0acffde0f952b44d500cf2689d6c9ab87e66ac7fa29a51f3c3e36a43ea5e694a

max time kernel
502s
max time network
532s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
17/02/2024, 14:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
MEMZ-virus-main/MEMZ.exe
Size 16KB
Sample240217-rcmrtsff7z
SHA256 3872c12d31fc9825e8661ac01ecee2572460677afbc7093f920a8436a42e28ff
MD5 1d5ad9c8d3fee874d0feb8bfac220a11
SHA1 ca6d3f7e6c784155f664a9179ca64e4034df9595
SHA512 c8246f4137416be33b6d1ac89f2428b7c44d9376ac8489a9fbf65ef128a6c53fb50479e1e400c8e201c8611992ab1d6c1bd3d6cece89013edb4d35cdd22305b1
SSDEEP 192:M2WgyvSW8gRc6olcIEiwqZKBkDFR43xWTM3LHf26gFrcx3sNq:JWgnSmFlcIqq3agmLH+6gF23sN
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

bootkit persistence

Malware Config

Signatures

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\Control Panel\International\Geo\Nation	MEMZ.exe
Key value queried	\REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\Control Panel\International\Geo\Nation	MEMZ.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	MEMZ.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\devmgmt.msc	mmc.exe

Drops file in Windows directory 59 IoCs

description	ioc	Process
File created	C:\Windows\INF\ts_generic.PNF	mmc.exe
File created	C:\Windows\INF\c_holographic.PNF	mmc.exe
File created	C:\Windows\INF\dc1-controller.PNF	mmc.exe
File created	C:\Windows\INF\c_monitor.PNF	mmc.exe
File created	C:\Windows\INF\c_smrvolume.PNF	mmc.exe
File created	C:\Windows\INF\c_fscontinuousbackup.PNF	mmc.exe
File created	C:\Windows\INF\c_fscfsmetadataserver.PNF	mmc.exe
File created	C:\Windows\INF\c_firmware.PNF	mmc.exe
File created	C:\Windows\INF\c_fssystemrecovery.PNF	mmc.exe
File created	C:\Windows\INF\c_mcx.PNF	mmc.exe
File created	C:\Windows\INF\c_fscopyprotection.PNF	mmc.exe
File created	C:\Windows\INF\c_fscompression.PNF	mmc.exe
File created	C:\Windows\INF\remoteposdrv.PNF	mmc.exe
File created	C:\Windows\INF\c_display.PNF	mmc.exe
File created	C:\Windows\INF\c_smrdisk.PNF	mmc.exe
File created	C:\Windows\INF\c_scmvolume.PNF	mmc.exe
File created	C:\Windows\INF\c_swcomponent.PNF	mmc.exe
File created	C:\Windows\INF\c_cashdrawer.PNF	mmc.exe
File created	C:\Windows\INF\rawsilo.PNF	mmc.exe
File created	C:\Windows\INF\c_fsencryption.PNF	mmc.exe
File created	C:\Windows\INF\digitalmediadevice.PNF	mmc.exe
File created	C:\Windows\INF\c_barcodescanner.PNF	mmc.exe
File created	C:\Windows\INF\c_scmdisk.PNF	mmc.exe
File created	C:\Windows\INF\c_apo.PNF	mmc.exe
File created	C:\Windows\INF\PerceptionSimulationSixDof.PNF	mmc.exe
File created	C:\Windows\INF\c_fsquotamgmt.PNF	mmc.exe
File created	C:\Windows\INF\c_sslaccel.PNF	mmc.exe
File created	C:\Windows\INF\c_fsphysicalquotamgmt.PNF	mmc.exe
File created	C:\Windows\INF\xusb22.PNF	mmc.exe
File created	C:\Windows\INF\c_fsopenfilebackup.PNF	mmc.exe
File created	C:\Windows\INF\c_linedisplay.PNF	mmc.exe
File created	C:\Windows\INF\c_camera.PNF	mmc.exe
File created	C:\Windows\INF\c_extension.PNF	mmc.exe
File created	C:\Windows\INF\c_fsundelete.PNF	mmc.exe
File created	C:\Windows\INF\c_netdriver.PNF	mmc.exe
File created	C:\Windows\INF\c_fsantivirus.PNF	mmc.exe
File created	C:\Windows\INF\c_fsreplication.PNF	mmc.exe
File created	C:\Windows\INF\c_ucm.PNF	mmc.exe
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	mspaint.exe
File created	C:\Windows\INF\c_fshsm.PNF	mmc.exe
File created	C:\Windows\INF\c_diskdrive.PNF	mmc.exe
File created	C:\Windows\INF\miradisp.PNF	mmc.exe
File created	C:\Windows\INF\c_fsinfrastructure.PNF	mmc.exe
File created	C:\Windows\INF\c_fscontentscreener.PNF	mmc.exe
File created	C:\Windows\INF\c_media.PNF	mmc.exe
File created	C:\Windows\INF\c_fssecurityenhancer.PNF	mmc.exe
File created	C:\Windows\INF\c_receiptprinter.PNF	mmc.exe
File created	C:\Windows\INF\c_magneticstripereader.PNF	mmc.exe
File created	C:\Windows\INF\c_volume.PNF	mmc.exe
File created	C:\Windows\INF\c_fsvirtualization.PNF	mmc.exe
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	mspaint.exe
File created	C:\Windows\INF\oposdrv.PNF	mmc.exe
File created	C:\Windows\INF\rdcameradriver.PNF	mmc.exe
File created	C:\Windows\INF\c_fsactivitymonitor.PNF	mmc.exe
File created	C:\Windows\INF\c_computeaccelerator.PNF	mmc.exe
File created	C:\Windows\INF\c_processor.PNF	mmc.exe
File created	C:\Windows\INF\c_fssystem.PNF	mmc.exe
File created	C:\Windows\INF\wsdprint.PNF	mmc.exe
File created	C:\Windows\INF\c_proximity.PNF	mmc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 20 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	mmc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	mmc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	mmc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A	mmc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	mmc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags	mmc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	mmc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	mmc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A\	mmc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A	mmc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	mmc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName	mmc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A\	mmc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom	mmc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	mmc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000	mmc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\ConfigFlags	mmc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	mmc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	mmc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	mmc.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\timedate.cpl,-51#immutable1 = "Date and Time"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\fhcpl.dll,-2#immutable1 = "Keep a history of your files"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\sud.dll,-10#immutable1 = "Choose which programs you want Windows to use for activities like web browsing, editing photos, sending e-mail, and playing music."	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\FirewallControlPanel.dll,-12123#immutable1 = "Set firewall security options to help protect your computer from hackers and malicious software."	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\netcenter.dll,-2#immutable1 = "Check network status, change network settings and set preferences for sharing files and printers."	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\SyncCenter.dll,-3001#immutable1 = "Sync files between your computer and network folders"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\inetcpl.cpl,-4313#immutable1 = "Configure your Internet display and connection settings."	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\fvecpl.dll,-1#immutable1 = "BitLocker Drive Encryption"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\powercpl.dll,-2#immutable1 = "Conserve energy or maximize performance by choosing how your computer manages power."	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\powercpl.dll,-1#immutable1 = "Power Options"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\recovery.dll,-101#immutable1 = "Recovery"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\system32\DeviceCenter.dll,-1000#immutable1 = "Devices and Printers"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\system32\colorcpl.exe,-7#immutable1 = "Change advanced color management settings for displays, scanners, and printers."	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\sud.dll,-1#immutable1 = "Default Programs"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\srchadmin.dll,-601#immutable1 = "Indexing Options"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\netcenter.dll,-1#immutable1 = "Network and Sharing Center"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000_Classes\Local Settings	MEMZ.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\intl.cpl,-2#immutable1 = "Customize settings for the display of languages, numbers, times, and dates."	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\autoplay.dll,-1#immutable1 = "AutoPlay"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\systemcpl.dll,-1#immutable1 = "System"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000_Classes\Local Settings	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\intl.cpl,-3#immutable1 = "Region"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\accessibilitycpl.dll,-45#immutable1 = "Make your computer easier to use."	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\fhcpl.dll,-52#immutable1 = "File History"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\Speech\SpeechUX\speechuxcpl.dll,-2#immutable1 = "Configure how speech recognition works on your computer."	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\main.cpl,-102#immutable1 = "Keyboard"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\inetcpl.cpl,-4312#immutable1 = "Internet Options"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000_Classes\Local Settings	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\RADCUI.dll,-15301#immutable1 = "Manage your RemoteApp and Desktop Connections"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\DiagCpl.dll,-15#immutable1 = "Troubleshoot and fix common computer problems."	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\mmsys.cpl,-300#immutable1 = "Sound"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\telephon.cpl,-2#immutable1 = "Configure your telephone dialing rules and modem settings."	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\Speech\SpeechUX\speechuxcpl.dll,-1#immutable1 = "Speech Recognition"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\main.cpl,-103#immutable1 = "Customize your keyboard settings, such as the cursor blink rate and the character repeat rate."	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\system32\colorcpl.exe,-6#immutable1 = "Color Management"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\timedate.cpl,-52#immutable1 = "Set the date, time, and time zone for your computer."	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\system32\Vault.dll,-2#immutable1 = "Manage your Windows credentials."	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\RADCUI.dll,-15300#immutable1 = "RemoteApp and Desktop Connections"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\usercpl.dll,-2#immutable1 = "Change user account settings and passwords for people who share this computer."	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\autoplay.dll,-2#immutable1 = "Change default settings for CDs, DVDs, and devices so that you can automatically play music, view pictures, install software, and play games."	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\SyncCenter.dll,-3000#immutable1 = "Sync Center"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\system32\DeviceCenter.dll,-2000#immutable1 = "View and manage devices, printers, and print jobs"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\system32\appwiz.cpl,-159#immutable1 = "Programs and Features"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\system32\appwiz.cpl,-160#immutable1 = "Uninstall or change programs on your computer."	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\fvecpl.dll,-2#immutable1 = "Protect your PC using BitLocker Drive Encryption."	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\FirewallControlPanel.dll,-12122#immutable1 = "Windows Defender Firewall"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\main.cpl,-100#immutable1 = "Mouse"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\devmgr.dll,-5#immutable1 = "View and update your device hardware settings and driver software."	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\srchadmin.dll,-602#immutable1 = "Change how Windows indexes to search faster"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\sdcpl.dll,-100#immutable1 = "Recover copies of your files backed up in Windows 7"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\DiagCpl.dll,-1#immutable1 = "Troubleshooting"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\mmsys.cpl,-301#immutable1 = "Configure your audio devices or change the sound scheme for your computer."	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\sdcpl.dll,-101#immutable1 = "Backup and Restore (Windows 7)"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\systemcpl.dll,-2#immutable1 = "View information about your computer, and change settings for hardware, performance, and remote connections."	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000_Classes\Local Settings	control.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\system32\Vault.dll,-1#immutable1 = "Credential Manager"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\telephon.cpl,-1#immutable1 = "Phone and Modem"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\usercpl.dll,-1#immutable1 = "User Accounts"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\devmgr.dll,-4#immutable1 = "Device Manager"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\accessibilitycpl.dll,-10#immutable1 = "Ease of Access Center"	explorer.exe

