61ca4d8dd992c763b47bebb9b5facb68a59ff0a594c2ff215aa4143b593ae9dc

Analysis

max time kernel
354s
max time network
350s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
05/07/2023, 12:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

MEMZ.zip
Size

8KB
MD5

69977a5d1c648976d47b69ea3aa8fcaa
SHA1

4630cc15000c0d3149350b9ecda6cfc8f402938a
SHA256

61ca4d8dd992c763b47bebb9b5facb68a59ff0a594c2ff215aa4143b593ae9dc
SHA512

ba0671c72cd4209fabe0ee241b71e95bd9d8e78d77a893c94f87de5735fd10ea8b389cf4c48462910042c312ddff2f527999cd2f845d0c19a8673dbceda369fd
SSDEEP

192:8xI2dw4xXlsUjs1ScK3ZeD6dUqENj710+MZ9R1SVBIpp:b2dHiosKA6OqEx2t9R1SLIL

Score

6^/10

bootkit persistence

Malware Config

Signatures

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1067

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	[email protected]

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	mspaint.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	Taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	Taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	Taskmgr.exe

Enumerates system info in registry 2 TTPs 15 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\SyncCenter.dll,-3001#immutable1 = "Sync files between your computer and network folders"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\DiagCpl.dll,-1#immutable1 = "Troubleshooting"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\main.cpl,-103#immutable1 = "Customize your keyboard settings, such as the cursor blink rate and the character repeat rate."	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\netcenter.dll,-1#immutable1 = "Network and Sharing Center"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\fhcpl.dll,-2#immutable1 = "Keep a history of your files"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\system32\colorcpl.exe,-6#immutable1 = "Color Management"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\Speech\SpeechUX\speechuxcpl.dll,-1#immutable1 = "Speech Recognition"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\accessibilitycpl.dll,-45#immutable1 = "Make your computer easier to use."	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\fvecpl.dll,-1#immutable1 = "BitLocker Drive Encryption"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\mmsys.cpl,-301#immutable1 = "Configure your audio devices or change the sound scheme for your computer."	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\fhcpl.dll,-52#immutable1 = "File History"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 = 14001f706806ee260aa0d7449371beb064c986830000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\{DE4F0660-FA10-4B8F-A494-068B20B22307}\GroupView = "0"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\{DE4F0660-FA10-4B8F-A494-068B20B22307}	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000_Classes\Local Settings	calc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\system32\colorcpl.exe,-7#immutable1 = "Change advanced color management settings for displays, scanners, and printers."	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\mmsys.cpl,-300#immutable1 = "Sound"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\Microsoft.Windows.ControlPanel\WFlags = "0"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\{DE4F0660-FA10-4B8F-A494-068B20B22307}\Vid = "{65F125E5-7BE1-4810-BA9D-D271C8432CE3}"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\{DE4F0660-FA10-4B8F-A494-068B20B22307}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000010000001800000030f125b7ef471a10a5f102608c9eebac0a00000000000000	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\RADCUI.dll,-15301#immutable1 = "Manage your RemoteApp and Desktop Connections"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\SyncCenter.dll,-3000#immutable1 = "Sync Center"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\main.cpl,-100#immutable1 = "Mouse"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\main.cpl,-101#immutable1 = "Customize your mouse settings, such as the button configuration, double-click speed, mouse pointers, and motion speed."	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\autoplay.dll,-1#immutable1 = "AutoPlay"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\recovery.dll,-2#immutable1 = "Recovery"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\systemcpl.dll,-2#immutable1 = "View information about your computer, and change settings for hardware, performance, and remote connections."	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\DiagCpl.dll,-15#immutable1 = "Troubleshoot and fix common computer problems."	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\sud.dll,-1#immutable1 = "Default Programs"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\intl.cpl,-2#immutable1 = "Customize settings for the display of languages, numbers, times, and dates."	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\{DE4F0660-FA10-4B8F-A494-068B20B22307}\FFlags = "18874369"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\timedate.cpl,-51#immutable1 = "Date and Time"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\NodeSlot = "3"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\usercpl.dll,-1#immutable1 = "User Accounts"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\devmgr.dll,-4#immutable1 = "Device Manager"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\netcenter.dll,-2#immutable1 = "Check network status, change network settings and set preferences for sharing files and printers."	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\autoplay.dll,-2#immutable1 = "Change default settings for CDs, DVDs, and devices so that you can automatically play music, view pictures, install software, and play games."	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\{DE4F0660-FA10-4B8F-A494-068B20B22307}\LogicalViewMode = "2"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\powercpl.dll,-2#immutable1 = "Conserve energy or maximize performance by choosing how your computer manages power."	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\RADCUI.dll,-15300#immutable1 = "RemoteApp and Desktop Connections"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\Microsoft.Windows.ControlPanel	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\{DE4F0660-FA10-4B8F-A494-068B20B22307}\GroupByKey:PID = "0"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000_Classes\Local Settings	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\sdcpl.dll,-100#immutable1 = "Recover copies of your files backed up in Windows 7"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\usercpl.dll,-2#immutable1 = "Change user account settings and passwords for people who share this computer."	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\inetcpl.cpl,-4312#immutable1 = "Internet Options"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\sud.dll,-10#immutable1 = "Choose which programs you want Windows to use for activities like web browsing, editing photos, sending e-mail, and playing music."	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\FirewallControlPanel.dll,-12123#immutable1 = "Set firewall security options to help protect your computer from hackers and malicious software."	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\{DE4F0660-FA10-4B8F-A494-068B20B22307}\IconSize = "48"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\{DE4F0660-FA10-4B8F-A494-068B20B22307}\GroupByDirection = "1"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\srchadmin.dll,-601#immutable1 = "Indexing Options"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\Microsoft.Windows.ControlPanel\HotKey = "0"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\sdcpl.dll,-101#immutable1 = "Backup and Restore (Windows 7)"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\{DE4F0660-FA10-4B8F-A494-068B20B22307}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000_Classes\Local Settings	control.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\system32\Vault.dll,-2#immutable1 = "Manage your Windows credentials."	explorer.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
4904	explorer.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3664	[email protected]
3664	[email protected]
116	[email protected]
116	[email protected]
3664	[email protected]
3664	[email protected]
3664	[email protected]
3664	[email protected]
228	[email protected]
228	[email protected]
116	[email protected]
116	[email protected]
228	[email protected]
228	[email protected]
3664	[email protected]
3664	[email protected]
228	[email protected]
228	[email protected]
116	[email protected]
116	[email protected]
116	[email protected]
116	[email protected]
228	[email protected]
228	[email protected]
4244	[email protected]
4244	[email protected]
3664	[email protected]
3664	[email protected]
4640	[email protected]
4640	[email protected]
116	[email protected]
116	[email protected]
116	[email protected]
116	[email protected]
4640	[email protected]
4640	[email protected]
3664	[email protected]
3664	[email protected]
4244	[email protected]
4244	[email protected]
228	[email protected]
228	[email protected]
4640	[email protected]
4640	[email protected]
4640	[email protected]
116	[email protected]
4640	[email protected]
228	[email protected]
228	[email protected]
4244	[email protected]
4244	[email protected]
3664	[email protected]
3664	[email protected]
116	[email protected]
116	[email protected]
116	[email protected]
3664	[email protected]
3664	[email protected]
228	[email protected]
228	[email protected]
4244	[email protected]
4244	[email protected]
4640	[email protected]
4640	[email protected]

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 39 IoCs

pid	Process
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
3192	msedge.exe
2412	msedge.exe
2412	msedge.exe
2412	msedge.exe
2412	msedge.exe
2412	msedge.exe
2412	msedge.exe
2412	msedge.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

description	pid	Process
Token: 33	2348	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2348	AUDIODG.EXE
Token: SeShutdownPrivilege	4904	explorer.exe
Token: SeCreatePagefilePrivilege	4904	explorer.exe
Token: SeShutdownPrivilege	4904	explorer.exe
Token: SeCreatePagefilePrivilege	4904	explorer.exe
Token: SeDebugPrivilege	4216	Taskmgr.exe
Token: SeSystemProfilePrivilege	4216	Taskmgr.exe
Token: SeCreateGlobalPrivilege	4216	Taskmgr.exe
Token: SeShutdownPrivilege	116	[email protected]
Token: SeShutdownPrivilege	4244	[email protected]
Token: SeShutdownPrivilege	228	[email protected]

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
4692	[email protected]
3664	[email protected]
116	[email protected]
228	[email protected]
4244	[email protected]
4640	[email protected]
1288	[email protected]
3960	mspaint.exe
3960	mspaint.exe
3960	mspaint.exe
3960	mspaint.exe
1288	[email protected]
3424	OpenWith.exe
1288	[email protected]
4244	[email protected]
116	[email protected]
3664	[email protected]
228	[email protected]
4640	[email protected]
228	[email protected]
116	[email protected]
3664	[email protected]
4244	[email protected]
4640	[email protected]
4244	[email protected]
116	[email protected]
3664	[email protected]
228	[email protected]
4640	[email protected]
228	[email protected]
3664	[email protected]
116	[email protected]
4244	[email protected]
4640	[email protected]
4244	[email protected]
116	[email protected]
3664	[email protected]
228	[email protected]
4640	[email protected]
228	[email protected]
3664	[email protected]
4244	[email protected]
116	[email protected]
4640	[email protected]
4244	[email protected]
116	[email protected]
3664	[email protected]
228	[email protected]
4640	[email protected]
228	[email protected]
3664	[email protected]
116	[email protected]
4244	[email protected]
4640	[email protected]
116	[email protected]
4244	[email protected]
3664	[email protected]
228	[email protected]
4640	[email protected]
228	[email protected]
4244	[email protected]
3664	[email protected]
116	[email protected]
4640	[email protected]

