4b30f308a5f0cf34361f5a53f2d73c523188adbbd9ac264275946197a3a8aa28

Resubmissions

03-03-2024 13:51

240303-q5vgpscb85 10

03-03-2024 13:45

240303-q2r76sbd9y 10

Analysis

max time kernel
141s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
03-03-2024 13:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

MEMZ 3.0/MEMZ.exe
Size

12KB
MD5

a7bcf7ea8e9f3f36ebfb85b823e39d91
SHA1

761168201520c199dba68add3a607922d8d4a86e
SHA256

3ff64f10603f0330fa2386ff99471ca789391ace969bd0ec1c1b8ce1b4a6db42
SHA512

89923b669d31e590189fd06619bf27e47c5a47e82be6ae71fdb1b9b3b30b06fb7ca8ffed6d5c41ac410a367f2eb07589291e95a2644877d6bffd52775a5b1523
SSDEEP

192:HMDLTxWDf/pl3cIEiwqZKBktLe3P+qf2jhP6B5b2yL3:H4IDH3cIqqvUWq+jhyT2yL

Score

7^/10

bootkit persistence

Malware Config

Signatures

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\Control Panel\International\Geo\Nation	MEMZ.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\Control Panel\International\Geo\Nation	MEMZ.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	MEMZ.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000_Classes\Local Settings	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5076	MEMZ.exe
5076	MEMZ.exe
5100	MEMZ.exe
5100	MEMZ.exe
4136	MEMZ.exe
5076	MEMZ.exe
4136	MEMZ.exe
5076	MEMZ.exe
1652	MEMZ.exe
1652	MEMZ.exe
4396	MEMZ.exe
5100	MEMZ.exe
5100	MEMZ.exe
4396	MEMZ.exe
4136	MEMZ.exe
5076	MEMZ.exe
4136	MEMZ.exe
5076	MEMZ.exe
4396	MEMZ.exe
4396	MEMZ.exe
5100	MEMZ.exe
5100	MEMZ.exe
1652	MEMZ.exe
1652	MEMZ.exe
4136	MEMZ.exe
4136	MEMZ.exe
5076	MEMZ.exe
5076	MEMZ.exe
4396	MEMZ.exe
4396	MEMZ.exe
5076	MEMZ.exe
5076	MEMZ.exe
4136	MEMZ.exe
4136	MEMZ.exe
1652	MEMZ.exe
1652	MEMZ.exe
5100	MEMZ.exe
5100	MEMZ.exe
4396	MEMZ.exe
4396	MEMZ.exe
5076	MEMZ.exe
5076	MEMZ.exe
1652	MEMZ.exe
1652	MEMZ.exe
4396	MEMZ.exe
4396	MEMZ.exe
5100	MEMZ.exe
5100	MEMZ.exe
4136	MEMZ.exe
4136	MEMZ.exe
5076	MEMZ.exe
5076	MEMZ.exe
1652	MEMZ.exe
1652	MEMZ.exe
5100	MEMZ.exe
4396	MEMZ.exe
5100	MEMZ.exe
4396	MEMZ.exe
5076	MEMZ.exe
4136	MEMZ.exe
5076	MEMZ.exe
4136	MEMZ.exe
1652	MEMZ.exe
1652	MEMZ.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 33 IoCs

pid	Process
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	4172	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	4172	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3716	MEMZ.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3212 wrote to memory of 5076	3212	MEMZ.exe	88
PID 3212 wrote to memory of 5076	3212	MEMZ.exe	88
PID 3212 wrote to memory of 5076	3212	MEMZ.exe	88
PID 3212 wrote to memory of 5100	3212	MEMZ.exe	89
PID 3212 wrote to memory of 5100	3212	MEMZ.exe	89
PID 3212 wrote to memory of 5100	3212	MEMZ.exe	89
PID 3212 wrote to memory of 4136	3212	MEMZ.exe	90
PID 3212 wrote to memory of 4136	3212	MEMZ.exe	90
PID 3212 wrote to memory of 4136	3212	MEMZ.exe	90
PID 3212 wrote to memory of 4396	3212	MEMZ.exe	91
PID 3212 wrote to memory of 4396	3212	MEMZ.exe	91
PID 3212 wrote to memory of 4396	3212	MEMZ.exe	91
PID 3212 wrote to memory of 1652	3212	MEMZ.exe	92
PID 3212 wrote to memory of 1652	3212	MEMZ.exe	92
PID 3212 wrote to memory of 1652	3212	MEMZ.exe	92
PID 3212 wrote to memory of 3716	3212	MEMZ.exe	93
PID 3212 wrote to memory of 3716	3212	MEMZ.exe	93
PID 3212 wrote to memory of 3716	3212	MEMZ.exe	93
PID 3716 wrote to memory of 3220	3716	MEMZ.exe	96
PID 3716 wrote to memory of 3220	3716	MEMZ.exe	96
PID 3716 wrote to memory of 3220	3716	MEMZ.exe	96
PID 3716 wrote to memory of 1760	3716	MEMZ.exe	101
PID 3716 wrote to memory of 1760	3716	MEMZ.exe	101
PID 1760 wrote to memory of 1504	1760	msedge.exe	102
PID 1760 wrote to memory of 1504	1760	msedge.exe	102
PID 1760 wrote to memory of 488	1760	msedge.exe	103
PID 1760 wrote to memory of 488	1760	msedge.exe	103
PID 1760 wrote to memory of 488	1760	msedge.exe	103
PID 1760 wrote to memory of 488	1760	msedge.exe	103
PID 1760 wrote to memory of 488	1760	msedge.exe	103
PID 1760 wrote to memory of 488	1760	msedge.exe	103
PID 1760 wrote to memory of 488	1760	msedge.exe	103
PID 1760 wrote to memory of 488	1760	msedge.exe	103
PID 1760 wrote to memory of 488	1760	msedge.exe	103
PID 1760 wrote to memory of 488	1760	msedge.exe	103
PID 1760 wrote to memory of 488	1760	msedge.exe	103
PID 1760 wrote to memory of 488	1760	msedge.exe	103
PID 1760 wrote to memory of 488	1760	msedge.exe	103
PID 1760 wrote to memory of 488	1760	msedge.exe	103
PID 1760 wrote to memory of 488	1760	msedge.exe	103
PID 1760 wrote to memory of 488	1760	msedge.exe	103
PID 1760 wrote to memory of 488	1760	msedge.exe	103
PID 1760 wrote to memory of 488	1760	msedge.exe	103
PID 1760 wrote to memory of 488	1760	msedge.exe	103
PID 1760 wrote to memory of 488	1760	msedge.exe	103
PID 1760 wrote to memory of 488	1760	msedge.exe	103
PID 1760 wrote to memory of 488	1760	msedge.exe	103
PID 1760 wrote to memory of 488	1760	msedge.exe	103
PID 1760 wrote to memory of 488	1760	msedge.exe	103
PID 1760 wrote to memory of 488	1760	msedge.exe	103
PID 1760 wrote to memory of 488	1760	msedge.exe	103
PID 1760 wrote to memory of 488	1760	msedge.exe	103
PID 1760 wrote to memory of 488	1760	msedge.exe	103
PID 1760 wrote to memory of 488	1760	msedge.exe	103
PID 1760 wrote to memory of 488	1760	msedge.exe	103
PID 1760 wrote to memory of 488	1760	msedge.exe	103
PID 1760 wrote to memory of 488	1760	msedge.exe	103
PID 1760 wrote to memory of 488	1760	msedge.exe	103
PID 1760 wrote to memory of 488	1760	msedge.exe	103
PID 1760 wrote to memory of 488	1760	msedge.exe	103
PID 1760 wrote to memory of 488	1760	msedge.exe	103
PID 1760 wrote to memory of 488	1760	msedge.exe	103
PID 1760 wrote to memory of 488	1760	msedge.exe	103
PID 1760 wrote to memory of 488	1760	msedge.exe	103

