Resubmissions

02/03/2024, 23:09

240302-244vjaab9z 4

02/03/2024, 23:06

240302-23c1esab8z 6

Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    02/03/2024, 23:06

General

  • Target

    https://kpl.jakubhyza.cz/tkAiWT

Score
6/10

Malware Config

Signatures

  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies registry class 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 31 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 41 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://kpl.jakubhyza.cz/tkAiWT
    1⤵
    • Enumerates system info in registry
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:880
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffffaa846f8,0x7ffffaa84708,0x7ffffaa84718
      2⤵
        PID:1384
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,15367202029446813022,2759976460901796008,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2148 /prefetch:2
        2⤵
          PID:2944
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2100,15367202029446813022,2759976460901796008,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2224 /prefetch:3
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:2032
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2100,15367202029446813022,2759976460901796008,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2836 /prefetch:8
          2⤵
            PID:3400
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,15367202029446813022,2759976460901796008,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
            2⤵
              PID:2588
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,15367202029446813022,2759976460901796008,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1
              2⤵
                PID:3964
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,15367202029446813022,2759976460901796008,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4164 /prefetch:1
                2⤵
                  PID:1532
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2100,15367202029446813022,2759976460901796008,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4908 /prefetch:8
                  2⤵
                    PID:2716
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,15367202029446813022,2759976460901796008,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4700 /prefetch:1
                    2⤵
                      PID:872
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,15367202029446813022,2759976460901796008,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4112 /prefetch:1
                      2⤵
                        PID:568
                      • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,15367202029446813022,2759976460901796008,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5124 /prefetch:8
                        2⤵
                          PID:1344
                        • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,15367202029446813022,2759976460901796008,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5124 /prefetch:8
                          2⤵
                          • Suspicious behavior: EnumeratesProcesses
                          PID:3160
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,15367202029446813022,2759976460901796008,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5552 /prefetch:1
                          2⤵
                            PID:3192
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,15367202029446813022,2759976460901796008,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5776 /prefetch:1
                            2⤵
                              PID:3056
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2100,15367202029446813022,2759976460901796008,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5664 /prefetch:8
                              2⤵
                              • Modifies registry class
                              • Suspicious behavior: EnumeratesProcesses
                              PID:4384
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,15367202029446813022,2759976460901796008,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3372 /prefetch:1
                              2⤵
                                PID:1472
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,15367202029446813022,2759976460901796008,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4768 /prefetch:1
                                2⤵
                                  PID:2416
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,15367202029446813022,2759976460901796008,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5928 /prefetch:1
                                  2⤵
                                    PID:1096
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2100,15367202029446813022,2759976460901796008,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5100 /prefetch:8
                                    2⤵
                                      PID:2504
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,15367202029446813022,2759976460901796008,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5292 /prefetch:1
                                      2⤵
                                        PID:2064
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2100,15367202029446813022,2759976460901796008,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5808 /prefetch:8
                                        2⤵
                                        • Suspicious behavior: EnumeratesProcesses
                                        PID:3140
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,15367202029446813022,2759976460901796008,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5592 /prefetch:1
                                        2⤵
                                          PID:1348
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,15367202029446813022,2759976460901796008,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5652 /prefetch:1
                                          2⤵
                                            PID:1180
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,15367202029446813022,2759976460901796008,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6532 /prefetch:1
                                            2⤵
                                              PID:4020
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,15367202029446813022,2759976460901796008,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5316 /prefetch:1
                                              2⤵
                                                PID:4328
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,15367202029446813022,2759976460901796008,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6400 /prefetch:1
                                                2⤵
                                                  PID:4040
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,15367202029446813022,2759976460901796008,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5784 /prefetch:1
                                                  2⤵
                                                    PID:1676
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,15367202029446813022,2759976460901796008,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5912 /prefetch:1
                                                    2⤵
                                                      PID:1540
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,15367202029446813022,2759976460901796008,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5652 /prefetch:1
                                                      2⤵
                                                        PID:764
                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,15367202029446813022,2759976460901796008,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6832 /prefetch:1
                                                        2⤵
                                                          PID:4952
                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,15367202029446813022,2759976460901796008,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6304 /prefetch:1
                                                          2⤵
                                                            PID:4348
                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,15367202029446813022,2759976460901796008,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6652 /prefetch:1
                                                            2⤵
                                                              PID:232
                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,15367202029446813022,2759976460901796008,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5864 /prefetch:1
                                                              2⤵
                                                                PID:2488
                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2100,15367202029446813022,2759976460901796008,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6908 /prefetch:8
                                                                2⤵
                                                                • Suspicious behavior: EnumeratesProcesses
                                                                PID:2384
                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,15367202029446813022,2759976460901796008,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3716 /prefetch:2
                                                                2⤵
                                                                  PID:4336
                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,15367202029446813022,2759976460901796008,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6888 /prefetch:1
                                                                  2⤵
                                                                    PID:1844
                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,15367202029446813022,2759976460901796008,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5856 /prefetch:1
                                                                    2⤵
