hxxps://s28667145[.]weebly[.]com/memz-download[.]html

Analysis

max time kernel
1014s
max time network
1095s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
26/03/2024, 03:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://s28667145.weebly.com/memz-download.html
Sample240326-ehgrjsff6v

Score

6^/10

bootkit persistence

Malware Config

Signatures

Writes to the Master Boot Record (MBR) 1 TTPs 2 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	MEMZ-Destructive.exe
File opened for modification	\??\PhysicalDrive0	MEMZ-Destructive.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5008_201573487\_locales\ta\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5008_201573487\_locales\pt_PT\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5008_201573487\_locales\hr\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5008_201573487\_locales\ja\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5008_201573487\_locales\lv\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5008_201573487\_locales\sv\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5008_201573487\_locales\mn\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5008_201573487\_locales\en_GB\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5008_201573487\_metadata\verified_contents.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5008_201573487\_locales\tr\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5008_201573487\_locales\zu\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5008_201573487\_locales\km\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5008_201573487\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5008_201573487\_locales\ms\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5008_201573487\_locales\th\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5008_201573487\_locales\pt_BR\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5008_201573487\_locales\fi\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5008_201573487\_locales\en\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5008_201573487\_locales\fr\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5008_201573487\_locales\sw\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5008_201573487\_locales\zh_TW\messages.json	msedge.exe
File created	C:\Program Files\msedge_url_fetcher_5008_251273942\GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_75_4_0.crx	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5008_201573487\_locales\de\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5008_201573487\_locales\te\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5008_201573487\_locales\hi\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5008_201573487\_locales\zh_HK\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5008_201573487\_locales\no\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5008_201573487\_locales\bg\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5008_201573487\_locales\es\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5008_201573487\_locales\fr_CA\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5008_201573487\_locales\nl\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5008_201573487\_locales\ne\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5008_201573487\_locales\kk\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5008_201573487\_locales\az\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5008_201573487\_locales\pl\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5008_201573487\_locales\sl\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5008_201573487\_locales\fil\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5008_201573487\_locales\pa\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5008_201573487\_locales\da\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5008_201573487\_locales\es_419\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5008_201573487\_locales\ka\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5008_201573487\page_embed_script.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5008_201573487\_locales\be\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5008_201573487\_locales\si\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5008_201573487\_locales\gu\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5008_201573487\128.png	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5008_201573487\manifest.fingerprint	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5008_201573487\_locales\kn\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5008_201573487\_locales\vi\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5008_201573487\_locales\eu\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5008_201573487\_locales\et\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5008_201573487\_locales\ko\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5008_201573487\_locales\lo\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5008_201573487\_locales\lt\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5008_201573487\_locales\ru\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5008_201573487\eventpage_bin_prod.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5008_201573487\_locales\ur\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5008_201573487\_locales\en_US\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5008_201573487\_locales\my\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5008_201573487\_locales\hu\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5008_201573487\_locales\gl\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5008_201573487\_locales\id\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5008_201573487\_locales\sr\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5008_201573487\_locales\mr\messages.json	msedge.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	Taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	Taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	Taskmgr.exe