Runs regedit.exe 1 IoCs

pid	Process
4536	regedit.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
3372	explorer.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1272	MEMZ.exe
1272	MEMZ.exe
1272	MEMZ.exe
1272	MEMZ.exe
1604	MEMZ.exe
1604	MEMZ.exe
1092	MEMZ.exe
1092	MEMZ.exe
3132	MEMZ.exe
3132	MEMZ.exe
1272	MEMZ.exe
1604	MEMZ.exe
1272	MEMZ.exe
1604	MEMZ.exe
1272	MEMZ.exe
1272	MEMZ.exe
3132	MEMZ.exe
3132	MEMZ.exe
4436	MEMZ.exe
4436	MEMZ.exe
1092	MEMZ.exe
1092	MEMZ.exe
1272	MEMZ.exe
1272	MEMZ.exe
1604	MEMZ.exe
1604	MEMZ.exe
1272	MEMZ.exe
1272	MEMZ.exe
1092	MEMZ.exe
1092	MEMZ.exe
4436	MEMZ.exe
4436	MEMZ.exe
3132	MEMZ.exe
3132	MEMZ.exe
1604	MEMZ.exe
1604	MEMZ.exe
1604	MEMZ.exe
1604	MEMZ.exe
3132	MEMZ.exe
3132	MEMZ.exe
4436	MEMZ.exe
4436	MEMZ.exe
1092	MEMZ.exe
1272	MEMZ.exe
1272	MEMZ.exe
1092	MEMZ.exe
1604	MEMZ.exe
1604	MEMZ.exe
1092	MEMZ.exe
1272	MEMZ.exe
1092	MEMZ.exe
1272	MEMZ.exe
4436	MEMZ.exe
4436	MEMZ.exe
3132	MEMZ.exe
3132	MEMZ.exe
1604	MEMZ.exe
1604	MEMZ.exe
1272	MEMZ.exe
1272	MEMZ.exe
1092	MEMZ.exe
1092	MEMZ.exe
3132	MEMZ.exe
3132	MEMZ.exe

Suspicious behavior: GetForegroundWindowSpam 3 IoCs

pid	Process
4536	regedit.exe
5528	mmc.exe
5404	mmc.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 50 IoCs

pid	Process
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe

Suspicious behavior: SetClipboardViewer 1 IoCs

pid	Process
5404	mmc.exe

Suspicious use of AdjustPrivilegeToken 14 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3372	explorer.exe
Token: SeCreatePagefilePrivilege	3372	explorer.exe
Token: 33	3116	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	3116	AUDIODG.EXE
Token: 33	5528	mmc.exe
Token: SeIncBasePriorityPrivilege	5528	mmc.exe
Token: 33	5528	mmc.exe
Token: SeIncBasePriorityPrivilege	5528	mmc.exe
Token: 33	5404	mmc.exe
Token: SeIncBasePriorityPrivilege	5404	mmc.exe
Token: 33	5404	mmc.exe
Token: SeIncBasePriorityPrivilege	5404	mmc.exe
Token: 33	5404	mmc.exe
Token: SeIncBasePriorityPrivilege	5404	mmc.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3372	explorer.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe
3612	msedge.exe

Suspicious use of SetWindowsHookEx 36 IoCs

pid	Process
656	MEMZ.exe
656	MEMZ.exe
844	mspaint.exe
656	MEMZ.exe
844	mspaint.exe
844	mspaint.exe
844	mspaint.exe
656	MEMZ.exe
5908	mspaint.exe
5908	mspaint.exe
5908	mspaint.exe
5908	mspaint.exe
5516	mmc.exe
656	MEMZ.exe
5528	mmc.exe
5528	mmc.exe
5372	mmc.exe
5404	mmc.exe
5404	mmc.exe
656	MEMZ.exe
656	MEMZ.exe
656	MEMZ.exe
656	MEMZ.exe
656	MEMZ.exe
656	MEMZ.exe
656	MEMZ.exe
656	MEMZ.exe
656	MEMZ.exe
656	MEMZ.exe
656	MEMZ.exe
5240	wordpad.exe
5240	wordpad.exe
5240	wordpad.exe
5240	wordpad.exe
5240	wordpad.exe
656	MEMZ.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3076 wrote to memory of 1272	3076	MEMZ.exe	88
PID 3076 wrote to memory of 1272	3076	MEMZ.exe	88
PID 3076 wrote to memory of 1272	3076	MEMZ.exe	88
PID 3076 wrote to memory of 1092	3076	MEMZ.exe	89
PID 3076 wrote to memory of 1092	3076	MEMZ.exe	89
PID 3076 wrote to memory of 1092	3076	MEMZ.exe	89
PID 3076 wrote to memory of 1604	3076	MEMZ.exe	90
PID 3076 wrote to memory of 1604	3076	MEMZ.exe	90
PID 3076 wrote to memory of 1604	3076	MEMZ.exe	90
PID 3076 wrote to memory of 3132	3076	MEMZ.exe	91
PID 3076 wrote to memory of 3132	3076	MEMZ.exe	91
PID 3076 wrote to memory of 3132	3076	MEMZ.exe	91
PID 3076 wrote to memory of 4436	3076	MEMZ.exe	92
PID 3076 wrote to memory of 4436	3076	MEMZ.exe	92
PID 3076 wrote to memory of 4436	3076	MEMZ.exe	92
PID 3076 wrote to memory of 656	3076	MEMZ.exe	93
PID 3076 wrote to memory of 656	3076	MEMZ.exe	93
PID 3076 wrote to memory of 656	3076	MEMZ.exe	93
PID 656 wrote to memory of 2252	656	MEMZ.exe	95
PID 656 wrote to memory of 2252	656	MEMZ.exe	95
PID 656 wrote to memory of 2252	656	MEMZ.exe	95
PID 656 wrote to memory of 3612	656	MEMZ.exe	100
PID 656 wrote to memory of 3612	656	MEMZ.exe	100
PID 3612 wrote to memory of 3464	3612	msedge.exe	101
PID 3612 wrote to memory of 3464	3612	msedge.exe	101
PID 3612 wrote to memory of 3432	3612	msedge.exe	102
PID 3612 wrote to memory of 3432	3612	msedge.exe	102
PID 3612 wrote to memory of 3432	3612	msedge.exe	102
PID 3612 wrote to memory of 3432	3612	msedge.exe	102
PID 3612 wrote to memory of 3432	3612	msedge.exe	102
PID 3612 wrote to memory of 3432	3612	msedge.exe	102
PID 3612 wrote to memory of 3432	3612	msedge.exe	102
PID 3612 wrote to memory of 3432	3612	msedge.exe	102
PID 3612 wrote to memory of 3432	3612	msedge.exe	102
PID 3612 wrote to memory of 3432	3612	msedge.exe	102
PID 3612 wrote to memory of 3432	3612	msedge.exe	102
PID 3612 wrote to memory of 3432	3612	msedge.exe	102
PID 3612 wrote to memory of 3432	3612	msedge.exe	102
PID 3612 wrote to memory of 3432	3612	msedge.exe	102
PID 3612 wrote to memory of 3432	3612	msedge.exe	102
PID 3612 wrote to memory of 3432	3612	msedge.exe	102
PID 3612 wrote to memory of 3432	3612	msedge.exe	102
PID 3612 wrote to memory of 3432	3612	msedge.exe	102
PID 3612 wrote to memory of 3432	3612	msedge.exe	102
PID 3612 wrote to memory of 3432	3612	msedge.exe	102
PID 3612 wrote to memory of 3432	3612	msedge.exe	102
PID 3612 wrote to memory of 3432	3612	msedge.exe	102
PID 3612 wrote to memory of 3432	3612	msedge.exe	102
PID 3612 wrote to memory of 3432	3612	msedge.exe	102
PID 3612 wrote to memory of 3432	3612	msedge.exe	102
PID 3612 wrote to memory of 3432	3612	msedge.exe	102
PID 3612 wrote to memory of 3432	3612	msedge.exe	102
PID 3612 wrote to memory of 3432	3612	msedge.exe	102
PID 3612 wrote to memory of 3432	3612	msedge.exe	102
PID 3612 wrote to memory of 3432	3612	msedge.exe	102
PID 3612 wrote to memory of 3432	3612	msedge.exe	102
PID 3612 wrote to memory of 3432	3612	msedge.exe	102
PID 3612 wrote to memory of 3432	3612	msedge.exe	102
PID 3612 wrote to memory of 3432	3612	msedge.exe	102
PID 3612 wrote to memory of 3432	3612	msedge.exe	102
PID 3612 wrote to memory of 3432	3612	msedge.exe	102
PID 3612 wrote to memory of 3432	3612	msedge.exe	102
PID 3612 wrote to memory of 3432	3612	msedge.exe	102
PID 3612 wrote to memory of 3432	3612	msedge.exe	102