C:\Users\Admin\AppData\Local\Temp\MEMZ 3.0\MEMZ.exe
"C:\Users\Admin\AppData\Local\Temp\MEMZ 3.0\MEMZ.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3212
- C:\Users\Admin\AppData\Local\Temp\MEMZ 3.0\MEMZ.exe
  "C:\Users\Admin\AppData\Local\Temp\MEMZ 3.0\MEMZ.exe" /watchdog
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5076
- C:\Users\Admin\AppData\Local\Temp\MEMZ 3.0\MEMZ.exe
  "C:\Users\Admin\AppData\Local\Temp\MEMZ 3.0\MEMZ.exe" /watchdog
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5100
- C:\Users\Admin\AppData\Local\Temp\MEMZ 3.0\MEMZ.exe
  "C:\Users\Admin\AppData\Local\Temp\MEMZ 3.0\MEMZ.exe" /watchdog
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4136
- C:\Users\Admin\AppData\Local\Temp\MEMZ 3.0\MEMZ.exe
  "C:\Users\Admin\AppData\Local\Temp\MEMZ 3.0\MEMZ.exe" /watchdog
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4396
- C:\Users\Admin\AppData\Local\Temp\MEMZ 3.0\MEMZ.exe
  "C:\Users\Admin\AppData\Local\Temp\MEMZ 3.0\MEMZ.exe" /watchdog
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1652
- C:\Users\Admin\AppData\Local\Temp\MEMZ 3.0\MEMZ.exe
  "C:\Users\Admin\AppData\Local\Temp\MEMZ 3.0\MEMZ.exe" /main
  2⤵
  - Checks computer location settings
  - Writes to the Master Boot Record (MBR)
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3716
- - C:\Windows\SysWOW64\notepad.exe
    "C:\Windows\System32\notepad.exe" \note.txt
    3⤵
    PID:3220
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://google.co.ck/search?q=internet+explorer+is+the+best+browser
    3⤵
    - Enumerates system info in registry
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:1760
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x118,0x11c,0x120,0xfc,0x124,0x7ffcaec246f8,0x7ffcaec24708,0x7ffcaec24718
      4⤵
      PID:1504
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,9077044846740592622,9755671750117071384,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2176 /prefetch:2
      4⤵
      PID:488
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2144,9077044846740592622,9755671750117071384,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2264 /prefetch:3
      4⤵
      PID:1488
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2144,9077044846740592622,9755671750117071384,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2908 /prefetch:8
      4⤵
      PID:4600
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,9077044846740592622,9755671750117071384,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3520 /prefetch:1
      4⤵
      PID:208
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,9077044846740592622,9755671750117071384,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3560 /prefetch:1
      4⤵
      PID:3004
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,9077044846740592622,9755671750117071384,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2072 /prefetch:1
      4⤵
      PID:4400
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,9077044846740592622,9755671750117071384,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5456 /prefetch:8
      4⤵
      PID:836
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,9077044846740592622,9755671750117071384,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5456 /prefetch:8
      4⤵
      PID:4468
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,9077044846740592622,9755671750117071384,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4292 /prefetch:1
      4⤵
      PID:2008
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,9077044846740592622,9755671750117071384,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5164 /prefetch:1
      4⤵
      PID:5020
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,9077044846740592622,9755671750117071384,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4968 /prefetch:1
      4⤵
      PID:2432
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,9077044846740592622,9755671750117071384,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4232 /prefetch:1
      4⤵
      PID:884
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,9077044846740592622,9755671750117071384,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3796 /prefetch:1
      4⤵
      PID:1556
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,9077044846740592622,9755671750117071384,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3784 /prefetch:1
      4⤵
      PID:4148
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,9077044846740592622,9755671750117071384,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6028 /prefetch:1
      4⤵
      PID:3448
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,9077044846740592622,9755671750117071384,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3128 /prefetch:1
      4⤵
      PID:4404
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,9077044846740592622,9755671750117071384,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5940 /prefetch:1
      4⤵
      PID:1044
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,9077044846740592622,9755671750117071384,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3612 /prefetch:1
      4⤵
      PID:2940
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2144,9077044846740592622,9755671750117071384,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=1728 /prefetch:8
      4⤵
      PID:4536
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,9077044846740592622,9755671750117071384,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5920 /prefetch:1
      4⤵
      PID:5628
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,9077044846740592622,9755671750117071384,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5868 /prefetch:1
      4⤵
      PID:5600
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,9077044846740592622,9755671750117071384,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4208 /prefetch:1
      4⤵
      PID:5612
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,9077044846740592622,9755671750117071384,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6060 /prefetch:1
      4⤵
      PID:5188
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,9077044846740592622,9755671750117071384,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5040 /prefetch:1
      4⤵
      PID:5148
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,9077044846740592622,9755671750117071384,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1144 /prefetch:1
      4⤵
      PID:2436
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,9077044846740592622,9755671750117071384,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3936 /prefetch:1
      4⤵
      PID:4744
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,9077044846740592622,9755671750117071384,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6620 /prefetch:1
      4⤵
      PID:1092
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,9077044846740592622,9755671750117071384,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6756 /prefetch:1
      4⤵
      PID:5836
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,9077044846740592622,9755671750117071384,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6508 /prefetch:1
      4⤵
      PID:6120
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,9077044846740592622,9755671750117071384,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6588 /prefetch:1
      4⤵
      PID:4856
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,9077044846740592622,9755671750117071384,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7092 /prefetch:1
      4⤵
      PID:6000
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,9077044846740592622,9755671750117071384,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3768 /prefetch:1
      4⤵
      PID:5532
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,9077044846740592622,9755671750117071384,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6668 /prefetch:1
      4⤵
      PID:3068
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,9077044846740592622,9755671750117071384,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7400 /prefetch:1
      4⤵
      PID:6088
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2144,9077044846740592622,9755671750117071384,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=1148 /prefetch:8
      4⤵
      PID:5128
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,9077044846740592622,9755671750117071384,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6088 /prefetch:1
      4⤵
      PID:5156
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2144,9077044846740592622,9755671750117071384,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7080 /prefetch:8
      4⤵
      PID:5140
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,9077044846740592622,9755671750117071384,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4916 /prefetch:1
      4⤵
      PID:1032
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,9077044846740592622,9755671750117071384,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7876 /prefetch:1
      4⤵
      PID:4992
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,9077044846740592622,9755671750117071384,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6336 /prefetch:1
      4⤵
      PID:6028
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,9077044846740592622,9755671750117071384,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7752 /prefetch:1
      4⤵
      PID:2872
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,9077044846740592622,9755671750117071384,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8164 /prefetch:1
      4⤵
      PID:4060
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,9077044846740592622,9755671750117071384,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7904 /prefetch:1
      4⤵
      PID:5996
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,9077044846740592622,9755671750117071384,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5856 /prefetch:1
      4⤵
      PID:2296
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,9077044846740592622,9755671750117071384,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7956 /prefetch:1
      4⤵
      PID:5312
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://google.co.ck/search?q=minecraft+hax+download+no+virus
    3⤵
    PID:4124
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffcaec246f8,0x7ffcaec24708,0x7ffcaec24718
      4⤵
      PID:2068
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://google.co.ck/search?q=bonzi+buddy+download+free
    3⤵
    PID:5364
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffcaec246f8,0x7ffcaec24708,0x7ffcaec24718
      4⤵
      PID:5536
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://google.co.ck/search?q=virus+builder+legit+free+download
    3⤵
    PID:5428
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x118,0x11c,0x120,0xfc,0x124,0x7ffcaec246f8,0x7ffcaec24708,0x7ffcaec24718
      4⤵
      PID:1776
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://google.co.ck/search?q=how+to+create+your+own+ransomware
    3⤵
    PID:5192
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffcaec246f8,0x7ffcaec24708,0x7ffcaec24718
      4⤵
      PID:5912