                                                                      PID:2096
                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,15367202029446813022,2759976460901796008,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6924 /prefetch:1
                                                                      2⤵
                                                                        PID:3484
                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,15367202029446813022,2759976460901796008,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6448 /prefetch:1
                                                                        2⤵
                                                                          PID:1192
                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,15367202029446813022,2759976460901796008,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5320 /prefetch:1
                                                                          2⤵
                                                                            PID:4560
                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,15367202029446813022,2759976460901796008,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6916 /prefetch:1
                                                                            2⤵
                                                                              PID:3452
                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,15367202029446813022,2759976460901796008,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6832 /prefetch:1
                                                                              2⤵
                                                                                PID:2220
                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,15367202029446813022,2759976460901796008,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6352 /prefetch:1
                                                                                2⤵
                                                                                  PID:2096
                                                                              • C:\Windows\System32\CompPkgSrv.exe
                                                                                C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                                1⤵
                                                                                  PID:2884
                                                                                • C:\Windows\System32\CompPkgSrv.exe
                                                                                  C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                                  1⤵
                                                                                    PID:2324
                                                                                  • C:\Windows\system32\AUDIODG.EXE
                                                                                    C:\Windows\system32\AUDIODG.EXE 0x2fc 0x2f4
                                                                                    1⤵
                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                    PID:3628
                                                                                  • C:\Windows\System32\rundll32.exe
                                                                                    C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                                                                                    1⤵
                                                                                      PID:1348
                                                                                    • C:\Users\Admin\AppData\Local\Temp\Temp1_memz-master.zip\MEMZ-master\MEMZ-Destructive.exe
                                                                                      "C:\Users\Admin\AppData\Local\Temp\Temp1_memz-master.zip\MEMZ-master\MEMZ-Destructive.exe"
                                                                                      1⤵
                                                                                      • Suspicious use of SetWindowsHookEx
                                                                                      PID:1080
                                                                                      • C:\Users\Admin\AppData\Local\Temp\Temp1_memz-master.zip\MEMZ-master\MEMZ-Destructive.exe
                                                                                        "C:\Users\Admin\AppData\Local\Temp\Temp1_memz-master.zip\MEMZ-master\MEMZ-Destructive.exe" /watchdog
                                                                                        2⤵
                                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                                        • Suspicious use of SetWindowsHookEx
                                                                                        PID:1548
                                                                                      • C:\Users\Admin\AppData\Local\Temp\Temp1_memz-master.zip\MEMZ-master\MEMZ-Destructive.exe
                                                                                        "C:\Users\Admin\AppData\Local\Temp\Temp1_memz-master.zip\MEMZ-master\MEMZ-Destructive.exe" /watchdog
                                                                                        2⤵
                                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                                        • Suspicious use of SetWindowsHookEx
                                                                                        PID:1300
                                                                                      • C:\Users\Admin\AppData\Local\Temp\Temp1_memz-master.zip\MEMZ-master\MEMZ-Destructive.exe
                                                                                        "C:\Users\Admin\AppData\Local\Temp\Temp1_memz-master.zip\MEMZ-master\MEMZ-Destructive.exe" /watchdog
                                                                                        2⤵
                                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                                        • Suspicious use of SetWindowsHookEx
                                                                                        PID:4052
                                                                                      • C:\Users\Admin\AppData\Local\Temp\Temp1_memz-master.zip\MEMZ-master\MEMZ-Destructive.exe
                                                                                        "C:\Users\Admin\AppData\Local\Temp\Temp1_memz-master.zip\MEMZ-master\MEMZ-Destructive.exe" /watchdog
                                                                                        2⤵
                                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                                        • Suspicious use of SetWindowsHookEx
                                                                                        PID:4556
                                                                                      • C:\Users\Admin\AppData\Local\Temp\Temp1_memz-master.zip\MEMZ-master\MEMZ-Destructive.exe
                                                                                        "C:\Users\Admin\AppData\Local\Temp\Temp1_memz-master.zip\MEMZ-master\MEMZ-Destructive.exe" /watchdog
                                                                                        2⤵
                                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                                        • Suspicious use of SetWindowsHookEx
                                                                                        PID:1776
                                                                                      • C:\Users\Admin\AppData\Local\Temp\Temp1_memz-master.zip\MEMZ-master\MEMZ-Destructive.exe
                                                                                        "C:\Users\Admin\AppData\Local\Temp\Temp1_memz-master.zip\MEMZ-master\MEMZ-Destructive.exe" /main
                                                                                        2⤵
                                                                                        • Writes to the Master Boot Record (MBR)
                                                                                        • Suspicious use of SetWindowsHookEx
                                                                                        PID:4432
                                                                                        • C:\Windows\SysWOW64\notepad.exe
                                                                                          "C:\Windows\System32\notepad.exe" \note.txt
                                                                                          3⤵
                                                                                            PID:1836
                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=minecraft+hax+download+no+virus
                                                                                            3⤵
                                                                                              PID:3900
                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffffaa846f8,0x7ffffaa84708,0x7ffffaa84718
                                                                                                4⤵
                                                                                                  PID:2100

                                                                                          Network

                                                                                                MITRE ATT&CK Enterprise v15

                                                                                                Replay Monitor

                                                                                                Loading Replay Monitor...

