a9cd3d966d453afd424d9ac54df414b80073bb51d249f4089185976fb316e254

Resubmissions

07-04-2023 08:11

230407-j3f3zaae2s 7

07-04-2023 08:08

230407-j1q56aad91 7

07-04-2023 07:42

230407-jj2wbsad6z 7

Analysis

max time kernel
441s
max time network
452s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
07-04-2023 07:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

MEMZ 3.0/MEMZ.bat
Size

12KB
MD5

13a43c26bb98449fd82d2a552877013a
SHA1

71eb7dc393ac1f204488e11f5c1eef56f1e746af
SHA256

5f52365accb76d679b2b3946870439a62eb8936b9a0595f0fb0198138106b513
SHA512

602518b238d80010fa88c2c88699f70645513963ef4f148a0345675738cf9b0c23b9aeb899d9f7830cc1e5c7e9c7147b2dc4a9222770b4a052ee0c879062cd5a
SSDEEP

384:nnLhRNiqt0kCH2LR0GPXxGiZgCz+KG/yKhLdW79HOli+lz3:nLhRN9t0SR4iZtzlREBWhuF

Score

7^/10

bootkit persistence

Malware Config

Signatures

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

MEMZ.exeMEMZ.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Control Panel\International\Geo\Nation	MEMZ.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Control Panel\International\Geo\Nation	MEMZ.exe

Executes dropped EXE 7 IoCs

Processes:

MEMZ.exeMEMZ.exeMEMZ.exeMEMZ.exeMEMZ.exeMEMZ.exeMEMZ.exe

pid process

4512 MEMZ.exe
4876 MEMZ.exe
4956 MEMZ.exe
5096 MEMZ.exe
2312 MEMZ.exe
4908 MEMZ.exe
948 MEMZ.exe
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
bootkit persistence

Bootkit
T1067

Processes:

MEMZ.exe

description ioc process

File opened for modification \??\PhysicalDrive0 MEMZ.exe
Drops file in System32 directory 1 IoCs

Processes:

mmc.exe

description ioc process

File opened for modification C:\Windows\System32\devmgmt.msc mmc.exe

pid	process
4512	MEMZ.exe
4876	MEMZ.exe
4956	MEMZ.exe
5096	MEMZ.exe
2312	MEMZ.exe
4908	MEMZ.exe
948	MEMZ.exe

description	ioc	process
File opened for modification	\??\PhysicalDrive0	MEMZ.exe

description	ioc	process
File opened for modification	C:\Windows\System32\devmgmt.msc	mmc.exe

Drops file in Program Files directory 2 IoCs

Processes:

setup.exe

description	ioc	process
File created	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\c4e6de7b-20ce-4e43-93bd-097acd762970.tmp	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20230407094445.pma	setup.exe

Drops file in Windows directory 57 IoCs

Processes:

mmc.exe

description	ioc	process
File created	C:\Windows\INF\c_linedisplay.PNF	mmc.exe
File created	C:\Windows\INF\c_fsopenfilebackup.PNF	mmc.exe
File created	C:\Windows\INF\rdcameradriver.PNF	mmc.exe
File created	C:\Windows\INF\c_fsvirtualization.PNF	mmc.exe
File created	C:\Windows\INF\c_smrvolume.PNF	mmc.exe
File created	C:\Windows\INF\rawsilo.PNF	mmc.exe
File created	C:\Windows\INF\c_camera.PNF	mmc.exe
File created	C:\Windows\INF\c_firmware.PNF	mmc.exe
File created	C:\Windows\INF\c_fscopyprotection.PNF	mmc.exe
File created	C:\Windows\INF\c_fsencryption.PNF	mmc.exe
File created	C:\Windows\INF\c_barcodescanner.PNF	mmc.exe
File created	C:\Windows\INF\c_fscompression.PNF	mmc.exe
File created	C:\Windows\INF\PerceptionSimulationSixDof.PNF	mmc.exe
File created	C:\Windows\INF\ts_generic.PNF	mmc.exe
File created	C:\Windows\INF\oposdrv.PNF	mmc.exe
File created	C:\Windows\INF\c_fsquotamgmt.PNF	mmc.exe
File created	C:\Windows\INF\c_processor.PNF	mmc.exe
File created	C:\Windows\INF\c_volume.PNF	mmc.exe
File created	C:\Windows\INF\miradisp.PNF	mmc.exe
File created	C:\Windows\INF\c_fscontentscreener.PNF	mmc.exe
File created	C:\Windows\INF\c_diskdrive.PNF	mmc.exe
File created	C:\Windows\INF\c_holographic.PNF	mmc.exe
File created	C:\Windows\INF\c_proximity.PNF	mmc.exe
File created	C:\Windows\INF\c_fssecurityenhancer.PNF	mmc.exe
File created	C:\Windows\INF\c_fscfsmetadataserver.PNF	mmc.exe
File created	C:\Windows\INF\c_extension.PNF	mmc.exe
File created	C:\Windows\INF\c_fsphysicalquotamgmt.PNF	mmc.exe
File created	C:\Windows\INF\c_cashdrawer.PNF	mmc.exe
File created	C:\Windows\INF\xusb22.PNF	mmc.exe
File created	C:\Windows\INF\c_media.PNF	mmc.exe
File created	C:\Windows\INF\c_smrdisk.PNF	mmc.exe
File created	C:\Windows\INF\c_fsantivirus.PNF	mmc.exe
File created	C:\Windows\INF\c_ucm.PNF	mmc.exe
File created	C:\Windows\INF\c_magneticstripereader.PNF	mmc.exe
File created	C:\Windows\INF\c_apo.PNF	mmc.exe
File created	C:\Windows\INF\c_fsinfrastructure.PNF	mmc.exe
File created	C:\Windows\INF\c_fsreplication.PNF	mmc.exe
File created	C:\Windows\INF\c_fsactivitymonitor.PNF	mmc.exe
File created	C:\Windows\INF\c_computeaccelerator.PNF	mmc.exe
File created	C:\Windows\INF\c_display.PNF	mmc.exe
File created	C:\Windows\INF\c_fscontinuousbackup.PNF	mmc.exe
File created	C:\Windows\INF\c_fssystem.PNF	mmc.exe
File created	C:\Windows\INF\c_fsundelete.PNF	mmc.exe
File created	C:\Windows\INF\c_monitor.PNF	mmc.exe
File created	C:\Windows\INF\wsdprint.PNF	mmc.exe
File created	C:\Windows\INF\remoteposdrv.PNF	mmc.exe
File created	C:\Windows\INF\c_fssystemrecovery.PNF	mmc.exe
File created	C:\Windows\INF\c_scmdisk.PNF	mmc.exe
File created	C:\Windows\INF\c_scmvolume.PNF	mmc.exe
File created	C:\Windows\INF\c_netdriver.PNF	mmc.exe
File created	C:\Windows\INF\c_receiptprinter.PNF	mmc.exe
File created	C:\Windows\INF\c_sslaccel.PNF	mmc.exe
File created	C:\Windows\INF\c_mcx.PNF	mmc.exe
File created	C:\Windows\INF\c_swcomponent.PNF	mmc.exe
File created	C:\Windows\INF\c_fshsm.PNF	mmc.exe
File created	C:\Windows\INF\dc1-controller.PNF	mmc.exe
File created	C:\Windows\INF\digitalmediadevice.PNF	mmc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 23 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

mmc.exeTaskmgr.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	mmc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	mmc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	mmc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	mmc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A\	mmc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	Taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A	mmc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom	mmc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	mmc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000	mmc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	mmc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags	mmc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	mmc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	mmc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	Taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	mmc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	mmc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName	mmc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	Taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\ConfigFlags	mmc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	mmc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A	mmc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A\	mmc.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exemsedge.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

Processes:

explorer.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe

Modifies registry class 64 IoCs

Processes:

explorer.exeMEMZ.exeexplorer.exemsedge.execontrol.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\netcenter.dll,-2#immutable1 = "Check network status, change network settings and set preferences for sharing files and printers."	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\fhcpl.dll,-52#immutable1 = "File History"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\FirewallControlPanel.dll,-12122#immutable1 = "Windows Defender Firewall"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\main.cpl,-102#immutable1 = "Keyboard"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\system32\appwiz.cpl,-160#immutable1 = "Uninstall or change programs on your computer."	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\mmsys.cpl,-301#immutable1 = "Configure your audio devices or change the sound scheme for your computer."	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\sud.dll,-1#immutable1 = "Default Programs"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\system32\DeviceCenter.dll,-1000#immutable1 = "Devices and Printers"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\timedate.cpl,-52#immutable1 = "Set the date, time, and time zone for your computer."	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\accessibilitycpl.dll,-10#immutable1 = "Ease of Access Center"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\fvecpl.dll,-1#immutable1 = "BitLocker Drive Encryption"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000_Classes\Local Settings	MEMZ.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\recovery.dll,-101#immutable1 = "Recovery"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\recovery.dll,-2#immutable1 = "Recovery"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\telephon.cpl,-1#immutable1 = "Phone and Modem"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\autoplay.dll,-2#immutable1 = "Change default settings for CDs, DVDs, and devices so that you can automatically play music, view pictures, install software, and play games."	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\sud.dll,-10#immutable1 = "Choose which programs you want Windows to use for activities like web browsing, editing photos, sending e-mail, and playing music."	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\autoplay.dll,-1#immutable1 = "AutoPlay"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\inetcpl.cpl,-4312#immutable1 = "Internet Options"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\system32\DeviceCenter.dll,-2000#immutable1 = "View and manage devices, printers, and print jobs"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\srchadmin.dll,-601#immutable1 = "Indexing Options"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\srchadmin.dll,-602#immutable1 = "Change how Windows indexes to search faster"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\powercpl.dll,-2#immutable1 = "Conserve energy or maximize performance by choosing how your computer manages power."	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\RADCUI.dll,-15301#immutable1 = "Manage your RemoteApp and Desktop Connections"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\netcenter.dll,-1#immutable1 = "Network and Sharing Center"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\accessibilitycpl.dll,-45#immutable1 = "Make your computer easier to use."	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\Speech\SpeechUX\speechuxcpl.dll,-2#immutable1 = "Configure how speech recognition works on your computer."	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\usercpl.dll,-1#immutable1 = "User Accounts"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\Speech\SpeechUX\speechuxcpl.dll,-1#immutable1 = "Speech Recognition"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\intl.cpl,-2#immutable1 = "Customize settings for the display of languages, numbers, times, and dates."	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\fhcpl.dll,-2#immutable1 = "Keep a history of your files"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\system32\Vault.dll,-1#immutable1 = "Credential Manager"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\timedate.cpl,-51#immutable1 = "Date and Time"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\mmsys.cpl,-300#immutable1 = "Sound"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\RADCUI.dll,-15300#immutable1 = "RemoteApp and Desktop Connections"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\usercpl.dll,-2#immutable1 = "Change user account settings and passwords for people who share this computer."	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\fvecpl.dll,-2#immutable1 = "Protect your PC using BitLocker Drive Encryption."	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\SyncCenter.dll,-3001#immutable1 = "Sync files between your computer and network folders"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\inetcpl.cpl,-4313#immutable1 = "Configure your Internet display and connection settings."	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\DiagCpl.dll,-1#immutable1 = "Troubleshooting"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\DiagCpl.dll,-15#immutable1 = "Troubleshoot and fix common computer problems."	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\main.cpl,-100#immutable1 = "Mouse"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\devmgr.dll,-4#immutable1 = "Device Manager"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\devmgr.dll,-5#immutable1 = "View and update your device hardware settings and driver software."	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\system32\colorcpl.exe,-7#immutable1 = "Change advanced color management settings for displays, scanners, and printers."	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000_Classes\Local Settings	control.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\telephon.cpl,-2#immutable1 = "Configure your telephone dialing rules and modem settings."	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\intl.cpl,-3#immutable1 = "Region"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\powercpl.dll,-1#immutable1 = "Power Options"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\FirewallControlPanel.dll,-12123#immutable1 = "Set firewall security options to help protect your computer from hackers and malicious software."	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\SyncCenter.dll,-3000#immutable1 = "Sync Center"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\system32\Vault.dll,-2#immutable1 = "Manage your Windows credentials."	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\main.cpl,-103#immutable1 = "Customize your keyboard settings, such as the cursor blink rate and the character repeat rate."	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\system32\appwiz.cpl,-159#immutable1 = "Programs and Features"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\system32\colorcpl.exe,-6#immutable1 = "Color Management"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\sdcpl.dll,-101#immutable1 = "Backup and Restore (Windows 7)"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\sdcpl.dll,-100#immutable1 = "Recover copies of your files backed up in Windows 7"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\systemcpl.dll,-1#immutable1 = "System"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\systemcpl.dll,-2#immutable1 = "View information about your computer, and change settings for hardware, performance, and remote connections."	explorer.exe