C:\Users\Admin\AppData\Local\Temp\MEMZ-virus-main\MEMZ.exe
"C:\Users\Admin\AppData\Local\Temp\MEMZ-virus-main\MEMZ.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3076
- C:\Users\Admin\AppData\Local\Temp\MEMZ-virus-main\MEMZ.exe
  "C:\Users\Admin\AppData\Local\Temp\MEMZ-virus-main\MEMZ.exe" /watchdog
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1272
- C:\Users\Admin\AppData\Local\Temp\MEMZ-virus-main\MEMZ.exe
  "C:\Users\Admin\AppData\Local\Temp\MEMZ-virus-main\MEMZ.exe" /watchdog
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1092
- C:\Users\Admin\AppData\Local\Temp\MEMZ-virus-main\MEMZ.exe
  "C:\Users\Admin\AppData\Local\Temp\MEMZ-virus-main\MEMZ.exe" /watchdog
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1604
- C:\Users\Admin\AppData\Local\Temp\MEMZ-virus-main\MEMZ.exe
  "C:\Users\Admin\AppData\Local\Temp\MEMZ-virus-main\MEMZ.exe" /watchdog
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3132
- C:\Users\Admin\AppData\Local\Temp\MEMZ-virus-main\MEMZ.exe
  "C:\Users\Admin\AppData\Local\Temp\MEMZ-virus-main\MEMZ.exe" /watchdog
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4436
- C:\Users\Admin\AppData\Local\Temp\MEMZ-virus-main\MEMZ.exe
  "C:\Users\Admin\AppData\Local\Temp\MEMZ-virus-main\MEMZ.exe" /main
  2⤵
  - Checks computer location settings
  - Writes to the Master Boot Record (MBR)
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:656
- - C:\Windows\SysWOW64\notepad.exe
    "C:\Windows\System32\notepad.exe" \note.txt
    3⤵
    PID:2252
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=batch+virus+download
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:3612
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xb4,0x108,0x7ffe242d46f8,0x7ffe242d4708,0x7ffe242d4718
      4⤵
      PID:3464
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2152,17471973598823652400,17118533864758834565,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2164 /prefetch:2
      4⤵
      PID:3432
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2152,17471973598823652400,17118533864758834565,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2216 /prefetch:3
      4⤵
      PID:1872
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2152,17471973598823652400,17118533864758834565,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2856 /prefetch:8
      4⤵
      PID:4192
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,17471973598823652400,17118533864758834565,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1
      4⤵
      PID:2524
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,17471973598823652400,17118533864758834565,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3428 /prefetch:1
      4⤵
      PID:4412
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,17471973598823652400,17118533864758834565,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4668 /prefetch:1
      4⤵
      PID:4904
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,17471973598823652400,17118533864758834565,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4880 /prefetch:1
      4⤵
      PID:4492
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2152,17471973598823652400,17118533864758834565,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3948 /prefetch:8
      4⤵
      PID:2192
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2152,17471973598823652400,17118533864758834565,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3948 /prefetch:8
      4⤵
      PID:3764
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,17471973598823652400,17118533864758834565,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5460 /prefetch:1
      4⤵
      PID:4448
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,17471973598823652400,17118533864758834565,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5424 /prefetch:1
      4⤵
      PID:3284
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,17471973598823652400,17118533864758834565,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4972 /prefetch:1
      4⤵
      PID:4788
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,17471973598823652400,17118533864758834565,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4512 /prefetch:1
      4⤵
      PID:1996
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,17471973598823652400,17118533864758834565,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5200 /prefetch:1
      4⤵
      PID:4968
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,17471973598823652400,17118533864758834565,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6000 /prefetch:1
      4⤵
      PID:2020
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,17471973598823652400,17118533864758834565,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3104 /prefetch:1
      4⤵
      PID:1664
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,17471973598823652400,17118533864758834565,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4848 /prefetch:1
      4⤵
      PID:3808
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2152,17471973598823652400,17118533864758834565,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5656 /prefetch:2
      4⤵
      PID:2100
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,17471973598823652400,17118533864758834565,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6036 /prefetch:1
      4⤵
      PID:1772
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,17471973598823652400,17118533864758834565,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6372 /prefetch:1
      4⤵
      PID:3880
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,17471973598823652400,17118533864758834565,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6160 /prefetch:1
      4⤵
      PID:908
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,17471973598823652400,17118533864758834565,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6484 /prefetch:1
      4⤵
      PID:3208
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,17471973598823652400,17118533864758834565,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6192 /prefetch:1
      4⤵
      PID:3428
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,17471973598823652400,17118533864758834565,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6224 /prefetch:1
      4⤵
      PID:1200
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,17471973598823652400,17118533864758834565,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5996 /prefetch:1
      4⤵
      PID:4600
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,17471973598823652400,17118533864758834565,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5428 /prefetch:1
      4⤵
      PID:4752
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,17471973598823652400,17118533864758834565,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6156 /prefetch:1
      4⤵
      PID:2004
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,17471973598823652400,17118533864758834565,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6568 /prefetch:1
      4⤵
      PID:3604
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,17471973598823652400,17118533864758834565,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5720 /prefetch:1
      4⤵
      PID:4052
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,17471973598823652400,17118533864758834565,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7020 /prefetch:1
      4⤵
      PID:5164
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,17471973598823652400,17118533864758834565,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=184 /prefetch:1
      4⤵
      PID:5644
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,17471973598823652400,17118533864758834565,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6528 /prefetch:1
      4⤵
      PID:3788
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,17471973598823652400,17118533864758834565,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6616 /prefetch:1
      4⤵
      PID:5752
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,17471973598823652400,17118533864758834565,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7332 /prefetch:1
      4⤵
      PID:5208
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,17471973598823652400,17118533864758834565,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7212 /prefetch:1
      4⤵
      PID:5252
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,17471973598823652400,17118533864758834565,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7584 /prefetch:1
      4⤵
      PID:4124
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,17471973598823652400,17118533864758834565,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7544 /prefetch:1
      4⤵
      PID:5020
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,17471973598823652400,17118533864758834565,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7936 /prefetch:1
      4⤵
      PID:3920
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,17471973598823652400,17118533864758834565,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7396 /prefetch:1
      4⤵
      PID:2628
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,17471973598823652400,17118533864758834565,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7344 /prefetch:1
      4⤵
      PID:5780
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,17471973598823652400,17118533864758834565,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7416 /prefetch:1
      4⤵
      PID:1404
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,17471973598823652400,17118533864758834565,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7392 /prefetch:1
      4⤵
      PID:5796
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,17471973598823652400,17118533864758834565,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7292 /prefetch:1
      4⤵
      PID:5756
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,17471973598823652400,17118533864758834565,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7188 /prefetch:1
      4⤵
      PID:5172
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,17471973598823652400,17118533864758834565,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8552 /prefetch:1
      4⤵
      PID:100
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,17471973598823652400,17118533864758834565,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8868 /prefetch:1
      4⤵
      PID:4636
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,17471973598823652400,17118533864758834565,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8840 /prefetch:1
      4⤵
      PID:2320
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,17471973598823652400,17118533864758834565,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8784 /prefetch:1
      4⤵
      PID:6032
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,17471973598823652400,17118533864758834565,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8684 /prefetch:1
      4⤵
      PID:4048
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,17471973598823652400,17118533864758834565,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8212 /prefetch:1
      4⤵
      PID:7024
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,17471973598823652400,17118533864758834565,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7452 /prefetch:1
      4⤵
      PID:7116
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,17471973598823652400,17118533864758834565,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8284 /prefetch:1
      4⤵
      PID:6492
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,17471973598823652400,17118533864758834565,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8600 /prefetch:1
      4⤵
      PID:6952
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,17471973598823652400,17118533864758834565,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9600 /prefetch:1
      4⤵
      PID:5388
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,17471973598823652400,17118533864758834565,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=55 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9868 /prefetch:1
      4⤵
      PID:6224
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,17471973598823652400,17118533864758834565,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=56 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9908 /prefetch:1
      4⤵
      PID:7468
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,17471973598823652400,17118533864758834565,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=57 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10320 /prefetch:1
      4⤵
      PID:7852
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,17471973598823652400,17118533864758834565,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=58 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10416 /prefetch:1
      4⤵
      PID:7880
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,17471973598823652400,17118533864758834565,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=59 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10036 /prefetch:1
      4⤵
      PID:6172
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,17471973598823652400,17118533864758834565,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=60 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10060 /prefetch:1
      4⤵
      PID:7196
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=how+to+send+a+virus+to+my+friend
    3⤵
    PID:4448
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x108,0x10c,0x110,0xe4,0x114,0x7ffe242d46f8,0x7ffe242d4708,0x7ffe242d4718
      4⤵
      PID:2948
- - C:\Windows\SysWOW64\control.exe
    "C:\Windows\System32\control.exe"
    3⤵
    - Modifies registry class
    PID:4528
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=my+computer+is+doing+weird+things+wtf+is+happenin+plz+halp
    3⤵
    PID:640
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe242d46f8,0x7ffe242d4708,0x7ffe242d4718
      4⤵
      PID:2968
- - C:\Windows\SysWOW64\regedit.exe
    "C:\Windows\System32\regedit.exe"
    3⤵
    - Runs regedit.exe
    - Suspicious behavior: GetForegroundWindowSpam
    PID:4536
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=skrillex+scay+onster+an+nice+sprites+midi
    3⤵
    PID:5024
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x108,0x10c,0x110,0xe4,0x114,0x7ffe242d46f8,0x7ffe242d4708,0x7ffe242d4718
      4⤵
      PID:1624
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=half+life+3+release+date
    3⤵
    PID:1108
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0xd8,0x10c,0x7ffe242d46f8,0x7ffe242d4708,0x7ffe242d4718
      4⤵
      PID:3008
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=facebook+hacking+tool+free+download+no+virus+working+2016
    3⤵
    PID:1944
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffe242d46f8,0x7ffe242d4708,0x7ffe242d4718
      4⤵
      PID:3880
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://play.clubpenguin.com/
    3⤵
    PID:2192
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x108,0x10c,0x110,0xe4,0x114,0x7ffe242d46f8,0x7ffe242d4708,0x7ffe242d4718
      4⤵
      PID:1696
- - C:\Windows\SysWOW64\mspaint.exe
    "C:\Windows\System32\mspaint.exe"
    3⤵
    - Drops file in Windows directory
    - Suspicious use of SetWindowsHookEx
    PID:844
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=my+computer+is+doing+weird+things+wtf+is+happenin+plz+halp
    3⤵
    PID:4796
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe242d46f8,0x7ffe242d4708,0x7ffe242d4718
      4⤵
      PID:972
- - C:\Windows\SysWOW64\mspaint.exe
    "C:\Windows\System32\mspaint.exe"
    3⤵
    - Drops file in Windows directory
    - Suspicious use of SetWindowsHookEx
    PID:5908
- - C:\Windows\SysWOW64\mmc.exe
    "C:\Windows\system32\mmc.exe" "C:\Windows\System32\devmgmt.msc"
    3⤵
    - Suspicious use of SetWindowsHookEx
    PID:5516
  - - C:\Windows\system32\mmc.exe
      "C:\Windows\System32\devmgmt.msc" "C:\Windows\System32\devmgmt.msc"
      4⤵
      Drops file in System32 directory
      Drops file in Windows directory
      Checks SCSI registry key(s)
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      PID:5528
- - C:\Windows\SysWOW64\mmc.exe
    "C:\Windows\System32\mmc.exe"
    3⤵
    - Suspicious use of SetWindowsHookEx
    PID:5372
  - - C:\Windows\system32\mmc.exe
      "C:\Windows\system32\mmc.exe"
      4⤵
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious behavior: SetClipboardViewer
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      PID:5404
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=how+to+get+money
    3⤵
    PID:5676
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe242d46f8,0x7ffe242d4708,0x7ffe242d4718
      4⤵
      PID:5660
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=half+life+3+release+date
    3⤵
    PID:5612
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe242d46f8,0x7ffe242d4708,0x7ffe242d4718
      4⤵
      PID:480
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://softonic.com/
    3⤵
    PID:5284
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffe242d46f8,0x7ffe242d4708,0x7ffe242d4718
      4⤵
      PID:5308
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=g3t+r3kt
    3⤵
    PID:6120
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe242d46f8,0x7ffe242d4708,0x7ffe242d4718
      4⤵
      PID:5384
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=minecraft+hax+download+no+virus
    3⤵
    PID:5740
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe242d46f8,0x7ffe242d4708,0x7ffe242d4718
      4⤵
      PID:5552
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=virus.exe
    3⤵
    PID:5652
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe242d46f8,0x7ffe242d4708,0x7ffe242d4718
      4⤵
      PID:5708
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=batch+virus+download
    3⤵
    PID:5004
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe242d46f8,0x7ffe242d4708,0x7ffe242d4718
      4⤵
      PID:2316
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=john+cena+midi+legit+not+converted
    3⤵
    PID:5192
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe242d46f8,0x7ffe242d4708,0x7ffe242d4718
      4⤵
      PID:4468
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=john+cena+midi+legit+not+converted
    3⤵
    PID:2236
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe242d46f8,0x7ffe242d4708,0x7ffe242d4718
      4⤵
      PID:6100
- - C:\Windows\SysWOW64\explorer.exe
    "C:\Windows\System32\explorer.exe"
    3⤵
    - Modifies registry class
    PID:6500
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://motherboard.vice.com/read/watch-this-malware-turn-a-computer-into-a-digital-hellscape
    3⤵
    PID:6944
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe242d46f8,0x7ffe242d4708,0x7ffe242d4718
      4⤵
      PID:6964
- - C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe
    "C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe"
    3⤵
    - Suspicious use of SetWindowsHookEx
    PID:5240
  - - C:\Windows\splwow64.exe
      C:\Windows\splwow64.exe 12288
      4⤵
      PID:7312
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=how+to+download+memz
    3⤵
    PID:7788
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe242d46f8,0x7ffe242d4708,0x7ffe242d4718
      4⤵
      PID:7804
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=how+to+remove+memz+trojan+virus
    3⤵
    PID:6288
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xdc,0x100,0x104,0xbc,0x108,0x7ffe242d46f8,0x7ffe242d4708,0x7ffe242d4718
      4⤵
      PID:2276