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1596

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1284

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4320

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x4f8 0x3fc
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4172

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5984

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3444

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F59A01A8B782D93EA6991BC172CEFFB1

Filesize
867B

MD5
c5dfb849ca051355ee2dba1ac33eb028

SHA1
d69b561148f01c77c54578c10926df5b856976ad

SHA256
cbb522d7b7f127ad6a0113865bdf1cd4102e7d0759af635a7cf4720dc963c53b

SHA512
88289cdd2c2dd1f5f4c13ab2cf9bc601fc634b5945309bedf9fc5b96bf21697b4cd6da2f383497825e02272816befbac4f44955282ffbbd4dd0ddc52281082da

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F59A01A8B782D93EA6991BC172CEFFB1

Filesize
242B

MD5
3020c0a8f068cc2385f34b6c8bb7e9a4

SHA1
1c91b25a228f2a5f84ecc6a1f1f5afa7e83ac4a4

SHA256
227d27c468a70eda0c3415f164b20514ad1d760245bd320579560b9c46f8443b

SHA512
bcaeeb4c2a086f81c7e0a13a0e7df53ef3d07276ff46d6eb50881d3672a6f311eca4b7885c382497cf36e706437b7fb8938b832174842ebaa56a5fa0d46b24b5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e494d16e4b331d7fc483b3ae3b2e0973

SHA1
d13ca61b6404902b716f7b02f0070dec7f36edbf

SHA256
a43f82254638f7e05d1fea29e83545642f163a7a852f567fb2e94f0634347165

SHA512
016b0ed886b33d010c84ca080d74fa343da110db696655c94b71a4cb8eb8284748dd83e06d0891a6e1e859832b0f1d07748b11d4d1a4576bbe1bee359e218737

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
0764f5481d3c05f5d391a36463484b49

SHA1
2c96194f04e768ac9d7134bc242808e4d8aeb149

SHA256
cc773d1928f4a87e10944d153c23a7b20222b6795c9a0a09b81a94c1bd026ac3

SHA512
a39e4cb7064fdd7393ffe7bb3a5e672b1bdc14d878cac1c5c9ceb97787454c5a4e7f9ae0020c6d524920caf7eadc9d49e10bee8799d73ee4e8febe7e51e22224

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\638ad1d4-a3c9-4889-a6fa-f63fdfdf384e.tmp

Filesize
6KB

MD5
f0313af1e3899ca7345c88b6d0ebfa2a

SHA1
1e945ca5ac5cdb71ede8723f356f9b31af6bf3c6

SHA256
55ee755d9f158a5d5d2fc35fc5dd89a62f8de01d05e6a9ed17bf8b1763614850

SHA512
24a09c029d64edc2b5b1271bf0d859ce58dfa2ef07d7de4153b99ec2b1b421851699533018733ebb30c97b68a4c3e0a8d48308e56ddfa019f207ceb9dc2714d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000001

Filesize
195KB

MD5
89d79dbf26a3c2e22ddd95766fe3173d

SHA1
f38fd066eef4cf4e72a934548eafb5f6abb00b53

SHA256
367ef9ec8dc07f84fed51cac5c75dc1ac87688bbf8f5da8e17655e7917bd7b69

SHA512
ab7ce168e6f59e2250b82ec62857c2f2b08e5a548de85ac82177ac550729287ead40382a7c8a92fbce7f53b106d199b1c8adbb770e47287fc70ea0ea858faba6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000006

Filesize
20KB

MD5
923a543cc619ea568f91b723d9fb1ef0

SHA1
6f4ade25559645c741d7327c6e16521e43d7e1f9

SHA256
bf7344209edb1be5a2886c425cf6334a102d76cbea1471fd50171e2ee92877cd

SHA512
a4153751761cd67465374828b0514d7773b8c4ed37779d1ecfd4f19be4faa171585c8ee0b4db59b556399d5d2b9809ba87e04d4715e9d090e1f488d02219d555