Runs regedit.exe 1 IoCs

Processes:

regedit.exe

pid process

3992 regedit.exe
Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

explorer.exe

pid process

1936 explorer.exe

pid	process
3992	regedit.exe

pid	process
1936	explorer.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

MEMZ.exeMEMZ.exeMEMZ.exeMEMZ.exeMEMZ.exe

pid	process
4876	MEMZ.exe
4876	MEMZ.exe
4956	MEMZ.exe
5096	MEMZ.exe
4956	MEMZ.exe
5096	MEMZ.exe
4876	MEMZ.exe
4876	MEMZ.exe
5096	MEMZ.exe
4956	MEMZ.exe
5096	MEMZ.exe
4956	MEMZ.exe
4876	MEMZ.exe
4876	MEMZ.exe
4956	MEMZ.exe
4956	MEMZ.exe
5096	MEMZ.exe
4876	MEMZ.exe
5096	MEMZ.exe
4876	MEMZ.exe
5096	MEMZ.exe
5096	MEMZ.exe
4908	MEMZ.exe
4956	MEMZ.exe
4956	MEMZ.exe
2312	MEMZ.exe
2312	MEMZ.exe
4908	MEMZ.exe
4876	MEMZ.exe
4876	MEMZ.exe
2312	MEMZ.exe
2312	MEMZ.exe
4956	MEMZ.exe
4956	MEMZ.exe
5096	MEMZ.exe
5096	MEMZ.exe
4876	MEMZ.exe
4908	MEMZ.exe
4876	MEMZ.exe
4908	MEMZ.exe
2312	MEMZ.exe
2312	MEMZ.exe
4876	MEMZ.exe
4876	MEMZ.exe
5096	MEMZ.exe
4956	MEMZ.exe
5096	MEMZ.exe
4956	MEMZ.exe
4908	MEMZ.exe
4908	MEMZ.exe
2312	MEMZ.exe
2312	MEMZ.exe
4876	MEMZ.exe
4876	MEMZ.exe
4908	MEMZ.exe
4908	MEMZ.exe
5096	MEMZ.exe
5096	MEMZ.exe
4956	MEMZ.exe
4956	MEMZ.exe
5096	MEMZ.exe
5096	MEMZ.exe
4908	MEMZ.exe
4908	MEMZ.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

regedit.exe

pid process

3992 regedit.exe

pid	process
3992	regedit.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 45 IoCs

Processes:

msedge.exemsedge.exe

pid	process
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
5604	msedge.exe
5604	msedge.exe
5604	msedge.exe
5604	msedge.exe
5604	msedge.exe
5604	msedge.exe
5604	msedge.exe
5604	msedge.exe
5604	msedge.exe
5604	msedge.exe
5604	msedge.exe
5604	msedge.exe
5604	msedge.exe
5604	msedge.exe
5604	msedge.exe
5604	msedge.exe
5604	msedge.exe
5604	msedge.exe
5604	msedge.exe
5604	msedge.exe
5604	msedge.exe
5604	msedge.exe
5604	msedge.exe
5604	msedge.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

Processes:

AUDIODG.EXEmmc.exeexplorer.exeTaskmgr.exe

description	pid	process
Token: 33	3760	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	3760	AUDIODG.EXE
Token: 33	4508	mmc.exe
Token: SeIncBasePriorityPrivilege	4508	mmc.exe
Token: 33	4508	mmc.exe
Token: SeIncBasePriorityPrivilege	4508	mmc.exe
Token: SeShutdownPrivilege	1936	explorer.exe
Token: SeCreatePagefilePrivilege	1936	explorer.exe
Token: SeDebugPrivilege	1792	Taskmgr.exe
Token: SeSystemProfilePrivilege	1792	Taskmgr.exe
Token: SeCreateGlobalPrivilege	1792	Taskmgr.exe

Suspicious use of FindShellTrayWindow 35 IoCs

Processes:

msedge.exeexplorer.exemsedge.exeTaskmgr.exe

pid	process
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
1936	explorer.exe
5604	msedge.exe
1792	Taskmgr.exe
1792	Taskmgr.exe
1792	Taskmgr.exe
1792	Taskmgr.exe
1792	Taskmgr.exe
1792	Taskmgr.exe
1792	Taskmgr.exe
1792	Taskmgr.exe
1792	Taskmgr.exe
1792	Taskmgr.exe
1792	Taskmgr.exe
1792	Taskmgr.exe
1792	Taskmgr.exe
1792	Taskmgr.exe
1792	Taskmgr.exe
1792	Taskmgr.exe
1792	Taskmgr.exe
1792	Taskmgr.exe
1792	Taskmgr.exe
1792	Taskmgr.exe
1792	Taskmgr.exe
1792	Taskmgr.exe
1792	Taskmgr.exe
1792	Taskmgr.exe
1792	Taskmgr.exe
1792	Taskmgr.exe
1792	Taskmgr.exe
1792	Taskmgr.exe
1792	Taskmgr.exe

Suspicious use of SendNotifyMessage 29 IoCs

Processes:

Taskmgr.exe

pid	process
1792	Taskmgr.exe
1792	Taskmgr.exe
1792	Taskmgr.exe
1792	Taskmgr.exe
1792	Taskmgr.exe
1792	Taskmgr.exe
1792	Taskmgr.exe
1792	Taskmgr.exe
1792	Taskmgr.exe
1792	Taskmgr.exe
1792	Taskmgr.exe
1792	Taskmgr.exe
1792	Taskmgr.exe
1792	Taskmgr.exe
1792	Taskmgr.exe
1792	Taskmgr.exe
1792	Taskmgr.exe
1792	Taskmgr.exe
1792	Taskmgr.exe
1792	Taskmgr.exe
1792	Taskmgr.exe
1792	Taskmgr.exe
1792	Taskmgr.exe
1792	Taskmgr.exe
1792	Taskmgr.exe
1792	Taskmgr.exe
1792	Taskmgr.exe
1792	Taskmgr.exe
1792	Taskmgr.exe

Suspicious use of SetWindowsHookEx 17 IoCs

Processes:

MEMZ.exemmc.exemmc.exe

pid	process
948	MEMZ.exe
3944	mmc.exe
4508	mmc.exe
4508	mmc.exe
948	MEMZ.exe
948	MEMZ.exe
948	MEMZ.exe
948	MEMZ.exe
948	MEMZ.exe
948	MEMZ.exe
948	MEMZ.exe
948	MEMZ.exe
948	MEMZ.exe
948	MEMZ.exe
948	MEMZ.exe
948	MEMZ.exe
948	MEMZ.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

cmd.exeMEMZ.exeMEMZ.exemsedge.exe

description	pid	process	target process
PID 5016 wrote to memory of 928	5016	cmd.exe	cscript.exe
PID 5016 wrote to memory of 928	5016	cmd.exe	cscript.exe
PID 5016 wrote to memory of 4512	5016	cmd.exe	MEMZ.exe
PID 5016 wrote to memory of 4512	5016	cmd.exe	MEMZ.exe
PID 5016 wrote to memory of 4512	5016	cmd.exe	MEMZ.exe
PID 4512 wrote to memory of 4876	4512	MEMZ.exe	MEMZ.exe
PID 4512 wrote to memory of 4876	4512	MEMZ.exe	MEMZ.exe
PID 4512 wrote to memory of 4876	4512	MEMZ.exe	MEMZ.exe
PID 4512 wrote to memory of 4956	4512	MEMZ.exe	MEMZ.exe
PID 4512 wrote to memory of 4956	4512	MEMZ.exe	MEMZ.exe
PID 4512 wrote to memory of 4956	4512	MEMZ.exe	MEMZ.exe
PID 4512 wrote to memory of 5096	4512	MEMZ.exe	MEMZ.exe
PID 4512 wrote to memory of 5096	4512	MEMZ.exe	MEMZ.exe
PID 4512 wrote to memory of 5096	4512	MEMZ.exe	MEMZ.exe
PID 4512 wrote to memory of 2312	4512	MEMZ.exe	MEMZ.exe
PID 4512 wrote to memory of 2312	4512	MEMZ.exe	MEMZ.exe
PID 4512 wrote to memory of 2312	4512	MEMZ.exe	MEMZ.exe
PID 4512 wrote to memory of 4908	4512	MEMZ.exe	MEMZ.exe
PID 4512 wrote to memory of 4908	4512	MEMZ.exe	MEMZ.exe
PID 4512 wrote to memory of 4908	4512	MEMZ.exe	MEMZ.exe
PID 4512 wrote to memory of 948	4512	MEMZ.exe	MEMZ.exe
PID 4512 wrote to memory of 948	4512	MEMZ.exe	MEMZ.exe
PID 4512 wrote to memory of 948	4512	MEMZ.exe	MEMZ.exe
PID 948 wrote to memory of 2332	948	MEMZ.exe	notepad.exe
PID 948 wrote to memory of 2332	948	MEMZ.exe	notepad.exe
PID 948 wrote to memory of 2332	948	MEMZ.exe	notepad.exe
PID 948 wrote to memory of 3992	948	MEMZ.exe	regedit.exe
PID 948 wrote to memory of 3992	948	MEMZ.exe	regedit.exe
PID 948 wrote to memory of 3992	948	MEMZ.exe	regedit.exe
PID 948 wrote to memory of 436	948	MEMZ.exe	cmd.exe
PID 948 wrote to memory of 436	948	MEMZ.exe	cmd.exe
PID 948 wrote to memory of 436	948	MEMZ.exe	cmd.exe
PID 948 wrote to memory of 4688	948	MEMZ.exe	msedge.exe
PID 948 wrote to memory of 4688	948	MEMZ.exe	msedge.exe
PID 4688 wrote to memory of 4032	4688	msedge.exe	msedge.exe
PID 4688 wrote to memory of 4032	4688	msedge.exe	msedge.exe
PID 4688 wrote to memory of 4520	4688	msedge.exe	msedge.exe
PID 4688 wrote to memory of 4520	4688	msedge.exe	msedge.exe
PID 4688 wrote to memory of 4520	4688	msedge.exe	msedge.exe
PID 4688 wrote to memory of 4520	4688	msedge.exe	msedge.exe
PID 4688 wrote to memory of 4520	4688	msedge.exe	msedge.exe
PID 4688 wrote to memory of 4520	4688	msedge.exe	msedge.exe
PID 4688 wrote to memory of 4520	4688	msedge.exe	msedge.exe
PID 4688 wrote to memory of 4520	4688	msedge.exe	msedge.exe
PID 4688 wrote to memory of 4520	4688	msedge.exe	msedge.exe
PID 4688 wrote to memory of 4520	4688	msedge.exe	msedge.exe
PID 4688 wrote to memory of 4520	4688	msedge.exe	msedge.exe
PID 4688 wrote to memory of 4520	4688	msedge.exe	msedge.exe
PID 4688 wrote to memory of 4520	4688	msedge.exe	msedge.exe
PID 4688 wrote to memory of 4520	4688	msedge.exe	msedge.exe
PID 4688 wrote to memory of 4520	4688	msedge.exe	msedge.exe
PID 4688 wrote to memory of 4520	4688	msedge.exe	msedge.exe
PID 4688 wrote to memory of 4520	4688	msedge.exe	msedge.exe
PID 4688 wrote to memory of 4520	4688	msedge.exe	msedge.exe
PID 4688 wrote to memory of 4520	4688	msedge.exe	msedge.exe
PID 4688 wrote to memory of 4520	4688	msedge.exe	msedge.exe
PID 4688 wrote to memory of 4520	4688	msedge.exe	msedge.exe
PID 4688 wrote to memory of 4520	4688	msedge.exe	msedge.exe
PID 4688 wrote to memory of 4520	4688	msedge.exe	msedge.exe
PID 4688 wrote to memory of 4520	4688	msedge.exe	msedge.exe
PID 4688 wrote to memory of 4520	4688	msedge.exe	msedge.exe
PID 4688 wrote to memory of 4520	4688	msedge.exe	msedge.exe
PID 4688 wrote to memory of 4520	4688	msedge.exe	msedge.exe
PID 4688 wrote to memory of 4520	4688	msedge.exe	msedge.exe

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\MEMZ 3.0\MEMZ.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:5016

C:\Windows\system32\cscript.exe
cscript x.js
2⤵
PID:928

C:\Users\Admin\AppData\Roaming\MEMZ.exe
"C:\Users\Admin\AppData\Roaming\MEMZ.exe"
2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4512

C:\Users\Admin\AppData\Roaming\MEMZ.exe
"C:\Users\Admin\AppData\Roaming\MEMZ.exe" /watchdog
3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:4876

C:\Users\Admin\AppData\Roaming\MEMZ.exe
"C:\Users\Admin\AppData\Roaming\MEMZ.exe" /watchdog
3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:4956

C:\Users\Admin\AppData\Roaming\MEMZ.exe
"C:\Users\Admin\AppData\Roaming\MEMZ.exe" /watchdog
3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:5096

C:\Users\Admin\AppData\Roaming\MEMZ.exe
"C:\Users\Admin\AppData\Roaming\MEMZ.exe" /watchdog
3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2312

C:\Users\Admin\AppData\Roaming\MEMZ.exe
"C:\Users\Admin\AppData\Roaming\MEMZ.exe" /watchdog
3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:4908

C:\Users\Admin\AppData\Roaming\MEMZ.exe
"C:\Users\Admin\AppData\Roaming\MEMZ.exe" /main
3⤵
- Checks computer location settings
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:948

C:\Windows\SysWOW64\notepad.exe
"C:\Windows\System32\notepad.exe" \note.txt
4⤵
PID:2332

C:\Windows\SysWOW64\regedit.exe
"C:\Windows\System32\regedit.exe"
4⤵
- Runs regedit.exe
- Suspicious behavior: GetForegroundWindowSpam
PID:3992

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe"
4⤵
PID:436

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://google.co.ck/search?q=my+computer+is+doing+weird+things+wtf+is+happenin+plz+halp
4⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4688

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x114,0x118,0x11c,0xfc,0x120,0x7fff971246f8,0x7fff97124708,0x7fff97124718
5⤵
PID:4032

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2164,4267382118395972544,13619965577222863919,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2220 /prefetch:2
5⤵
PID:4520

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2164,4267382118395972544,13619965577222863919,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2268 /prefetch:3
5⤵
PID:5016

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2164,4267382118395972544,13619965577222863919,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2772 /prefetch:8
5⤵
PID:1500

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,4267382118395972544,13619965577222863919,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3656 /prefetch:1
5⤵
PID:2016

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,4267382118395972544,13619965577222863919,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3672 /prefetch:1
5⤵
PID:2284

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,4267382118395972544,13619965577222863919,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5228 /prefetch:1
5⤵
PID:3092