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4692 wrote to memory of 3664	4692	[email protected]	97
PID 4692 wrote to memory of 3664	4692	[email protected]	97
PID 4692 wrote to memory of 3664	4692	[email protected]	97
PID 4692 wrote to memory of 116	4692	[email protected]	98
PID 4692 wrote to memory of 116	4692	[email protected]	98
PID 4692 wrote to memory of 116	4692	[email protected]	98
PID 4692 wrote to memory of 228	4692	[email protected]	99
PID 4692 wrote to memory of 228	4692	[email protected]	99
PID 4692 wrote to memory of 228	4692	[email protected]	99
PID 4692 wrote to memory of 4244	4692	[email protected]	100
PID 4692 wrote to memory of 4244	4692	[email protected]	100
PID 4692 wrote to memory of 4244	4692	[email protected]	100
PID 4692 wrote to memory of 4640	4692	[email protected]	101
PID 4692 wrote to memory of 4640	4692	[email protected]	101
PID 4692 wrote to memory of 4640	4692	[email protected]	101
PID 4692 wrote to memory of 1288	4692	[email protected]	102
PID 4692 wrote to memory of 1288	4692	[email protected]	102
PID 4692 wrote to memory of 1288	4692	[email protected]	102
PID 1288 wrote to memory of 1324	1288	[email protected]	103
PID 1288 wrote to memory of 1324	1288	[email protected]	103
PID 1288 wrote to memory of 1324	1288	[email protected]	103
PID 1288 wrote to memory of 4740	1288	[email protected]	104
PID 1288 wrote to memory of 4740	1288	[email protected]	104
PID 4740 wrote to memory of 932	4740	msedge.exe	105
PID 4740 wrote to memory of 932	4740	msedge.exe	105
PID 4740 wrote to memory of 4568	4740	msedge.exe	106
PID 4740 wrote to memory of 4568	4740	msedge.exe	106
PID 4740 wrote to memory of 4568	4740	msedge.exe	106
PID 4740 wrote to memory of 4568	4740	msedge.exe	106
PID 4740 wrote to memory of 4568	4740	msedge.exe	106
PID 4740 wrote to memory of 4568	4740	msedge.exe	106
PID 4740 wrote to memory of 4568	4740	msedge.exe	106
PID 4740 wrote to memory of 4568	4740	msedge.exe	106
PID 4740 wrote to memory of 4568	4740	msedge.exe	106
PID 4740 wrote to memory of 4568	4740	msedge.exe	106
PID 4740 wrote to memory of 4568	4740	msedge.exe	106
PID 4740 wrote to memory of 4568	4740	msedge.exe	106
PID 4740 wrote to memory of 4568	4740	msedge.exe	106
PID 4740 wrote to memory of 4568	4740	msedge.exe	106
PID 4740 wrote to memory of 4568	4740	msedge.exe	106
PID 4740 wrote to memory of 4568	4740	msedge.exe	106
PID 4740 wrote to memory of 4568	4740	msedge.exe	106
PID 4740 wrote to memory of 4568	4740	msedge.exe	106
PID 4740 wrote to memory of 4568	4740	msedge.exe	106
PID 4740 wrote to memory of 4568	4740	msedge.exe	106
PID 4740 wrote to memory of 4568	4740	msedge.exe	106
PID 4740 wrote to memory of 4568	4740	msedge.exe	106
PID 4740 wrote to memory of 4568	4740	msedge.exe	106
PID 4740 wrote to memory of 4568	4740	msedge.exe	106
PID 4740 wrote to memory of 4568	4740	msedge.exe	106
PID 4740 wrote to memory of 4568	4740	msedge.exe	106
PID 4740 wrote to memory of 4568	4740	msedge.exe	106
PID 4740 wrote to memory of 4568	4740	msedge.exe	106
PID 4740 wrote to memory of 4568	4740	msedge.exe	106
PID 4740 wrote to memory of 4568	4740	msedge.exe	106
PID 4740 wrote to memory of 4568	4740	msedge.exe	106
PID 4740 wrote to memory of 4568	4740	msedge.exe	106
PID 4740 wrote to memory of 4568	4740	msedge.exe	106
PID 4740 wrote to memory of 4568	4740	msedge.exe	106
PID 4740 wrote to memory of 4568	4740	msedge.exe	106
PID 4740 wrote to memory of 4568	4740	msedge.exe	106
PID 4740 wrote to memory of 4568	4740	msedge.exe	106
PID 4740 wrote to memory of 4568	4740	msedge.exe	106
PID 4740 wrote to memory of 4568	4740	msedge.exe	106

C:\Windows\Explorer.exe
C:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\MEMZ.zip
1⤵
PID:3348