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000a

Filesize
74KB

MD5
8df64f08312fc0ee3a80b8358ff94c4e

SHA1
55688d2fb73a0125518c0ccabeddfff6d3c4ef25

SHA256
3feaa14533284f5713f8e2d85145f453186a16574ac7e47bec897c72eb2f7096

SHA512
36ae9ee70558e1f94579905532f646277bace1ba80a1f292b5a284099296031588c2bcf62e7515538ebcfc84db9af7b9e90a3c615cf2f4a8bd59c2b5a8c2ce65

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000d

Filesize
40KB

MD5
d2d0c427f1d093c36a9fd6751a9a9d61

SHA1
dbd596ab1f2256ed3e3816be5eeb75d34f38f821

SHA256
b37bce0e0f504a7b54d3a01007169d4126c2a401be8f93afe35f665e62c3e34f

SHA512
b8418e074df9619ae62461b5c42fcc42d2ffb8b099e09ec0271bb481f8e1ad8d7655fd5149d8abdbce1d35226029f200623574946d6223df1c9c14c7824d63ca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000019

Filesize
212KB

MD5
dccf12096bb297369451afc6db16a236

SHA1
571bc48377a985f63fc7899142a7224e24aa4c8f

SHA256
7715812d50fd87d35cbcb910abad64fcc94360346e7728011c71820c8bc73a54

SHA512
d14341f35d251ad4870d686a810feba0c1b802e552c13a050f34af51aa491645d4cad9dc72a8d664a567844d54ff758c09165e41f8cc9c9a03966dbc91efe8c1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001b

Filesize
31KB

MD5
e9fec90d4af8805b11e69a53eb21aca8

SHA1
e546322eb933862fa653f20fd4bd38bc6c3375a1

SHA256
e3801b7cfce7b9fc9ad44dc8569bb007c4cd934fdb7b4c3fea8c23a79e4775b6

SHA512
9ee5f9f118d869b2f7ae5d30903cc081710a7fb2f3912fef3bc178e6ad9bd3556f227fc6db940def5049f855938ebc4e2d4d855afbeac5b1ef2305642f8a7b95

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001c

Filesize
33KB

MD5
1862a084867804c6446e31f801a6ca10

SHA1
9f0addd7e5407ad6adc297d83e71864bf5d234ef

SHA256
fddbb692490ae3a98abc3505688261ed1d9de4440367b2b83dfc26237dab2637

SHA512
110160df85746bedc1b5c56c9837a0e6850f47b27b18b804077179821932ea5e4317d1e42407304d3b96f9848504f0ca879c02030510f509d6409285aa90d144

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00002d

Filesize
26KB

MD5
086122a4bfb7a51510e3f0f0358446c2

SHA1
409d7940193c0a6201fb28376f9ca1ec4e09d979

SHA256
3c982a4b7283f4a728760190c40feaef16cceafab2f04f372c7848ff1b65c270

SHA512
1db1eb3cc8fa2fea162297b95d6f9d5fff99d2ddecb2e5a70eee014585f6c51550816dff2b295aa268e7040c5414c89c6c7d45f0c924a612dd98ff4e7974c309

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00002e

Filesize
30KB

MD5
e4894b6743a33cb43f5bdf2f8a92a3ef

SHA1
30b2f7e89b0c05b3efdced5b397b898c3f8e945b

SHA256
b9fd347194d8f8a15898952230c6875bf39d6e2ba8f7482a71a7b42010b7ed2a

SHA512
322970dbdabb8aa37ea9ffecc5ff6036098b14a0d77b2f83d3926a78e0959f6efb0e3c5f84b1f5e35ae2a27b36239a9ff01b1f0f146334f9d99918948b8d774b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00002f

Filesize
41KB

MD5
2cf73d6372138886b3fe37499042ee06

SHA1
f100a28ddcaee59fbd68d2a9dbcd6dc457c44acf

SHA256
a97a5fa1b435ab5ba24b31ede74a866e01e1228f3fe0cbe0110e70a35add8dd0

SHA512
28ceac572092b397be65b4008c4af9c80e76e8bcfa69b9cc697d70451a0564a4790feeb3597d875599811def22c086c80f87154e2f46d7985bed708e0dcdc630

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000030

Filesize
75KB

MD5
3feb0b100c4ae9cd32c996905392e85f

SHA1
2ee20584956b113e5348cb87059137f89aae3e03

SHA256
b926c3041d7babb2f769a5e64c0c1da6f8ce56143ff56db7f36f2a007a54f62f

SHA512
0a6ae399eb588d927c0003db73c68be3edece7eb7f280e4579453ec8ee0ce7f9b48aab4f8e333b07184c66ce59050f557fa67e9e83fe856786c2ae68d903d13b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000031

Filesize
49KB

MD5
75bcff289cf74add9a55dcf623c8d6d0

SHA1
029b3e84a844b980407f523c2b6f1383bd2a4b79

SHA256
b492a5740dc2ab92548ebdd53b689b9c7232c3988add4e94d7242a32e976c604

SHA512
1f65cda880c57f19caff9ff99d549e560010432428ade2a516f9d5898e62f875f44faf3534626923b8dc757c61b8f09643ae93149c7162a9299fa244ca71fbbe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000032

Filesize
49KB

MD5
b48dc30285baf341a5b2c26b0fd31c40

SHA1
d6b1ffc3b6ca8840a040757666385c6c32eb428b

SHA256
de713d9d1a539bc93c55c3b96344be41d3b29e5081e7f572b593cef06f6a2795

SHA512
901707012ab143e5a910d05c95f330f2f244a5b2521982f52f29d815d8b397042a8a3ae9f5ca77710468ca32c2da42a66e671725494cafef32e7370903117064

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000033

Filesize
94KB

MD5
d339a224190dd899ba99c94baf31e229

SHA1
f92d036468244790220ea371116b5b23cc2e2214

SHA256
22536a64481e41d2691509e8868d206a9f9f2dcad68b791762bbc03130c0620c

SHA512
382a4a8966c69085b787e3af8a689f6af8916f42e80b5197288110fb1cbed7e4ebb0969189598a210b5e976870cc756c169a5f318181f3643a3e65dfe94e0373

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000034

Filesize
30KB

MD5
50c773d89c84efbf2df5d22842a496c8

SHA1
f5128fdd5ccfae051dd2005c2bd026e163bbc5ff

SHA256
d7f2b849e164d6585a2ccec0686b1f8ca8b4de16f46590cca2c0a1f9343b23b4

SHA512
8480e7f8d7f8f4a9a3fc3f9f638c9472b3183a47a10aac79b763ebdac94ff9dd6e8027e48b8435d5175dbd160d1f63478c6f639a42356e5c33bc1ffc87ded5eb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000035