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe

Enumerates system info in registry 2 TTPs 9 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\sud.dll,-1#immutable1 = "Default Programs"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\sud.dll,-10#immutable1 = "Choose which programs you want Windows to use for activities like web browsing, editing photos, sending e-mail, and playing music."	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\SyncCenter.dll,-3000#immutable1 = "Sync Center"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\accessibilitycpl.dll,-10#immutable1 = "Ease of Access Center"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\netcenter.dll,-2#immutable1 = "Check network status, change network settings and set preferences for sharing files and printers."	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\inetcpl.cpl,-4313#immutable1 = "Configure your Internet display and connection settings."	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\DiagCpl.dll,-15#immutable1 = "Troubleshoot and fix common computer problems."	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\accessibilitycpl.dll,-45#immutable1 = "Make your computer easier to use."	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000_Classes\Local Settings	control.exe
Key created	\REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\FirewallControlPanel.dll,-12122#immutable1 = "Windows Defender Firewall"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\main.cpl,-102#immutable1 = "Keyboard"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\devmgr.dll,-4#immutable1 = "Device Manager"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\sdcpl.dll,-100#immutable1 = "Recover copies of your files backed up in Windows 7"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\system32\Vault.dll,-2#immutable1 = "Manage your Windows credentials."	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\system32\Vault.dll,-1#immutable1 = "Credential Manager"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\RADCUI.dll,-15301#immutable1 = "Manage your RemoteApp and Desktop Connections"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\srchadmin.dll,-602#immutable1 = "Change how Windows indexes to search faster"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\systemcpl.dll,-1#immutable1 = "System"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\fvecpl.dll,-2#immutable1 = "Protect your PC using BitLocker Drive Encryption."	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\powercpl.dll,-1#immutable1 = "Power Options"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\netcenter.dll,-1#immutable1 = "Network and Sharing Center"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\autoplay.dll,-1#immutable1 = "AutoPlay"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000_Classes\Local Settings	calc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\sdcpl.dll,-101#immutable1 = "Backup and Restore (Windows 7)"	explorer.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1904519900-954640453-4250331663-1000\{03D8394A-2C13-42EE-8688-CE08931C06B5}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1904519900-954640453-4250331663-1000\{3E3DAC44-7678-4BE5-9CD7-AAD18455C8B7}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000_Classes\Local Settings	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\powercpl.dll,-2#immutable1 = "Conserve energy or maximize performance by choosing how your computer manages power."	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\intl.cpl,-3#immutable1 = "Region"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\main.cpl,-103#immutable1 = "Customize your keyboard settings, such as the cursor blink rate and the character repeat rate."	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\system32\appwiz.cpl,-160#immutable1 = "Uninstall or change programs on your computer."	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000_Classes\Local Settings	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\usercpl.dll,-2#immutable1 = "Change user account settings and passwords for people who share this computer."	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\srchadmin.dll,-601#immutable1 = "Indexing Options"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\autoplay.dll,-2#immutable1 = "Change default settings for CDs, DVDs, and devices so that you can automatically play music, view pictures, install software, and play games."	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\recovery.dll,-2#immutable1 = "Recovery"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\mmsys.cpl,-301#immutable1 = "Configure your audio devices or change the sound scheme for your computer."	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\telephon.cpl,-1#immutable1 = "Phone and Modem"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\system32\colorcpl.exe,-7#immutable1 = "Change advanced color management settings for displays, scanners, and printers."	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\systemcpl.dll,-2#immutable1 = "View information about your computer, and change settings for hardware, performance, and remote connections."	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\timedate.cpl,-51#immutable1 = "Date and Time"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\fhcpl.dll,-52#immutable1 = "File History"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\system32\appwiz.cpl,-159#immutable1 = "Programs and Features"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\system32\DeviceCenter.dll,-1000#immutable1 = "Devices and Printers"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\DiagCpl.dll,-1#immutable1 = "Troubleshooting"	explorer.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1904519900-954640453-4250331663-1000\{C1724AE3-481C-440D-A4D9-A1621114D00B}	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\Speech\SpeechUX\speechuxcpl.dll,-1#immutable1 = "Speech Recognition"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\recovery.dll,-101#immutable1 = "Recovery"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\mmsys.cpl,-300#immutable1 = "Sound"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\RADCUI.dll,-15300#immutable1 = "RemoteApp and Desktop Connections"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\Speech\SpeechUX\speechuxcpl.dll,-2#immutable1 = "Configure how speech recognition works on your computer."	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\usercpl.dll,-1#immutable1 = "User Accounts"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\main.cpl,-101#immutable1 = "Customize your mouse settings, such as the button configuration, double-click speed, mouse pointers, and motion speed."	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\SyncCenter.dll,-3001#immutable1 = "Sync files between your computer and network folders"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\fvecpl.dll,-1#immutable1 = "BitLocker Drive Encryption"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 03000000000000000200000001000000ffffffff	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\telephon.cpl,-2#immutable1 = "Configure your telephone dialing rules and modem settings."	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\intl.cpl,-2#immutable1 = "Customize settings for the display of languages, numbers, times, and dates."	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\timedate.cpl,-52#immutable1 = "Set the date, time, and time zone for your computer."	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202020202020202	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\FirewallControlPanel.dll,-12123#immutable1 = "Set firewall security options to help protect your computer from hackers and malicious software."	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\devmgr.dll,-5#immutable1 = "View and update your device hardware settings and driver software."	explorer.exe