                                                                                                Downloads

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                                                                  Filesize

                                                                                                  152B

                                                                                                  MD5

                                                                                                  7740a919423ddc469647f8fdd981324d

                                                                                                  SHA1

                                                                                                  c1bc3f834507e4940a0b7594e34c4b83bbea7cda

                                                                                                  SHA256

                                                                                                  bdd4adaa418d40558ab033ac0005fd6c2312d5f1f7fdf8b0e186fe1d65d78221

                                                                                                  SHA512

                                                                                                  7ad98d5d089808d9a707d577e76e809a223d3007778a672734d0a607c2c3ac5f93bc72adb6e6c7f878a577d3a1e69a16d0cd871eb6f58b8d88e2ea25f77d87b7

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                                                                  Filesize

                                                                                                  152B

                                                                                                  MD5

                                                                                                  9f44d6f922f830d04d7463189045a5a3

                                                                                                  SHA1

                                                                                                  2e9ae7188ab8f88078e83ba7f42a11a2c421cb1c

                                                                                                  SHA256

                                                                                                  0ae5cf8b49bc34fafe9f86734c8121b631bad52a1424c1dd2caa05781032334a

                                                                                                  SHA512

                                                                                                  7c1825eaefcc7b97bae31eeff031899300b175222de14000283e296e9b44680c8b3885a4ed5d78fd8dfee93333cd7289347b95a62bf11f751c4ca47772cf987d

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\673ea0ca-3dfa-4fd4-9485-185de655b733.tmp

                                                                                                  Filesize

                                                                                                  3KB

                                                                                                  MD5

                                                                                                  4903b6f14979d858de9ba7c905ce369f

                                                                                                  SHA1

                                                                                                  c1926bf6e5bf17bb86d96a9fa5411a2fed1f5893

                                                                                                  SHA256

                                                                                                  99a31a31b0c81094c7c9fb8184e5531cdc9c63c66a7148565c8f4f5375ca26e6

                                                                                                  SHA512

                                                                                                  c066e09bec0a980186bdfa3715ae3b7acf1b788b5808e30ae204e77106634eedc3eef59ef01b1527e8a4f15e9d0ec7a0eb44bd1e3ddf7b20245c007b855dedf5

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000013

                                                                                                  Filesize

                                                                                                  62KB

                                                                                                  MD5

                                                                                                  c3c0eb5e044497577bec91b5970f6d30

                                                                                                  SHA1

                                                                                                  d833f81cf21f68d43ba64a6c28892945adc317a6

                                                                                                  SHA256

                                                                                                  eb48be34490ec9c4f9402b882166cd82cd317b51b2a49aae75cdf9ee035035eb

                                                                                                  SHA512

                                                                                                  83d3545a4ed9eed2d25f98c4c9f100ae0ac5e4bc8828dccadee38553b7633bb63222132df8ec09d32eb37d960accb76e7aab5719fc08cc0a4ef07b053f30cf38

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000014

                                                                                                  Filesize

                                                                                                  67KB

                                                                                                  MD5

                                                                                                  88a552e6be1ac3978c49143983276b3a

                                                                                                  SHA1

                                                                                                  dbf4f4dc62a3da564b1a87b5191dc9a72a9b9423

                                                                                                  SHA256

                                                                                                  927121d8118a41fa3460b9ad84daeae59ea60dc9607e462b7e1341bea60da8d5

                                                                                                  SHA512

                                                                                                  125b13be3d209ff5cc12d8f9f12d01d271cd50c2800059241ebb419167c21adfa9d979ff6b8d88052f5d302e98090b7c8ceff4894b397168d8ba6d8a6204fb9a

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000015

                                                                                                  Filesize

                                                                                                  31KB

                                                                                                  MD5

                                                                                                  acd3f8bcdca044e4382c0bb6246b0234

                                                                                                  SHA1

                                                                                                  1c83d89a3c40835a82f06e6bea0af86f52901bc5

                                                                                                  SHA256

                                                                                                  cec8af8be960f3b13ad0f554c338ab88688ae5b4ddfcda5471fc8268ce66db25

                                                                                                  SHA512

                                                                                                  3cbf100cc72f4a63c7aebe0ec029fc3635b97addbb0a4e83febbd127e00ff1455fc0b4cb90839f3bec498a7cdb848d8fde4d6991cc6a1f479669e70ad220b5a1

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000016

                                                                                                  Filesize

                                                                                                  19KB

                                                                                                  MD5

                                                                                                  2e86a72f4e82614cd4842950d2e0a716

                                                                                                  SHA1

                                                                                                  d7b4ee0c9af735d098bff474632fc2c0113e0b9c

                                                                                                  SHA256

                                                                                                  c1334e604dbbffdf38e9e2f359938569afe25f7150d1c39c293469c1ee4f7b6f

                                                                                                  SHA512

                                                                                                  7a5fd3e3e89c5f8afca33b2d02e5440934e5186b9fa6367436e8d20ad42b211579225e73e3a685e5e763fa3f907fc4632b9425e8bd6d6f07c5c986b6556d47b1