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1520

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3160

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{5BD95610-9434-43C2-886C-57852CC8A120} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3372

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
1⤵
PID:3480

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x4ec 0x4fc
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3116

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService
1⤵
PID:4408

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4840

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc
1⤵
PID:7408

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 245b396ed1accfae337f770d3757c932bc30a8fc8dd133b5cefe82242760c2c7
MD5 fa070c9c9ab8d902ee4f3342d217275f
SHA1 ac69818312a7eba53586295c5b04eefeb5c73903
SHA512 df92ca6d405d603ef5f07dbf9516d9e11e1fdc13610bb59e6d4712e55dd661f756c8515fc2c359c1db6b8b126e7f5a15886e643d93c012ef34a11041e02cc0dc
MD5 SHA1 SHA512

Submit Download

f_000003

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000003
Size 194KB
SHA256 193b8f571f3fd65b98dc39601431ff6e91ade5f90ee7790bfc1fba8f7580a4b0
MD5 ac84f1282f8542dee07f8a1af421f2a7
SHA1 261885284826281a99ff982428a765be30de9029
SHA512 9f4f58ab43ddadad903cea3454d79b99a750f05e4d850de5f25371d5bec16fc312015a875b8f418154f1124c400ae1c82e2efd862870cd35c3f0961426c8cd82
SSDEEP 3072:YRm7cDmIXEEsbXJv1ypg41qVV23Rbh+Hqqx9ySbtq28eukP0YEGJSAb4PYeDCE:GdqIXEEGd5Ebuq4Tc28DMbhSDh
MD5 SHA1 SHA512 SSDEEP

Submit Download

17eba9b492f689b7_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\17eba9b492f689b7_0
Size 391KB
SHA256 ca0e97b50682e564bff257f8b6ab1046a4908ea244d045db5069f576a6df17ff
MD5 eced523c0c603162263fcaf675556edc
SHA1 dd99412f158fed3caa5559271b95362814920695
SHA512 792e91ca83798f821af7570de5fc9faad5efcd4029da55aade2b9a311f23d4112ab5587594147bb6a7c1c3ed94079271c93a1b5340a49c102cc14d52a5893e46
SSDEEP 6144:Wo2DTEnFu3LsksTukaJp5oDMctoEF356qdXj/JC0PT:W/IFCOTukEpCvtvZkqtj/JC0P
MD5 SHA1 SHA512 SSDEEP

Submit Download

522a418db2535cc7_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\522a418db2535cc7_0
Size 18KB
SHA256 7af3f5a89139dbb93cc64a859c6355b1b268c072a337293ef9f8f42edc49af70
MD5 6d37505f3c377b04e21654ea0d9e0001
SHA1 1135834aae7c93d54c599283191ad4ef77b7173c
SHA512 be74f76af5da94ddd3022707daf94d5515b552b1795431f5ace31423ae13183a593dde11d25c25f76ed2a22ce245182d0a60a73ae208a808afa4a57156787a79
SSDEEP 384:skWNmDG2zKWE2+YnVQ7gKMIwu5VIc9g4a/rEJjpWn8C:/JzXE2EpMIV/K4WE9G
MD5 SHA1 SHA512 SSDEEP