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3712

C:\Users\Admin\AppData\Local\Temp\Temp1_MEMZ.zip\[email protected]
"C:\Users\Admin\AppData\Local\Temp\Temp1_MEMZ.zip\[email protected]"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4692
- C:\Users\Admin\AppData\Local\Temp\Temp1_MEMZ.zip\[email protected]
  "C:\Users\Admin\AppData\Local\Temp\Temp1_MEMZ.zip\[email protected]" /watchdog
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:3664
- C:\Users\Admin\AppData\Local\Temp\Temp1_MEMZ.zip\[email protected]
  "C:\Users\Admin\AppData\Local\Temp\Temp1_MEMZ.zip\[email protected]" /watchdog
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:116
- C:\Users\Admin\AppData\Local\Temp\Temp1_MEMZ.zip\[email protected]
  "C:\Users\Admin\AppData\Local\Temp\Temp1_MEMZ.zip\[email protected]" /watchdog
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:228
- C:\Users\Admin\AppData\Local\Temp\Temp1_MEMZ.zip\[email protected]
  "C:\Users\Admin\AppData\Local\Temp\Temp1_MEMZ.zip\[email protected]" /watchdog
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:4244
- C:\Users\Admin\AppData\Local\Temp\Temp1_MEMZ.zip\[email protected]
  "C:\Users\Admin\AppData\Local\Temp\Temp1_MEMZ.zip\[email protected]" /watchdog
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:4640
- C:\Users\Admin\AppData\Local\Temp\Temp1_MEMZ.zip\[email protected]
  "C:\Users\Admin\AppData\Local\Temp\Temp1_MEMZ.zip\[email protected]" /main
  2⤵
  - Writes to the Master Boot Record (MBR)
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1288
- - C:\Windows\SysWOW64\notepad.exe
    "C:\Windows\System32\notepad.exe" \note.txt
    3⤵
    PID:1324
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=mcafee+vs+norton
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:4740
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffc2b2f46f8,0x7ffc2b2f4708,0x7ffc2b2f4718
      4⤵
      PID:932
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2264,3220480774597616770,14445934538787398954,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2152 /prefetch:2
      4⤵
      PID:4568
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2264,3220480774597616770,14445934538787398954,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2536 /prefetch:8
      4⤵
      PID:2736
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2264,3220480774597616770,14445934538787398954,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2368 /prefetch:3
      4⤵
      PID:3792
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2264,3220480774597616770,14445934538787398954,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:1
      4⤵
      PID:316
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2264,3220480774597616770,14445934538787398954,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1
      4⤵
      PID:4916
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2264,3220480774597616770,14445934538787398954,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2136 /prefetch:1
      4⤵
      PID:1236
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2264,3220480774597616770,14445934538787398954,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5344 /prefetch:8
      4⤵
      PID:4404
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2264,3220480774597616770,14445934538787398954,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5344 /prefetch:8
      4⤵
      PID:4996
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2264,3220480774597616770,14445934538787398954,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4500 /prefetch:1
      4⤵
      PID:4928
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2264,3220480774597616770,14445934538787398954,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4872 /prefetch:1
      4⤵
      PID:3320
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2264,3220480774597616770,14445934538787398954,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5004 /prefetch:1
      4⤵
      PID:1524
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2264,3220480774597616770,14445934538787398954,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4952 /prefetch:1
      4⤵
      PID:4408
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2264,3220480774597616770,14445934538787398954,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5444 /prefetch:1
      4⤵
      PID:456
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2264,3220480774597616770,14445934538787398954,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4988 /prefetch:1
      4⤵
      PID:3104
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=skrillex+scay+onster+an+nice+sprites+midi
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    PID:3368
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffc2b2f46f8,0x7ffc2b2f4708,0x7ffc2b2f4718
      4⤵
      PID:4596
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2040,8467618092140095985,15462599828994511894,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2056 /prefetch:2
      4⤵
      PID:464
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,8467618092140095985,15462599828994511894,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
      4⤵
      PID:524
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,8467618092140095985,15462599828994511894,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
      4⤵
      PID:2368
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2040,8467618092140095985,15462599828994511894,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2856 /prefetch:8
      4⤵
      PID:952
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2040,8467618092140095985,15462599828994511894,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2192 /prefetch:3
      4⤵
      PID:812
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,8467618092140095985,15462599828994511894,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4868 /prefetch:1
      4⤵
      PID:2960
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,8467618092140095985,15462599828994511894,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3768 /prefetch:1
      4⤵
      PID:1728
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,8467618092140095985,15462599828994511894,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5288 /prefetch:1
      4⤵
      PID:2864
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,8467618092140095985,15462599828994511894,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5332 /prefetch:1
      4⤵
      PID:4744
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2040,8467618092140095985,15462599828994511894,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5544 /prefetch:8
      4⤵
      PID:3232
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2040,8467618092140095985,15462599828994511894,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5544 /prefetch:8
      4⤵
      PID:4824
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,8467618092140095985,15462599828994511894,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5948 /prefetch:1
      4⤵
      PID:756
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,8467618092140095985,15462599828994511894,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5832 /prefetch:1
      4⤵
      PID:4184
- - C:\Windows\SysWOW64\mspaint.exe
    "C:\Windows\System32\mspaint.exe"
    3⤵
    - Drops file in Windows directory
    - Suspicious use of SetWindowsHookEx
    PID:3960
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=best+way+to+kill+yourself
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    PID:5112
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffc2b2f46f8,0x7ffc2b2f4708,0x7ffc2b2f4718
      4⤵
      PID:3692
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2224,17129600695393233604,10697992401014958437,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2292 /prefetch:3
      4⤵
      PID:112
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2224,17129600695393233604,10697992401014958437,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2656 /prefetch:8
      4⤵
      PID:780
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2224,17129600695393233604,10697992401014958437,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2232 /prefetch:2
      4⤵
      PID:3196
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,17129600695393233604,10697992401014958437,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3456 /prefetch:1
      4⤵
      PID:2916
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,17129600695393233604,10697992401014958437,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:1
      4⤵
      PID:2412
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,17129600695393233604,10697992401014958437,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4880 /prefetch:1
      4⤵
      PID:4684
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2224,17129600695393233604,10697992401014958437,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3708 /prefetch:8
      4⤵
      PID:3360
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2224,17129600695393233604,10697992401014958437,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3708 /prefetch:8
      4⤵
      PID:388
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,17129600695393233604,10697992401014958437,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5124 /prefetch:1
      4⤵
      PID:1352
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,17129600695393233604,10697992401014958437,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5152 /prefetch:1
      4⤵
      PID:1348
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,17129600695393233604,10697992401014958437,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4920 /prefetch:1
      4⤵
      PID:4280
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,17129600695393233604,10697992401014958437,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4900 /prefetch:1
      4⤵
      PID:4672
- - C:\Windows\SysWOW64\control.exe
    "C:\Windows\System32\control.exe"
    3⤵
    - Modifies registry class
    PID:2484
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://softonic.com/
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    PID:3192
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x124,0x128,0x12c,0x100,0x130,0x7ffc2b2f46f8,0x7ffc2b2f4708,0x7ffc2b2f4718
      4⤵
      PID:5108
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2208,828418225944798249,5309517112517697779,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2224 /prefetch:2
      4⤵
      PID:2952
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2208,828418225944798249,5309517112517697779,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2616 /prefetch:8
      4⤵
      PID:1116
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,828418225944798249,5309517112517697779,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:1
      4⤵
      PID:3608
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,828418225944798249,5309517112517697779,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
      4⤵
      PID:1272
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2208,828418225944798249,5309517112517697779,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2276 /prefetch:3
      4⤵
      PID:4528
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,828418225944798249,5309517112517697779,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4968 /prefetch:1
      4⤵
      PID:4708
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2208,828418225944798249,5309517112517697779,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5356 /prefetch:8
      4⤵
      PID:2028
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2208,828418225944798249,5309517112517697779,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5356 /prefetch:8
      4⤵
      PID:740
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,828418225944798249,5309517112517697779,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5548 /prefetch:1
      4⤵
      PID:2552
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,828418225944798249,5309517112517697779,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5556 /prefetch:1
      4⤵
      PID:2508
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,828418225944798249,5309517112517697779,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4336 /prefetch:1
      4⤵
      PID:1644
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,828418225944798249,5309517112517697779,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5060 /prefetch:1
      4⤵
      PID:5004
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,828418225944798249,5309517112517697779,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5648 /prefetch:1
      4⤵
      PID:2404
- - C:\Windows\SysWOW64\Taskmgr.exe
    "C:\Windows\System32\Taskmgr.exe"
    3⤵
    - Checks SCSI registry key(s)
    - Suspicious use of AdjustPrivilegeToken
    PID:4216
- - C:\Windows\SysWOW64\calc.exe
    "C:\Windows\System32\calc.exe"
    3⤵
    - Modifies registry class
    PID:956
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=how+2+buy+weed
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    PID:2412
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffc2b2f46f8,0x7ffc2b2f4708,0x7ffc2b2f4718
      4⤵
      PID:648
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1980,154417004264957127,14074156774471837097,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2532 /prefetch:3
      4⤵
      PID:1908
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1980,154417004264957127,14074156774471837097,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1992 /prefetch:2
      4⤵
      PID:1936
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1980,154417004264957127,14074156774471837097,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2756 /prefetch:8
      4⤵
      PID:3800
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,154417004264957127,14074156774471837097,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3356 /prefetch:1
      4⤵
      PID:4648
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,154417004264957127,14074156774471837097,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3344 /prefetch:1
      4⤵
      PID:3616
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,154417004264957127,14074156774471837097,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4844 /prefetch:1
      4⤵
      PID:2748
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1980,154417004264957127,14074156774471837097,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4980 /prefetch:8
      4⤵
      PID:1800
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1980,154417004264957127,14074156774471837097,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4980 /prefetch:8
      4⤵
      PID:4332
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,154417004264957127,14074156774471837097,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5116 /prefetch:1
      4⤵
      PID:2404
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,154417004264957127,14074156774471837097,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5080 /prefetch:1
      4⤵
      PID:2484
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,154417004264957127,14074156774471837097,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5500 /prefetch:1
      4⤵
      PID:924
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,154417004264957127,14074156774471837097,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5436 /prefetch:1
      4⤵
      PID:4724

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4644

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4632

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2508

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService
1⤵
PID:3032

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2028

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x494 0x2fc
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2348

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{5BD95610-9434-43C2-886C-57852CC8A120} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of AdjustPrivilegeToken
PID:4904

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
1⤵
PID:3804

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4868

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:3424

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4980

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Bootkit

T1067

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
2d4e14f32272ee0ed272981e917491a9

SHA1
34faea01d81b01a22e7f33f448db62cd827f1b1e

SHA256
ecc40aee6a447e945b29331f16594536f663d95d61e7088538437ac4a66ef298

SHA512
0ea45644be42c99d990eade529b3d2f3acf26507dd869404776f132b5b7836c6250275e28293e4274eb9d5a76c6ae31c740e1c1f7343997b244c460650ae77ed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f6f47b83c67fe32ee32811d6611d269c

SHA1
b32353d1d0ed26e0dd5b5f1f402ffd41a105d025

SHA256
ac1866f15ff34d1df4dafa761dbb7dc2c712fe01ac0e171706ef29e205549cbc

SHA512
6ee068efa9fbd3c972169427be2f6377a1204bf99b61579e4d78643e89e729ad65f2abcc70007fd0dd38428e7cd39010a253d6f9cd5e90409e207ddaf5d6720d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f6f47b83c67fe32ee32811d6611d269c

SHA1
b32353d1d0ed26e0dd5b5f1f402ffd41a105d025

SHA256
ac1866f15ff34d1df4dafa761dbb7dc2c712fe01ac0e171706ef29e205549cbc

SHA512
6ee068efa9fbd3c972169427be2f6377a1204bf99b61579e4d78643e89e729ad65f2abcc70007fd0dd38428e7cd39010a253d6f9cd5e90409e207ddaf5d6720d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
19e9d5e081ac153d005fc369ae140b86

SHA1
66419cac485a4ce460975ded9e38631e044f0c50

SHA256
aefe0158521d8d3c169f2163b57a74adbb83fd585d50c6391d0c841e515d9ba0

SHA512
8307bae254d3d590cb94eb92116eb48b6157aaf12cf326d37ddf037b74d1b833f1d4664c626c8e41a92250f696134372a3893aa49302e25d98a81e719492640f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e2d5aafb5a359352941b350f98dddbbd

SHA1
4d4856beaf050a9d89fdef4f002488accbd8b11b

SHA256
78217bc9ad05b2de6eff2cdc1fae48bb8d9d7f7ebd4fb76306a36442390c3e9f

SHA512
88d941781c6e65c8468e77120bba1398d4ce733fc64961be5420e7795aa6d9f36b1442ecbe71089e6b75a1f48d49a242ed2acb0b66c264487e9115b98e59bf2e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
5335e29c1ee101729a8ba67a01fa4440