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000017

                                                                                                  Filesize

                                                                                                  65KB

                                                                                                  MD5

                                                                                                  56d57bc655526551f217536f19195495

                                                                                                  SHA1

                                                                                                  28b430886d1220855a805d78dc5d6414aeee6995

                                                                                                  SHA256

                                                                                                  f12de7e272171cda36389813df4ba68eb2b8b23c58e515391614284e7b03c4d4

                                                                                                  SHA512

                                                                                                  7814c60dc377e400bbbcc2000e48b617e577a21045a0f5c79af163faa0087c6203d9f667e531bbb049c9bd8fb296678e6a5cdcad149498d7f22ffa11236b51cb

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000018

                                                                                                  Filesize

                                                                                                  88KB

                                                                                                  MD5

                                                                                                  b38fbbd0b5c8e8b4452b33d6f85df7dc

                                                                                                  SHA1

                                                                                                  386ba241790252df01a6a028b3238de2f995a559

                                                                                                  SHA256

                                                                                                  b18b9eb934a5b3b81b16c66ec3ec8e8fecdb3d43550ce050eb2523aabc08b9cd

                                                                                                  SHA512

                                                                                                  546ca9fb302bf28e3a178e798dd6b80c91cba71d0467257b8ed42e4f845aa6ecb858f718aac1e0865b791d4ecf41f1239081847c75c6fb3e9afd242d3704ad16

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000019

                                                                                                  Filesize

                                                                                                  1.1MB

                                                                                                  MD5

                                                                                                  f07899b2fa8398870c2dcb5d7fe44fc5

                                                                                                  SHA1

                                                                                                  6efd418ec9d45e731cf848b75b52cfb6124e773b

                                                                                                  SHA256

                                                                                                  732fe8afbf4fda320d34ed9bb0d4d4f5525879ed87784870face53eb50ffbaeb

                                                                                                  SHA512

                                                                                                  0b30a0d01277d2f3abcb85f3fc16be3b07fd826e9cb523b73fd9e45bc5cacab03e6f0486ce84cdeab01adb70810d6891d87dae036e525959a4e97114588a900f

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001a

                                                                                                  Filesize

                                                                                                  32KB

                                                                                                  MD5

                                                                                                  bbc7e5859c0d0757b3b1b15e1b11929d

                                                                                                  SHA1

                                                                                                  59df2c56b3c79ac1de9b400ddf3c5a693fa76c2d

                                                                                                  SHA256

                                                                                                  851c67fbabfda5b3151a6f73f283f7f0634cd1163719135a8de25c0518234fc2

                                                                                                  SHA512

                                                                                                  f1fecb77f4cdfe7165cc1f2da042048fd94033ca4e648e50ebc4171c806c3c174666bb321c6dda53f2f175dc310ad2459e8f01778acaee6e7c7606497c0a1dea

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001b

                                                                                                  Filesize

                                                                                                  74KB

                                                                                                  MD5

                                                                                                  bc9faa8bb6aae687766b2db2e055a494

                                                                                                  SHA1

                                                                                                  34b2395d1b6908afcd60f92cdd8e7153939191e4

                                                                                                  SHA256

                                                                                                  4a725d21a3c98f0b9c5763b0a0796818d341579817af762448e1be522bc574ed

                                                                                                  SHA512

                                                                                                  621386935230595c3a00b9c53ea25daa78c2823d32085e22363dc438150f1cb6b3d50be5c58665886fac2286ae63bf1f62c8803cb38a0cac201c82ee2db975c4

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001d

                                                                                                  Filesize

                                                                                                  40KB

                                                                                                  MD5

                                                                                                  3051c1e179d84292d3f84a1a0a112c80

                                                                                                  SHA1

                                                                                                  c11a63236373abfe574f2935a0e7024688b71ccb

                                                                                                  SHA256

                                                                                                  992cbdc768319cbd64c1ec740134deccbb990d29d7dccd5ecd5c49672fa98ea3

                                                                                                  SHA512

                                                                                                  df64e0f8c59b50bcffb523b6eab8fabf5f0c5c3d1abbfc6aa4831b4f6ce008320c66121dcedd124533867a9d5de83c424c5e9390bf0a95c8e641af6de74dabff

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001e

                                                                                                  Filesize

                                                                                                  53KB

                                                                                                  MD5

                                                                                                  68f0a51fa86985999964ee43de12cdd5

                                                                                                  SHA1

                                                                                                  bbfc7666be00c560b7394fa0b82b864237a99d8c

                                                                                                  SHA256

                                                                                                  f230c691e1525fac0191e2f4a1db36046306eb7d19808b7bf8227b7ed75e5a0f

                                                                                                  SHA512

                                                                                                  3049b9bd4160bfa702f2e2b6c1714c960d2c422e3481d3b6dd7006e65aa5075eed1dc9b8a2337e0501e9a7780a38718d298b2415cf30ec9e115a9360df5fa2a7