Filesize
20KB

MD5
87e8230a9ca3f0c5ccfa56f70276e2f2

SHA1
eb116c8fd20cb2f85b7a942c7dae3b0ed6d27fe7

SHA256
e18d7214e7d3d47d913c0436f5308b9296ca3c6cd34059bf9cbf03126bafafe9

SHA512
37690a81a9e48b157298080746aa94289a4c721c762b826329e70b41ba475bb0261d048f9ab8e7301e43305c5ebf53246c20da8cd001130bf156e8b3bd38b9b8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000038

Filesize
19KB

MD5
233bac65b1e572d177982c004427b11a

SHA1
ff3e3b78ebe6738929314282b6539c254cacdd41

SHA256
1083412d99a19f9037474da7547c0c3b708dfcfba94f8130f194dccc18bf929a

SHA512
8e39f2e028dfa55caedd2b19ceb0f0193a60afefc1e7025c6a2b61d23329c537df8ed35370ecf89d175cbf31a503e1d0acebaa0b68b98b4eaef40ba228f826d9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000042

Filesize
25KB

MD5
75cbe49261ae403f5006766c6a7fd3f8

SHA1
fb807606dfd3de1cc199d3db1c9c1d24c7556cc0

SHA256
17ceb4e5448c0f8b0c07c4aba7ba5b3901e50f1164962e31720572984b9bd080

SHA512
6247e860b5e3dfa901e324c93c4cb6b0c159a0ea701614ee5ab86c2c2be34648517f96a7d4b6213556de47757396d86864769099daa1bb358faf8546d8a14edb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000049

Filesize
137KB

MD5
d75040631e76e960582d2ab1db9d527e

SHA1
225dc00d740d5cb6d53b83cf69917aef7a6e2272

SHA256
c2ce357d60c7dbb3dee6b356cb50cd5b41935835c21c6b713bd9ee5058f5656a

SHA512
9c4e1660b21f0845ab4053c5f662f050081758712909fa4674c08a1c3707560fedeb1645dbe795b12c26054e57966b71b002ace107c50eedd2eed1df42d4932e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00004d

Filesize
339KB

MD5
b3d3c5d605893aa2033618fa9d741bb7

SHA1
4e527ea90d05c35857b7a5ae9e48ce92705ce87d

SHA256
8e30eb629e6c780ee78cb3d7c1426d263c4c8edaa87319ac5ee5ac4ab1f14a18

SHA512
75266ca5741653b5debfd8ff4f962eeaf4e5c6b9678fb2c66e383ca49fec2bd92e09754e93edc9b51e3a125c08fa417536bd4294bd0db1ef7ad5276ff54d6a13

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00004e

Filesize
131KB

MD5
eb91cbf654b0d2e11a364985fd2091c8

SHA1
92b1d974f4f4394452da984ed1c8449fab8b7301

SHA256
c8462e898d89720d9be0b8491eeae589f69b9b308cf8d0b630aad6c58e7b29e7

SHA512
7db121030fe56ca52018d05a0fbe9998eec9f225ae6b21285668ef6f41de41fec2181e9a63bc7dc46fb8564a00ce1c65b0a5efe3adcb0194fa2a2bdd9450db3a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00004f

Filesize
147KB

MD5
037dba406a60591e2c3d8d89a326b2fe

SHA1
4b5e5a30c89f9b4155ca785cc2f2426b6c5fdbf4

SHA256
a7a9974b4e18ce3ed2a044f5719b91fdc443dfddc147920d7124d50895d2d8e4

SHA512
47251864d397da04b3d6e7774b3a7c2644336bf85740357eed8c06cc91e92f58eca16c7eb9c1deabd582f9f29451936d61e888eee74f9720bcb85ca5b33f0a94

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\0f748faa296b276a_0

Filesize
116KB

MD5
899c03fd04df5a4868ac9021a542169e

SHA1
a5de9daee4f431a2ea51b6418c7240b8530ba729

SHA256
bd70a4dc27ac120982d33e56ee7f0bb49d5ec8dd7bbc4b31c26a1acaa2c297fd

SHA512
a1dcdac565646765713904afb3dc9581981b9b035f22a21dfe001d6aa77ae92725de78e0bc623b138b5ac9c52c235c413caf4ecaba04d5e531edaeacb60a0ff3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\4cd41b4521df34f5_0

Filesize
248B

MD5
3a286a0e336a0304cf0b788d723cf4b4

SHA1
8ec9c34bd598f6022a052a8f3f6ae1bc8fe63225

SHA256
c33a536544f6b2221bd1d19a7d946125be93e8622d421bb79bec1ba900142fae

SHA512
909d3ec63a9858dcb96326ba1eb0c5667f7fa71d35dd4c0db0c64aa491c8f067ded04a99a2e8446fe7de60bb6f5b16f43e9aee9da273b50327d6e3deeba0bb3c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\5f0d04b583af008a_0

Filesize
279B

MD5
956306b5a82a8d8341acb6beaa263513

SHA1
af2db3a6021b9aa74563b17fbd2e3075478f6c27

SHA256
627a7ab0bf87ca778a5c5ca208f8918aafd4206c79100376b2e3a8743510ae56

SHA512
49e4e5b1162c7bffaf1c1726c0071d707914065a4a4e13f5f4a02379c593cf35443afb456b04f54cd10e63b14c002fa8dfb74ccd388d594c874d555029167dd0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\7dbd20317bdb269b_0

Filesize
259B

MD5
8ca3a7cac9e3cec36d6629b6311e05e5

SHA1
f98c677c5ec9c6b463f9bb3742761b041b7293be

SHA256
5678bb563dcdf596d429cd07b2a2350fdcc67be3b39867532b1dd4bd85aec4ba

SHA512
51921ac350ac54518c398294de6f3c13440c92fb56040c4ba9235726270cf87ae9dd9c6e89760efca9e41ed2494841bb24b613470e04a2222fa56d71f69cabb3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\8177d9fd5c140ce9_0

Filesize
79KB

MD5
4f5eb04a89acffb4256f4ed5f6d66066

SHA1
bd6b736865c2fa92d92c7dd1730d61659ed35ab6

SHA256
1b345d24d6ff37422f319dc84095a9f3a120c827bc2c035dd206e921fbf0a379

SHA512
32aa3cb5197fd3862ac88801617ce010373b1b2da6bb8c5f3acb551414a92a5d99f110319f676dd89a2259e06b9cab8e6dc80081eb1548693ec973bd91addc8e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\94da36f4fdea10d9_0