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,4267382118395972544,13619965577222863919,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5416 /prefetch:1
5⤵
PID:984

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,4267382118395972544,13619965577222863919,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5716 /prefetch:1
5⤵
PID:3412

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,4267382118395972544,13619965577222863919,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5692 /prefetch:1
5⤵
PID:3036

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,4267382118395972544,13619965577222863919,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5628 /prefetch:1
5⤵
PID:4728

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,4267382118395972544,13619965577222863919,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5224 /prefetch:1
5⤵
PID:220

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2164,4267382118395972544,13619965577222863919,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5884 /prefetch:8
5⤵
PID:3380

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
5⤵
- Drops file in Program Files directory
PID:2928

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x23c,0x240,0x244,0x218,0x248,0x7ff7eb6e5460,0x7ff7eb6e5470,0x7ff7eb6e5480
6⤵
PID:240

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2164,4267382118395972544,13619965577222863919,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5884 /prefetch:8
5⤵
PID:4992

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,4267382118395972544,13619965577222863919,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6032 /prefetch:1
5⤵
PID:404

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,4267382118395972544,13619965577222863919,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5756 /prefetch:1
5⤵
PID:1276

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,4267382118395972544,13619965577222863919,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1760 /prefetch:1
5⤵
PID:2876

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,4267382118395972544,13619965577222863919,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5372 /prefetch:1
5⤵
PID:1308

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,4267382118395972544,13619965577222863919,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1800 /prefetch:1
5⤵
PID:388

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,4267382118395972544,13619965577222863919,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3940 /prefetch:1
5⤵
PID:2288

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,4267382118395972544,13619965577222863919,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6376 /prefetch:1
5⤵
PID:5012

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2164,4267382118395972544,13619965577222863919,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3260 /prefetch:2
5⤵
PID:4192

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,4267382118395972544,13619965577222863919,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6148 /prefetch:1
5⤵
PID:3752

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,4267382118395972544,13619965577222863919,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7132 /prefetch:1
5⤵
PID:1664

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2164,4267382118395972544,13619965577222863919,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=7028 /prefetch:8
5⤵
PID:3292

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,4267382118395972544,13619965577222863919,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6164 /prefetch:1
5⤵
PID:5364

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,4267382118395972544,13619965577222863919,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7624 /prefetch:1
5⤵
PID:5380

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,4267382118395972544,13619965577222863919,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6420 /prefetch:1
5⤵
PID:5712

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,4267382118395972544,13619965577222863919,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5596 /prefetch:1
5⤵
PID:5728

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://google.co.ck/search?q=how+2+remove+a+virus
4⤵
PID:2264

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7fff971246f8,0x7fff97124708,0x7fff97124718
5⤵
PID:1224

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe"
4⤵
PID:1440

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://google.co.ck/search?q=internet+explorer+is+the+best+browser
4⤵
PID:3584

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7fff971246f8,0x7fff97124708,0x7fff97124718
5⤵
PID:4968

C:\Windows\SysWOW64\mmc.exe
"C:\Windows\system32\mmc.exe" "C:\Windows\System32\devmgmt.msc"
4⤵
- Suspicious use of SetWindowsHookEx
PID:3944

C:\Windows\system32\mmc.exe
"C:\Windows\System32\devmgmt.msc" "C:\Windows\System32\devmgmt.msc"
5⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4508

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://google.co.ck/search?q=g3t+r3kt
4⤵
PID:1832

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7fff971246f8,0x7fff97124708,0x7fff97124718
5⤵
PID:768

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://google.co.ck/search?q=how+to+remove+memz+trojan+virus
4⤵
PID:5288

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7fff971246f8,0x7fff97124708,0x7fff97124718
5⤵
PID:5300

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://google.co.ck/search?q=facebook+hacking+tool+free+download+no+virus+working+2016
4⤵
PID:5636

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7fff971246f8,0x7fff97124708,0x7fff97124718
5⤵
PID:5612

C:\Windows\SysWOW64\control.exe
"C:\Windows\System32\control.exe"
4⤵
- Modifies registry class
PID:3048

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://google.co.ck/search?q=how+2+remove+a+virus
4⤵
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
PID:5604

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x124,0x128,0x12c,0x100,0x90,0x7fff971246f8,0x7fff97124708,0x7fff97124718
5⤵
PID:4428

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2148,14511171755251665172,9379945111900017065,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2200 /prefetch:3
5⤵
PID:5980

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2148,14511171755251665172,9379945111900017065,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2800 /prefetch:8
5⤵
PID:5528

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,14511171755251665172,9379945111900017065,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3468 /prefetch:1
5⤵
PID:5884

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,14511171755251665172,9379945111900017065,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3436 /prefetch:1
5⤵
PID:6040

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2148,14511171755251665172,9379945111900017065,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2140 /prefetch:2
5⤵
PID:5940

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,14511171755251665172,9379945111900017065,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4364 /prefetch:1
5⤵
PID:1656

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,14511171755251665172,9379945111900017065,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3636 /prefetch:1
5⤵
PID:3536

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2148,14511171755251665172,9379945111900017065,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5176 /prefetch:8
5⤵
PID:3180

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2148,14511171755251665172,9379945111900017065,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5176 /prefetch:8
5⤵
PID:5136

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,14511171755251665172,9379945111900017065,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5452 /prefetch:1
5⤵
PID:5728

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,14511171755251665172,9379945111900017065,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5436 /prefetch:1
5⤵
PID:5184

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,14511171755251665172,9379945111900017065,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5784 /prefetch:1
5⤵
PID:6100

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,14511171755251665172,9379945111900017065,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3988 /prefetch:1
5⤵
PID:6104

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,14511171755251665172,9379945111900017065,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5084 /prefetch:1
5⤵
PID:5112

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,14511171755251665172,9379945111900017065,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5828 /prefetch:1
5⤵
PID:1248

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,14511171755251665172,9379945111900017065,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1728 /prefetch:1
5⤵
PID:4356

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,14511171755251665172,9379945111900017065,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6096 /prefetch:1
5⤵
PID:1168

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,14511171755251665172,9379945111900017065,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5596 /prefetch:1
5⤵
PID:4320

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,14511171755251665172,9379945111900017065,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6184 /prefetch:1
5⤵
PID:3960

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,14511171755251665172,9379945111900017065,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6588 /prefetch:1
5⤵
PID:5032

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,14511171755251665172,9379945111900017065,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5756 /prefetch:1
5⤵
PID:1340

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,14511171755251665172,9379945111900017065,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4028 /prefetch:1
5⤵
PID:1788

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,14511171755251665172,9379945111900017065,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6120 /prefetch:1
5⤵
PID:864

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,14511171755251665172,9379945111900017065,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6680 /prefetch:1
5⤵
PID:1428

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,14511171755251665172,9379945111900017065,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6184 /prefetch:1
5⤵
PID:2372

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2148,14511171755251665172,9379945111900017065,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=7064 /prefetch:2
5⤵
PID:5840

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,14511171755251665172,9379945111900017065,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5356 /prefetch:1
5⤵
PID:5744

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,14511171755251665172,9379945111900017065,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7028 /prefetch:1
5⤵
PID:4476

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,14511171755251665172,9379945111900017065,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6720 /prefetch:1
5⤵
PID:4564

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,14511171755251665172,9379945111900017065,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7216 /prefetch:1
5⤵
PID:2660

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://google.co.ck/search?q=how+2+buy+weed
4⤵
PID:4724

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7fff971246f8,0x7fff97124708,0x7fff97124718
5⤵
PID:5936

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://pcoptimizerpro.com/
4⤵
PID:4624

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7fff971246f8,0x7fff97124708,0x7fff97124718
5⤵
PID:3180

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://pcoptimizerpro.com/
4⤵
PID:5896

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7fff971246f8,0x7fff97124708,0x7fff97124718
5⤵
PID:4072

C:\Windows\SysWOW64\explorer.exe
"C:\Windows\System32\explorer.exe"
4⤵
- Modifies registry class
PID:5484

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://google.co.ck/search?q=how+to+code+a+virus+in+visual+basic
4⤵
PID:5368

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7fff971246f8,0x7fff97124708,0x7fff97124718
5⤵
PID:3376

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://google.co.ck/search?q=batch+virus+download
4⤵
PID:5820

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf4,0x128,0x7fff971246f8,0x7fff97124708,0x7fff97124718
5⤵
PID:3772

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://google.co.ck/search?q=how+to+get+money
4⤵
PID:2976

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x118,0x11c,0x120,0xf8,0x124,0x7fff971246f8,0x7fff97124708,0x7fff97124718
5⤵
PID:5160

C:\Windows\SysWOW64\notepad.exe
"C:\Windows\System32\notepad.exe"
4⤵
PID:5428

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://google.co.ck/search?q=how+to+create+your+own+ransomware
4⤵
PID:4848

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x124,0x128,0x12c,0xf4,0x130,0x7fff971246f8,0x7fff97124708,0x7fff97124718
5⤵
PID:5420

C:\Windows\SysWOW64\Taskmgr.exe
"C:\Windows\System32\Taskmgr.exe"
4⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1792

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://google.co.ck/search?q=how+2+buy+weed
4⤵
PID:5252

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7fff971246f8,0x7fff97124708,0x7fff97124718
5⤵
PID:5192

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3868

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3588

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:768

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x394 0x4a8
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3760

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3336

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{5BD95610-9434-43C2-886C-57852CC8A120} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1936

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
1⤵
PID:456

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:6028

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1412

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3692

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Bootkit

T1067

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Peripheral Device Discovery

T1120

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
dfeee58d8e9ccc6ffa537d5b4782ed65

SHA1
995bd4512e107fe1274eba41e49984403e075f31

SHA256
1a35071ba780d220a4e2d5c2c696563b316ba36993191563953059f70f6ae884

SHA512
3f598ed40475c4ebc65df2b9d1ce35bd29792cd0bddc2c02ab4a1776cf8a814523261bd130118ce5f5b16f111fe060ec185397fc7a6dd5539f442f8fb1444ad6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
dfeee58d8e9ccc6ffa537d5b4782ed65

SHA1
995bd4512e107fe1274eba41e49984403e075f31

SHA256
1a35071ba780d220a4e2d5c2c696563b316ba36993191563953059f70f6ae884

SHA512
3f598ed40475c4ebc65df2b9d1ce35bd29792cd0bddc2c02ab4a1776cf8a814523261bd130118ce5f5b16f111fe060ec185397fc7a6dd5539f442f8fb1444ad6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
dfeee58d8e9ccc6ffa537d5b4782ed65

SHA1
995bd4512e107fe1274eba41e49984403e075f31

SHA256
1a35071ba780d220a4e2d5c2c696563b316ba36993191563953059f70f6ae884

SHA512
3f598ed40475c4ebc65df2b9d1ce35bd29792cd0bddc2c02ab4a1776cf8a814523261bd130118ce5f5b16f111fe060ec185397fc7a6dd5539f442f8fb1444ad6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
dfeee58d8e9ccc6ffa537d5b4782ed65

SHA1
995bd4512e107fe1274eba41e49984403e075f31

SHA256
1a35071ba780d220a4e2d5c2c696563b316ba36993191563953059f70f6ae884

SHA512
3f598ed40475c4ebc65df2b9d1ce35bd29792cd0bddc2c02ab4a1776cf8a814523261bd130118ce5f5b16f111fe060ec185397fc7a6dd5539f442f8fb1444ad6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
7abc6e597d5861b4bd2797073d353fdf

SHA1
2301fa6b712087c765caa84095151477f99f02eb

SHA256
25e94de5069effa8bac56a77caa6f00b9595183b78b01409079acf1695156535

SHA512
3ac3bc0bd2186e71cee273e12c7944800dbf106e50b10d76bdbc0d722ab366c14b97256829031a1b561d23c5e155492cc75a263450dfd7bd8d328782b65c4f05

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
a5fd05a46763e9667be6722d46909b14

SHA1
75a32cf26f7faa82285869d79bfdf596cec6e71e

SHA256
9d0c60043b6c8fca3ab768d25107a5aff7451bd360c3f9ccc47765cfda98f711

SHA512
13f3e27529931bb87d85e78528da18e8cb32234cb9da5f1fa7d096433b1dd87a73f18dc29b65be6d43343af09697dea271ed6bea263f0cfe894db17bb2022290

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
cd4f5fe0fc0ab6b6df866b9bfb9dd762

SHA1
a6aaed363cd5a7b6910e9b3296c0093b0ac94759

SHA256
3b803b53dbd3d592848fc66e5715f39f6bc02cbc95fb2452cd5822d98c6b8f81

SHA512
7072630ec28cf6a8d5b072555234b5150c1e952138e5cdc29435a6242fda4b4217b81fb57acae927d2b908fa06f36414cb3fab35110d63107141263e3bba9676

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
1d40312629d09d2420e992fdb8a78c1c

SHA1
903950d5ba9d64ec21c9f51264272ca8dfae9540

SHA256
1e7c6aa575c3ec46cd1fdf6df51063113d277012ed28f5f6b37aea95cd3a64ac

SHA512
a7073247ae95e451ed32ceeae91c6638192c15eaad718875c1272eff51c0564016d9f84690543f27df509a7d579de329d101fbf82fed7cbeb27af57393de24ac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
dfeee58d8e9ccc6ffa537d5b4782ed65

SHA1
995bd4512e107fe1274eba41e49984403e075f31

SHA256
1a35071ba780d220a4e2d5c2c696563b316ba36993191563953059f70f6ae884

SHA512
3f598ed40475c4ebc65df2b9d1ce35bd29792cd0bddc2c02ab4a1776cf8a814523261bd130118ce5f5b16f111fe060ec185397fc7a6dd5539f442f8fb1444ad6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
dfeee58d8e9ccc6ffa537d5b4782ed65