SHA1
05f97851ce2ffde23a60a398bcea22b9a0a161e2

SHA256
2085266649988a12f17f3ecadc9bfb25006e93857f7cd650fffae877c623e7cb

SHA512
8f554f0c6190d26d82cff2a83a60f3d8c8143aa40b084300589b674c84ea88aadbdd71b31f68f8570ee050edcfc0b4e3f1a01b0aae7eef6f28fe18148cf2dd65

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f3b9f59a2f1e31a21a8ca01f7a3f0991

SHA1
07ecd03e547f9bdd9a6883c2486dd69962478cfd

SHA256
da27c5e9119520854a92444a32076a0dd680d6b82fca8aefffe6c910aec0a041

SHA512
fba30a4c0c3a0f13f0935468c5a00c5e0ccf6227a34e00fa166819860c22b0724d8c53fc19184a66f4b597b2ce35748c859b0cba6b71b5c3cb438e8b9b9ebce6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\012e6bce-73f5-4869-a67d-863a8ba24820.tmp

Filesize
2KB

MD5
5ff52a57ec0f2361b990a0e13dcc2099

SHA1
14529c10cecd456a7ee488e729294885a53605ed

SHA256
24a3a0c9f916c9ef4b394f382c675aca1acee989dd4f8c42af380b2712c0e3ad

SHA512
2afe7517d40f7d7f86b404a1aaf9c168913798d12ba807d1276a0b2ab9e0867791b1c77f7f14fcc03ec4eda1d7c0a7e5d8963e61007fb88559ce5730cc61c003

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\data_0

Filesize
44KB

MD5
ade38d6fc410bd849a4c59e13e3839ed

SHA1
08a29336ec46b6ef22964274a7ffcbd603333cfb

SHA256
f724bc1d6606028b6fe9f0c2dde58cbffe60fc4854fec4d50411d6fa1674fd52

SHA512
94070f3393e228457798ccc9a3aa94c298df1a44fb327c14b1cce5fe53475a855ab542cdfb20ef1157498a4080f2e55733adf8c230d08f98cddd66ed8634af77

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\data_1

Filesize
264KB

MD5
232403078626da0d054142dd6d0d4df6

SHA1
bf4c0e488df6c18c8f96f59a646789921647cec4

SHA256
6f152ba4bdb608852e8846ae6055db24cc20af0e07fe06efac6eb7ce46ceb584

SHA512
c2156e631e53a1803fbbc8fb30a20e12b3ed484abad991ef926477d10e318d1e9d503d240719e487323a6e58f0b57d4b688b17d82ad3a651223458664ca14490

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\data_2

Filesize
1.0MB

MD5
df7f476a04336f4df47266f5faf1c62d

SHA1
d543afb20ad463f8e8e9135cdffe3a79c8628c4a

SHA256
ff098d3020b27259edd07ef42238d6b06397c5044f2549620f91789f64e66fb9

SHA512
6ab708ab3784858f07267f827ca338de5f4c12b67e3247191b87317d05d93aff62e625f70994932232c68a5f44bf5555e7fe040319b94addee6b04fa756703b9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\data_3

Filesize
4.0MB

MD5
76239902abfe7c0564a5158763bf2c58

SHA1
23dff00381edcbb041df32e7f981b3307ca8f838

SHA256
ec32daa91d143ebf2cdd36a216fdb5c0b2caf739daecfb6ff19acd1f7205b797

SHA512
5828d1323d0b4ea0b730e4a6136b30ed2fb4962e1baaf790654d51c6c1cb8e4ef583fc5c5f8deb82d64abe8fca23fd4e7f2e04dd017b8bbecd00b97ab92dc70a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000001

Filesize
20KB

MD5
923a543cc619ea568f91b723d9fb1ef0

SHA1
6f4ade25559645c741d7327c6e16521e43d7e1f9

SHA256
bf7344209edb1be5a2886c425cf6334a102d76cbea1471fd50171e2ee92877cd

SHA512
a4153751761cd67465374828b0514d7773b8c4ed37779d1ecfd4f19be4faa171585c8ee0b4db59b556399d5d2b9809ba87e04d4715e9d090e1f488d02219d555

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000003

Filesize
351KB

MD5
5784b8d3079b0c09118c69ba2cc28973

SHA1
106eb7ff29e3da9e808bbea38b11fa9f72745837

SHA256
19d32f9432355b70ed998d498ec9bbcc78b80cd230704dabbde2b1cfb93d5ecf

SHA512
f64a965522ebe8c6d50c30902619ce79be86c59055f104397aa130527d2548398c4247234c0eabdf16037be1a456736be2a4de59c350948646da594439841920

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000004

Filesize
81KB

MD5
37cd8bdab2f9a0b44f63f29a061e15b7

SHA1
9e7331276753453a2fa2cf08411ce9c95b41b7c4

SHA256
dca6d42261f6070d4d3639cc393bed88448acf637c7ce7f2762fd2803c965297

SHA512
7e516675c9a65916f1df686f911af893074f595c2958d26b5c40235c9bae241ee9782bbb1fd70f175527f00ad7980bc568191a5b960636f0fdb10b79250f25dd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000006

Filesize
69KB

MD5
a94cb171a7e8c137e309f19efc38de95

SHA1
71f459b2f38e7a7bac21f7cad263a1281383dd45

SHA256
af19fe3bdf13487f7d4720936b34e5a001bb506d540021281baea7a4431c59b4

SHA512
7259a6be2a002d84d14f548440981732352616750c393e0d0c7cee336543fcdd5e3e9e9c31b62caa0bce12d2c4608ce21814bc130d33cf4131910899bf391efd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\1a881344aa907396_0

Filesize
408B

MD5
1d8566cd82c8c75e0014dba50304e3ef

SHA1
af2f6827b11beca61c87ad01b9f684f4a229116b

SHA256
c838cb9d489af0339d0b52ea2c962e31414da87a4e295dbd221b6e1ed4315ed3

SHA512
afd0606bfd5c496b702cd7e79eac39c780497e92d901e86f288a0cc149d9e59e899544145a008907b2f6c1b01dddc06fd058e50e26bd5dd8189375a7d1076628

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\2c031bb8b32785ac_0

Filesize
388B

MD5
cf436f4c2c02550ae06f2641b579ed43

SHA1
b3354408a5cd3017b62b4c799402bbadc73599f5

SHA256
fdda1b9c77ba2fe8ea1bedf80494e46fb2481ab3edaff40f29f921f9494b9a35

SHA512
824bb2e5f2841d9f5c20b4d59f23588cabc5d5ecabcf7c74b702f7c8ea55cf6d31543edf3e87705d557085a40238a9a4f039abd9aea99274d8d0eb4b07a832a1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\2f6467ab2ae4ee16_0

Filesize
145KB

MD5
091fff1aba3144b2fdb330dcf112fbbb

SHA1
2f292f38203268dd916e1c6ac9c612e6767d4ca4

SHA256
3f74758b60e1f48edd7a3f3b0ed9a80e29cbb368ca10cd4b6e3bf11bacac5e9a

SHA512
777c0d1bab7fb879fdcd84d4ecc263ca6511a996aa5d7f00a31a11737c93ebc18bac6954edb126cd9a6fd2378853402a703464c9e9521074ab2bf838caefd69f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\97278559a09381dd_0

Filesize
2KB

MD5
9adae44af6796e9e53741b1a07f11c1a

SHA1
4385ae5b8e5cd9e3ba1eaa3afaccb6345f61d5bf

SHA256
084a8a2c07e0e38f24be4cb49ec614f520434ebb002dfa233ad2c05261e9950a

SHA512
58da7064ba8b40a44eb7bfb78ccd1d3fd985d5c16976767e3b94f45279146d1c43f1bb636bedb9472fd11c2d112d40c7a6f8d4e151975dc56ca3adf469ce2282

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\97bcc9e418cc71b7_0

Filesize
230KB

MD5
affb7f808ceacc77c51e28fe43794c24

SHA1
83ae04416b6756b775c15351db5d47943b02631e

SHA256
a2959329238c99c5d5b6abad303192b3e6717d05460a7d864ec803557b09f727

SHA512
3cb4c154ade807c07940f5ce59d5ac051be250d428b76982a12b7e05fd0be1f95360592ae528afad4106847e6965251e273d25baca8045f4055e8b299c39ca32

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
cf2ae62f94a5c5f936a0a94d32c8b2a3

SHA1
28d127e12ed1ad60c5855f4fd6222714b4da79c1

SHA256
4011dc19a4aaee0f4dfce23674c0b3b86a51b2af33826a279487118d4f88b5a5

SHA512
629c09d3014b20c855606bc9dc52630b7acd60242b9cbb13d771513c007b579e7fe7b00c695d5e9630a349663ec568af2a1d6ce3eb3e6616463606a4f73c5b39

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
552B

MD5
5a9583138f0d5d6215cb2238320cb6d8

SHA1
7c418532f8b4b9e651368e9c9eef3ad420818396

SHA256
d524522f7b53d5dd020a754ccae36eb2293965f208c58de81b517b5bac20d856

SHA512
0c76008a0541a4953879ef156d72812382fa873b4a45d5c92c64346f94eef9a4a4b2c76aaf1a9a14c19acf7593071672d24aae314f0fc501ba114e885bbf0fc0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
552B