Filesize
251B

MD5
6c70d7cba17804b3bcf65c0fe3108db1

SHA1
b8271681ea9f59c77c7a76ca0c8896e455a9b572

SHA256
b8ae802b1186115b97c5dd51c6957289e58c063f1da8104e7e61c573e6a5b993

SHA512
c027936a89d890c152f655b2732de03d58d9c3143f01f0305ba6c5b1dacb242364153d82ee48dff15b19b03c0d663fff33a1cfd9540ca1e983e4844639183d56

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\991efdbd338d7c88_0

Filesize
188KB

MD5
d8f682b098175142f19ab6f5266ba588

SHA1
8fa1f917ad113ba6ed5dd6130dd6a19a0c917a50

SHA256
3a028e26b6332d2b58eb5ee370355b4f996e6384e4c27283e55743b7fe67be72

SHA512
0520e1c883f9b4d64b7e5cdb41bdef0b93d2ec2cd12c23bfe502d5e317dc6fa72cd9bec74829bbf91b8d57dc5d038c00e48c0ae5dada84485ff049effee87175

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\c8563500e3fa4308_0

Filesize
304KB

MD5
363e99c944c87da9f8c6d2d3970e83c9

SHA1
30f5907c931a6194735ed65b6c0ea18908b5d6e3

SHA256
adfba318d29d50eea5e0996020a2ffffba49cc822fd06c1e189afd7c5b1b2e63

SHA512
d1a705d4099f77a6a47d73c1071c7774529cc0bb610c9231fedf19de3dcdef86efcffefc1561d7762f716d39ae5863e11209bc811f6bf90154feef38a20b76ea

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\cb146dbcede583ab_0

Filesize
445KB

MD5
b21ac12d980af5090206ca75e37ea28d

SHA1
5b93fe50fe0f7d5b1acf30935f39ddefbd334ddc

SHA256
70e687c7104a3024987eb2d58d79531a7517400bdc60a0d2a200a23500758fda

SHA512
6fd8267889a30e811c1d371b8e4cd1d07366a047ff03c27029803b0af1e5e0c9712911246c117a8d6672df54adbd8f89662f6476b9138e0136acd8a7ac9d6163

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\d4b473d40717e3be_0

Filesize
299B

MD5
b0f8c289653a5f8c6158bbf39b1efddb

SHA1
db54061e594f0cbb8c8cf42e8d8a263fa06a14f3

SHA256
b19c7786f3c90e733b147e3e1489cd5e7c7a56a1cd8a149415bb1ef5ed6ce2b1

SHA512
81a98ab6383675c42a9689e1debdd8e3978b52356c5ab3130173dc02492e53cd2bc3ae71cf3bcac3f738aec939c1478f4ccf35f46b4e1a90f140d77274bdd6b5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
6KB

MD5
288728f5a2f2fa1836b15926db5b8052

SHA1
e5f93bc28750961950ece3ccd12529c249ff8ea3

SHA256
fa308554015b0f82b55527fafb3d8e76d18acda6ab9e96d9fe128fc7c37a0e63

SHA512
8eef3fa63bf61f5b8b8de4f0c2b36ca812bd7b3e045a37e4d8f6913a0076cb219b392db406b953a91b207b89000d6e7d4af7eef6847e8aba849a4e7521d0abd9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f16c9f0760d38ecadccb4c2df102270c

SHA1
a8d23c193d5e9d9edbc2b0317f2ecef6a1015446

SHA256
261afafee26c028e762913c57ed84b86a1600e7f4e495c5dbcd94958b9ed03d3

SHA512
16f37a2dd8a8b03e0284523856921467b882e45f6bbfdff24bc6c8c6a28e645e770cd17ffc6d47d14189ce53169dcd10c7ace05bd9de93a8f8c32690762d0e2b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
2b251c9506bee4ddc571b1062eac0f9f

SHA1
d9a4bf76342be031c378ca52c3398dcfd5663fa6

SHA256
d6259b423df41300ff7470f71d739b41383842c58aee1a3b6a7ff38db7e8bc48

SHA512
3b280d3de0413f5bff3d7fbccedae2fa374aee4093daa510742477e75cac915cbcf556acda3bb6816fef7f34832b0604a625183267c455138b9816dfc47fccce

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
5e3fb42f825c69e9d1a7aa45ac53dc64

SHA1
19c07a90e7a3b05f2b5776911b265be01418fe7e

SHA256
9da374be412beb3819409d100bc9040ced1c362a80b80c1d37c6d0ab03641bde

SHA512
609684fdd7b059e0ac404718f824c5356266887bf9d9dd1af51c6fac553314676a24ff82a6723deedf7b65bae8d2d41b887981f1b48a50083128d0378ceca176

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
10KB

MD5
4b9421b38092dc4cae3a1278d109858e

SHA1
d2daa5713286ece9da27365b2f1860dea1798b8d

SHA256
81f1a5ffa9e293c1cd086f74f8cff15784abbd73a9938fd01bf5ba014ba61e26

SHA512
ceadd1b165cc61a02594e208058d505cb2010cc0aa4fff47246b14ea349c80c872ad8a97d501c6793d5b621ff6d2511fa570db3de2f80907a55fa1c4d039ca5e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
12KB

MD5
72e87d5292b5f997cf8b6bccc8407141

SHA1
303e6e6c91740532c1853225ffdb43deba98756e

SHA256
fd34d3630bda601ab1b02ac3b1c47979c07c409de9027563dd0d08f5bdfcfa80

SHA512
e6e323998fb69d99bdfaf88eb0162d991e8fa98f00f16f11d5b7f3d168afa2e0d5105d8d0f383f534cc5955b5f9ccb19a2a3b8a7a5ccbdb3befe487f9bbcdfea

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
11KB

MD5
8d839882a0529dbbf26e64de2d0e8a46

SHA1
3c3da5dd5db4c4d1c24e8cc86c6693b5ad81af7f

SHA256
521e09afa9eeba326a7a6a92bc40d97ed9796d591f9697bbfd128e0f8dc8fd3a

SHA512
ef04ad1ab5ce08b613992fdef78d632a5b2a35994a7d92d823dd58cb7a74f84f4a7ecb13c62a12796552bcb8d98e07733f314946765c09bdae06d3573d9c8266