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000027

                                                                                                  Filesize

                                                                                                  59KB

                                                                                                  MD5

                                                                                                  063fe934b18300c766e7279114db4b67

                                                                                                  SHA1

                                                                                                  d7e71855cf6e8d1e7fbaa763223857f50cd1d4bd

                                                                                                  SHA256

                                                                                                  8745914e0214bcd9d2e6a841f0679a81084ef3fc3d99125876bee26653f4253e

                                                                                                  SHA512

                                                                                                  9d0dfc21306b3a56c2ecdf1265392271969e3765e161e117c8765125b34793e24458217cf6514b364f351f47e65baaaf5856be0d13406a789f844d6ba8c7075f

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000028

                                                                                                  Filesize

                                                                                                  153KB

                                                                                                  MD5

                                                                                                  ce9fe310a8b8ed92ae2c8472ff3b59ca

                                                                                                  SHA1

                                                                                                  59b1ef50b9181ea7b2ff15c6b3aee5b5b9d1e637

                                                                                                  SHA256

                                                                                                  886630a4fffcd5467a13460abee5fe70b262befa51b6353ea902a02e8ce112a1

                                                                                                  SHA512

                                                                                                  31c68e2fd65c6bad73ec409e6ddd9b1593bd3ad92ed5af979752ab4cd41bcc2f896a9be992c6ceeb232db9687c57c0abd3e35185c1e84199e6e87aeae84d099b

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00002c

                                                                                                  Filesize

                                                                                                  28KB

                                                                                                  MD5

                                                                                                  2a06917fd5d3ea2c7a338528c5874cac

                                                                                                  SHA1

                                                                                                  aaa0afe8021b2ffc5bccb0dbc66ff2ddc84509ec

                                                                                                  SHA256

                                                                                                  02183d70bb9f43e753ae3c34c3bda9a7fbbbb0ec774c711c263d3a54ff970476

                                                                                                  SHA512

                                                                                                  1d1ed0af85c32080d17f6370eb3fe639beae8794e965e1def462dfd5ce53e36949b996c6220570782712ee8d8aaf1e1bee1a34e7000805421144247bcdc26762

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00004c

                                                                                                  Filesize

                                                                                                  195KB

                                                                                                  MD5

                                                                                                  89d79dbf26a3c2e22ddd95766fe3173d

                                                                                                  SHA1

                                                                                                  f38fd066eef4cf4e72a934548eafb5f6abb00b53

                                                                                                  SHA256

                                                                                                  367ef9ec8dc07f84fed51cac5c75dc1ac87688bbf8f5da8e17655e7917bd7b69

                                                                                                  SHA512

                                                                                                  ab7ce168e6f59e2250b82ec62857c2f2b08e5a548de85ac82177ac550729287ead40382a7c8a92fbce7f53b106d199b1c8adbb770e47287fc70ea0ea858faba6

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                                                                                  Filesize

                                                                                                  3KB

                                                                                                  MD5

                                                                                                  abd1c92dcfc6718f4d55ae02dcff56e7

                                                                                                  SHA1

                                                                                                  11208a50a2ae89c96a24cc1da27a6fd19464e0be

                                                                                                  SHA256

                                                                                                  77c2822b4c9a4b37acd45d52fd4dde2f90a56c607e14664cf8c24aa4385f96d0

                                                                                                  SHA512

                                                                                                  477937d6b3da538b364a10b77f835d1197b4e76bca550ad18e7ccdde8a58012b48fe5884abeeb0ee0b2eae95c933d8a86298fa554d0aa030d352a2c87bbe6987

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                                                                                  Filesize

                                                                                                  4KB

                                                                                                  MD5

                                                                                                  81e611fbeac68a04e4f02c3c549f4667

                                                                                                  SHA1

                                                                                                  12be50c708a59b23c0baa51fdfc7f9f9f0533836

                                                                                                  SHA256

                                                                                                  587c5c56cc582e703f8489c53c1ecae076c650635856edc30288efd09cdd2ff5

                                                                                                  SHA512

                                                                                                  1e1348ab860e930f058f99552266f19ceb410982a2beecbdaa62cfa40cdceeeaf6e417e7667652897ed229bca8777bce0835cb773170625a407bd357164d4047

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                                  Filesize

                                                                                                  7KB

                                                                                                  MD5

                                                                                                  60758d769ece8d737be9736fd4dfcec6

                                                                                                  SHA1

                                                                                                  e821bf14727dfd22d52e1449d94d9378b8653ad2

                                                                                                  SHA256

                                                                                                  a88bf48787160cc3d225b952715f6dd269151d86cef02157012f99232e37868e

                                                                                                  SHA512

                                                                                                  695554f43696e6ba70e99247db52ff50e63788fbce8a3ca9e0a7db3d5af186b00994ed6d60989eb8458af7211916631b3b27a66dcb214786a82227a9127fc336

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                                  Filesize