Submit Download

99e1c8dadaba454d_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\99e1c8dadaba454d_0
Size 288B
SHA256 dfb59e71f1eab34bc5c3081adbfc5249411611267b4f466be486fa2dbf5c0ae7
MD5 3fc8acf6d16c534dd615be389847adcd
SHA1 932dec5b9243333102862da8b4e2cb986446864d
SHA512 a5152635dc20161d1b7ad72b89db17c20115c0d7721bcfb453343f169eba2484501b108e28a4b0f0912845028bdfbb5b887517c3f45d7fd0851b59ec81a7245f
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 144B
SHA256 67a54ad8f00497b88d9262ea00ecbfc0c31d0ef00b4c7240dc2a883d5d07ff24
MD5 07e3c0870e2968d675c087f05f6cf053
SHA1 a0ff0fb382705f10ca7a11ef74be8acf3af8f705
SHA512 5de742d51937f1c3e3343c1f667b669ad271d9ebbbfad59dde4a67feb1d13db0e7f529e819bbed963f8175bcec4945d81f48441c38252a454301bffcc19588ae
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 192B
SHA256 6a4e5228cd503bf1916d87a67ff6f2cd4bc98771bdc246c1a7a0890f806df92e
MD5 a476cf86ccc161e0807480cdd756b010
SHA1 8e4375f44725c6c778ab42bde98a2781c7d670b5
SHA512 8a49e2d6cd283d05ca758571c1aba0e653ee8f228c9263f3ed8a0258bf554494e64944ae4ae5ea3bb0c03576c84176cfe7833016852ac1a6e87286b394337852
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 192B
SHA256 ee451cda54d79be3f4b8be8aa525312a734ffd242255e93098014a0c193a838d
MD5 fa84518d40471f6eec8d788268a410f4
SHA1 dd0aa92503ef07d8d9cf5f2a7978f426f5ac532c
SHA512 ccc18991a144c5d0f16444df5db36701adefea483840034d44fd9fb24247ca7be21b9e0d3bd44b0e2c077d6cca664d88ff1bab2d1b59625d327168ff0371bb6c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 192B
SHA256 8798d9c41df7bf5fae043a82741241b0a3aa01ecb0a788eb289312416f43a030
MD5 15a88d13c319a8bea9768c5e946b0cd6
SHA1 ac72013ec45d98d3464cfed2f97344e58a1f448f
SHA512 5471fcd74d893ad39749001fcc30a3b339deef8c32460281268159fae44dff4021f58ed3cbdc0a9bb832eb3ace453106ecb4d3a4d77623f888823dd9e9c27cd1
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 168B
SHA256 d34bca74d70564693b1ff01ea81a8f89354933de6bf38e179e3cd28f0277fa99
MD5 d2089ddfb791f6d40eadeea51dce3f31
SHA1 8805019e6c3d2775c1696531f4d82398671e6146
SHA512 6cacc877671689f7bc5b5adee1765ebe009bf6ea5231795e5def834dc90188b10e0045479bdac03a674bf3beae5ae1ef141c48ad02e9ce888e54b8730c1d8f77
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 192B
SHA256 b55435abdec4183ff80a7381b854b87d1fe8c45e93f3901238818d413bcdde66
MD5 fd2b556df5c48a3dfd44761a1e39bc82
SHA1 0d28289f1ba2fee27abf2f5203542de3f880e0f7
SHA512 324c55302f4fe71a2ae422bcbf980c96f19eced4ed2da6a9ef99de1825b6fa8b540f7a18eb7a0f412856e9d6e2c8e2aacf0fd2eb7ef2cea694136f29f822f150
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 408B
SHA256 3ae89359eba2f1389f2e5a93eed07044278a68bfa4a5dd1ac9144e61d9fc6f92
MD5 94ae13b10210a5355a86ffa7c129188a
SHA1 d9a44f41c4afe95f2c06840c280b318c2114102b
SHA512 ebcbb49f68b155963b98e75ce1a5414d197f1a8c41a8a75a765c3448967b8a9ebce2231fe4f52924a32df2db77a5ba5aae9cb7088e862a1f949c31448b34ccf3
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 168B
SHA256 94dba2097ad220ed2e1a92df4dffc122413fb4a076ed96440f5f1ccd04cfffa8
MD5 aa6a5197563258488b527b60c3d1e54b
SHA1 7d27f0831c2952567ba93aba2e23c9c91e882112
SHA512 477dea1e39fdfa02d5abdb64cf8a6b4d6e88bdf22e874f899e524b813889ae38b619a11dacf0d01b5d71a5a506ad9b97506ffb0007f19309bf30e56ac7c1bdec
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.vice.com_0.indexeddb.leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 815B
SHA256 a19cd6129daa1acd854fd1058a2d9ad97781c886ff8bafb25eece054c05faaa9
MD5 95bb6aab62031487a1810deb9f461461
SHA1 ff1537f9472740c0adb9f8ac94a9a78ac3406ada
SHA512 aa86545a842b71db0d5ae0375f0545ba3ce3cfbfa746c687aeb18da0f44f91e531a7fe738cd0bee31b43f3d36ff14e3df858df3313a66c49e69412e3cbd122cc
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 815B
SHA256 4d8e31ab47f59d90db5846718718bd92f5165a6cd73c2b79652290a5aef86211
MD5 53213e64432563c7dfcd8d4307061660
SHA1 bd483281764089e058747f8e8d61a552f40f4f19
SHA512 4191924e2b02524aa7319e1f1467a955b886eace37fb29f5d1412cf48d6d64a7e504c201445309e03e807c62ab98625c178a2d92fef7a04f48ac8e8f1cf25059
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 815B
SHA256 e314421ce402bfbac30bbb35a53568782609fbe55931138fd60985e9133b4dcd
MD5 881f8f2a2c04516f9f8eeca6da0d6854
SHA1 1caa33b20a435205f62ee08f3893b75784f47443
SHA512 1bf849978f591ab31a7a0d82cdaf9e80089ef147cc131238fd52dcec4eab74673ab1e4c674dd227c96289ad84298fb9db1def903f8efc7917ca89ed7c41b711c
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 3KB
SHA256 54057b7fe462e78392a0d93d7b153ae4e235bd963939c0141f8127d6351bfd8a
MD5 1354681a1a1f40ca70401528d748d4d2
SHA1 20c7e8d125d2e8810dfa48b8552b0168ac795a6e
SHA512 61bbc0d6880dfd6d003edda04a2f118359740dab9a9b5c2a5d94530dc6870d60d65620f21cce5b5085c68bc5e649b49e73c98ef1af9a87448225abe9785d304f
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 b43e8a81d90cad9927d4a4183b5e6c7ba86ac2fa9b581df13285425ac4637224
MD5 8d68c1baea07885ff1e1a38235566a72
SHA1 0e1d831bc7cd2ed5b2784e1e87dc018c71eb3bb4
SHA512 77f9a620a0799c56636699baa91ed64ba1656987c7045deac67d6293e5e255cb6c3e6f8cf6064249ef94f5d50c3324a52d8de63e1108c345e277eb497d106abb
SSDEEP 96:nwkyr1cLJvvwpvWMoiVmde7ulZ1uqUJz7UWQyV+VD7AiEwb:nwkc4dvGWMrulZ4qIPrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 99e0639c3cbd7f1b18766a4f17e9a570b8f94b523ecaec22348b2eb323a46a34
MD5 053dbc9468abd3aaaf7eb1bc595bb002
SHA1 265d0bec2dbf73e7896878a4b35c6a0c55b699ad
SHA512 9d1f6f7ef1009ed7322bccad90d23457e52c0c920e0cd0f4a6f43d649aa723c88ea16e9d078fcac1d7b06c12c5ba300ee7cce7db00d50387a2bb707059f61c85
SSDEEP 96:nwkyr1c3XvvwpvWMoiVmdeOqdlU4g0YdJ55vrUWQyV+VD7AiEwb:nwkccfvGWMeqdllg0YH5xrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 c23e4cb7d5a1f034bb391b7d2a674b74b967eb2dfb36d54d12d48bf4dde4a79a
MD5 90d750a45dc67d830c9df87737ea4f51
SHA1 4f751f73121b1dfd2030c6849dbdbf3a16b1a2d0
SHA512 1fbecaf8eb6cc8b255a1753b34730cdd17a145a776a3e09fb0edef563dee84261c56973ef56b330d2e9e7dd9974b0e3f78389548698233d62c07d3d4d90209ad
SSDEEP 96:nmkOr1cLZvvwpvWMoiVmdeHUJq7UWQyV+VDCzia:nmkQ4tvGWMXIirj
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 e091733e7119b32b71a872873191e3b9ca8c586e9bb39d0578f01ea3d416ff54
MD5 dc483559fdda6c76a3718a8ead8c247d
SHA1 1f6d7f39420461ea77cf34cd1d13f1f821df7c13
SHA512 4b51244dee4904d36e748e8f458527d31a1916206bbef41ec3647f540b7dccf0de642307aa0f7c71c36fef64cb34fe10d216da69abdb19e538df7dca4a934544
SSDEEP 96:nwkyr1c3EvvwpvWMoiVmdeYtfE4sx0YdJ+veUWQyV+VD7AiEwb:nwkccIvGWMItfJsx0YH7rg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 63d4cd9663916ab1858db2d3220f22ccacfc4ee697ac6761e7796ad05c27c8b2
MD5 21f19a1b6ee5f837930bb6c3a8f46410
SHA1 599f58b4fc46c338fdaedda2667e927c9283ad68
SHA512 b1c9f52a15b0ba76f45b3437b507a5044da10eb23c5c98043b7ee959f372d0810ec5b9fec18adb375a6cf32587dfbd085ec072260264fa203337bb07c4dc4121
SSDEEP 96:nwkyr1c3CvvwpvWMoiVmdeUePSlTPH0YdJe4JUWQyV+VD7AiEwb:nwkccqvGWMEe61H0YHbrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 95ee167bffbdae3fdf9d176e8520255e43819f0a3ddbd2b5037aa9941c7f6512
MD5 6f493db559f573bf8e110eeb1686e0f9
SHA1 07a41e3bcb63070b56cb1afcf4d1ad3e9eac3a3b
SHA512 642dc7f17895f90e182a5a1117f614dc3dc23504c8bc4ba74f672f0b52d449f4857ddaa006cb3b7e82a9ec0b1f7ffee42388c2e7e837b34368779e0b850e48c2
SSDEEP 96:nwkyr1c3FvvwpvWMoiVmde7VkuI20YdJV4PUWQyV+VD7AiEwb:nwkccpvGWMrVkN20YHKrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 3c57bf954412c944f2113a68ceab3cdf8630817255c6908538033a3c72837d04
MD5 9fff7202ea749bd7b724582881ed9d75
SHA1 b7a73a7f51b84ddb348146e106aaba51ee263184
SHA512 d537601369695f29760b0ea8a1cacd7251cbb87d6a4a00fdeacb4ecf2f5ce016c266ad0d68675899a859968fe0549c3dde8daf753e28df797acea238ba6a775a
SSDEEP 96:nwkyr1c3AvvwpvWMoiVmdeYg0to90YdJy4mUWQyV+VD7AiEwb:nwkcckvGWMIg0C90YHwrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 1dfc04ddd048ccd11c680aafe7db42e7bf92c78a59680437d5be6143eab43495