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
11KB

MD5
6da387246256e739eecea7b8f5de20dd

SHA1
d95ff04c7f4c8c2b1ad21d313470378107602bf4

SHA256
71c9cd49724b4d2376d052daffa1e91b475390c62fdbabe2264da393dcd0b868

SHA512
ca858f49c5cf73baf9519790212dd45e5e7cae44faa8e2837d73d2ff2a7714e6fc6413015352112d08ce3ba8d784ebd22631ba449b2e09e9e2a790d2aff16a60

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
11KB

MD5
ef316cc0f7f017247b247d2d0ef16c5e

SHA1
8fd35567cc498023f78de5e84ce270f50ea671e3

SHA256
540e6df35a0c917a9c4d3a133005887a3fea57c1ebc13fc30e0d9bdfe26ee16f

SHA512
6760573a2c474ee49fad6f05c81a103c8aaeeeccd6e287c0bd6b3eb5f37a01ac7295b9b33b4d7453d09f3062e6c00fe5f6d416e83766a4f6c180006121186545

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\89ab4016-65a0-427b-888b-9824f3eb943c\index-dir\the-real-index

Filesize
48B

MD5
b79e6e7f585fedcbc253c2cecd4617a0

SHA1
2524f51798f655108e3c17498576498fee4b8ed3

SHA256
894ccfd8bcd6195ab713925877a35e4b6102da6227ce570348b64a5014d9550d

SHA512
a4d30977957c9b26e14cdada2e7c2904615cd92ebf709582d1b3e6229cf4afb99cb49638e952bd64c119685bbed382de7463f31a29750f55bb4ec058b392cf54

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\89ab4016-65a0-427b-888b-9824f3eb943c\index-dir\the-real-index

Filesize
2KB

MD5
aaf2e5e65637ffb25ac571d06b2dff54

SHA1
86a95203f0edaef02a124c0762404d817512a161

SHA256
c792613473ca935d3010f7e3281f5c6cd1f2a71027416f62f418070511657d57

SHA512
b347b9b017aa177553c797c5dd37881a96526f4f033e005f1678d53a6e29dcbba51c2e6544acced1195228f43482d29bb1fde829c1bb6f525eddf917ec79d8d2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\a8a6f1db-ce27-4ec0-a7b5-289a25bb039f\index

Filesize
24B

MD5
54cb446f628b2ea4a5bce5769910512e

SHA1
c27ca848427fe87f5cf4d0e0e3cd57151b0d820d

SHA256
fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d

SHA512
8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\ca577276-623c-4d0b-8336-3dc3d4d66973\index-dir\the-real-index

Filesize
624B

MD5
de76edc37272e988f37cf45ffa0079d1

SHA1
305d1a90c6f038adf85cf29210c623f120c14a05

SHA256
9e98bf1866aa7017498487b4186a73623d2aae21d8724532c20075daedd595d6

SHA512
092811c2998bb28c6d67fb85d76808aa50663553622f2ffef0383c8539f649bd63f839d9a685e7dce94b1aa79b0035fdf1f71045518745f0fe218e82faa736d2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\ca577276-623c-4d0b-8336-3dc3d4d66973\index-dir\the-real-index~RFe5902a6.TMP

Filesize
48B

MD5
cef28edafe69b63b4a5ec3907aa55728

SHA1
495031e29ab2fe2bcca2b5d030ddc193b38d5cc5

SHA256
3b5c804ca5363ce48ff30744f8409f20e18a7aa31615f8141575f9cdbf2f110e

SHA512
3081f79f23db5ca425385a139f4dc19af09a523d917f11d5590dc6ebf140ec63a0d4a6dc625c31b1fc07e9ec4ca91c7ff59a4c981d9203394be9f9edea1ea546

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
89B

MD5
82243f73270ede96000ac70360fed583

SHA1
8f1e91035a57cc0acfb65c94d4bd3201f5229619

SHA256
0ea873224125f7306a4df5f873b473b6b539580405c9e41f7199e4684b5192b2

SHA512
a87e858e7f456456ad4f8cccd66303f9576c931602ad3803b5a4495e8d4b867f13abb2080eabca9874bb97a7b917c59fde1130a3d81e006f807196ba55e5981a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
146B

MD5
bedb6f882387226112e0ced4a0a267be

SHA1
debd9ff29332f4dad367be1c25dc0a39dcb6161d

SHA256
74032f7863b3253cd0468489fec35ed41055e1dc5c4ba82ae49b5c958cdf3179

SHA512
4129607ccb30bc08b9b31e47f900af14371213debde77039ae6703b709be2beff3893461bfab3e01bac2b6d2723e1a83f49488e33f1d986b0fcfbcebe7ded547

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
82B

MD5
6cb5b6d832f76abf73940a8fc5379c22

SHA1
14ad7fc4788a39f8e4488cbe49df9b774fb74043

SHA256
544e72a4bdc234400f251e8ea9398fca82b6775ca9b77bce9b5ababbf90571bf

SHA512
55cbe52e11102c116175ea2156ddf7bf84acf17ecf1084d97983834242c7fadf195a40a526202f116c18b6e28d4eb51dafe46d7ec37cf152c80ff70cc21fdfb4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
146B

MD5
0461204b205db0ed99c95987b13ac6a8

SHA1
9605f47cb82268adc16b3371398e29cee0e037f1

SHA256
a3b48f3de8c33514c62c52f20a6bd16755338dbd5b2f344894a9999df659022b

SHA512
512fde4c6bda790483dc4a4740cdf3becb0bb4e743a9a8317df06f97aa163f54adff53b73962ea0c70ef3007e44750e1fbecf83246ec82ae3df8dab7e641f798

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
153B

MD5
de184383987860faa2a66681ecc5608b

SHA1
633f6d9818ba810976a57a6864ddc188b73aeb61

SHA256
969903bab9ebb19d8a08e9fbf11e83600edd96382e91c3fcdc6be603b533c3ae

SHA512
de20744c0f598db32bb6116ba5e41461aa2475904a06c171b57a57d87811965a54eb0a6bae1ebc8a846b3989a4b3f5808e06cfc53850993a0dc63cfe6eded94c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
217B

MD5
c7812e171b10704223c7da2e945fa67d

SHA1
49e188a332e0fd564db0b48fe386afa44f82b963

SHA256
f356a1784ea47313117d64dc9666635fa8ac04a004a6f0ce5f36e3906a1c9c59

SHA512
60228826db11be1214a023d297d23df94b09aaac56adc473d7c4244b646dab0e75dfcbcc9427f06e99dad8d72dc2f48a948b3127b07cef6609897a05f77474dd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
155B