                                                                                                  8KB

                                                                                                  MD5

                                                                                                  7c62c6555f46411aa080a8e452c8d47a

                                                                                                  SHA1

                                                                                                  91a61267808bed4da5333e8ddf1040fd4c7c2e72

                                                                                                  SHA256

                                                                                                  70a080bebb56cc3d8a19b57619536f46e7cd39e42e5315b37dd65ede572e5f13

                                                                                                  SHA512

                                                                                                  cefa6d4cd875f57b337405eed4a215296f1e73b0423102065b1aa8a60654ad9f7806e801321d2d311b0407f0148b061fea0ea9f3013611357185e37a97746c01

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                                  Filesize

                                                                                                  8KB

                                                                                                  MD5

                                                                                                  a12d6e7c38b9ba8424e13efc597e2819

                                                                                                  SHA1

                                                                                                  67f77cec0359b1a33e0daacddb65781576385118

                                                                                                  SHA256

                                                                                                  066ef363a56c1ded737f53e71d4c00bb9aa539160f967441a3c2c352110c03f0

                                                                                                  SHA512

                                                                                                  a489eb777de2754bc77405fb1ed05e0d02fbbdd29450f858dd37b83f546b174cb06f08caa41d7be5f5c790997edc605e8a65f521ea9f62d8dec091a20391d469

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                                  Filesize

                                                                                                  9KB

                                                                                                  MD5

                                                                                                  22879a8d58cb9e6a107d1123574a0a94

                                                                                                  SHA1

                                                                                                  9bb78fe76ae9b313d4ff2d1b2355454c667152d7

                                                                                                  SHA256

                                                                                                  93dd2257c2e5bef336f8f003a5b841939f563606fd9bc8be3d8103ebde76f12a

                                                                                                  SHA512

                                                                                                  750b9eea7998e70d9469bdddba281f61f4508c14817ae6ba2bc3e6be4fe5226d7af2b6be6674c979a9e884ed7c9bfe132a846a1c4b23ab86a6cf471e39792bc1

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                                  Filesize

                                                                                                  9KB

                                                                                                  MD5

                                                                                                  c0f25c29467a4a766b1e1ea768a25a1c

                                                                                                  SHA1

                                                                                                  3ab02a1c058f3cc39a79068f068a2f1be677ef31

                                                                                                  SHA256

                                                                                                  1f4e9f7a19e2b6d6fd3033d9ded7beb1efea08b3cb3fd5673e051d5035223550

                                                                                                  SHA512

                                                                                                  01618bade4e04fbb301b4781211c0371719b061fa6dc61c55505a7134aa4622b4814d4ca2a13ab2f83bae1e4a17b61755091329a14d31c8e2ae50df254c5423d

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                                  Filesize

                                                                                                  8KB

                                                                                                  MD5

                                                                                                  3578dd886170d32cee73c49a8601d2e1

                                                                                                  SHA1

                                                                                                  e52493ce05dde9557534ca41a0dbe0f720681614

                                                                                                  SHA256

                                                                                                  3507d0727dcfc6d6616b26285b69f3fa3ef8f1a28598b9ff14c2172c67b0a960

                                                                                                  SHA512

                                                                                                  f50e273af2d7c1d7570816050e9d814491973784a72dc0bc363f8fe1006ff0398ae8968998bfb5c2c3f3bd2681c91b1939c16b65ba5a9fd8bae574a822b32eb2

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                                                  Filesize

                                                                                                  1KB

                                                                                                  MD5

                                                                                                  f5f3242dacabd271d65cce783f50b57b

                                                                                                  SHA1

                                                                                                  3e2ac9d8000174cef15e702c24c70649874d8886

                                                                                                  SHA256

                                                                                                  c81fff1d61219165af249b7b824fda35454f405f852e677c087b41f001f98e8e

                                                                                                  SHA512

                                                                                                  2f010e4f9b2e243ba8aec5a81d13f4cc64bebf16a8436585609fe03390a7fc27ba64598455bafeb80da7596c709eb61b91b7b1d290d3fdde3b2dd7391f16da35

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                                                  Filesize

                                                                                                  1KB

                                                                                                  MD5

                                                                                                  2f3755ce232e5c57210da9c310b857a1

                                                                                                  SHA1

                                                                                                  1b9ca0219513f202d90363a4a74f3df1d778c793

                                                                                                  SHA256

                                                                                                  edfb9e2d289703ce64a1d4e48d0b3fb15f239d5fcadb2860e812b05aa63e65ca

                                                                                                  SHA512

                                                                                                  6fb75ef070e9ad557519387f0cf769d7651773a0e11cc00f931d889dcc9ac59356ae7a6ceb03ea9fd0a0419e7a00a573d9f09c3ee3632e3d16a35e0261ab72e7

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                                                  Filesize