SHA1
995bd4512e107fe1274eba41e49984403e075f31

SHA256
1a35071ba780d220a4e2d5c2c696563b316ba36993191563953059f70f6ae884

SHA512
3f598ed40475c4ebc65df2b9d1ce35bd29792cd0bddc2c02ab4a1776cf8a814523261bd130118ce5f5b16f111fe060ec185397fc7a6dd5539f442f8fb1444ad6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
dfeee58d8e9ccc6ffa537d5b4782ed65

SHA1
995bd4512e107fe1274eba41e49984403e075f31

SHA256
1a35071ba780d220a4e2d5c2c696563b316ba36993191563953059f70f6ae884

SHA512
3f598ed40475c4ebc65df2b9d1ce35bd29792cd0bddc2c02ab4a1776cf8a814523261bd130118ce5f5b16f111fe060ec185397fc7a6dd5539f442f8fb1444ad6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
dfeee58d8e9ccc6ffa537d5b4782ed65

SHA1
995bd4512e107fe1274eba41e49984403e075f31

SHA256
1a35071ba780d220a4e2d5c2c696563b316ba36993191563953059f70f6ae884

SHA512
3f598ed40475c4ebc65df2b9d1ce35bd29792cd0bddc2c02ab4a1776cf8a814523261bd130118ce5f5b16f111fe060ec185397fc7a6dd5539f442f8fb1444ad6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000001
Filesize
20KB

MD5
923a543cc619ea568f91b723d9fb1ef0

SHA1
6f4ade25559645c741d7327c6e16521e43d7e1f9

SHA256
bf7344209edb1be5a2886c425cf6334a102d76cbea1471fd50171e2ee92877cd

SHA512
a4153751761cd67465374828b0514d7773b8c4ed37779d1ecfd4f19be4faa171585c8ee0b4db59b556399d5d2b9809ba87e04d4715e9d090e1f488d02219d555

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000003
Filesize
335KB

MD5
fcc028327a1f47d7847d253aaf25f5c6

SHA1
9f46c5032ecca6ca7abc7826cacc091cebbafcaf

SHA256
78a542df9c4df44a8a4336b547bcf953e8e4112d6ace06ca294167257e1e7b62

SHA512
59cddd85cea5f5af87c19de0110bfd510295b9cde46b170305bdb9ed95239186caa360fd03819e8f0242087d48d367511689918aaa5e3d838f0ba1cc22bfa252

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000005
Filesize
64KB

MD5
1067041b8fa46bae06ebeac837cb67ed

SHA1
9a1e51cfe25d04692592f1dc13ce75058db813d3

SHA256
e6f3a928b555e72664e65ac8d3455b7ace51ce76f205975f98daff89b3a5d533

SHA512
d16c71f87ebcdc4553cb5aa4283f84ba02178e80d237a99d56ec416377031af4354582d459abac88df5b06239e3fb4625466b478bbf67ac5f6f001e82fa58882

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000007
Filesize
37KB

MD5
47ae9b25af86702d77c7895ac6f6b57c

SHA1
f56f78729b99247a975620a1103cac3ee9f313a5

SHA256
9bde79a1b0866f68d6baa43f920e971b5feb35a8e0af7ffadc114366f8538224

SHA512
72b5296e3dd1c5b4c42d8c3e4a56693819779167b9f02bc2d5f5a626b519a9cf10bee59846d614c929c42094b65d13039f6024f6cb1c023e740969aaefd060c4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000008
Filesize
70KB

MD5
bf60e369a13f6aa51d9709ff1d1b560f

SHA1
c24ef96b3a1c339644145ac06709704b31e259ee

SHA256
0f48079fd06018af3f3309da572441b103caeb8df8454dca1e309e9173472a3a

SHA512
7ecc9025c482b30cf2ce41f4005be41692a0749a313f62d54f694de9ba18f89852e0a010c9ede7a123937643482842b29d45a98c6c9926ca242db00c9f563fef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000a
Filesize
209KB

MD5
4efa911c670ebb49df94768a642c0e9d

SHA1
b6b23fbf8ebba2acde63650a9727f5108b50912a

SHA256
c61bd4151c7745d1c4f724e78a334364d0fc9a726a208c035096f4e543ea37bf

SHA512
2c9b48623290de9ba212103df27c70c8595f8a591415174c012ed46ecc004ee23a911d844dac7b0a5fb761cce12e8e5b983266545566d8817307c433dde6c40b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000c
Filesize
408KB

MD5
10ffed64f20be5f93f5ba4d04d1c3486

SHA1
ce7e1619c6107d30f24ec74eaeb6d04cbe329491

SHA256
c225e7599667f36665dddef4ce236584cd7d73046a521cb57f2573fa10ee4479

SHA512
000cf588b50a5979cebc05270d1f3feecfb462978a45224022203c907eae8ea0dae10ba3411fa707e318021d783369788550ebe9bc5e3d19cb2c6040beec2474

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000d
Filesize
61KB

MD5
f71b0894d35d9dffdcc3db2be42fa0df

SHA1
abfcb6ffe0b38228fcf03fcfd01e5ae7d363d9af

SHA256
bc12e3374035e04abc80bec91a6abccbc6f736c3f91ec29fcc5b715fb1b3dfd2

SHA512
bfb99588b5a33da1d78a2b79d0734029cf16cc85cba2c353361fd1187ea4fe3ad9baf250548edd96980ae07167a1026fae106c2f0fee8792d36479aa3b3350ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000e
Filesize
50KB

MD5
6d81cd0d857a5d1728e08c77b9b0ae22

SHA1
3cc0e10ffa948e94df63f20a66f5190224c57d07

SHA256
703521ee76a6b56c41ea6bec08e91e25e64705acfce7abfc2ff9e75c3d92b2b4

SHA512
9d0cea67338db2e97b58f30e25c702aaeaa41ea0f480a5b2b0c8e9d2935e4ae65c10b1186507a5bcd86540c6b333b5856fe0902146e1a9ce57cd4ed0eb67d959

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000011
Filesize
35KB

MD5
aef13a646c7327cbd4a6d3bcebb034db

SHA1
7d9ee720386efcddc69c6d6f810732f5debfd067

SHA256
e22cf8b805411472bc63a30289ad2fddf603a0d4fb1f7ad6ba5a72511da75412

SHA512
ded8aad01610fd13228905f618dc5f6954fc4a175f4ddafb681bb504b1990d75b6c00d55907f8b25ee8aefbe35fbcd3966dd5de8d69351c83bc725ff554416b7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000021
Filesize
613KB

MD5
117a24f8df93cb18f513ca58d426ad41

SHA1
cfc25336c98be31856a0d4a064c9119033a95ea8

SHA256
6914dd9ba2bdc56c2dc31ffa487b61b71240d238445d99d1cfd1ff395dc0692d

SHA512
406bfcf17969f06e17dab79005db344ea3bf6bfde4a0891fd4314aebf7e0f21e49364a7c4c3a160908b9f5d2dba6c93ed481ce32139cb7d17540f0eb84aa8285

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000037
Filesize
21KB

MD5
805321a7ab08b098c7e60353dd915cb4

SHA1
84b5c3f64adf6a3b4f2a1c400d31625d3086e509

SHA256
37db7a8a979ff0dd017e502271e3a4dc6fdb1415a721979352865fa073173bbe

SHA512
2c5e8b232bf0ca61bfcc39a426535b7a09f2b277617e511ef6785723f1beab6cf6cea36d4937bdddf82b3dd3465326c49d5bf7b8a68cebbb441f71c9373a5d53

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00003c
Filesize
63KB

MD5
9532d6cfa45799456b447d26fe0f8b20

SHA1
dca8a98ad97e8af759860bc6dfa47e050f0daae2

SHA256
0bb31d364405d0dc6c166e77ac4ac26a5b9b7383462234f50536da58a2f49546

SHA512
5ced5b8a6278c679f8e2f430c5af46fafd863cc5431107be1c1df02be243563a24f75551bd76c7eeab2bbe48afadd7f9c03fbf13fe7d8dceed7d21eca14fb4fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00003d
Filesize
121KB

MD5
2ed606346e09f5459aae4962da201015

SHA1
e76aa356acb7a4cbc0853d4cf222e53d601858f5

SHA256
6c3eb207f4875f19774cd2f065e6f8717d74317960c3c8c25b0c0bd54ac2d233

SHA512
65e98434c426705dc9b01b4cc41c89d74eb29e26194acbd041083237ac2675cf291828f98668a0d2e136db9a0f7dec93b014117d3fd69e9465a8433fbd7d8114

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00003e
Filesize
278KB

MD5
8ca5b4c94bdb9059b420f716c641beae

SHA1
6d0b9ffbeddf43792d909d697c9d893287b5c89b

SHA256
dea24dda6399ee36e9e3a9a330025d87ef7857412e9851945b053f19727ca695

SHA512
c744b390521f9b575a88de078986b701f20aef1ddd1bc7d050ab63188b2fa23f6f22729206f97d1058c7d4f7b2eefa1591a22ccd1ca9c9b7c2f70f329ff02819

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\53ccae0f086ff811_0
Filesize
388B

MD5
a49c7869c81cce37c6e3dcf169e57f21

SHA1
bcef941281033e51cbe424f88d1693baae32000b

SHA256
d9271a0f4d059d6991b4a381d9e0a0377eecf442ad918cfbdd3d5c54fe76d48b

SHA512
5b5b2b547dbbe1f594ad52c8e836c57c401d712885d6ba0ace1040cdf7bfa0da8c641bcd66159322fcc4fc993468604b03c14f798b280c560adcd4efff779961

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\85752563213f5225_0
Filesize
136KB

MD5
9f88d05deba19b279291afa5d1a21ef3

SHA1
770d36e4815085c115aa2c25be5ed76e529bac60

SHA256
2798a9e7e75cca3b57c6750675d4a05d78caa1f0da34aa4496c6ce88d0b5f495

SHA512
c68b990fc424ac57ff3528315d03bf3aecc84b0497ce8c0994e12334c27d68e0abd7bb69a41dae174232976fd217850550e2efcbda815bed590cb10c9c760256

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\9a0dcca5a4fb02ce_0
Filesize
1.5MB

MD5
2a387494e9906d4c6c0ce8cdd178a10e

SHA1
369349d34c8929c071f590043ad8b1884b2a7ff6

SHA256
02ef831b031bb8d43e30c91c0cb646f8794c693e680b79aa7cc87c9434082867

SHA512
1e0f72fbe21fd03192e11deb488c56bdfe588a85656add87cf6f13ff13b8583fb6074e7332f80fb19d134b1c4e34b36583becc3f2cc3331f27d49b5dc848c520

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\9b011c5c25d4f0ba_0
Filesize
413B

MD5
294de65ed324c95de2338fecfefb2137

SHA1
abd2e38ea648ecc4fed9cd354e9567dde49a37e5

SHA256
19d076ff86469c1b028e093019605e25c796314dda0db24d24ed3afa52333463

SHA512
ee7750567e3e72ede16db51bc0a0092b10a9b00eb633562302ed21cdfe447fea2e2bbb1cc28b317380d99066aba18ee787635588e65ff8c5a0567de96936c1c5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\a7e51d4e7dba1fcc_0
Filesize
205KB

MD5
d206168b41f1341b0e529a039c53b25e

SHA1
0e8f7e6e7b6461e04b32269dc64141021deeb490

SHA256
dea96484ec143c01a66ce89eef40195325e1534380abc8e47745ac21ef477efb

SHA512
73f55d0cfc1c604caabe513e14eec39df208027374f156d1d2ea7da6aa4e278aeeda89ce0931fe4accf805da649c70e41837a1776b952e16e95700fb562eb917

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\cb126f066a015e90_0
Filesize
505B

MD5
f2e2690983e009ac23617bd64fb6459f

SHA1
13eb4fe0f4c3f1ce8c259c497cbbf00f10668eab

SHA256
df60db2c929872c8d7f35b13c46aa418ea0f81a146c3d8fe002bbb3378cfec74

SHA512
1690768a4c1a8c7110ee01d9ac0e1978c2f01cd9bca351c9a246e1767c466a26206a66538200b77c7e069f7681d0f46e041ef4643d488f086da3a6d3d15a4b70

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Filesize
1KB

MD5
34248609c0150067d4d07d2af268e3f4

SHA1
acc8a327fc7a91d3642256e48d74cfdd5ad96231

SHA256
9be053c18aaf6eb20f3000526e07e90ecb3764c1f87d967d29a2917060673e1c

SHA512
613bb0c91be6a90b7be47174df395da680d71a08e3d9e98f4d2b07509470647678add10c00a9d8a77bbb09ce73f1d06c1fcfd001947ee17675a6f3f6cddae74c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
1008B

MD5
32214dd9c57861a36bd75067d140964a

SHA1
4464b0d70bd26bd13f1e6f8fd336bcb2e348c591

SHA256
dc45a38421d677c2aeaa558cc182cc6a53f5b8c656eadc83d1a2923a4420a5d1

SHA512
30fbfc49eef021f045de5428956674da90aeff53c99aec4a06fee2d72991bf00274f9559917d411e8089c879b4bb72648b67afea8b52d4521eb2645b69ada24e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
2KB

MD5
0133fc21adc46e487f8d670bf9bdb06d

SHA1
3677880cad9fa74bc5b97d89ca0c9fe3eff64fbd

SHA256
8139b3cf5fbfc54ad5bcb025008d70431c5939ab920e532943724493d0836f21

SHA512
0bb65b42455a2d50e6bc8fddbf78a86cfcaf89422b799ae97caf63ec1189de567117e2854173a769928d261e512f6b46a1f03e475029e97b61ca522120fba98b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
912B