MD5
d8aea27dd88c7c1cdbbdd0b0bb65f5cb

SHA1
bbc609bba72d2c33a58431ada294cb0638fcd535

SHA256
3a3110c312002aa7daa895fa74194dc358aa10e1bf379723fe477ef2080f50f1

SHA512
b6cc4205d440d9b80de712873e82332a128040ae81a8a14a512dc7734de7b3a336d2ed10a8d222cb6104ecc58e3cde1cf03a0ed17fc507c45a0542bd8fdf8eca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
96B

MD5
d1e13f5fcd86d82a1aaa417ef48715f2

SHA1
d7d0ab43f6fa423708b673e4c1424c8abb421cd2

SHA256
193e789380fe79cae25e947349c8f4746219b5b88aa39a0b3da0c5100636d227

SHA512
cf04805ba748d02b302a05f89a94bf3f8696d483c020c45971fc04ac982893187bd07cda7f118799fd4fedd6056905b4c47244f75a3662c121d566d93250cb54

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58e72f.TMP

Filesize
48B

MD5
c9c928d63de4daf8dcdb7a59a84cbb39

SHA1
84287076d74ae5eb29b965093c9562aae91971c1

SHA256
4b5c0eccb6c567f7e99def730961d8472c6001eda4525ddd914745cd21c6d745

SHA512
39898e09ce86ce35adb7b519a54248e72ee9a5ac19a3f4ce27c6ec346e794e990d64484d502a1cdb0d8f4098b65ee2901396b0fdea72c91a717b3279e61c3eec

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
2be6030a08917549d938cf2157afb9fd

SHA1
680e7feea11403cb146f2914f9726e0ddb88eaf4

SHA256
0dad5247ee5b710ebf05f102dec7635e3718f3d36e8cb213b12b6bd1baaf3462

SHA512
5e75c5160697fcb790bb83a3fa48d7636f63422e9959c110f77c10eec9924bbff20abe464b9f4a894b0b5530c37c5a514586ddbf2d5d1a58e10cf5d54beaddc1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
207039edbd58e0a5a9f658e2db5c3159

SHA1
03e77d91040475d38644b848be0a4d5751c48b62

SHA256
3d27f963702c1ef208a92854c00c8fba9cfc046b71164b9adfd1e6201abf6088

SHA512
87815fd81db5152f029dec596bb0a6ba84357c32a901c4ff914e145bdd584fd6f85b21bc90c79c797b88d0b9ab4b77b5e60f239db6d5478d0406eab9b941276c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
9b787d78511d8e16588b8ad62d1da5f5

SHA1
ca78b1df900e71f321fc739d6b49a447b478042b

SHA256
11583b4a39f5b0d5b8feb98206f9ffde5b4d79cac77977d3279eeed8c21dbe0d

SHA512
bd8063ff99deda5526766b19f621cfbdd5a1c523cdf849c1740fc7808926f93720c977290f2960ae81d76d30b4238d8dac0a2ce14f67b28322b70e02ca3c2ecb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
707B

MD5
0531c24ca60cdf4cc755c1a369327307

SHA1
f4ddbbf2c3bc8dceb3b22d1bc91fbe66918cba34

SHA256
39136c14e1e72af1cbb2406c6cc6b9da64ddd33336d4b5c3e9735b7e10f34a75

SHA512
f2c26092f369f1b6a3b15658ddf71876e0d207e024be031aebca903f97b980524e193b074a0411707f2d794ca204aa866c183712187fe88e781c4fc64a4b7899

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
e305cf1d92852316cf1b218969be96df

SHA1
667e920649cbe1ec6847f0cf518a9226f7a79957

SHA256
5713d9f7a39ba2fa4feb08780c391adb5db4dcfa4632c5c3d8a14382140c14f0

SHA512
7028f452e03263d80ee6ed66877da61dc8f5eeec46cceef91875d32087ee9b0c3caaa98cbbd75059b0f0a71f3eef372daf79fb8a917a302531727ffb6747b365

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
86819626e8cf987fe09b8167043ad913

SHA1
0fcda1eacf39439e08788fb0f046da8870274f6b

SHA256
88b781c8e135dd6516ad92805f227f765ea8fce1698fd6aa20f9f626176b24a7

SHA512
f0053d6530df7604d3b191778ff185a40392533f0207e2966bf1f22c79f845bade6cd8448645a2eb19fbb55d59d39d70f655e52dac453e3ec97267b64779bc0a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe589ae3.TMP

Filesize
540B

MD5
853f0844168146dca58e1bfcf6b2b9bd

SHA1
2a2cf372b0687fa6a2528b4a29116a4e0179cefa

SHA256
d6d30f65a67a6a1150a1df87a80b122bcb0bceda7b9a3f559ef554a88b700968

SHA512
3cdbc13cf18a328db375f5bacce205f86f0a059950368ec9c380a0174e775f72d5a900a5b3de1061cdba12b2e238d360923b875ccd46a56a72cb0dc880a94c1e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
779f5a0338c934b12144e81466ca234b

SHA1
4c222b041c0dbbebf30ebca36d22976cb75c229c

SHA256
0b4d4f3717bcff723a42458499241e5e9302debe52e00c08d6acd4a06ba36c19

SHA512
87ec7ab736c49cbe2f080997f6c2f136f6816014ed8f7c5f52b6853184f2a3d379c23abac67e1c302b23b650fda811d2029116cc5a4701a9331a9319e275bf09

Download Submit
C:\Users\Admin\Downloads\virusmakersource.zip

Filesize
1.5MB

MD5
5f80837463c08177865a2165b0ddcb3d

SHA1
9a831df118c228bee59b0af1567c6c5fd13cbbbe

SHA256
473f5432be4bf1e36f0b2f7f33324924318ec6fb424b701619d00b9c28c1477e

SHA512
c23dd81f3ab3790d350d2f0135f527fbf4e7b72b41474cfcb859f0187d2d9c8cd724c661b57c250feb8274db267443169208db65ed6c284f1a9aefde07dd022c

Download Submit
C:\note.txt

Filesize
218B

MD5
afa6955439b8d516721231029fb9ca1b

SHA1
087a043cc123c0c0df2ffadcf8e71e3ac86bbae9

SHA256
8e9f20f6864c66576536c0b866c6ffdcf11397db67fe120e972e244c3c022270

SHA512
5da21a31fbc4e8250dffed30f66b896bdf007ac91948140334fe36a3f010e1bac3e70a07e9f3eb9da8633189091fd5cadcabbaacd3e01da0fe7ae28a11b3dddf

Download Submit