51289923b669d31e590189fd06619bf27e47c5a47e82be6ae71fdb1b9b3b30b06fb7ca8ffed6d5c41ac410a367f2eb07589291e95a2644877d6bffd52775a5b1523
-
C:\Users\Admin\AppData\Roaming\MEMZ.exeFilesize
12KB
MD5a7bcf7ea8e9f3f36ebfb85b823e39d91
SHA1761168201520c199dba68add3a607922d8d4a86e
SHA2563ff64f10603f0330fa2386ff99471ca789391ace969bd0ec1c1b8ce1b4a6db42
SHA51289923b669d31e590189fd06619bf27e47c5a47e82be6ae71fdb1b9b3b30b06fb7ca8ffed6d5c41ac410a367f2eb07589291e95a2644877d6bffd52775a5b1523
-
C:\Users\Admin\AppData\Roaming\MEMZ.exeFilesize
12KB
MD5a7bcf7ea8e9f3f36ebfb85b823e39d91
SHA1761168201520c199dba68add3a607922d8d4a86e
SHA2563ff64f10603f0330fa2386ff99471ca789391ace969bd0ec1c1b8ce1b4a6db42
SHA51289923b669d31e590189fd06619bf27e47c5a47e82be6ae71fdb1b9b3b30b06fb7ca8ffed6d5c41ac410a367f2eb07589291e95a2644877d6bffd52775a5b1523
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-msFilesize
3KB
MD59f4cb494d232b245cc4bc9838da73b7c
SHA1c8f8edcf538e286b33987e7000606d49260222d6
SHA256e3a8cc521c4347f29b60c126c3f360af44f11bb7ff8294540f2d15abe44903cd
SHA512e60c6f9ae7e0b82ca3f73da8c9784ed36f6dd72dd8f278afb07e7098ecee8ba0491270a8646a17657406c2722eb70cce5443775b5e0965a374c7a8978e3c0220
-
C:\note.txtFilesize
218B
MD5afa6955439b8d516721231029fb9ca1b
SHA1087a043cc123c0c0df2ffadcf8e71e3ac86bbae9
SHA2568e9f20f6864c66576536c0b866c6ffdcf11397db67fe120e972e244c3c022270
SHA5125da21a31fbc4e8250dffed30f66b896bdf007ac91948140334fe36a3f010e1bac3e70a07e9f3eb9da8633189091fd5cadcabbaacd3e01da0fe7ae28a11b3dddf
-
\??\pipe\LOCAL\crashpad_4688_SXTGWSAWSJKDVFGDMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
\??\pipe\LOCAL\crashpad_5604_RWTQUKEZGGQZXYOGMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
memory/1792-2391-0x0000000005D80000-0x0000000005D81000-memory.dmpFilesize
4KB
-
memory/1792-2400-0x0000000005D80000-0x0000000005D81000-memory.dmpFilesize
4KB
-
memory/1792-2399-0x0000000005D80000-0x0000000005D81000-memory.dmpFilesize
4KB
-
memory/1792-2398-0x0000000005D80000-0x0000000005D81000-memory.dmpFilesize
4KB
-
memory/1792-2397-0x0000000005D80000-0x0000000005D81000-memory.dmpFilesize
4KB
-
memory/1792-2401-0x0000000005D80000-0x0000000005D81000-memory.dmpFilesize
4KB
-
memory/1792-2402-0x0000000005D80000-0x0000000005D81000-memory.dmpFilesize
4KB
-
memory/1792-2403-0x0000000005D80000-0x0000000005D81000-memory.dmpFilesize
4KB
-
memory/1792-2392-0x0000000005D80000-0x0000000005D81000-memory.dmpFilesize
4KB
-
memory/1792-2393-0x0000000005D80000-0x0000000005D81000-memory.dmpFilesize
4KB
-
memory/4508-920-0x0000000002D50000-0x0000000002FA4000-memory.dmpFilesize
2.3MB