MD5
0b8cc48879c858856c0c53f4a3273cdf

SHA1
8b205457f52dd78ebf7143b407c2bb2dea2e58a6

SHA256
82c0eb8968a5079b804392c1cf3b62493bdae8bd036410ab867d09ae76f878cd

SHA512
062cbc07d60bc8083b7ab60d7f4b202fa75fcc863543e7476a575380858dc304f95853ea9191992f5d5bd21c4b9564c3cd49fd0bc2801836b4dab71089737f8f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
2KB

MD5
07c4fc141733bde8a5f9cec2dc40166c

SHA1
6f23a8db40d9bf6b4d3941eb2f1699927ccc95af

SHA256
cff41976469da2913400558389d8d5c453ea5ba44ca2a5f006c9557311527753

SHA512
6ad0c513533fbd772e04a99244bb7f5546f14d442142065e97bd79644a785f9dc1608d9041ec3962b95fea5c77b86f72300a9c95c5fcd25a6c6fa23d36687afe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
2KB

MD5
816ea409b88279befbf4392adff38fca

SHA1
0bcb9dddd522f4e533520917a6d893817c92162e

SHA256
fab5b8a7586e419fa22aaf6678be9d47451df5b33bdc7ec8e6149c1f29942283

SHA512
b2ca28ca3ad0a97e2480b60be17ea5339ef3961af0cd35f6ebfbda4ca1c17ce31430968e889299673180e89d9abea2a11d4b534dc847bec059d28a19abb46265

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5894b9.TMP
Filesize
48B

MD5
73e17ba5db700ba0a5d89d5fe66e0ae4

SHA1
521b54971b9d75caa5168a6f9990ceeaf36538d2

SHA256
d13d3a3bb2a6f2a0ff5bc8e02b2c00b5fc9ccdad4e342ea901bcd0df6e859865

SHA512
b3b77991c56748cdfcd1062e76519b682bb135f33ae04a0274b4d1068695bde518a6fec372edf50af6e0700c7502c6f8092e8bfb5ee3c24779065538ef8c7bd6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Filesize
70KB

MD5
e5e3377341056643b0494b6842c0b544

SHA1
d53fd8e256ec9d5cef8ef5387872e544a2df9108

SHA256
e23040951e464b53b84b11c3466bbd4707a009018819f9ad2a79d1b0b309bc25

SHA512
83f09e48d009a5cf83fa9aa8f28187f7f4202c84e2d0d6e5806c468f4a24b2478b73077381d2a21c89aa64884df3c56e8dc94eb4ad2d6a8085ac2feb1e26c2ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Favicons
Filesize
24KB

MD5
8ae97d55dc54e0ac7dc1caf52004de2f

SHA1
c14e3449579350e0052d2dcac46fca59857022a3

SHA256
27b1914dfe5525e028ef0496aa5c7926a8297fcbcc72daa1a0337555c7f1f09a

SHA512
e9da2b787d4aa60061ead0a108ede5411c94880b05cde0265a013632904edb320b6aebfd4dc36c79bf369f694707013a1387890bbfc2dfc5528541836371cf64

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History
Filesize
124KB

MD5
128974046c411533c682ad577206a7db

SHA1
cb9fce95b00f405d58abd5f38708235e64c2b6ab

SHA256
c99a0fb6b3e233b01f242ee06482a6abb61201953934a2769da8d91589f5ba1b

SHA512
c04edffab7cb2c232f274793643bc902cba61c825a2e937d18d1f097225e3929ab189c4d120356637f948240420faf7e33ddebc0b5903fb2dc0ed0fb9827f1dd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Microsoft Edge.lnk
Filesize
2KB

MD5
717cbb3b012f784024c53f73d4bc375c

SHA1
8381b7b5b0482fc75a0e418477193d7939a3c777

SHA256
f04dd3ad50e09b29b0ec051acbe87c079d0cf7216b6089d045ce5bbc3ec4b840

SHA512
43f9193e858a7c98ea6bbfe36f3bea1512d29ecc5001bb0b3b17a4cfd4b28f412e5bc3f09a990f7c06de99a5a3d486488f5725e30bdee7bab892e7e577d639c2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
3KB

MD5
91816113737e053c01c202948fb40719

SHA1
48d898a2dfa2f810d0d99140602f63b08c7a70f3

SHA256
831824766a257a4f20e3f661d1152195976144407b1c5a043f130d092b867e40

SHA512
84c9c867d7660672795066704765eebea531fd7e324b4febc3f197ef731bbf10c2bc7980dc3eb83deb94af33aee5b63ed38eabdf69689a3a588e1a73f017838c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
4KB

MD5
d8785d1bcc7f0576a00b2f219a8b7d21

SHA1
bc22cf0439e5f89b06b18b178c776eaa6af02db3

SHA256
91f76d7f1e7af5a41f7a7914b11637e69ed0c22b9d653a116aca94de8c9d67c4

SHA512
42e97484107643d75011f6359d524485854d4146438fdd8541f16a4d9b52a8cc3de101ca65601e3e3a0a561041481561a1a4caa5e28a46dbde3ff036e8e38234

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
8KB

MD5
151bbe650881eacf49308f97b4beeb6c

SHA1
0cd5a755fefa68a8dd4e9af3145a73ef14b40532

SHA256
f08c98d5dd938931415efd28a9e512a0444cc7a75aee98847177b9d246da5543

SHA512
a05173f8e49bf0ee4207c4e1b4c42d340c607bdb2e1590379a59b6e5d5d0257175b743738610f8b6723e09d617768d4090a3394e81a525248a7094f9f97199b7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
8KB

MD5
eb27eb9412139303b79e5df607df2d4f

SHA1
4210d12eb9743e99f95c596aa4379c9d13a46246

SHA256
675d956a2564dce84cf705c6b0b01ab72d580ab18de8b9fdd50030bc7582b2a0

SHA512
9e2067b53b3f48907539aba5633f152e13d9a169ba19d3cc7c817281770ab63aedf01f07c5d1bed9862103d03c592d5eed235eb259d5524ed85a240777352174

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
5KB

MD5
5cf8bd12dcbdd49364d7b48e3513b34f

SHA1
c3a7489e65a8cc90d8d7e64fdc40a69fc66431c3

SHA256
5e2143264b0f2f4d3815dbdb06cca2d8769b42461149208b3f4b7d058867f7a3

SHA512
3696d650681b3aab4af224cf0d7fcfb121cd8e5a0627ea6f8ec16df92b2077b67c17cf3bbd1f6855350c66ce17f6556e94d7ed3b513dbea6627a4d99afe7bb16

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
4KB

MD5
718711aa779a805ef51be44cd4ee2cec

SHA1
76e4bc8d189bab0a858da62f9bdbb15d2f4b7f38

SHA256
3d8acb856b94646be6c6577292580cc4843b01602a98002e60dc010fc72d1da7

SHA512
ed9b73889b021d979ad6dd527819eaaddef027072180a273e6b794e7a7bdc83af9d29fda1e40ccdcc8e31e98f21d5161a3fd5755a0ded8d8c81c8bba3a77fcc5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
5KB

MD5
19551693870a692f7a0b3661d4e8cecf

SHA1
7b817650931e154ceea400938984cc6df32cf182

SHA256
f67b3455f23b6b3b3d0a0e6411f6925230784df22c52d03e1a05e707295fff50

SHA512
0de9046c64e4e4573c5d3229bbd9da339ac10b1dac7e7251c10246e0ff65c93886305c4717decf5910ecf7b59f0b1a0fa5621dc8571bcd18d5254de9d48a065c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
34ccaad802e725641b1e36578704862a

SHA1
af44bb07ecdac277be38eb5f8cd417e26884bafd

SHA256
70b6ca3b0a860b34e7476d7b01108a0aa9a64f06c71864796e131efd0ced383f

SHA512
65ecc8bd92ac9d1b74aaea9c1eab74fbd760dad45bc327a65c862fb0f7fa6d21b7ba34eb0fa97aeae4415f608f1bac8693e40fad69f93c4200a0fb15a5c479c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
7KB

MD5
631cee154410d0b699a32aab21c2bd6e

SHA1
5211d2a818c96c438513bf0c30f52b21a4594e1b

SHA256
6ad45e9c72d0cf4bb5cc0735cd1a823b2e3260d0e8a88b28592b3d1e2120cf2a

SHA512
e7e5c73b70fba6ee31aa6d3455f321e6cbbaf92fc1117fd754a5bddf4526883a5ec6329002a9eebec88a35fca7b31ee51b881c0e4f7b4adf86b9c062315c5843

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
8KB

MD5
32196ec1aa839430f43421ba914e454d

SHA1
8b8fa2a995cdc129d0d7385637161924dcafb834

SHA256
f457f577773655a5ae2afa26a74ab7281e13a76db9c97bce9b6c7963848f6239

SHA512
39201f6be4aab165e17ed03052061185edcdafe31c4a8188a6cb79c22bd385cb125c66fd6c29420c74034e8d915e9599ed573168bdc2d4abfb41a352c3403017

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
9KB

MD5
c9b718c4b4e783ad4ed0e9a83c149d46

SHA1
02c440c2a2c8de013327fd05b819b63f7771cb77

SHA256
36947d456f4c623118d46b22fc165359c29189a1fbf1eae3c3b282ae48c82f13

SHA512
ae9494bc2bbb87960f2a59a0b484ac8e1c04cbe207eeb9972730f96051da54477f6b422320b59aded8706ffe76193c183655dc13538a8f305cd734a5049417d9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
9KB

MD5
69d42cd609123178ac0baf2367a6a3c0

SHA1
7964f413ca609c705a7d0e38d4f961e79000b677

SHA256
eba37110bdc96d9f21aa778a10643233a4f2f71649d71a6604774279fc87c470

SHA512
781fc1ae76ab30ff61c1a51bb90e237f8511e17a88cc2afca0d834432170239912f3b9093ceeec85c1ae8cd2123d5b3442547bf20f22314fdb775ec3b33c8b91

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
9KB

MD5
a7e5a311cba1514715cd7b88da4fe921

SHA1
f0db0e64e00b09b8b9e5a8921b3651ca78a82a3a

SHA256
57b888ec2156c4647211c7dfa32265a7cda62b31d61a2b016480dc83ec25540c

SHA512
2bd5ca02e4b3bedde25c9f7dcaf508a718657513a21c9cac109198d61efa04d2bc077d906f64b4266e672c97696a44bc03e8ab7157de6dbde275e87cf9720581

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
9KB

MD5
2dffd144ecb0fe4d19413043f70e0efa

SHA1
6be969c6b74e5de029dcb4987218532cbddf4aac

SHA256
3318c8931cf3b4de08ad85b2d02a0911e9a32ce7f6fb944213de1d626f9746fe

SHA512
0eea820e4794a8332b53d0075e3393e0eaa6bd38e754b23077865649c76131ebe0ac84c39aee9e228b134d5c0e1917fd1ba5ca6be9ac1dc9edf3b14cfd80d6b9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
9KB

MD5
410e49af46d45c2699fc53127c3f682c

SHA1
3d61e0d8a9f648d10f74e2895b1270ac0d49c839

SHA256
b6233a5e7eb53ff536928697479c29871b2d5f75082af1284280fce4d0a62074

SHA512
cf04dd05f0598e667673f50a5b3bcee88bd35399a8cbbdec59e681555303a3dc04e99a71b03f1f99215e08832b958640ee26c138156412cef3c5c383c4bc0420

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
e4f600ccf0043d17629e7854f1f53350

SHA1
32fe5bc4b092897eb7031c00c0c91c8cabc282ec

SHA256
e5271bf4c97508d41784be18e3d61e48b3514096412965a633fb74e367762470

SHA512
61a9407d55bfd4c257e8ac115312aa247f3ee4556d45517e0ee70079726921395006be729e12d2c62f1730744440760f516048e48d1413c870d1c29dee85713e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
9d199a9440322a635b61839a8bc78610

SHA1
4f97897d5780d88d5ec58a4022ea2a5f3b26c5ab

SHA256
fab8a34b94bda1919dfd1056f8915b82be2dc949cdb6f92906740c39b1b1b7ac

SHA512
28a7e7261a0b357e8e4b2230e9be7be248b74f1971eadf71f63e290a358309488231fc52eaf22f578f100b3dbfdc81e8192b440d75324f10abbf1e925b51c544

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
8KB

MD5
b90baf53969b8cb791570300ac6f99bc

SHA1
b82fb59a4fa58d9cd5288dccbd4e7428c784d32c

SHA256
4743f71863a841bd5edad2bd12fb5c714c2fd7b18a4aa290bf8cbde1a8ae6673

SHA512
c20a9da0dcb0966510d552826922be4198114cd9aa45191f535e3016c7823fecf60d2d24fbf88098f854dfa1d0afb26d3447cb5d3daf864ef4fa0cdf91ff7a4e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
9KB

MD5
3fafc1f551a4a66b3e91933bd3140e11

SHA1
6e0d9043c1f0457e5265b4994e3b28ea92279562

SHA256
eede54dfddf18d0475b347bcc19d19b853173291c644270366042449419a142a

SHA512
4cd43e03124b2e0548c161c72435f9893049c83681d0954cf80bad66f8054281c13516f32fdd6ba7e3f71bec57249b1e5f7b15e35cf31cec4d46e798445fb6d7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
9KB

MD5
3c19a96b201a9c46f9e3b8e31f6f0921

SHA1
b79a229e84ed9aea922888a7f27dd1764e417c36

SHA256
3fe86d04dbe5bd5702990bcd19adfbcc85d4992efc7fb23e7c8ca85b108d5251

SHA512
3e0f077b74f29e6cb0b69b875a7c2f009ca09c06ce3faf4d92ce103ee586d0157726e782e6a95e199f0a13d75684b1a26ccc063aa2224bfa00369047b5f1ad05