MD5
5a9583138f0d5d6215cb2238320cb6d8

SHA1
7c418532f8b4b9e651368e9c9eef3ad420818396

SHA256
d524522f7b53d5dd020a754ccae36eb2293965f208c58de81b517b5bac20d856

SHA512
0c76008a0541a4953879ef156d72812382fa873b4a45d5c92c64346f94eef9a4a4b2c76aaf1a9a14c19acf7593071672d24aae314f0fc501ba114e885bbf0fc0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
b691131db9ecf6f6c0bd7843b84d31d3

SHA1
7b3690275b2e3e98d2453b7ea174cea609af399d

SHA256
12842db4e88d0ce76011f3b6e3b7e15f85e24c6c95a0a35c9ca0037834b402d9

SHA512
8c797068455984f09864b3acd05ee1b31f4f6c4891c09664f9877b586864e47be11e0ed816b5e90518437da0e666191f33013fb2faa62c80f44726a164c0755e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
984B

MD5
cbcf0cae6f5d4707f2d3ee3088c66d40

SHA1
f44029caa64534959f00e908b3239630418c20f4

SHA256
fa76beb880663f836b0967581bc7269620386ffbccda664ed199e7139c4411d8

SHA512
676d3c48b3a14ec46d1c5ade9f43359f0f05763284eab8a7c919087d5d27eb2a78845b4519666b70859c80448a8711105e71f833b5006146437d689b24456a2c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies

Filesize
20KB

MD5
c70f259798f607abec3e3dcfee008f77

SHA1
37c67d771244a14e5e07c828da8f1dc93500cd84

SHA256
61625d7e8fa3bf0ff354b557768466881e970c8edeb5237a14ddd8f4f0f14df7

SHA512
fb90f7ed59974f8acb355aefee1afc46f0bc68db1849c57042d9814a423a3d58bbfcbdd5d2d5395db2497f75cd5cb5939b4de7eb00d262ec7360f5d6452fcde0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG

Filesize
319B

MD5
4981511299519888cf1ffd2a09587e67

SHA1
4ea2634ed40d6285dc06fd1af819a6f3886017c1

SHA256
1530fd36cb78c7f9b7f4273234e4e604a8549daf9b39e017d0fd413b7c42ed2a

SHA512
b06db0c0be60dacb6fe7498b470ad5117c0fdcca1857f6c31870197d9f9fce756b7daeb754b711d6e904c3f5a12227ad04d8e90363197a4bedb0486d1dc49acd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Favicons

Filesize
20KB

MD5
c40168996ed43ddfbca899a4430c95fa

SHA1
09af9335790d49524656d386f55adaa3aff69d43

SHA256
c36b30ff805b973b8decbc48448bcd8913ca857ceb349cd0ece864c8e38a0b9d

SHA512
398569a2bbcbd1089a431db047c624b3ed4edb27effb15cbab66df93fae6a7b5adf560b30e0120e522ce163f9e12ae710e9f7c404a7ff117492240bea4384b78

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\GPUCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\GPUCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History

Filesize
124KB

MD5
2b5a3471406cf7b9c87dad859c5167dd

SHA1
9d1c6ed6fdffb69c40012dfc5f080267a2377890

SHA256
24e230cac2e398b2051329d1d25f2ff994c2b4323c78391a95cb023e436aab76

SHA512
e343b01e5287e6a731b60c8ebf9c3312629fcc4ef70e3237e53655f60a8f967bea77f78807aeb417a12e7cc5ba35909b99d1a57d08c216b75faecf6e9c39a6b9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History Provider Cache

Filesize
1KB

MD5
07fb6e966adf03faf636983e5abe11f2

SHA1
1717daf56cbe66a85542810d0d1580ec4cc3fd55

SHA256
8add167c7d9297f1d95fb31708d893c5d31370e8a45d9c87cd8256ec86a7b36c

SHA512
213004425aacfafba09c50990a509ac65a0110726c91766721041e34722ef1c49d41669ee771818be324070a0cc2dc6428f8f05c1aebda79d6bebd1b4e229bc4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History-journal

Filesize
28KB

MD5
bd1170453dc02fac51656124da6ce310

SHA1
2ecd9211328b1b69d89bce81f49d7c2882762e0b

SHA256
3624e568e05fb9622263c06775d7009748cd632dc9d3432f1715dc223b238575

SHA512
9a2c6e3c8599d482ceb387e1091f9baaaa96766f0ae83affff4e969084578dd636adfc89afc4e7254dcad57fea47ffe7433a712e62075b8a94699d20f572fe9d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_en.softonic.com_0.indexeddb.leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_en.softonic.com_0.indexeddb.leveldb\MANIFEST-000001

Filesize
23B

MD5
3fd11ff447c1ee23538dc4d9724427a3

SHA1
1335e6f71cc4e3cf7025233523b4760f8893e9c9

SHA256
720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed

SHA512
10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log

Filesize
35KB

MD5
61b227941909aa0292017603fffec635

SHA1
d9244e9c54082b13da41bbf16ac479dfc6a0649e

SHA256
46c358bcb563f8aa976a15a58ecd73f3ab43e8baee16187e0a7ff534d9d3c776

SHA512
7d71de0a952dea4f903be88ae291301dd3e30aa46a9c6b71cbb543a89753be9d5ba014ea392ebcf6940c59983d46de7c775c9c3b3d54233de8f4404374a03f70

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG

Filesize
331B

MD5
a51aa3641278da7fadc0332b05abc389

SHA1
13744f9a10f3dc35339fd7229b51211d123688de

SHA256
e468099c555d1417c58633ffef0cae8f001b57c29bd6c491d3a89578ff361d99

SHA512
f6ff47c1cf9217b79d4cbaaed4360b2309a17d57f191f1d46efbf27042f0fa90548202c2696c7310d7cd6023bdc53eca9cd0fb2b30634c305f4d3a7a8c87701b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
8KB

MD5
6ff2db0b710d8ca2e77bd3b9c5dbefd4

SHA1
8666a9999f1e56d9ad6ecd847cc34a28339db313

SHA256
cadb207ed82a4150c32d058701c8ff79fce72ded37a9b6217b67014390dd820b

SHA512
51af695fc42f7c24ad78bb2fd957c83fe8ebe0e02cea33cbf24dd9610c67b8958ca493c39e38940b2078c9f541de42851d5e20dfaa89d45f1c56ea7e5ea5322e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
5ff52a57ec0f2361b990a0e13dcc2099

SHA1
14529c10cecd456a7ee488e729294885a53605ed

SHA256
24a3a0c9f916c9ef4b394f382c675aca1acee989dd4f8c42af380b2712c0e3ad

SHA512
2afe7517d40f7d7f86b404a1aaf9c168913798d12ba807d1276a0b2ab9e0867791b1c77f7f14fcc03ec4eda1d7c0a7e5d8963e61007fb88559ce5730cc61c003

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
cd6de2f51b7f57f3fb9eab62d482fc4a

SHA1
a5203278e1d09735aa3b75ddae476787b6f92d8c

SHA256
e6ee840f4303c97ab7732e17d547f209a64b09781c684a1c6df9272bf8b585fc

SHA512
58bf18f5903730d843f4e020c88024a7c49dbae24c497c8253683d33c953b51fe5cdc02571edd4f792bcb773602a19aa119f863ab03f8386a26d9cf81d5d20c1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
d9683d3913482e4a3fffe5d825b0a8c4

SHA1
c5373593020f3c8249f0d84f430f314bf57901cd

SHA256
1217541b94878f3bff42de62033ea3b6bd9a9e6879c26e40f606365d0b0e6319

SHA512
e16655b4278aa4b222d0c099316c88f725a642434c694a4efd88b02ce89f0c757e22a616e8039dbcd1762cb6f42aab7469c929472d00c3fc5ad25ef98af0207d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
cca33fca7decdce1b60ef0b6cc7100cb

SHA1
b9d84c7a3983d90ee23b6858779d663b4d792c49

SHA256
d8026c0dc36214b1243f8e4e3ec3451c2061f18de23408cde2e1c47a9794f619

SHA512
89e33aa667af79a0d141b7afba329ae52df72e6fe6575d41ac49b9a976720d4f9af611161d94b8b28f33863a0bffbabe3535c184dce4f82173ce371f8ac041a2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
998724cd58adaee3caee074ad6ea9e76

SHA1
2d14635e74614ed0a005869632bb2e7dc868fb4e

SHA256
97ce88cf6697ff110eca110d20de8381fd7fd82d9e0e2f9254739fd46a4e2147

SHA512
70d3fcfcf9d4b94fae2d652f4e63ec4ca81bfea751f0811c7b52b35b0df07b4b23ed1d0bfd793334c53f3ad1cfe55fa546cc6b0111618dfc0a371632709b1237

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
998724cd58adaee3caee074ad6ea9e76