                                                                                                  1KB

                                                                                                  MD5

                                                                                                  3456b7e3ed07a8101e05e8938145c4ef

                                                                                                  SHA1

                                                                                                  5a19b0867f1b68b0b47d45cdc6076c834dc476db

                                                                                                  SHA256

                                                                                                  f4a27fcbda7e595cc3ced5ef7267d34f20a9ba4fee886f6f94d9785ad1231a89

                                                                                                  SHA512

                                                                                                  1d232c48ea65be1109e2ed29dcb7e696142b363d9c5d2f1d25adda03e89d01767cdb171240117428e2b7a544cf9e0d930adaf0e7c0a24a77b4615d6dcf2bdee6

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                                                  Filesize

                                                                                                  1KB

                                                                                                  MD5

                                                                                                  c9f60242c540a74da5b439ed28d76340

                                                                                                  SHA1

                                                                                                  33d5ef0b03a9475a723edcaf7f3f14052db796df

                                                                                                  SHA256

                                                                                                  4bde009702ce47fd776399363dbd1e69b4f6da234901951d2084039a1cddf0df

                                                                                                  SHA512

                                                                                                  2f714e1e7f08a162ed57a0b1add9b9391251b1a11d67497a848638ade61559d028460a8fc7d46cefe4bef932dbdb6636685b87ef5bf9d1b8886959deaa2a0606

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                                                  Filesize

                                                                                                  2KB

                                                                                                  MD5

                                                                                                  cc192d18b5fe1029c356e5d81f40e9b9

                                                                                                  SHA1

                                                                                                  f87266679c5e866213d5250a54f697b812a6fa6b

                                                                                                  SHA256

                                                                                                  0acbbef16aef041af52cb17d4db2ef6a09edbd4577ea54f346154c29ca3a842f

                                                                                                  SHA512

                                                                                                  4e5ba9049a9f53769a5559e44822302c46ebfdae97cf5dceef18df59b1eae297a4c0793c6e6303311647a6a6b50e10c97b4e76515bc4d52a97d2c7a7d49278be

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                                                  Filesize

                                                                                                  2KB

                                                                                                  MD5

                                                                                                  2148348f9677e299c431825c78e013fe

                                                                                                  SHA1

                                                                                                  475e4e271f77fbef0fa1449095412f5ac399e5bb

                                                                                                  SHA256

                                                                                                  77008b00589d95b7f31638bb73f206e20be0a9ea8f2a580d7b9e9d352fe17cd2

                                                                                                  SHA512

                                                                                                  85fac02001fd00eef9fad924cc7c8f424cf0f903bc94a5d22db532289495d3ea87a3fee1637cf66243279c320d6de7d6432b07078427c906533235a121a9dbca

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57b342.TMP

                                                                                                  Filesize

                                                                                                  1KB

                                                                                                  MD5

                                                                                                  92e4c9e8e21fac5c045e53af051cd3d2

                                                                                                  SHA1

                                                                                                  05e286eaee05b2b705afddddbd5fb1ed068e4db8

                                                                                                  SHA256

                                                                                                  556c3a6e28af2423f6696f31f1faadb66bc4155c5a74042d39e25ec783c11b22

                                                                                                  SHA512

                                                                                                  7d1a92fca654f75cd6f2c2f5c8bc85b4a7ee8d2f696526eeedd18042d37b173048fc754581b910c4e86a8492b753abd22fcbd00ef9807f4852b2ca2023301c46

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\bc133bea-2e9f-411a-9640-1cda85ccb856.tmp

                                                                                                  Filesize

                                                                                                  6KB

                                                                                                  MD5

                                                                                                  def1972126837031e3a819f826a84e14

                                                                                                  SHA1

                                                                                                  98d5430180b14764892153cd89ef25ba5bbd1c87

                                                                                                  SHA256

                                                                                                  32e6d0d33424f7b3c669f5d8a65e4e3a8e637006a5e1658463f16e7fb6bd8f8c

                                                                                                  SHA512

                                                                                                  35d48c4619c03a547cf267eeba15879c567e824abe53e4c014e99f2cdef725d0806f3192b5e7d0e8124acad2e8fe388a4436fb4c9bf80c56b50dbe8b4a0665e2

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                                                                                  Filesize

                                                                                                  16B

                                                                                                  MD5

                                                                                                  6752a1d65b201c13b62ea44016eb221f

                                                                                                  SHA1

                                                                                                  58ecf154d01a62233ed7fb494ace3c3d4ffce08b

                                                                                                  SHA256

                                                                                                  0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

                                                                                                  SHA512

                                                                                                  9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                                                  Filesize

                                                                                                  11KB

                                                                                                  MD5

                                                                                                  1f2eb1ddb99ebf405b6c0c307fefeded

                                                                                                  SHA1

                                                                                                  3e239207ca07f183bbc0eb2c4d466d88f3542092

                                                                                                  SHA256

                                                                                                  985f2548b31f8c1cc0924bf4c5ece2e1131e351924cbfd15f316d144af1de104

                                                                                                  SHA512

                                                                                                  c5d0053abad5e226c7ad18f343af01bedd7d43bfff33d433ae65ed26b07ec6aeddf05ea80cd957480eafe727abc0c7e1086a52568de4b603e81f88ac84be7b79

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                                                  Filesize