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
7KB

MD5
799f7fe02c5368e91e6a264b3635fb89

SHA1
1611167029dd71745340fb6fd95529de24fbfde2

SHA256
44a846fb365ab74fec43e9c1e9c2f509f29c163c447f2e0f12b7473e459a2aae

SHA512
6f2f401be3bbe1f422ce7c701f103d6d08ea07b46df1e703db764d5b8411f8704e51b3144b8ae21f903077de39a6a6d48ad1ec8b66f6e534458e17a8f09d7dd3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
8KB

MD5
56d08fa784bde80782b8f0901afb1be6

SHA1
aa1ba67402f9e9de8defb878f21f2aa0f853e5a8

SHA256
ef6e29ccbdfdf96171765bfdd44a007b54c39d9f7276d343bdb993ecbb1bd3f3

SHA512
73cc1e7a57564ce737d337bd5935f1130dfb61ea6b15999ad26677ccc7419bdfda4e1a2eeed1bd3a7d40c557cd651ca7af5791f31f62cc7a09aae5d2c616a29e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
8KB

MD5
56d08fa784bde80782b8f0901afb1be6

SHA1
aa1ba67402f9e9de8defb878f21f2aa0f853e5a8

SHA256
ef6e29ccbdfdf96171765bfdd44a007b54c39d9f7276d343bdb993ecbb1bd3f3

SHA512
73cc1e7a57564ce737d337bd5935f1130dfb61ea6b15999ad26677ccc7419bdfda4e1a2eeed1bd3a7d40c557cd651ca7af5791f31f62cc7a09aae5d2c616a29e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
8KB

MD5
5ed81f6939a371615780f4a31af1a9e6

SHA1
69874b5aecce2bb2b408b852d96e540cc2aad38e

SHA256
008a130f617e083edb179736c78785f3a5dbb9d4f76ea4b301e73c9ce28b2423

SHA512
59ab902b78c19701b0e1aca3ba39cd1c75202e7c5a7e2a6c9e4a9f04b60cd7cd02f94972b26bd9e2eaae8c8e6879f070298f67009401510d0ebd067239c9bb29

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Filesize
24KB

MD5
1463bf2a54e759c40d9ad64228bf7bec

SHA1
2286d0ac3cfa9f9ca6c0df60699af7c49008a41f

SHA256
9b4fd2eea856352d8fff054b51ea5d6141a540ca253a2e4dc28839bc92cbf4df

SHA512
33e0c223b45acac2622790dda4b59a98344a89094c41ffdb2531d7f1c0db86a0ea4f1885fea7c696816aa4ceab46de6837cc081cd8e63e3419d9fcb8c5a0eb66

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Filesize
24KB

MD5
166f524689f2340f93af075a9a6ef88c

SHA1
c44b971082ef72b93638930735a39a3b94302ce8

SHA256
b80f3ee893ad9a930823b3e8d370c076e112c4e8b68f784dc28542ff0fa9f9ec

SHA512
c1f14e787a1f69dc596586d87df2e2359a105d74d717d04bef03d58e32eb1c95068f3ce114c54b2a767c1c36c4c4f2681359199eaaeb38437b87c00394ca6868

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\3a8fb06e-7115-4815-b0c8-27f5ed056a83\index
Filesize
24B

MD5
54cb446f628b2ea4a5bce5769910512e

SHA1
c27ca848427fe87f5cf4d0e0e3cd57151b0d820d

SHA256
fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d

SHA512
8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\3ab927a5-bf97-4723-b187-0ccb9cbe716a\index-dir\the-real-index
Filesize
624B

MD5
dabb73c5ba4f6ce483b704ae17aa9f78

SHA1
84700f6f7b6d52296979e8d30d1f1d63991f6406

SHA256
99dc05f4430a0f9cb99ea705604c801cb8151e3f01a8465bd95670aedce17400

SHA512
7b6963650405d66a2179351c9498fe1b62f423ede80697620beeebe3690806984626152fca21e1dc3c79c7911337fa79ccba413995d15ae1c9638b8f9c32c9ca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\3ab927a5-bf97-4723-b187-0ccb9cbe716a\index-dir\the-real-index~RFe5a18f8.TMP
Filesize
48B

MD5
775f030068348a5b541c8b95bc45a049

SHA1
36475cb3b3258913f6e4cc0ce27e29464c3718a3

SHA256
f664fe7eeea46d4372e8f9c5c63f42c30f73f724389b501a26308858c5b925be

SHA512
99f066be058f1d96873c4b75055011f90bf11441439d74aafde1676060f713065ddc476b9f8b92e06ea339ff12532ddedb2498e535999d9ac8875957762092ec

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Filesize
90B

MD5
9596b5897e18951123d98982d055d2e7

SHA1
6cee9ed46eafc452fa07748820cd7768486fa733

SHA256
301af408d61aeedd0f92859e2b495468155ca5028cbbf4b74e50a72f7d1eee30

SHA512
ae99a84d288ef047e7cfc44003d006ba7cac2f6e3f547cc0e233db7c041bb79ff5001980f5f50ad8e6cf3fd39cc7e16b40106f3c4d7ed7a8823a22b180e8f0f2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Filesize
26B

MD5
2892eee3e20e19a9ba77be6913508a54

SHA1
7c4ef82faa28393c739c517d706ac6919a8ffc49

SHA256
4f110831bb434c728a6895190323d159df6d531be8c4bb7109864eeb7c989ff2

SHA512
b13a336db33299ab3405e13811e3ed9e5a18542e5d835f2b7130a6ff4c22f74272002fc43e7d9f94ac3aa6a4d53518f87f25d90c29e0d286b6470667ea9336ae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Filesize
90B

MD5
4dfae2b4291c3f9d850c10cc0e439ca2

SHA1
1dceed89e6d09d74ee26e2edadaf588ef9184fef

SHA256
ea01ce614043ba951c913960dce98f06970b5c3f57db1014b8de01be018a2440

SHA512
dc4ba2e0a4dc9942de9d11a24c441b60c446530121b177fb045e19b5dba11bdd3ba83fd5c020219c53a9f40de0cbd4d5b78cb9c7f208549207d57fe3d2ead925

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Filesize
90B

MD5
55fb85464f9e54d487c55bedd50a1c2d

SHA1
fc61b0ae54c4cb3747d9297d21b8e8f8c730d959

SHA256
858659b463e298a7e12a6e7d47f29a7b0a4271cb63d1143e8a5784bc18e0df61

SHA512
194f05b096df7ddd2ca543b21975c20c68221df8587a4610e8284ab1baadb2a165927f077d8006c5bc2a96e49a2a95335b6dc7f042b5400e116d8015fad92794

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Filesize
90B

MD5
71812b03f1d0532a89afd50c1761e318

SHA1
db7417c937f2b2dc04653ced3cc802421df6ae14

SHA256
ff6d00a464bb59bb272e98371fa4a51dfb368da2ad7fec1418fab88e08fe93ac

SHA512
6a168804515eaa4da3e7c5228ff138e5a7b1b8eb66498ff5d0f9e0ef25124e96baefbc44528992985d590e8dc5caba9c80469557857c32b681898cb7212b4e56

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Filesize
159B

MD5
833ed7c33292c55e6644856ca1d7dd0b

SHA1
9cc8f75bd84ff9362733a893fec49523719a6990

SHA256
108f9ed6a341e41ee28494966c7d94fbd4633a0fd1b612c5570f10d3a7c4100c

SHA512
95e6e47e91a5ce624d6eb27de5beec7f2830aae24cc11654288f8f9f563231bc5dc61d3a6b7f816449166f9b610fb125c62b702a10fbb151a2301c4c3062fde4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Filesize
95B

MD5
0ceb79224d3eb4a7236061383456c46b

SHA1
50e38b08e4d660638041798daa944f9ad9b8bcb8

SHA256
fd4b871f5c4a928cac4bdf4623892bd95910a6057c345fb14706048ac2c1f99e

SHA512
eeef87960757b3b07a760a9fd7b5d93a4b20d955992359c7022bd192a4ac948e15d064f0abdcd3b36cbebf021257e8847b5128049b7821c6941e1871399602a2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Filesize
159B

MD5
d60d531866f7953385ee824f5c9410c7

SHA1
381b90c319aeb9697444cf53a0bee32df6055e6a

SHA256
9c3fe596677faac025f69cfcdf4289437732d98c5aada62895fcdf7cd718f7f8

SHA512
0167ab54a405d46f74dcf9303e74a25fcfe226aca2c9c957483f905a3ecd1c2aaac148ae2428fdc824f72266c45a95f7fe40319d784cdaf1b27d60fc356d71e5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Filesize
159B

MD5
7c1dce670788864105b4e3c5a326769c

SHA1
6d6860de89f2a10c94688e5ab19891923166edc5

SHA256
b3de2b973d32376bcddba0ce17d3684dd9139ed601c19e75c88118a4ea1efdff

SHA512
8a55bcc55b841d9fd1d968f043d70b55fe1d46392f4d5bb6cc8e559dcd2802d34f8cd928de9992d9d0f6d4ba7523aa859100f6c347f4e602a6e9b0289610e61a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Filesize
159B

MD5
9de9287adc4de66d6320782a0319a419

SHA1
0b5d81e7cbaee1ce8cab343c84a7defdd11c9542

SHA256
fe79940adf04a24f0c44095cf2dfa94da4fd1468615972953fb89ad3c8672efe

SHA512
73e3029d3f66c5e3c0c3b2382518c275c8b04c20a879180c3805d3e249f077fe860d3194d73421d92b886e6931771e01a2c04164647110f7c3bc791035df7b5f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Filesize
159B

MD5
cbea621fbfaa12f8d88fe6d9edf2c02a

SHA1
a80d0e49ec93cf94a9646c7cca2928c81bec974a

SHA256
35d566f8cd88c976e09847e0efb773995a36a3d6ad41a59858a8c0444b2c4eab

SHA512
3ad49eeef31fbd42d31375645741608d31110910940057ba4aa735200014dd38132c988b7e6879053123694dea39cf953f9b5b3135458b1b5f2078b600dd2fd8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Filesize
99B

MD5
aa035cc8ec2067c46f04f1669f78c494

SHA1
e235cfb999a91d9fd7d596e6de19b3f9a0f20ed9

SHA256
9a387eed800df7b8992a280416cefb07de25c3d711d9d377d6a5f574f141ff27

SHA512
a6787d65d0da9baa1c451ab48fcbbf4c54df6da5d06d25fc05b32b06ad5a31c5cc60fd495b1994410431657987403248069e6499f441847734804d39e50d0fd7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt.tmp
Filesize
90B

MD5
500db70392d6f776f42b9c43261469bc

SHA1
0a7ad641903014113ce13792bc8177914a0a5ba3

SHA256
8e22a108d9385e2d5201984efaa1998087becdffd1d0b1613e83dba666e0bcbe

SHA512
36f03d3535e81e144292ca3a783e3a24d6710e89ea20476516d589dcb65d1ef0b97b627c1be68b1a3c0ed2bc909bd5a192919e51bc12fe7e0be453fc534bd008

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Filesize
96B

MD5
6ee5f5250d45c0e0c8f0a30fd9238c5d

SHA1
b1af59a792f5889ec8fcf4fb1e94fbbe8bbfe2f9

SHA256
a38ffb93650396f94655f69484fb197e1d1c1f563676475cc09eeedff42a9f5d

SHA512
9665317b3f4c29f3150e8a50ea1dc5697165fab6c0cfbdc83fcad10d59dc53111cd711c7c7a7a137bc59e586fb1b374dc0fe7c97db0d00af67133cc94977d765

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5a0725.TMP
Filesize
48B

MD5
1df4b50ab8971b2ad2423cb70a9c428c

SHA1
e8fde49dfe581868e8da3dc69aec96ffedcbaf4c

SHA256
f1002973c34e2cd43057fb3ad4226220c8193319c1bde30ade1425c50840f085

SHA512
8ab2db18326878479df2806d592cc72a7c7b3b7fc1ba3895288cb793758bd566b2b39d16c4f5437e3676b485352a2c68c4d1edc9772c4d520abc35a4ab9717df

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sessions\Tabs_13325334404280004
Filesize
20KB

MD5
00119866f742fd54fff2fd1343e17c27

SHA1
bc27a0befa167adb06387d86367849ee494cbd0c

SHA256
c862f9de55a8c64d7b2f1113197e84a2f2e55a9e447be83367c4d57519ce9af2

SHA512
d9de450f120a345cf83e7bc742457ac11f9a1556b144cea3c8b275a1ea2f6cb2633f5b1afce9a3c52cee72561d1ba125b5523df4062e8fdb2ce3572ba2611283

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\000003.log
Filesize
187B

MD5
cbc9e636e7cb701ce757bdc8d1c6aa96

SHA1
688557df22fe1114dc65dc285dd7f24b6f773bdc

SHA256
bea6d891ddd2647611d614dafacb9718d191a8d597265736dbe9d2984e87694b

SHA512
4733b04a8dfa33083226af1e9e2427d8563fb3d5e5b3f14fd01cc28780d8320cd361a9efe5cbf52e90007899d09b607c60b297a402d2d1e572c9b67d01bf548e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG
Filesize
341B

MD5
e8f8d2760490542d6e422ed85c5d199e

SHA1
45b2492a5e222dd4d0ffbb3ac42d09d99c7250a3

SHA256
120ad7630ea3301047a9afdcda19a8563a42b62a997bfb5d1f16c6fb1bf56c72

SHA512
b68e7ed01d269c4b855d439515ee6dde9c696cc164aecea320c3cc11f7af724fc8b88cd7c16164ae1a1a28795e312de66005b1e25ed5ea65d15a1bc271a3ffc4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG
Filesize
326B