MD5 95adf58a96f239e50f7008f1bef06366
SHA1 d4c41e33cdd9fbef1c03195034bd4b3b18031028
SHA512 b7cda55154262015a967786a649845ee20e8780fe11a79e2499d4711dd89a676b33f70bbacff7f98830b60174e466ab1ab6b1f1859606a3277e93560d89146a8
SSDEEP 96:nwkyr1c3AvvwpvWMoiVmde9yOhIg0to90YdJ/1yUWQyV+VD7AiEwb:nwkcckvGWMtyOug0C90YH8rg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 45f6360a67efe942e3390e0874bca228069501e2fae15991960eb3e769594c4d
MD5 f3e587e521083f75c817ce43792a5f74
SHA1 e45cc67dce9fa5c52ffc74c7747f686b39338340
SHA512 779b993df370b6cb1f7c7427b4c1373b401a3354324396e9abfc1288f5150a0a646e10d0bacb93f5638ffae9648743a3ff8488b0865882bd0d5cef29a3cc06df
SSDEEP 96:nwkyr1c3jvvwpvWMoiVmde9yOhyfyQXaR/hM0YdJhcEaEUWQyV+VD7AiEwb:nwkccLvGWMtyO2yMUM0YH/5rg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 8KB
SHA256 1e8aadddb8164a1e31950cbfc720ecc4c26655af293c4c54831424ea08b99484
MD5 3d5b966871ef93bdc6bb519f65437f1f
SHA1 8317b45b2fe57178c6bba0c68f0fb7f173e64477
SHA512 61ecf1b9d4c7471bd5d44f6979c72b92aa8c28c6577a9a3e04a64e57380ea1e691f3950b1a064d42ecee3bec7a9ddd59a91d60e1b38e8987c714a20ad89bb29f
SSDEEP 192:nwkhcpvGWMtyO9yDmuyS0czzLc9CMVwGjpL20YHCrg:nwwcpuWWguJob
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 8KB
SHA256 dad3dfeaa50fcd9d9868614a511cf782621ed8ae780f9562e1433889256094ae
MD5 4ca6bb659eb7dda2422d0bfd3c2068dc
SHA1 1758f6498c77b966471ff2998de44cd8d2391dde
SHA512 a704b17195df0cd2d4c410c8d1a321de9b9c6a357d31dd007e353f311436b3c0e1137a00e7eaeb85b608463027f1fba80f00e521783e3f8946a5d184a36a0c8a
SSDEEP 192:nwkhcqvGWMtyOZyLmuyS0czzLc9CMVwGjr720YHQrg:nwwcquWWguJe1
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 ee21435b86c760bd634e57100375a021070f9e889a630a68c5c0b26c1e11a80e
MD5 eeadb36bdf1b5ab1ad5612e5bcc9b0dd
SHA1 34231ac8bcc8a528250791e79e9374277a4d93ea
SHA512 26550d9c735ae311999319dfcb931baadcbb59a6dd0e90375b082db7096c8d92b112901a06c0f72875e7d29afa557ee7339709e632c9cbd423908238567282dd
SSDEEP 192:nwkQcIvGWMtyOryt8muyWuvpva3/gcwKizzL0HMfQ9CMa5wni7MSwx34rqyzhOj0:nwzcIuWWfurEsYJFor23u
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 b5a7a23f680d3cdfa319d6f509a27be6b8c15e8ea5990f70adca68b2f2281f18
MD5 aaa968831b7696c63b61b97dfc6924e5
SHA1 eceaba089718de6ee9026825830aa305c2df5a52
SHA512 b9bf0994147061c706a0d498b2bd0ae0f59537fc9a2dba66caada28dd5cf937b49128d016cc742dcfb09e7898be3c6e2e7eca7a74c28348288e2a14d6e100302
SSDEEP 96:nwkyr1c3xvvwpvWMoiVmde9yOhbyD25y0YdJRJ5UWQyV+VD7AiEwb:nwkcclvGWMtyO9yD8y0YHlrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 8KB
SHA256 31dad0d75b18833718deb16f33ac91268f1952845a9936ee063346dac7b79292
MD5 3ccd512bee2e024b6ccd3c925eb80a15
SHA1 cc5d7a7f98b140f960c56e8f64e288fdf8d80d79
SHA512 e28d3c483a11a53a4992979bf086efb00db20153f3e0431ddbd8b607162259b8afe116e6be78ffc3ba2a9e472a83cb7bb14c5cb3f7427f2681c3a3ee84074bc3
SSDEEP 192:nwkhcLvGWMtyOWytmuyS0czzLc9CMVwGjqa20YH6rg:nwwcLuWWjuJmz
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 8KB
SHA256 f9c1069d3d0e44aa27bda7255b7afebf0ad534db7afdba1dbafb60ab0c3e3f64
MD5 384fbe570012745a35d1aceb7cb0a410
SHA1 db0df2ea104742ad2984f3e10be8cae92b25c65b
SHA512 d64c2e596f58e42111e396a1afd1953e98dff86ca1ab748f4e1020bd70e4fdb7cfa495988f76c66c0798a88e92d4ec87e93ff52f8edd8d486f3e2bdc9d7144ca
SSDEEP 192:nwkhckvGWMtyOBykmuyS0czzLc9CMVwGjNYF20YH+yrg:nwwckuWW/uJXG
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 7c10b50e34845cdaec55dc8aadff09b8603d29ae7b20a0f0e7c9869e08381259
MD5 c14e128d0d7c0fdfbf60144614323090
SHA1 d96a53720de54c80ca44473d9127659b600ba472
SHA512 74f1cd3883980c030b8317fce54ea6c0fac17ce167c50d811330d97422acb88443721e08f350aa9a920578db23a69a66e3c330dd1df36574c7c4b0c675a700f4
SSDEEP 192:nwkQcxvLvWMtyOVyDmuymwnxZva3G/gcwKdwizhzLH10HJYf29c9C5MapVwni7M0:nwzcxDWWMuN6Wdv1ForCQ7
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 3b9503e9c8da8a506d3a6871f055568192203c762b450ccffa4621cc605dfd0f
MD5 a7f90aa23c43d8bc68001dcd08436178
SHA1 330f1bb56285714df6e7d2f9bf56e9b59902a2dc
SHA512 f0fd73a7f37bd295b004e94be33ad5ed142660f407fa062b3b23b0fb37098431e21b1eb8968a2cded988c7f776acda372adeeb20af864eb5e3a77a85f3313408
SSDEEP 192:nwkQcIvLvWMtyOryt8muymwnxZva3G/gcwKizhzLH10HJYf29c9C5MapVwni7MS1:nwzcIDWWfuN6xv1ForRX3
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 f10fb5843dd0f619c1e9aa2bf82f39368f535180d4f111b99707b4b961ee5e12
MD5 97b57ece3326e4678e40c50bf9fae5ad
SHA1 4c50f7d5c684acb8643b656b001d94cfa5807473
SHA512 310c56cd33a490242644f3c5ebf2eb8a637a00edc9494b6225c93f7dd11f9115e93652b4f7839098087d3932252f369738cd423f6ddf2a0c98a50c96b5edfcd2
SSDEEP 96:nwkyr1c3OvvwpvWMoiVmde9yOh1ye29D0YdJXroUWQyV+VD7AiEwb:nwkcc2vGWMtyOHyeUD0YHErg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 8KB
SHA256 75eda1608a2b2575ddc7225f050cf2828634ab8ebf22b63ae113cfa3749f805a
MD5 425622b00324e5ba32f466ec3e993b74
SHA1 8a883a33c8a0a8fd88c272b7bcfb5e639f858fcc
SHA512 e91f4202a1651f62309356680a3ea2f0056d27182a50d349cf9d27f9dc95b2fe943d405c918ee6dad7eadecceede580a2a2bdbfe447c2d7aaa1f64f43b17471e
SSDEEP 192:nwkhcOvGWMtyOMyAmuyS0czzLc9CMVwGjmn20YH/5rg:nwwcOuWWkuJxy
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 5d66b1e0d5558c31eea1d1dc14acb1d4054be01f8afb09c91f21ef50364fa148
MD5 65c44e2c0cad635ad3f30704b696f486
SHA1 8f25f05d55669b15a9f1f701e8d59683002cf620
SHA512 213f4a71e75d3b8d14a04d11ce6bea07524e99c290ea7f481e2c9a7c62aff8737ad432dba120d54815dd9b62da7193a57b6aebf3d9d7bae543f6669882bc5efe
SSDEEP 96:nwkyr1c3EvvwpvWMoiVmdepsYzZMkrsx0YdJ0xeUWQyV+VD7AiEwb:nwkccIvGWMmYdnsx0YHlrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 8KB
SHA256 5796727e01bd823d721260e91cb92473140e401f1d29ae77bd455570b7c58c5c
MD5 c713b530f3846b5e81adc84b03b4c066
SHA1 ed2f5c2273eed88607ca8c2415fa1790c4aaa233
SHA512 ecc23372714438f949709b6404bd3f34e5383eb6bf27e97593159ed4164e95e4a221fd9f3ed4f51491c446f608966b5187f743e33e0e594d75b2816fb8e2cfe2
SSDEEP 192:nwkhcdvGWMtyONyvmuyS0czzLc9CMVwGjNM20YH4Mrg:nwwcduWWEuJxu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 39638b0edc88416e78342cffeb763a044b4bf3d12fce97065cf0aa81a794a057
MD5 4c95274b33b923d4b007c338d40657f6
SHA1 0de0d0d654c9c039bc3ce260d5f2ffdde8f86e9c
SHA512 578bca6e96f3773bf14ba9fa75fafb498afbf29bc611d23bbe3b97c2cf8d6482ee7bfb5f2b556dd715062b144f356b9a463a977dba38d3e0e4e1ceb597e8726f
SSDEEP 192:nwkQcSvLvWMtyOIylmuymwnxZva3G/gcwKdwizhzLH10HJYf29c9C5MapVw8bi7P:nwzcSDWWluN6Wdv6For4oJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 8KB
SHA256 f2376836f2f5007bebfdb3f15af29cb28689e97cb9fa3d0e3312f71f45536a74
MD5 6978fdcb0e957eeb6546997f81d6508b
SHA1 384763f83d25fd0a2ea3a5923e6d2c5b54b9a67d
SHA512 96ff352fb8f718d8734e9f3cafeb760011e1de9ad60d68bab44e5e85154bdb534b6dc7df7d5063af77cceb03668bb1a02e2809d3633e39e12a2073df666af5d8
SSDEEP 192:nwkhcfvGWMtyOryt8muyS0czzLc9CMVwGjgG20YHfcrg:nwwcfuWWfuJQx
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 98afdad398ea7270123b6bb6a87e6a901d9eaac2e085a8531fb720c32202f6d8
MD5 c79f5ef1f546a0123c0d5ee4a35441bf
SHA1 d154cd8e25c0fd797b48780c996f93ee7013fc07
SHA512 f3fc95d081c7e380c6bcd25a5b93b5ec8fb9956bd7021e7f2af45e8360629865590e88ec3b19663db69478f5318eeecd888855d0979534950a6c3dc4b4891bb3
SSDEEP 96:nwkyr1c3XvvwpvWMoiVmde8RGf84g0YdJS4rUWQyV+VD7AiEwb:nwkccfvGWMsRGFg0YH1rg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 24KB
SHA256 9692162e8a88be0977395cc0704fe882b9a39b78bdfc9d579a8c961e15347a37
MD5 917dedf44ae3675e549e7b7ffc2c8ccd
SHA1 b7604eb16f0366e698943afbcf0c070d197271c0
SHA512 9628f7857eb88f8dceac00ffdcba2ed822fb9ebdada95e54224a0afc50bccd3e3d20c5abadbd20f61eba51dbf71c5c745b29309122d88b5cc6752a1dfc3be053
SSDEEP 768:nXQWtp8F1+UoAYDCx9Tuqh0VfUC9xbog/OVfLlQMrUoRt+:nXQWtpu1jayLiwo
MD5 SHA1 SHA512 SSDEEP