NTFS ADS 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\memz-master.zip:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\memz-master(1).zip:Zone.Identifier	firefox.exe

Runs regedit.exe 1 IoCs

pid	Process
5236	regedit.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
2336	explorer.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
6060	MEMZ-Destructive.exe
6060	MEMZ-Destructive.exe
6060	MEMZ-Destructive.exe
6060	MEMZ-Destructive.exe
1144	MEMZ-Destructive.exe
1144	MEMZ-Destructive.exe
4180	MEMZ-Destructive.exe
4180	MEMZ-Destructive.exe
6060	MEMZ-Destructive.exe
6060	MEMZ-Destructive.exe
5560	MEMZ-Destructive.exe
1144	MEMZ-Destructive.exe
1144	MEMZ-Destructive.exe
5560	MEMZ-Destructive.exe
6060	MEMZ-Destructive.exe
6060	MEMZ-Destructive.exe
2940	MEMZ-Destructive.exe
2940	MEMZ-Destructive.exe
4180	MEMZ-Destructive.exe
4180	MEMZ-Destructive.exe
4180	MEMZ-Destructive.exe
6060	MEMZ-Destructive.exe
4180	MEMZ-Destructive.exe
6060	MEMZ-Destructive.exe
1144	MEMZ-Destructive.exe
1144	MEMZ-Destructive.exe
5560	MEMZ-Destructive.exe
5560	MEMZ-Destructive.exe
4180	MEMZ-Destructive.exe
4180	MEMZ-Destructive.exe
6060	MEMZ-Destructive.exe
6060	MEMZ-Destructive.exe
2940	MEMZ-Destructive.exe
2940	MEMZ-Destructive.exe
2940	MEMZ-Destructive.exe
2940	MEMZ-Destructive.exe
6060	MEMZ-Destructive.exe
4180	MEMZ-Destructive.exe
4180	MEMZ-Destructive.exe
6060	MEMZ-Destructive.exe
5560	MEMZ-Destructive.exe
1144	MEMZ-Destructive.exe
5560	MEMZ-Destructive.exe
1144	MEMZ-Destructive.exe
2940	MEMZ-Destructive.exe
2940	MEMZ-Destructive.exe
6060	MEMZ-Destructive.exe
6060	MEMZ-Destructive.exe
4180	MEMZ-Destructive.exe
4180	MEMZ-Destructive.exe
1144	MEMZ-Destructive.exe
1144	MEMZ-Destructive.exe
5560	MEMZ-Destructive.exe
5560	MEMZ-Destructive.exe
6060	MEMZ-Destructive.exe
2940	MEMZ-Destructive.exe
6060	MEMZ-Destructive.exe
2940	MEMZ-Destructive.exe
5560	MEMZ-Destructive.exe
5560	MEMZ-Destructive.exe
1144	MEMZ-Destructive.exe
1144	MEMZ-Destructive.exe
4180	MEMZ-Destructive.exe
4180	MEMZ-Destructive.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
5236	regedit.exe
2312	mmc.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 55 IoCs