MD5
bc03894c56fadc25809cf7b5c6a9836c

SHA1
c6289af59fb3b255981f0566006365674ff63f40

SHA256
138d19cd4a2aa1b80b2bc2905e02705455a9f3db8adeaf4b8b06de098ce19e01

SHA512
a84c04475715e16c36a8d22f1fc7fbaa88a3139bfe6ac550c125de617d0f839d661261dfbac432284d1b1d57629306f7c7a4f2fdfade018764debe27e6d1eae0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
372B

MD5
51f1ea09f63d669afa05d07186a4e4cc

SHA1
eacffbe3c3ba0a8bf745d3ef6b189798f71657f0

SHA256
2c1b781cdd6e2efedc0253b7a053043a3cb09c3e11181287b4fb2580f8ad74e2

SHA512
3c69255af6b5d937d4f08f246a1e765a66e4e6450338064fb1c79ac1b45a987ee3a2c6cbc16cdc6d3ffb24d2bac0d9bb598cb6eebb39f6d65c3f146071f668e4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
705B

MD5
8c23badc9e7e7f5c056959c2d72fa97a

SHA1
aea0ae66e0a7c74e33940126c1263c0ee1548897

SHA256
f1067ce0786ee99fe4b92ed8fb58a4b3d0f92c00174f83477d1244c1128e62a2

SHA512
1910afc011a41eab0a7906267008b0b68e2dd1548442c907f9ffc613413db8130a583a185b0232ad133ae3bb40264acd276ca3162523cbfe0aae329988246fc5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
372B

MD5
54d293617d4928d0d4a320b78283eecf

SHA1
b6c7a1e9060950f82616cf846592363220bd078c

SHA256
a6d0e94cdda3f3ddf85ebd780dbe7d5381651561bb3982474cfe3dd8dcb858a9

SHA512
e3a224ac2170e254ddfcb0d4f791ee833857fe6347705f62d26328c8e39c86573c64085448645abbc423dad97a6313a25a1ed5631ad5fabb18d15d7ab9b9312b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
872B

MD5
a2123eecee724f576bf85381e56cc251

SHA1
2a7c57992255c3d1c07ecf977e50dd820998f66b

SHA256
fdef7de2ce869b0ecc4fad34adf35afb96688bf2fb7b8a0cd694be5a3ad0de9c

SHA512
764ba9c0d8136b85cf01b83870f7b365cd127114444677aee7da9dc395f515136b4b98a2d03b994f61fbfc296c95eed2e6047a9a4223b43a5446eb057db12ead

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
872B

MD5
ffe8323a217506084ba5a459e50e7a05

SHA1
ccecabcb58e65c9ea1d08d5637f585585200562a

SHA256
7c4e085f92174edb7729f609b5baf3ef23c40ca5133d4bdca50f85320aa0ce99

SHA512
f2b342ecf1e81470fa51be4952b0e844c710cd5c6a8343a21a66e8954c2413af0f7573862eae02851d590474ff923ed14612bfa9ad5d1665b9ff3d6e2a528f8d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
872B

MD5
c47f3985b3749a44f42c7c6d383e3186

SHA1
558494dd0eac16846aaf23ab0bfd56978f8440d0

SHA256
d038e49c3f6180f304e829062b9088132e30ad321000c59fa22abe2a581173d3

SHA512
82cc3906c6074344df933aa77bfd53342dccbda47f7b9429994f78ab8440d667295de3b52e30a5c089c340329352555f84ff379c3a3c8f4421f058d580c78db0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
1KB

MD5
55adf9957dbaee9d288581eeeb1bc67a

SHA1
2bb90c2049a84998d3a905a06f7d0528d02e0077

SHA256
7f107e85506a0de9ed4b74057721663aeefd1da370b0ffbfe7e1c83329845ec3

SHA512
3e12dc41871419e2f25809d0379a64413db5bc272d1869a8a95f3bdb06d72c32cafb356ef561b8c9b72f9e0267c9963919043f66eddd342f9de9e3d252b30fb6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
1KB

MD5
af16aeacd15478bab243d04278819985

SHA1
717efdfa68f9a6a0ff9f4a2fb912cfa1768b9529

SHA256
270107678dd284c74bc162735827667f2cd61445ccd5630bb351c39f8cfd44a3

SHA512
2f196bafc3562c6570cf107b0626ce7536ca42991ec56be319ff4c896730d47e244e0914b43dace019b9fbb08f01fc08237f1ce9a6cd968f2c90c8322ca13c87

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
1KB

MD5
5bab629139d95f498e0557a0e787845f

SHA1
1259fbf0ffc6087e5135cac15a7f9460aaa8f964

SHA256
748c68e6e3eb2538ccc024150d94c495f5365c01f3b74cf2ff5b7007de5dc71d

SHA512
ce7a33fb52c3bdd187daab31a7756026c98781661a54744e99be3c6abe39bdc2dc90675cf4239bf95d1c893bb9e9099f6a4f91f36073baae6c5d4d6bb8980cfd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
872B

MD5
34ad6dd9a8288786687dd28c27aba9ba

SHA1
0993f8fbb1835cf04e04a8c204b716066f7e24bf

SHA256
e6dd0949e144356651bd34191ba0a044b46f76c4d8e5ea5ac20c1be4859a5a42

SHA512
fbed5f73243ad03a060a603ec2bed9e6f1e3e22cfbfc8005a711c46e2688becd88882486b25d0f9d7dbdff4d4deacb57524419cf433a06684d9b997190b7e77a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
872B

MD5
19cd3916489cb99e38483c247fdf8cc6

SHA1
42f8720e81c4d0c3d6bca6b056dbd89d68f1f70d

SHA256
7e60070846cd4b846d5d40fc7d10a36321297c6c04fba02d1773d4d29cc27d07

SHA512
a71246041ffb9b80c4a116e2edb38c4f89d091542ee13ad0c2f94f528e8048cb9717005b20ee715ff213677e2a7b8df2b003e975c3fca0d428ce2b0ede306788

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
1KB

MD5
1da157af45c2a1773f77faf4e5a668f6

SHA1
b94dbafa96a58efd91d0f311dc9a1aadfdf30c3e

SHA256
a585bf0cb04272740bf16d9b4e9f914a27fcda4da170ce4fa219fa08e95b0ae7

SHA512
b25f35ab2b4c05b1b4f247559d8bd6a88d885ad4ffd56865a52c068fddb1eee72352b0cb10e7c20afa92e3b9d543a3219b43e0e91594a256b1f034613096052f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
1KB

MD5
cda63f18d73c1e5cefa96765dcf41beb

SHA1
d0c171cbbf977ad01d29f5680dce02dd0dd335c1

SHA256
fd0ec1e6fd784780a1648df3b53f14dc268319376a1b46ddd7b72d13f8f757d7

SHA512
daf961c54884e9ee355eab4f932c6d32d1987c3031d28ea7da7d6d79063d4517e68570e6c79f9f456714a176297e46609dec98452ca2887cefc34fd2d3a6c115

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
1KB

MD5
af48786005d08a2261ce6f82b173f4a5

SHA1
e7987305a85980bbc617e28a61d7f8f69067c4c9

SHA256
bac0ad91947492277b1841b3d274a7ba617b50df7bafda2102f350f41dbd2fb7

SHA512
acd0b7ff1d2ed5914acb26f6fc8d89fbda4b4200df7a2af9f4567193426a006277434f5315fc1790aa4855b3d76cb3b607f68f2eea2ec1a421b84d81b411399a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe585f32.TMP
Filesize
372B

MD5
d3d50ed79c662ab92283c5f375e7016c

SHA1
7853d89fad71a8f07f1072579a9fb4e6c81efc8e

SHA256
b9e9941f18715f7b216c4420eddb1386c416d0c4c78f602bfcf3ad08cf902b49

SHA512
9313081cf061b790227170291154ffe25914a7f73db2c072571d87ad20d141bda16c25c6b68198e542eb98ae609ff186444c648929fd223144fa97b9245ee8ee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Visited Links
Filesize
128KB

MD5
029c46619750766658d3b6bf1c29926a

SHA1
e63fafe5281ba6f47a6ca3869e1aa22ed1baf513

SHA256
a71678e4d560093deb6403dcb2a701b0b83568bf7b733197cce586bd663ab2c7

SHA512
084000a9f0b003dff4506f5353827d93cac837a2d7a287ad42fcc46cc2f982eafb6421dd7ac348ea9f6e41aca841a1f7add605cad86b608b4d34d7f35a5a91f7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data
Filesize
116KB

MD5
f70aa3fa04f0536280f872ad17973c3d

SHA1
50a7b889329a92de1b272d0ecf5fce87395d3123

SHA256
8d782aa65de6db3538a14da82216e96d5e0a3c60496726e3541a8165bccc65f8

SHA512
30675c5c610d9aa32a4c4a4d9c3af7570823cd197f8d2a709222c78e2cd15304bbed80e233e3674ec2f6e33d1961c67fd6a46dc8ba8b1a301cd0722932c03c84

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\b469414f-38fc-4799-9af6-828a06c43fa7.tmp
Filesize
5KB

MD5
81eb31222adf31cd413786416fc3ce44

SHA1
2b2e908a19ee8c6c06bf63d9d26970cacac90a9b

SHA256
31cd49d183ed8ff4fae0566436594f8bd226a997ace5c8b9ce98c6995064e7e4

SHA512
0d5678870ecb7aaa562fbd4edad90ffe82d1b770589c959d8857d3c991cd8a06a9fbf98fdef6073bec588694e45f633f1e9fe1059dc9c891e78f6c4802d612c0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\CURRENT
Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\MANIFEST-000001
Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Filesize
11B

MD5
838a7b32aefb618130392bc7d006aa2e

SHA1
5159e0f18c9e68f0e75e2239875aa994847b8290

SHA256
ac3dd2221d90b09b795f1f72e72e4860342a4508fe336c4b822476eb25a55eaa

SHA512
9e350f0565cc726f66146838f9cebaaa38dd01892ffab9a45fe4f72e5be5459c0442e99107293a7c6f2412c71f668242c5e5a502124bc57cbf3b6ad8940cb3e9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
9KB

MD5
fed306c58112b75d0b31748a4bea8723

SHA1
beb53d1b2236bc84703951dfd6d4d8802d9e5703

SHA256
9562a6deaf599d08f1590d871508569dab8d196505d8cc733be3581a6e1ef9b5

SHA512
dd5147d6a1dbdb76ba14e49a99281a78686c73916e078bd86313f2399bf9a21d8a8a18d2e2d0b990f808e17f9edf4558a15eaee293674c7e2db8f14ed44d3365

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
12KB

MD5
a1d465744ab239e3957ba8ac81241cdb

SHA1
5f5485a0eb00333ae9bf39bc739c78a1718796a7

SHA256
a71cf8d6243fb097f999b7cef389119edbf287ca0a77caf7ed46c70428dd49a0

SHA512
f5d89a6558c07b454015ebaade43335084ba64011bebf08b4c1ad0a954ba182045740ae02dace55796ed717e7a3fc073b851641201a00f8f7dad738083a9f5cd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
13KB

MD5
bd2a9b1fb1a37bfdb96dbb0b2e77f205

SHA1
ffa39714a75383120e3eac6a0cf8e79f864a71c9

SHA256
8eb2c61a8871766c086f778b55ab3ac45981d7062ab3613c6ee2e5b5ba0a81c3

SHA512
ba1abd12ee77dc175c749f930a67b1aee078667708049a5ca55109ac3ac4b7d47b7da472d1d6e55d659733f048abeed274b4428ee503779ba5fc93e2af37b414

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
13KB

MD5
9e949d6bbadab5bee29d70bfee8c4183

SHA1
7e46cc3eedbecab7a745f751666f5a3947e1576d

SHA256
bfeabcb538a5620f356da4e0395f414e3d6ad9196212e76e0e046ed4236cb290

SHA512
7d252111135fed5c1caae748d8410e0d7168332c008d26f747c426414e21291401ebcf10b92351455323b55475e377668393aa2b703e3e275ebce1d4bfb7d0ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
13KB

MD5
2e33e969ed7936fa660428ddda06aa6c

SHA1
140003b240de3c9e62d8b90013ff49b398fb9a5c

SHA256
d30958b16fcbacfaf4f91bd110512ed82eb009e428fbf5ce4bd1a15c35d36ba0

SHA512
63a1587844f6abcc315382b760a024dcc06fcf9aa74de9f109ac6fb0d0bd3306e641f1312f07a7be6191e6fd87bdd0a49d9e9bbef561e8d9fb6b15420df89099

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
13KB

MD5
a3de6c16782a0535773343d615577b84

SHA1
f37aa54d6d59b9a26dbd790f5017e2f0c7d6156a

SHA256
b9cf26d420221b1a8754091eb6a5f24aa76f2a44af823fa5ea01665eac04b436

SHA512
e3731880e6df608644a5da727e9eaae6dd99115b1e5d01c986831f222c36b20982db98d61e603f43e4bbc2082e92c8b50249b7ca7fe2f38a5aae35fd2f04daf4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
13KB

MD5
92bc7cd7da566becf21f2f3e104414c5

SHA1
193697ad15f0f3816f792cb34ca51e862ee58962

SHA256
9c3389bf26534e39aa93cbf85fd86c8a360eda70538450f211905176432af8c5

SHA512
8575298249a739288ad5cc3dbb289937d3e21782871ac90e383e9a86362081d0083ad12e15da321c5502c3c7ac58cfb47aaa2d4e1bd05542b926bbb4f75c6cd2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
12KB

MD5
564eec36e85fdf1cc13a9a31ad31a002

SHA1
b104607dac6370d50c87521384346c3d2bd9e70c

SHA256
82b4a31331f29ecb7d839a2fdad700b3071db4208b283315ff6201bee0f079c3

SHA512
faf205b0e618f51b8130ac77a6097f17b8f6fd5b0eab5fcdfdd99b121f0c3d7e8e5667e3dd813af08380ccae04364fbf8d410dce13753fc1604b7aed711a662d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
13KB