SHA1
2d14635e74614ed0a005869632bb2e7dc868fb4e

SHA256
97ce88cf6697ff110eca110d20de8381fd7fd82d9e0e2f9254739fd46a4e2147

SHA512
70d3fcfcf9d4b94fae2d652f4e63ec4ca81bfea751f0811c7b52b35b0df07b4b23ed1d0bfd793334c53f3ad1cfe55fa546cc6b0111618dfc0a371632709b1237

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
304ce5cd7dc3eb863ff3958ac21482b4

SHA1
0afc389450690811e607a74de19be818c586a597

SHA256
74f4b25ccb2f45e16549117f35dec45585bf672cae044e5334fe5fa0769082db

SHA512
c6ffc17279563f895cf5986b9980e6c70be66f8f8c09fbcb0b56b36cdf0d8f946f8894b0e3f4736d8ce452afd0967bc80f59ca351223f056bdf0c790c34696ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
97e1aeb32a06b0e749524d39116d34d0

SHA1
d2b93baf06ab629385c23c436bd82e1d0fe5abc7

SHA256
b9025b0416b8eb6e4adddc9636da621b3d0b851c4bad23030aa71813026aba98

SHA512
c938f4044d5b104f22b1c016388a9484ae64ee831aa770421241f006ef29db5d4bf94db27b5f5dd30f7c7630f1b13fa035777192cb581845192279eef673a648

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
03868eb27fe74ec583b7ad649bca6162

SHA1
1e8acdc67fece824d056e8161be648dcb7aa0005

SHA256
45ad9754c82cbe6736116ff83c25f4d0cf201000c9cb0ec000cd398558722dec

SHA512
7867d0fc32f4ee04032dc34578785563fbe24fc394437d64c25e218f1dc351f2969e8edbb55e335bcaca15dd7c61c300bcb4d9b38db8914c2050378fd77e3047

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
a351975af30b781963c1b67c45e510ca

SHA1
770a89885a6b310c73eb38175cc3c137b8faf940

SHA256
4ab3049cb12d697403618cb5519d5dec79916b5e3dc3829389642bdb02275364

SHA512
412dfdcc7051e6a3101b110bbc3062e10eab1b57fabbeb764b46894b9d9791a013ca73f793b9c065346cbd83c87a75f7beef9a11719e5d0f9bfde69df9107998

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
feba20a8304a33181fcc5a5d79826c13

SHA1
2798f293e92ca7020444eba050dd0943167e6187

SHA256
c53da4ca42d8c7cd277a4ca53c8247ee15cc7e5bc9c7961b1cc61abbcac0dca3

SHA512
3702953f412875918529372f8722647e2d48b28a395f70e14ccdf3d9d9b54c8a524f1ba78c2f3671e9b4f29ffcb95d26e593f2a068fe6bc0d76b923035fc65ed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
30e8e29d4f2c326f82971981d7d972e1

SHA1
784c25466e9cb51ba2d3359a50f9cea63348394c

SHA256
3a8aa98872c504e887f6b89bd4c4a51f8a46b073d9bd3d658662f4dff10c842e

SHA512
80f0ec6794dd63e97b01ea51792ee1d17d797bb672b5015ed64aaee3b4e275be6828b499951f194bd70970715adfc4bdcab382234c7a02e4a3523b02e11f1110

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
5bdfd27f8792988b6221fdf3097554b7

SHA1
ad1f3a17e1cdefafe1af7d9a8fb12c704e7a77d7

SHA256
5cf70ab9e9cc01d99b3884f2fe3bd48d63f236c963de3f504726c4caa78427e1

SHA512
8d98f5231d6b91a8d7cdc8d3952bb1bae181a59f6030af57f5aa722837d9b22129cbda7289c11b70c7befea4015e28bb4e2c0239a1d2c0940915c98cda2dc09b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
a98dd840598643db104f57fe3387423e

SHA1
f3cfac53e7f09d74d4aaf0ee53816c2ca59ce15c

SHA256
8d6a07e13985f0ec1568dddcc9e95dcf20472da90855ab0a27bd29d42849f140

SHA512
c278794f93a869437f6744cccab0beafa38deb379147c0963c90df7c0a4cf0bec371224971b1c29c90d6ca95680b175edfb69f0dc4c5e15bc55794c5236c2b6f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
c7abe8953283279e559ac1da93a5b31c

SHA1
b58581f42944f7d4a253bc86b50341be3f218b0b

SHA256
a24c55158244a32ec8f7e7471f29b27aafce6cd28feb9ffd1f04dc537b0dab81

SHA512
edfb2eeed9efe377649faf11b3f0f483e0af09f7f237c24110da3e84986f01733a5137900d3f58c5dfd3d8183ef0dea2515fada3023988a6b1eccbc8f49aea4e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
b8b2af06a0bd219e780864ab398ee0bf

SHA1
cfae4ca7f7a027d8d9bf7bdb14a2a94815dea4c9

SHA256
059ce6c64469bda0ccba7fb42f39a9f638a1d508527c17e6656d049fd4596cd5

SHA512
b3ef00acf92821b4cb4ae9f9619858fdaa14570c9ad8e2e1d0332b987ce0a473f570f3d215bd2be10617d866d4c54ff35c532867373aba4631c3be6b76cd957e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
10KB

MD5
48bdc53fcd01b3bd169e4883bb13e9cd

SHA1
4ea37d1a8bc3df7d4553c3d53877571f52c8dc3a

SHA256
b387aa69f9f12c24fd208531f688319a3f6d96d4940f5b5e4e37d5348d4f83b7

SHA512
8a089016b4c65c394d0798af2c9a37ac29a2017435f19295b9207c3cee06195cbf40a35b64e0be3b672e0edfc9bebd93055da644ce55dbab8b64143f6a5893c7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
dac4684cfabf3f0b27158f0f7def72f5

SHA1
db8dee2c9aef7134407dd4f7e921049130945669

SHA256
256010dac6c8df05e12da5685d7c07440dbe074da03b836246355c96612f4e67

SHA512
6dc965831b881740c1d5cb2708f1aac6de65a3d63fc68c383af0b23ff1c1e4fe0feed7c555d12b98978b4fe301e78a9266927e960bef28ee66a896a18348f09a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Reporting and NEL

Filesize
36KB

MD5
fd4059f216c33cea1e57ac905805ed1e

SHA1
8c6b84dbf26fc3182591b77cd76c65eef55d9c77

SHA256
a4661f29220c595f33b483ee3b55ced3925047e1083cc7ff6455d927d77198ed

SHA512
5fe49efa03b4c38cef3d3525eff2488614f07d78ebd6d9eff6c1d8f84c45cc863ebb31041a56023eacdf313be3e3a0c2a877d035b816c997ef2ffc76c46c529a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
4b781306eef375e7a60cf1e186ae3d54

SHA1
e9d718868bb4f5bdeb1658da532477159c9e11d0

SHA256
2171b47efeb585994751e106a8014a21fe355109b7de1d032cd7190242e59a4c

SHA512
aa738ade4ba51982fec15d6da8368be77491c0d220b0b0340af52626f6b18478842705472d4fb18d61de9a39e21d5a7e70b53ccc63617ff3147ee9d5a05423dc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
5544c64f2a8f49dabc19eb84267b1c9b

SHA1
c5b78d63a8bab1c7b985f7ea2f268d0d7809071e

SHA256
a1fcfee2974a77e76a7431a2069db301861ab42dd41769cead8697f41f5a497f

SHA512
38c80d7c810441fc87beff38929473088cf426b0a25a30820d8a060f493350d99bb8521b314afe00578ea54648fce2aa4e55880a83a4f1048c56307991726565

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
90B

MD5
838d96de397ee54c7a045772a21fca45

SHA1
a4ea182676df451246a8e800486afbc5a666dda7

SHA256
6d01e52a745d67af4771645494c8a66cb3236e7f0ef6b25b89c4b07a20430201

SHA512
5f84718250b3c7adbcfab92fb063b582dc285d9c2e7e3b74992a62fedbb961917e6cc045d62c6e352d16f4393b08bb823ae1683a133d26f3c6b34597d023d047

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
26B

MD5
2892eee3e20e19a9ba77be6913508a54

SHA1
7c4ef82faa28393c739c517d706ac6919a8ffc49

SHA256
4f110831bb434c728a6895190323d159df6d531be8c4bb7109864eeb7c989ff2

SHA512
b13a336db33299ab3405e13811e3ed9e5a18542e5d835f2b7130a6ff4c22f74272002fc43e7d9f94ac3aa6a4d53518f87f25d90c29e0d286b6470667ea9336ae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\000003.log

Filesize
1KB

MD5
2584514bdf78a2a5a297eb1a2a79aa63

SHA1
56117350388bb4aa95a4fa6cee049764202e1ce9

SHA256
fac80c80487f45993c0297601520518715f44895ddb8d0640e8490ecb78680c5

SHA512
c5cb8e7dfd8aa4dc8f7377584841ea905087088043b2a52fd6d6afa1a23457e851209c38d11cd66158a7fa2530ec3548c8bce3410aff343165c97c379a0ae501