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 90B
SHA256 06e242abeb96239505505274ee4060e1bf107c3ba54f1ceef7e2b2c285858147
MD5 ec3d0c10e0fd1363ae2be9c3ec9c73c7
SHA1 34eeea3faa0b07ff4a86fd31bc9688f3fb12bba7
SHA512 ebabe50437fb00080f293fd405306fc32c5ff3a2807c82e6b45bca6592236b21a2745e753abf3122f615544ab3ed45a5bda40747eb09ee83ca7175b9c5f497ed
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 26B
SHA256 4f110831bb434c728a6895190323d159df6d531be8c4bb7109864eeb7c989ff2
MD5 2892eee3e20e19a9ba77be6913508a54
SHA1 7c4ef82faa28393c739c517d706ac6919a8ffc49
SHA512 b13a336db33299ab3405e13811e3ed9e5a18542e5d835f2b7130a6ff4c22f74272002fc43e7d9f94ac3aa6a4d53518f87f25d90c29e0d286b6470667ea9336ae
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\c5ce88bc72edbf8813410e12eaafa3c8e5ceb644\c7caedc3-76b4-45ca-a2cd-2c35f811d9d9\index-dir\the-real-index
Size 1KB
SHA256 e112c8be3623cb4e212575e547f1b2ebf52ee29f99a3fc39f081b6a5000633b5
MD5 71e528292d58105cedad78a19c4502ba
SHA1 9d91cfe1cd5c7f2009ad861a135a677fd8d340d4
SHA512 a5e62f49b0b6118afc37eef7dbb60993f08292fb45f960896f7b5f01d190080802fce1585f938f5639d0e989421c0b02c027446b0f034111bd3441a9b60793b7
MD5 SHA1 SHA512

Submit Download

the-real-index~RFe5f435b.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\c5ce88bc72edbf8813410e12eaafa3c8e5ceb644\c7caedc3-76b4-45ca-a2cd-2c35f811d9d9\index-dir\the-real-index~RFe5f435b.TMP
Size 48B
SHA256 fecdfe4bc1b3cc46f91a24546b3c1796efd6fcd4b9104d9d8b186a7224ad3d07
MD5 70b7a2ca662e662685c4d333382c4400
SHA1 7cd6e82cc8798a4a68a617c729ea61df4868e083
SHA512 d02478ab1116dea63e93a0c405ee10656d26e1ac149808d2176ad97a35bcd453b35f7f9c9a9bf74b1da73c86836a95239efe23a7de0d55ff4772a2d0d7ed9f46
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\c5ce88bc72edbf8813410e12eaafa3c8e5ceb644\index.txt
Size 115B
SHA256 2a564c832b4a671fe5633ef82b665650439f338a0d0ddf9b60d16774a0d6bbf0
MD5 f7cd7edafd2a6aab9342b7b12fb1ee07
SHA1 eb335c4a6714f3c8c359fee583c29cf116398cc5
SHA512 f56c4f69bcc575f69bcf7d9f3ca53f96b46a45139dcaaaa59cd7380e841b7046074fcf6fbfdab5ded3c04c505a473d5cd088d36a7dc70b5db794aab581720dbc
MD5 SHA1 SHA512

Submit Download

index.txt~RFe5f437a.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\c5ce88bc72edbf8813410e12eaafa3c8e5ceb644\index.txt~RFe5f437a.TMP
Size 119B
SHA256 038b8b295b3e5c6a3dafb470782922e6f0c1f93f30fb8675eae9f9d2899eb863
MD5 c016b254f02423b8d574f7a8624abe45
SHA1 c330db7089143e87ad47928388e76f7fc68af202
SHA512 fae2e28314fec1b88db0e87153285fd76cf39ef9a8d644b799c6699e021a0e652b909ebb42195c7675fc975169a8ddb00961960a1a82d738751adc43ba53d003
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 52c26b83920e4379293b06c7c3a04e588f36a7e32b20856c13b4d5b41315f8e7
MD5 ce507757bca81aaa8213950cb3f421a0
SHA1 5d95f78a132a36b12d2263952c39b5911324c9ca
SHA512 a31ae5adf51f9fae9753e2772476a6fd72b7d3b340a5199156c813db818961b025a92fcaa7ace69f47a1c3fbe8fd8412b513fcc81db073ad4f855e8a5179505a
MD5 SHA1 SHA512