                                                                                                  12KB

                                                                                                  MD5

                                                                                                  a7f534b3acc426a7128409fab5c6b0d2

                                                                                                  SHA1

                                                                                                  441f84d7938ccd7fff59afc777779e444e157434

                                                                                                  SHA256

                                                                                                  509253b069f991ae0541aac1018d645e60da0a4f3ae37a4707512213e808e4a0

                                                                                                  SHA512

                                                                                                  1fcb10e557de288117f98e85744d43880ae782591d6d86e688459557a0af4ba824196941b5ac9c0e009b9a01e804f919d4c7261af775f5b5c0b67fec27561d61

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                                                  Filesize

                                                                                                  12KB

                                                                                                  MD5

                                                                                                  9380e24ed69cfa9ec4d39c6bc639c79c

                                                                                                  SHA1

                                                                                                  c7c78ca2937b0cdb27afdd9d93da2ca0ad621abe

                                                                                                  SHA256

                                                                                                  9d4fa305a0fd7d7b7e2481cc28aa881c9fa98a0bbe2671faa6cd3030db5b9795

                                                                                                  SHA512

                                                                                                  f55e9eeba0dbdfb6393b58b3a0101668644d0cc4a9d8e434b70b9a78f4988150f4cd0d476271401e753381cf27156377d9c23719f21552ee28af3c2013b179dd

                                                                                                • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

                                                                                                  Filesize

                                                                                                  10KB

                                                                                                  MD5

                                                                                                  4ae702c38ae39fdb2866c5e57201285f

                                                                                                  SHA1

                                                                                                  4ac6ee241ad5265af21a180b35853fbb8b2e344b

                                                                                                  SHA256

                                                                                                  20c158bb3dd52c9b50d4647d0b48095c381bd073bbd1aa0ecd30f81311726a38

                                                                                                  SHA512

                                                                                                  b0ad6e80cf2e8918a404042a9779f2dc66af95131aff7cf8d573f82cd57cdb8881071a1b6d5b2702240c30fdc0d0049215f651651f54a13bf733897c85cc7e29

                                                                                                • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

                                                                                                  Filesize

                                                                                                  10KB

                                                                                                  MD5

                                                                                                  598b39982ebb6db1c2c2a8cc206a0cfc

                                                                                                  SHA1

                                                                                                  510e0c5f0d94d1ee2924d38b18d3846a77111aad

                                                                                                  SHA256

                                                                                                  bdf1eae7f27198fe5f4f3e566d4e9f34b9b3dc5e9204a44783e44b48f5a43e87

                                                                                                  SHA512

                                                                                                  d105f19315ff2ef8565a6548497f29870e97b0e47e37da15239f6351cf30f138911cc29e382560f737c28395ec9555f95a4a5e58a7968ac612659057c1786641

                                                                                                • C:\Users\Admin\Downloads\MEMZ.4.0.Clean.zip

                                                                                                  Filesize

                                                                                                  12KB

                                                                                                  MD5

                                                                                                  8ce8fc61248ec439225bdd3a71ad4be9

                                                                                                  SHA1

                                                                                                  881d4c3f400b74fdde172df440a2eddb22eb90f6

                                                                                                  SHA256

                                                                                                  15ef265d305f4a1eac11fc0e65515b94b115cf6cbb498597125fa3a8a1af44f5

                                                                                                  SHA512

                                                                                                  fe66db34bde67304091281872510354c8381f2d1cf053b91dcd2ff16839e6e58969b2c4cb8f70544f5ddef2e7898af18aaaacb074fb2d51883687034ec18cdd9

                                                                                                • C:\Users\Admin\Downloads\memz-master.zip

                                                                                                  Filesize

                                                                                                  17KB

                                                                                                  MD5

                                                                                                  4790677e05d72ef7429dddf35562bf4a

                                                                                                  SHA1

                                                                                                  4243d6ea53db7e8cc0c355e70d6cffb54787b90b

                                                                                                  SHA256

                                                                                                  319bf6087040d17b87f46cd05f5ee064c291ba9ca46e1910f28d1f4c57cb3d96

                                                                                                  SHA512

                                                                                                  a93c5f691938bc1bdd9ef20b975f0b22cf494543e7df82ec31838bf811552ead5cd855959be4e47186ee7de944be005030f52f58b9dc85e7cde719cb97b794e3

                                                                                                • C:\note.txt

                                                                                                  Filesize

                                                                                                  218B

                                                                                                  MD5

                                                                                                  afa6955439b8d516721231029fb9ca1b

                                                                                                  SHA1

                                                                                                  087a043cc123c0c0df2ffadcf8e71e3ac86bbae9

                                                                                                  SHA256

                                                                                                  8e9f20f6864c66576536c0b866c6ffdcf11397db67fe120e972e244c3c022270

                                                                                                  SHA512

                                                                                                  5da21a31fbc4e8250dffed30f66b896bdf007ac91948140334fe36a3f010e1bac3e70a07e9f3eb9da8633189091fd5cadcabbaacd3e01da0fe7ae28a11b3dddf