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG

Filesize
319B

MD5
5d083a4361c6506c1fd58482388effb7

SHA1
d4e7e54e6aa4dae04435da0987bbf43fc4d59a9f

SHA256
dbf87e6d5a786911fcb42b2f3be714d63df6254a3d81f17c0d83a6e3ce6b19b2

SHA512
269cd822eab806fd7b0779f7cf38bf45144e3e9b135ac5e892d79ebae9f623dfc0b8a4494153b25f62f1df4ef76a78ca7f704118cddf9769e4eee9dd2ff0e463

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sessions\Tabs_13333033452930934

Filesize
3KB

MD5
b849bb2ef0b6e9512f4917fd8f0610d8

SHA1
e1f34f226dffe8adf37d24721272b9d1560b1576

SHA256
3df9dca5133c70be42481dab881b4e9022b1f0e28ea46781863f340a563d45f9

SHA512
b5217bb27feb04d1d9d94c0a0510455705cee8c2473ff74357d3b3b996b7ff8e6766c20b4a49e1ab585c4cca447f2db90868bc6b5bcc943e48b6b898fb09a45e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\000003.log

Filesize
112B

MD5
bbac8f572f3c01175b67f44168de0bdc

SHA1
e58ae229abd821ea5fc99e087d16a2c24da0f347

SHA256
2dd124a3905ced155ce83d45d6eb9880ce394d1faf8e739055a331fb5b908151

SHA512
1f39ed90de4e0fe7a8d3902e0517e4977720c642ad2b8bf60c031c913d1b9922b705a6ea57f215111ad723b7184ef1f027d073bd0b4ec559c503ab05df4f4dab

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG

Filesize
347B

MD5
768fb72e130da2c62ac290ae034ac922

SHA1
c520a76db9a3252559048225d09d603245541e3f

SHA256
3cae43e101f106006290ef1ea673cdebf8522bac14cfd66dcedb91a45f83b0af

SHA512
c7a1554d76c0dc721ce78a24ba28d60e0f2d459d969024079ce30432b465e78f66e0635fe246922241ea69a5f1e0bf4b47b4cb9a572c4a6f768cfd25eb4ea977

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG

Filesize
323B

MD5
e3b63241e8706e60401b4d608d417608

SHA1
01b4f0c137f5486a2e69b6aed234d4dc83f9ac04

SHA256
5403caa29d1cd3936bb181cc41bb8b994ba3dfc7b311210a7b53eee36f5aad82

SHA512
250b595d1e4e1294d18d31326cac4f5683a73870902f82c01ef8386d3a88b733734ff6f7079595578d66301360a31f2994528c1c77943eaaf7e33611dc71c4d6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
202B

MD5
efa75a07ce507456ae52670d9a00506d

SHA1
a5698eec52e62188787f8a47fc34bd592a5bf029

SHA256
a273f5b14ee17afefbaeb2df8cc0f65e3e671c22f30eb91318abb9dda241d9ea

SHA512
cf7a93b63764b5436279924b394c0d18de3767b996aaecfca2c9b7f212c550f03e847194780e2749736caa4af097f3b69140a30153ab6cf843622a1aa5c02ac1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
0b6aa40e529d023f6b865d9c4c75cb9f

SHA1
3c8b8fbbc36e30c4487cd7d7c3cbef30aa139cb0

SHA256
ffc0cddd14d11cb2cb9f655681b753a3f93aa381ff5b4f65f67a2c1ccbe2d637

SHA512
8f8aee4b6f61151fe77aa0608bac21e72b115f01a8cdae59e4e1c2d1ad4afad905ad68c1c240f89652bb4e427c991f2f0524062d267420b4a7b1580afac7dcdc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
30904d5448010a3d6ac3638a99d1d3a0

SHA1
c673ce4ecc46ffb106360de8641e6285623d82e4

SHA256
4c8841c1d0fc0682ee681ac2ff6776bcbf518076a39ddf61f5bb5344ad3733af

SHA512
5d8a706a6281cbfc3b81fd0a11516866ee0ba141c2ed3b9d541550d50eec08e8a3dd7ad3f9da0497c3485082eaa5678fc63e2146db1c4b052908cf7484617a0a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
370B

MD5
237313097cf3b0a96cb303b8877b3c3f

SHA1
8bebefdcc413d97ec28c81488fdd27836069fd97

SHA256
5dfb8d3cd4aa24dfc5701b96cdd64433762dbbba9ea2aac26beeff908c4017ce

SHA512
f926a845ac0d4b73cf4821f3a4f66f12e4d3a4a281c5a40dc2a0dbe24a531067786908165c2e3203b75fd0d1e83a7d09971d8522eacef89179bddf7437b30428

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
1ea94af1114c3b3092a262521e3e336e

SHA1
0e69c2a118c0f529560f691b1074f02418e92baa

SHA256
0fb48206c586dfb059ffc2a2242b48dcfa829d887ac8243a70fc40dc7513f4ae

SHA512
715dbc5fecfceeb2c7896e290a2e3e6a64ea928999a14113955d4adfd170a937ee80a23bc12469791f0c4cab2d63d578a65c6dc935b90b923e64a23d428f27f8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
372B

MD5
fcfa77aabeb033fb5ec00c5be61d2f83

SHA1
4f162a9c0b7fa3d6c26a2019cfd07fff4cb98a56

SHA256
ad336fdc803f9e189edea822ca2fef1e07e3c3c4f6c35762be16b689a3d0898d

SHA512
5ced549dce078327f0e3293ac3a2a38bda3fae3ae871de2ac31f7a5a9e406df4f6d0d50d8f2cd79c21a908f508914c09b3bafb284ccc66e8dbde0a16d640aa64

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Visited Links

Filesize
128KB

MD5
b0e3d27f7f34c8ed4a1c512f54cc4d35

SHA1
8e3c036e31adf6df14e70235da5277aa20866c7a

SHA256
ce77e1b1b0a7641f0aa6474b57c0d0a7f70dbfefb4e8b04443fea1cb395685b1

SHA512
3ad22d5d9888e517e40bfb43aaee71590d4f438ae5b855344f5d4fe02d6d4606a53f31cd16f8c6605c4b320bc699414c900263b7a2ff76894fa2592670038f51

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\d353f068-5411-4bb7-b7cb-8aa958d4f1a0.tmp

Filesize
1B

MD5
5058f1af8388633f609cadb75a75dc9d

SHA1
3a52ce780950d4d969792a2559cd519d7ee8c727

SHA256
cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8

SHA512
0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
60e3f691077715586b918375dd23c6b0

SHA1
476d3eab15649c40c6aebfb6ac2366db50283d1b

SHA256
e91d13722e31f9b06c5df3582cad1ea5b73547ce3dc08b12ed461f095aad48ee

SHA512
d1c146d27bbf19362d6571e2865bb472ce4fe43dc535305615d92d6a2366f98533747a8a70a578d1f00199f716a61ce39fac5cab9dd67e9c044bc49e7343130e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
ab6ab31fbc80601ffb8ed2de18f4e3d3

SHA1
983df2e897edf98f32988ea814e1b97adfc01a01

SHA256
eaab30ed3bde0318e208d83e6b0701b3ee9eb6b11da2d9fbab1552e8e4ce88f8

SHA512
41b42e6ab664319d68d86ce94a6db73789b2e34cba9b0c02d55dfb0816af654b02284aa3bfd9ae4f1a10e920087615b750fb2c54e9b3f646f721afb9a0d1aea3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
aefd77f47fb84fae5ea194496b44c67a

SHA1
dcfbb6a5b8d05662c4858664f81693bb7f803b82

SHA256
4166bf17b2da789b0d0cc5c74203041d98005f5d4ef88c27e8281e00148cd611

SHA512
b733d502138821948267a8b27401d7c0751e590e1298fda1428e663ccd02f55d0d2446ff4bc265bdcdc61f952d13c01524a5341bc86afc3c2cde1d8589b2e1c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
589c49f8a8e18ec6998a7a30b4958ebc

SHA1
cd4e0e2a5cb1fd5099ff88daf4f48bdba566332e

SHA256
26d067dbb5e448b16f93a1bb22a2541beb7134b1b3e39903346d10b96022b6b8

SHA512
e73566a037838d1f7db7e9b728eba07db08e079de471baca7c8f863c7af7beb36221e9ff77e0a898ce86d4ef4c36f83fb3af9c35e342061b7a5442ca3b9024d2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db

Filesize
52KB

MD5
9fc1ef71dff585775e522294b4df1dd1

SHA1
58e46ca582ae1a2678f91f205b86b2a522336059

SHA256
124c2777d43ebb6b806333e507f04ca25bb025622ae783bbb25cfdb8f0cea9e6

SHA512
6b59b3ef17c14611a602b8beccc222465bca344d81f1a744c3d7dc123c85985e2d491120a8e721b7c92700763c50873b8f3f5d95d6d53aa1c939990670a85c7d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log

Filesize
206B

MD5
0658573f773e2223bb028be93873e762

SHA1
381caef243a42d7ba64a23a1b7dd5e115e94a7d9

SHA256
cd4b1cbcc3fdf0edbe5bff94fb2acb2bcb0b6a55eb2c8090148fdb8c5a6adc7f

SHA512
938761242214fb8fd625eec4497a5e59d2279847a5b452a78b913a540098cd0d97402d5d40ec7a7570f7b30063025ad03a8ec9579e999d5a508bb65257c5c12a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG

Filesize
322B

MD5
648128786d45361b2072a8a81211f174

SHA1
7b387128ab9ed160ef522a23c445c3da60d4f91e

SHA256
6da414328db02f169f81e514144734cd4ccdfc373cf49b2ad35ec12357b594aa

SHA512
3e47c0dc26f2b4aef3900370909afb6a72fc73fc85223314c85f318733785873df359aa9b87142ec7ed6afcb089d1472f6931aea7182ec0af28fbd22d2902bc2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log

Filesize
594B

MD5
3dd5c5b20df322f9c3f0cfedb0844724

SHA1
c244722e17518ad333029d5db50cd09ff5aed2ec

SHA256
fe6437896dbe5f2c725d21d3fde9ba786b4b6da2c2ab084063fe33f817538021

SHA512
a737d935e45e7cba78159d618ef3144b5cbf35017d7da0bbd22db581900300c93ab64f649ff9e3922170f0d1466f8ebdfe792c0d33d1df45a8ccd89d2fe33f6f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG

Filesize
340B

MD5
eedb45bcd99a561275c08f98b32a38f9

SHA1
cc8c2d7ab4295f4d4d6054db878c791eaf5bb339

SHA256
c934eb250b463f4c25089b9b0030947a2f253a181824c66d5f43b0035f3f179f

SHA512
1d0617c46bbe3c621701f1245170c7a7872f46c1204f81e1ed0ff3ebdadf396214cca2facad965b69a651a3263affa952cd12687ede7928cde61a933695bd2ac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Browser

Filesize
120B

MD5
a397e5983d4a1619e36143b4d804b870

SHA1
aa135a8cc2469cfd1ef2d7955f027d95be5dfbd4

SHA256
9c70f766d3b84fc2bb298efa37cc9191f28bec336329cc11468cfadbc3b137f4

SHA512
4159ea654152d2810c95648694dd71957c84ea825fcca87b36f7e3282a72b30ef741805c610c5fa847ca186e34bde9c289aaa7b6931c5b257f1d11255cd2a816

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version

Filesize
11B

MD5
838a7b32aefb618130392bc7d006aa2e

SHA1
5159e0f18c9e68f0e75e2239875aa994847b8290

SHA256
ac3dd2221d90b09b795f1f72e72e4860342a4508fe336c4b822476eb25a55eaa

SHA512
9e350f0565cc726f66146838f9cebaaa38dd01892ffab9a45fe4f72e5be5459c0442e99107293a7c6f2412c71f668242c5e5a502124bc57cbf3b6ad8940cb3e9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version

Filesize
11B

MD5
838a7b32aefb618130392bc7d006aa2e

SHA1
5159e0f18c9e68f0e75e2239875aa994847b8290

SHA256
ac3dd2221d90b09b795f1f72e72e4860342a4508fe336c4b822476eb25a55eaa

SHA512
9e350f0565cc726f66146838f9cebaaa38dd01892ffab9a45fe4f72e5be5459c0442e99107293a7c6f2412c71f668242c5e5a502124bc57cbf3b6ad8940cb3e9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
565190142d12019ae27028ddf9d926a3

SHA1
02aee8ea640c3a975bbda824e7011970c08e11b3

SHA256
e331a50b8924b8f8e0c03d6f81076870aab96c0b4fc55c8ec5794b3feec0d009

SHA512
45f7b2e788197a096cdf3c89ffbd61c4398cf9ae65786cf84aeeebb7e24dc0254a9dadf2aac17ea95ba6524eaf276eaf275be2d089646f020e89610fe175a8cf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
565190142d12019ae27028ddf9d926a3

SHA1
02aee8ea640c3a975bbda824e7011970c08e11b3

SHA256
e331a50b8924b8f8e0c03d6f81076870aab96c0b4fc55c8ec5794b3feec0d009

SHA512
45f7b2e788197a096cdf3c89ffbd61c4398cf9ae65786cf84aeeebb7e24dc0254a9dadf2aac17ea95ba6524eaf276eaf275be2d089646f020e89610fe175a8cf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
0d4638adff13b5c695af615d87b80ac6

SHA1
6310135790c56379d3b48a5dcf6af108af0f158e

SHA256
0e9865e7d37d7792de5583586cda5893e02745a4346d37f70874e1f499bf09fe

SHA512
ac21a07ff252bc05017d4ca22cd69931067392af3177a64528f52e1c48970e8666ca6a9f96e068abd319dd0cf60fccc94ab1fa28112f097e9f2a7f467fbd91e4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
13KB

MD5
db33545c3bbdd25b3d6e75d310733c46

SHA1
283ee146ebc54ca86c0205d751bf28e6048ea0c9

SHA256
2b9ef8e0298cf4e0c8b361ba4ebe27199bc82675d9b147fce0c00b5ca5773922

SHA512
b3b3a051b41d420d9e58423a5a29a0b231d1526ee148ddc128fafca77ab765e2c79f76af5cacf3d4ffe6dd1daf8772659cb5d8d33fda3626e392b3f5c2885c5f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
13KB

MD5
616660bb94c2873be1f7f0101a506909

SHA1
a676f9f4939800e84ebc8cd287462938c5bbe1a1

SHA256
e2d014703e36c6fa95c284a6f8e444c0a9c844b135fbfaeef451ab0044150de1

SHA512
fbff87f683f510c39831cf0919f6dcd777225339129b6ae9341181b8ef6bdb11c9e2393998e042c7867cab52b109251f317414e00a96c1451d45c5cd25259399

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
13KB

MD5
7420c7edb5ba4340589e77bdd1c74ba3

SHA1
a09ff5cf86e511db3784a9665dfef9710a7ae6a7

SHA256
5ffde9caff19216b64130025b1de1dd0c18128e96aa2359d7bd985db8e7ff844

SHA512
f6051039fe4fe2f754cdbf6f6e3f2d89618e44451e1c5be751bc4a81b281791abcdbd5f1ac2704f083eee0a8e50f43b8a42a5307b01b27caa28d3b043ddc3a63

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
13KB

MD5
2868ed22d75f1a9fbebcf0b1e1f4b6fb

SHA1
ca7f973e0c299192ed09bf176740162ffec7adad

SHA256
02c656eda47e452498ae3766502eb83bfb8db302795987e45d3f370523dca125

SHA512
7bcce7bf4cac9574a4059ec4d0ccd3ddd4b7b2c27d621ffe2b1c91f00a2514fcb768a008e3a05d08e8698dae567a763053dce979ebe23b746ae147a2463b2459

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
13KB

MD5
133b810072fa324d3515e99c5a915213

SHA1
36ff47846ebd9580eb69f475e6486352f98e771f

SHA256
945ebcc96f02fd38a3ad42803bfb871dc765215ba9106239b416e5728e5ce7c4

SHA512
93815da48bfcc4002425d21307e2b5a1d809614e2dc59e09eeb8f123105ba81a5b9c3de781d9f0bdf3cb8b0dbcb6b4a7d54f1d95ded34de62aa6d126e7e39c89

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
13KB

MD5
1c513d4dc3c936e3ef110ab1c3f03a90

SHA1
31f0ed5bc0f5918f519e29efa16fdda1d2840b8f

SHA256
67723ab5ba1ab80f5097f169d9176dbd3a71c4c314033043a9284711f68e2cd6

SHA512
03d483bd4601af59d086c857e2b199817b3234b171fe215eabcb5d77692f8224686570c7b312af77a62b4b2db3298fd99063d84616fc19908771f9cff18026f6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\GPUCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\note.txt

Filesize
218B

MD5
afa6955439b8d516721231029fb9ca1b

SHA1
087a043cc123c0c0df2ffadcf8e71e3ac86bbae9

SHA256
8e9f20f6864c66576536c0b866c6ffdcf11397db67fe120e972e244c3c022270

SHA512
5da21a31fbc4e8250dffed30f66b896bdf007ac91948140334fe36a3f010e1bac3e70a07e9f3eb9da8633189091fd5cadcabbaacd3e01da0fe7ae28a11b3dddf

Download Submit
memory/4216-1115-0x0000000006280000-0x0000000006281000-memory.dmp

Filesize
4KB

Download
memory/4216-1125-0x0000000006280000-0x0000000006281000-memory.dmp

Filesize
4KB

Download
memory/4216-1126-0x0000000006280000-0x0000000006281000-memory.dmp

Filesize
4KB

Download
memory/4216-1124-0x0000000006280000-0x0000000006281000-memory.dmp

Filesize
4KB

Download
memory/4216-1123-0x0000000006280000-0x0000000006281000-memory.dmp

Filesize
4KB

Download
memory/4216-1122-0x0000000006280000-0x0000000006281000-memory.dmp

Filesize
4KB

Download
memory/4216-1121-0x0000000006280000-0x0000000006281000-memory.dmp

Filesize
4KB

Download
memory/4216-1120-0x0000000006280000-0x0000000006281000-memory.dmp

Filesize
4KB

Download
memory/4216-1116-0x0000000006280000-0x0000000006281000-memory.dmp

Filesize
4KB

Download
memory/4216-1114-0x0000000006280000-0x0000000006281000-memory.dmp

Filesize
4KB

Download