Submit Download

the-real-index~RFe5f3040.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5f3040.TMP
Size 48B
SHA256 3290f494a311536bb07bcef848207b87c883538e8eab8e838d875582a72089d0
MD5 a27cd560a16a0edb26f03d401a1b3343
SHA1 1d10b6aaf669753d2620ba8462a12bbe6603b076
SHA512 d49498dce3759fc18e6d84cae1b03ea7e84a8c3a10f72aadc79217c042c3f66213902bfa8a60e6f6ce04e03be06cc8a0f8c364705b70b5dbcc7f509a1dd5d262
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 4KB
SHA256 803ef171c82d6f035d0953409087ce04e21aa12d027e2f5065ee659f6e8fb334
MD5 ef9d66c6634aa5452eb5ca2dd4e38f27
SHA1 bc26a2cb5316018ad491252bd6bb96183c810a37
SHA512 84bbfe3de99accc5378839da247e7087992a9bc040a5f976a29ed399193cecf8f2cc27d3e85a46582bba9edfc38713a9cb0c2f04f91ea42a834334aed6f18c87
SSDEEP 96:lUNN5dHU9UmUmieU0UgUno7U5TUxUIEU6mUgUGU+Ue0USXUrSU0KU6UcS7UbqUqA:lUjHU9UmUSU0UgUno7U5UxU7U3UgUGU6
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 4KB
SHA256 292e262fa5730c8e9b586b00c7860cb82b7e60aacdb8942cfb42aac2ed7dd81b
MD5 4868271b2ef9c465bf44f1b59ac7c774
SHA1 272b81c7bc12b7e69b0e3041ebad58fc833da722
SHA512 c0868b2283205dd650a8cc8e854c4d01ee4d3bc8fd158a3b3ba60e332ca0363e81edd6036db97b6b07cf47dac1fc7362a38a33d83866ee0df5ea2d285a6be7e6
SSDEEP 96:nU2UNN5dHU9UmUmieU0UgUno7U5TUxUIEU6mUgUGU+Ue0USXUrSU0KU6UcS7UvU1:nU2UjHU9UmUSU0UgUno7U5UxU7U3UgUv
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity~RFe5ef192.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5ef192.TMP
Size 2KB
SHA256 d356cc5f95709ef36bdbb1f918f1db6416801a1de80d26bec9bd1ffc28ab3fe6
MD5 2c864f3f0a361564dcc34bf96e5fa5b2
SHA1 8749f157150b0620b0b3a9e809b724692af34ab0
SHA512 58b3d283515bc0d5e921a781a1f3a621609a384ac8906cd300acb3ef99cbfb62f8b3fa03a779b8958689166c627bda26f785d14dca8df9ba1cbe77c0aabdcb22
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 6055fe4e0a814d1278fbaf37f8898055f62c39539532a17080cf574b5b10bbbb
MD5 054ded06b89da356677b42fa960c4ea9
SHA1 d08c1832af0fbdd425527a0718f3502b6673ce00
SHA512 6c84c25c58f9fca2914d211d669d884712c2d7714f750ff6b4ca5d447fe751263b482e6996e9c08f41efb1c3cbe801bdc424f8b15ffdb08aca6444a169c75e00
SSDEEP 384:A9iIxuERzA83h09RZxY7SDLmHjP9E1MeuBOA:rIxuERzA83h09RZxnmHjPTOA
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 6b2a54cf284457394e035ef66fbcef46e0daa7e8f066a483f0b3f645d3649da4
MD5 2e3c65e8c2a2c8aba61c5d422ce9e1e3
SHA1 12151ef439363a3800db9afbc144662f23a40b3a
SHA512 d767dbd1883901e94f50d33bdff3383df8bf6273f30f9a8771601e95634da16cae7834915288a1272dacbe266d197c742d56f8dbc4a4578a3abb8f4c0b1443ae
SSDEEP 384:89iIxuERzA83h09RZxY7PqDLmHj59E1MeuBOA:nIxuERzA83h09RZxagmHj5TOA
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 36b6e873156b769703261f54daebdbd685d4aee8641480e446735f5462c95ffe
MD5 dfc4e1a97a3bbf7d68758ee6d3575302
SHA1 1f9ab5e7845d227e745fc952127cc733d689dbb5
SHA512 d6ce07eb5f23cab589b1b6a147e0617e0324ab75e289ec3b16e926e97cc5da387cde785f3abb300d411caf84bcf99c4a80bfeabd7969d1ceb631f9a3c820b03a
SSDEEP 384:R9iIxuERzA83h09RZxY7aDLmHjp9E1MeuBOA:aIxuERzA83h09RZxPmHjpTOA
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 3a80d5076061b399fec7dfbf1cc2c084d66fc9c8145155b47aeccd95ad913cc9
MD5 44aa2ff9ce9259b36b13af1920c5df18
SHA1 d1d8446ad0ea7acae86fe2dfbcf675e3ac6043e6
SHA512 b4dacc921f977c37878f04c423825ac829760e3b0a68e8133f4bf69e93a1108b2570c56b4c16d7afdfbbb4bc4931d0943f8f879e2eec90b3eb52bf6d6ea771d8
SSDEEP 384:K9iIxuERzA83h09RZxY7eDLmHjez9E1MeuBOA:JIxuERzA83h09RZx7mHj6TOA
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 f42950519658d2747f2182a2026a08da1c846b228e7656218227687362c16a34
MD5 7e23153f3484f6b1ef4a5be216ecb17a
SHA1 2b1c4cc6cf87fbb4b75ec693c8153d7fd7fa87d2
SHA512 a77fc66c108d10539bfc228d95fc5295e05ac0764af35e16dc995d56ef81ccddcd7c4fd01cbcb7ab8642986d582b9a30dae8d0f1093b5656b7a6a29f3f624237
SSDEEP 384:v9iIxuERzA83h09RZxY7+DLmHju9E1MeuBOA:EIxuERzA83h09RZxDmHjuTOA
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 7cf2b4f37e037308fd3e4d43159d5a8cf97fef1784865a05ab6814e0ce3c83c9
MD5 b363ae5477ca66d30788e54ac3e89b0d
SHA1 9efe588dc4208cc1251f10b8b006668f9147e4d7
SHA512 51ff66a0f6dd02058f47e9e72d81393534581981fc21b88951a9e6218dd08912f75bd63c9ac3531f8d05cb6b7e593cde1ac3ddb392b27e87f32325af932926c5
SSDEEP 384:D9iIxuERzA83h09RZxY7SDLmHjP9E1MeuBOA:4IxuERzA83h09RZxnmHjPTOA
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 2cb15f49ec9b5aa45bae4f003d41979c3f023a623ebf6f9ef950af0cd65b45c1
MD5 00c5c1dce56d651eb967eb065ddb3fd0
SHA1 d4952085ee8aa8ef967db9b090c0e322aa15cbc7
SHA512 434ac54c623781115df99850e34847298e7b1483c1e1b90b6042ce2e754c632b352341c023e2abd7f35b090716fc0127d15d24b7e9bc4025f193f76eaf7d97e2
SSDEEP 384:m9iIxuERzA83h09RZxY72DLmHj59E1MeuBOA:VIxuERzA83h09RZxnmHj5TOA
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 9b4b2bd7be28f943008be94d3c2eb877e7465b3a9dfaa280bb74ffd893ac7c92
MD5 185f4ee4eee5c1bf89e9571798de412e
SHA1 f040766176cd11370baf7125fd2ab51b3ed643c1
SHA512 8f9fcc670639ae11634f8dc4db232093d11b5b701011b9124783407cfed38a26531a315bb5c74fb09cf286f81a6e88be67fd360a68ca697cd1415064bb8c5f20
SSDEEP 384:69iIxuERzA83h09RZxY7GDLmHjR9E1MeuBOA:ZIxuERzA83h09RZxXmHjRTOA
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 fc8da38a4ae0db0812406b1ac714404e7461df0219e61da74604d3da48558f23
MD5 652cdfb3aa257cc4081d0cdbce289f9a
SHA1 b23d891f036fb1f24eba4f2eb8495bcce4f08abc
SHA512 c61f5948a19135dbda61f820316ae541eb1c25758a1a99b4a7ec985b3258075848f105a47cee86b7835165af60671d55021acb714ffeedc100a906e5a7344a97
SSDEEP 384:Y9iIxuERzA83h09RZxY7UDLmHjun9E1MeuBOA:DIxuERzA83h09RZxBmHj2TOA
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 2bdcb8d326cdd7779db1e2891247da98734ba783f0cc3e3585157f3a39fdfd7c
MD5 196ce8769c29494c5378bc51e458b707
SHA1 c1e81f5e88643459475e2f7016385a24959f992f
SHA512 06fd520b2301861c0d5ccda3e2197734c9594086acf661f13df29b922be97d3eb6f7b6b11ce9b7dc597752b742fdbcab11553ee53003485e52566e7391eb4061
SSDEEP 384:y9iIxuERzA83h09RZxY7oDLmHjq9E1MeuBOA:xIxuERzA83h09RZxxmHjqTOA
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 87fd002f5a0eedb0b4d3325d4dd6d0796daf4a1674f32cceb71b80c4c7fdc717
MD5 451bf14f55814102736d97723de00872
SHA1 eb8eb1fad6a825b0ddf4d0a0a6e47816a1ce8af8
SHA512 5f2ccdce0cb7a9ea18adeb58c118d662ea2bc8b53935ea4e023759567ebc2945f8a9fe5fb7d67b669ad7042c6a9052d34c103d3af495412a7f82a7464ac8361a
SSDEEP 384:/9iIxuERzA83h09RZxY7IDLmHjW9E1MeuBOA:0IxuERzA83h09RZx5mHjWTOA
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 bd74f869f61393c59378e4660de48fcd57fad9ab0b11a83da69a24c5fe4ec99d
MD5 6c069216b981b5fd743c0cf367182965
SHA1 9c69fb9ce1118a5ae2af4ae0feaf7df8eb176ff7
SHA512 e38a04bdbc3625c2cc0eb49f784ceb59ada08a0482e8f522f46c6689a811df61bad6d314cb403502ee44814b4d7360b97507e0c3ee13c3050dd19eba290c9985
SSDEEP 192:RoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupSJe2RU+ubBw9xUX1MPeuuK:N9iIxuERzA83h09RZxY2aw9E1MeuBOA
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 b1ab99d022c6bd32cc6ae10d0ea9af80c1a41874ae6afaf694644f96a61339d7
MD5 14d1cefdd808735bb118b3bd12e22864
SHA1 e1f33cda3188fc17e676e3560ad8864bfa062909
SHA512 1c4e777fcf071befbfc930e6b948f7874117f680b774ba7cc24fd26d900458b360dcb751ee2f6b8ff786e3be9706f6211b82d3433d2b1ae48027162e960a9516
SSDEEP 384:49iIxuERzA83h09RZxY7VyDLmHj19E1MeuBOA:jIxuERzA83h09RZxpmHj1TOA
MD5 SHA1 SHA512 SSDEEP

Submit Download

wiatrace.log

Path C:\Windows\Debug\WIA\wiatrace.log
Size 1KB
SHA256 0e78d8e67044fcfdc5eb294bdadc61c7cb83420884e8a8764ab175cf003e62dc
MD5 fb5e8eb5f4ba1141eb13caff677da6f1
SHA1 862d7eb0438c0623227e41f8916058c945eee66d
SHA512 30ee90ec507795dd0e493d1873731737bb87dbba1658fa70ecdf29dc6763e586daf991b50058913da4e483a423cde4e2f0458bdc5841435806bfa00c803af6e2
MD5 SHA1 SHA512

Submit Download

note.txt

Path C:\note.txt
Size 218B
SHA256 8e9f20f6864c66576536c0b866c6ffdcf11397db67fe120e972e244c3c022270
MD5 afa6955439b8d516721231029fb9ca1b
SHA1 087a043cc123c0c0df2ffadcf8e71e3ac86bbae9
SHA512 5da21a31fbc4e8250dffed30f66b896bdf007ac91948140334fe36a3f010e1bac3e70a07e9f3eb9da8633189091fd5cadcabbaacd3e01da0fe7ae28a11b3dddf
MD5 SHA1 SHA512

Submit Download