MD5
cc27c4404f75693a77768d9966f12609

SHA1
106df7284fc683cadcd7b9ef3e9ef972c0a5e758

SHA256
db1ad458699b7e9ad967c1dc1a25c834e51be641ce4752cbd6a12f88097ccf30

SHA512
092e659842f3bedbc3f8ea9a307668d1c2dff5516622b56b51352f7c0317f6f5b889488b925497fd7cb27594919094dce610d49e3ae7c2ea03ca0abaa75172cf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
13KB

MD5
e636a981730fa623a4d678e704a1186e

SHA1
9c1d15434b7710def1d8bf50d2673a3320f20a5d

SHA256
eab827ebc72dc86cb3d68fe896933da650848fa9919a4c796430d16b350b9a14

SHA512
fde4e0910ea98f694f119a7eb1f8af460b6ebb039c8d6bd3c77ca233fd98f36bc0e0ef3f5bed05e9804dedc2e17b0cf9f94da24457d887a88c246ec54f968cd7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
13KB

MD5
c4a09dc3e1a6262490b5c1b2fe03a4c2

SHA1
048e41ef2bfa865f76b6fe8c659c8bbcc27eb6d5

SHA256
55f63ae79956449f66814c464f000a8835f52070103f334cdb9fee42d184237f

SHA512
ca95f24e712a99b120a608647b08b9298d66f0039fb0ffcf7b30ec8f13b5d17ff42983e03b36cb27da5975b8eb833c84b023842938b87ad1cbd211ae14777614

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
13KB

MD5
3e98e81c9d25879ccd273d08e12c5245

SHA1
3bd965512c345b9559bd5ed9e6cbede426111bdf

SHA256
6e10ddb2af63f558c28381f67cd61d432681deb3f56998412e93dbed9209e59d

SHA512
4da5da5160af75f4b134234123213df0755f68dcdfc1b3545181e9c973388bba32ed5fd02860e60c82d8d3329eba6d5e2a2da12aab8b1f9ead5c11a490c5bf5d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
13KB

MD5
e636a981730fa623a4d678e704a1186e

SHA1
9c1d15434b7710def1d8bf50d2673a3320f20a5d

SHA256
eab827ebc72dc86cb3d68fe896933da650848fa9919a4c796430d16b350b9a14

SHA512
fde4e0910ea98f694f119a7eb1f8af460b6ebb039c8d6bd3c77ca233fd98f36bc0e0ef3f5bed05e9804dedc2e17b0cf9f94da24457d887a88c246ec54f968cd7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\GPUCache\data_1
Filesize
264KB

MD5
9e05dfdcb270c6cf5d54888582f51480

SHA1
815b8882df203a41d51c8d562fee916d2edacbd6

SHA256
6cf4c2878ce248145d6ca698964cdc0571e596d90e5b9f5e102a1d98570409f5

SHA512
81a8a8a2572455d21c7bedd4ee52e63f4b9078984c6802a49b774db29ec991d7240b531427990abd742c8f1579f8b846948c57c99c78b88631952e89b14dc951

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\GPUCache\data_1
Filesize
264KB

MD5
9e05dfdcb270c6cf5d54888582f51480

SHA1
815b8882df203a41d51c8d562fee916d2edacbd6

SHA256
6cf4c2878ce248145d6ca698964cdc0571e596d90e5b9f5e102a1d98570409f5

SHA512
81a8a8a2572455d21c7bedd4ee52e63f4b9078984c6802a49b774db29ec991d7240b531427990abd742c8f1579f8b846948c57c99c78b88631952e89b14dc951

Download Submit
C:\Users\Admin\AppData\Local\Temp\MEMZ 3.0\x
Filesize
4KB

MD5
c6e68ff1dc039af122429c3c5418630f

SHA1
771938ab02aaf6714782ea1c70420794848b1d9c

SHA256
b18e0bb23b9b78ca561b9499853ec5be84f67fcb7db5c7e207c6da1b89c17dbb

SHA512
837b8b31d381030b79a1b85449238b8770999dde21dd705aec81a0205cfc40cb2f65fb7877de479bae9ca96c1233a62078332c93db764389bd6f26985b61c9b7

Download Submit
C:\Users\Admin\AppData\Local\Temp\MEMZ 3.0\x
Filesize
10KB

MD5
fc59b7d2eb1edbb9c8cb9eb08115a98e

SHA1
90a6479ce14f8548df54c434c0a524e25efd9d17

SHA256
a05b9be9dd87492f265094146e18d628744c6b09c0e7efaabf228a9f1091a279

SHA512
3392cfc0dbddb37932e76da5a49f4e010a49aaa863c882b85cccab676cd458cfc8f880d8a0e0dc7581175f447e6b0a002da1591ecd14756650bb74996eacd2b1

Download Submit
C:\Users\Admin\AppData\Local\Temp\MEMZ 3.0\x.js
Filesize
448B

MD5
8eec8704d2a7bc80b95b7460c06f4854

SHA1
1b34585c1fa7ec0bd0505478ac9dbb8b8d19f326

SHA256
aa01b8864b43e92077a106ed3d4656a511f3ba1910fba40c78a32ee6a621d596

SHA512
e274b92810e9a30627a65f87448d784967a2fcfbf49858cbe6ccb841f09e0f53fde253ecc1ea0c7de491d8cc56a6cf8c79d1b7c657e72928cfb0479d11035210

Download Submit
C:\Users\Admin\AppData\Local\Temp\MEMZ 3.0\z.zip
Filesize
7KB

MD5
cf0c19ef6909e5c1f10c8460ba9299d8

SHA1
875b575c124acfc1a4a21c1e05acb9690e50b880

SHA256
abb834ebd4b7d7f8ddf545976818f41b3cb51d2b895038a56457616d3a2c6776

SHA512
d930a022a373c283f35d103e277487c2034a0b0814913b8f6ec695b45e20528667aa830eeab58e4483d523bd6a755a16a5379095cb137db6c91909a545a19a2f

Download Submit
C:\Users\Admin\AppData\Local\Temp\MEMZ 3.0\z.zip
Filesize
7KB

MD5
cf0c19ef6909e5c1f10c8460ba9299d8

SHA1
875b575c124acfc1a4a21c1e05acb9690e50b880

SHA256
abb834ebd4b7d7f8ddf545976818f41b3cb51d2b895038a56457616d3a2c6776

SHA512
d930a022a373c283f35d103e277487c2034a0b0814913b8f6ec695b45e20528667aa830eeab58e4483d523bd6a755a16a5379095cb137db6c91909a545a19a2f

Download Submit
C:\Users\Admin\AppData\Roaming\MEMZ.exe
Filesize
12KB

MD5
a7bcf7ea8e9f3f36ebfb85b823e39d91

SHA1
761168201520c199dba68add3a607922d8d4a86e

SHA256
3ff64f10603f0330fa2386ff99471ca789391ace969bd0ec1c1b8ce1b4a6db42

SHA512
89923b669d31e590189fd06619bf27e47c5a47e82be6ae71fdb1b9b3b30b06fb7ca8ffed6d5c41ac410a367f2eb07589291e95a2644877d6bffd52775a5b1523

Download Submit
C:\Users\Admin\AppData\Roaming\MEMZ.exe
Filesize
12KB

MD5
a7bcf7ea8e9f3f36ebfb85b823e39d91

SHA1
761168201520c199dba68add3a607922d8d4a86e

SHA256
3ff64f10603f0330fa2386ff99471ca789391ace969bd0ec1c1b8ce1b4a6db42

SHA512
89923b669d31e590189fd06619bf27e47c5a47e82be6ae71fdb1b9b3b30b06fb7ca8ffed6d5c41ac410a367f2eb07589291e95a2644877d6bffd52775a5b1523

Download Submit
C:\Users\Admin\AppData\Roaming\MEMZ.exe
Filesize
12KB

MD5
a7bcf7ea8e9f3f36ebfb85b823e39d91

SHA1
761168201520c199dba68add3a607922d8d4a86e

SHA256
3ff64f10603f0330fa2386ff99471ca789391ace969bd0ec1c1b8ce1b4a6db42

SHA512
89923b669d31e590189fd06619bf27e47c5a47e82be6ae71fdb1b9b3b30b06fb7ca8ffed6d5c41ac410a367f2eb07589291e95a2644877d6bffd52775a5b1523

Download Submit
C:\Users\Admin\AppData\Roaming\MEMZ.exe
Filesize
12KB

MD5
a7bcf7ea8e9f3f36ebfb85b823e39d91

SHA1
761168201520c199dba68add3a607922d8d4a86e

SHA256
3ff64f10603f0330fa2386ff99471ca789391ace969bd0ec1c1b8ce1b4a6db42

SHA512
89923b669d31e590189fd06619bf27e47c5a47e82be6ae71fdb1b9b3b30b06fb7ca8ffed6d5c41ac410a367f2eb07589291e95a2644877d6bffd52775a5b1523

Download Submit
C:\Users\Admin\AppData\Roaming\MEMZ.exe
Filesize
12KB

MD5
a7bcf7ea8e9f3f36ebfb85b823e39d91

SHA1
761168201520c199dba68add3a607922d8d4a86e

SHA256
3ff64f10603f0330fa2386ff99471ca789391ace969bd0ec1c1b8ce1b4a6db42

SHA512
89923b669d31e590189fd06619bf27e47c5a47e82be6ae71fdb1b9b3b30b06fb7ca8ffed6d5c41ac410a367f2eb07589291e95a2644877d6bffd52775a5b1523

Download Submit
C:\Users\Admin\AppData\Roaming\MEMZ.exe
Filesize
12KB

MD5
a7bcf7ea8e9f3f36ebfb85b823e39d91

SHA1
761168201520c199dba68add3a607922d8d4a86e

SHA256
3ff64f10603f0330fa2386ff99471ca789391ace969bd0ec1c1b8ce1b4a6db42

SHA512
89923b669d31e590189fd06619bf27e47c5a47e82be6ae71fdb1b9b3b30b06fb7ca8ffed6d5c41ac410a367f2eb07589291e95a2644877d6bffd52775a5b1523

Download Submit
C:\Users\Admin\AppData\Roaming\MEMZ.exe
Filesize
12KB

MD5
a7bcf7ea8e9f3f36ebfb85b823e39d91

SHA1
761168201520c199dba68add3a607922d8d4a86e

SHA256
3ff64f10603f0330fa2386ff99471ca789391ace969bd0ec1c1b8ce1b4a6db42

SHA512
89923b669d31e590189fd06619bf27e47c5a47e82be6ae71fdb1b9b3b30b06fb7ca8ffed6d5c41ac410a367f2eb07589291e95a2644877d6bffd52775a5b1523

Download Submit
C:\Users\Admin\AppData\Roaming\MEMZ.exe
Filesize
12KB

MD5
a7bcf7ea8e9f3f36ebfb85b823e39d91

SHA1
761168201520c199dba68add3a607922d8d4a86e

SHA256
3ff64f10603f0330fa2386ff99471ca789391ace969bd0ec1c1b8ce1b4a6db42

SHA512
89923b669d31e590189fd06619bf27e47c5a47e82be6ae71fdb1b9b3b30b06fb7ca8ffed6d5c41ac410a367f2eb07589291e95a2644877d6bffd52775a5b1523

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms
Filesize
3KB

MD5
9f4cb494d232b245cc4bc9838da73b7c

SHA1
c8f8edcf538e286b33987e7000606d49260222d6

SHA256
e3a8cc521c4347f29b60c126c3f360af44f11bb7ff8294540f2d15abe44903cd

SHA512
e60c6f9ae7e0b82ca3f73da8c9784ed36f6dd72dd8f278afb07e7098ecee8ba0491270a8646a17657406c2722eb70cce5443775b5e0965a374c7a8978e3c0220

Download Submit
C:\note.txt
Filesize
218B

MD5
afa6955439b8d516721231029fb9ca1b

SHA1
087a043cc123c0c0df2ffadcf8e71e3ac86bbae9

SHA256
8e9f20f6864c66576536c0b866c6ffdcf11397db67fe120e972e244c3c022270

SHA512
5da21a31fbc4e8250dffed30f66b896bdf007ac91948140334fe36a3f010e1bac3e70a07e9f3eb9da8633189091fd5cadcabbaacd3e01da0fe7ae28a11b3dddf

Download Submit
\??\pipe\LOCAL\crashpad_4688_SXTGWSAWSJKDVFGD
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\??\pipe\LOCAL\crashpad_5604_RWTQUKEZGGQZXYOG
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/1792-2391-0x0000000005D80000-0x0000000005D81000-memory.dmp

Filesize
4KB

Download
memory/1792-2400-0x0000000005D80000-0x0000000005D81000-memory.dmp

Filesize
4KB

Download
memory/1792-2399-0x0000000005D80000-0x0000000005D81000-memory.dmp

Filesize
4KB

Download
memory/1792-2398-0x0000000005D80000-0x0000000005D81000-memory.dmp

Filesize
4KB

Download
memory/1792-2397-0x0000000005D80000-0x0000000005D81000-memory.dmp

Filesize
4KB

Download
memory/1792-2401-0x0000000005D80000-0x0000000005D81000-memory.dmp

Filesize
4KB

Download
memory/1792-2402-0x0000000005D80000-0x0000000005D81000-memory.dmp

Filesize
4KB

Download
memory/1792-2403-0x0000000005D80000-0x0000000005D81000-memory.dmp

Filesize
4KB

Download
memory/1792-2392-0x0000000005D80000-0x0000000005D81000-memory.dmp

Filesize
4KB

Download
memory/1792-2393-0x0000000005D80000-0x0000000005D81000-memory.dmp

Filesize
4KB

Download
memory/4508-920-0x0000000002D50000-0x0000000002FA4000-memory.dmp

Filesize
2.3MB

Download