pid	Process
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe

Suspicious use of AdjustPrivilegeToken 23 IoCs

description	pid	Process
Token: SeDebugPrivilege	648	firefox.exe
Token: SeDebugPrivilege	648	firefox.exe
Token: SeDebugPrivilege	648	firefox.exe
Token: SeDebugPrivilege	648	firefox.exe
Token: SeDebugPrivilege	648	firefox.exe
Token: SeDebugPrivilege	648	firefox.exe
Token: SeDebugPrivilege	648	firefox.exe
Token: SeDebugPrivilege	648	firefox.exe
Token: SeDebugPrivilege	3784	Taskmgr.exe
Token: SeSystemProfilePrivilege	3784	Taskmgr.exe
Token: SeCreateGlobalPrivilege	3784	Taskmgr.exe
Token: 33	3784	Taskmgr.exe
Token: SeIncBasePriorityPrivilege	3784	Taskmgr.exe
Token: 33	1640	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1640	AUDIODG.EXE
Token: 33	2312	mmc.exe
Token: SeIncBasePriorityPrivilege	2312	mmc.exe
Token: 33	2312	mmc.exe
Token: SeIncBasePriorityPrivilege	2312	mmc.exe
Token: 33	2312	mmc.exe
Token: SeIncBasePriorityPrivilege	2312	mmc.exe
Token: SeShutdownPrivilege	2336	explorer.exe
Token: SeCreatePagefilePrivilege	2336	explorer.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
648	firefox.exe
648	firefox.exe
648	firefox.exe
648	firefox.exe
648	firefox.exe
648	firefox.exe
3784	Taskmgr.exe
3784	Taskmgr.exe
3784	Taskmgr.exe
3784	Taskmgr.exe
3784	Taskmgr.exe
3784	Taskmgr.exe
3784	Taskmgr.exe
3784	Taskmgr.exe
3784	Taskmgr.exe
3784	Taskmgr.exe
3784	Taskmgr.exe
3784	Taskmgr.exe
3784	Taskmgr.exe
3784	Taskmgr.exe
3784	Taskmgr.exe
3784	Taskmgr.exe
3784	Taskmgr.exe
3784	Taskmgr.exe
3784	Taskmgr.exe
3784	Taskmgr.exe
3784	Taskmgr.exe
3784	Taskmgr.exe
3784	Taskmgr.exe
3784	Taskmgr.exe
3784	Taskmgr.exe
3784	Taskmgr.exe
3784	Taskmgr.exe
3784	Taskmgr.exe
3784	Taskmgr.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
4788	msedge.exe
4788	msedge.exe

Suspicious use of SendNotifyMessage 58 IoCs

pid	Process
648	firefox.exe
648	firefox.exe
648	firefox.exe
648	firefox.exe
648	firefox.exe
3784	Taskmgr.exe
3784	Taskmgr.exe
3784	Taskmgr.exe
3784	Taskmgr.exe
3784	Taskmgr.exe
3784	Taskmgr.exe
3784	Taskmgr.exe
3784	Taskmgr.exe
3784	Taskmgr.exe
3784	Taskmgr.exe
3784	Taskmgr.exe
3784	Taskmgr.exe
3784	Taskmgr.exe
3784	Taskmgr.exe
3784	Taskmgr.exe
3784	Taskmgr.exe
3784	Taskmgr.exe
3784	Taskmgr.exe
3784	Taskmgr.exe
3784	Taskmgr.exe
3784	Taskmgr.exe
3784	Taskmgr.exe
3784	Taskmgr.exe
3784	Taskmgr.exe
3784	Taskmgr.exe
3784	Taskmgr.exe
3784	Taskmgr.exe
3784	Taskmgr.exe
3784	Taskmgr.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe

Suspicious use of SetWindowsHookEx 43 IoCs

pid	Process
648	firefox.exe
648	firefox.exe
648	firefox.exe
648	firefox.exe
648	firefox.exe
648	firefox.exe
648	firefox.exe
5224	MEMZ-Destructive.exe
6060	MEMZ-Destructive.exe
1144	MEMZ-Destructive.exe
4180	MEMZ-Destructive.exe
5560	MEMZ-Destructive.exe
2940	MEMZ-Destructive.exe
3168	MEMZ-Destructive.exe
5124	MEMZ-Destructive.exe
2140	MEMZ-Destructive.exe
3332	MEMZ-Destructive.exe
3728	MEMZ-Destructive.exe
5924	MEMZ-Destructive.exe
5612	MEMZ-Destructive.exe
4780	MEMZ-Destructive.exe
3168	MEMZ-Destructive.exe
3168	MEMZ-Destructive.exe
5816	wordpad.exe
5816	wordpad.exe
5816	wordpad.exe
5816	wordpad.exe
5816	wordpad.exe
5816	wordpad.exe
5476	mmc.exe
2312	mmc.exe
2312	mmc.exe
3168	MEMZ-Destructive.exe
3168	MEMZ-Destructive.exe
4780	MEMZ-Destructive.exe
3168	MEMZ-Destructive.exe
3556	OpenWith.exe
4780	MEMZ-Destructive.exe
3168	MEMZ-Destructive.exe
3168	MEMZ-Destructive.exe
4780	MEMZ-Destructive.exe
3168	MEMZ-Destructive.exe
4780	MEMZ-Destructive.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2440 wrote to memory of 648	2440	firefox.exe	95
PID 2440 wrote to memory of 648	2440	firefox.exe	95
PID 2440 wrote to memory of 648	2440	firefox.exe	95
PID 2440 wrote to memory of 648	2440	firefox.exe	95
PID 2440 wrote to memory of 648	2440	firefox.exe	95
PID 2440 wrote to memory of 648	2440	firefox.exe	95
PID 2440 wrote to memory of 648	2440	firefox.exe	95
PID 2440 wrote to memory of 648	2440	firefox.exe	95
PID 2440 wrote to memory of 648	2440	firefox.exe	95
PID 2440 wrote to memory of 648	2440	firefox.exe	95
PID 2440 wrote to memory of 648	2440	firefox.exe	95
PID 648 wrote to memory of 2960	648	firefox.exe	96
PID 648 wrote to memory of 2960	648	firefox.exe	96
PID 648 wrote to memory of 1888	648	firefox.exe	97
PID 648 wrote to memory of 1888	648	firefox.exe	97
PID 648 wrote to memory of 1888	648	firefox.exe	97
PID 648 wrote to memory of 1888	648	firefox.exe	97
PID 648 wrote to memory of 1888	648	firefox.exe	97
PID 648 wrote to memory of 1888	648	firefox.exe	97
PID 648 wrote to memory of 1888	648	firefox.exe	97
PID 648 wrote to memory of 1888	648	firefox.exe	97
PID 648 wrote to memory of 1888	648	firefox.exe	97
PID 648 wrote to memory of 1888	648	firefox.exe	97
PID 648 wrote to memory of 1888	648	firefox.exe	97
PID 648 wrote to memory of 1888	648	firefox.exe	97
PID 648 wrote to memory of 1888	648	firefox.exe	97
PID 648 wrote to memory of 1888	648	firefox.exe	97
PID 648 wrote to memory of 1888	648	firefox.exe	97
PID 648 wrote to memory of 1888	648	firefox.exe	97
PID 648 wrote to memory of 1888	648	firefox.exe	97
PID 648 wrote to memory of 1888	648	firefox.exe	97
PID 648 wrote to memory of 1888	648	firefox.exe	97
PID 648 wrote to memory of 1888	648	firefox.exe	97
PID 648 wrote to memory of 1888	648	firefox.exe	97
PID 648 wrote to memory of 1888	648	firefox.exe	97
PID 648 wrote to memory of 1888	648	firefox.exe	97
PID 648 wrote to memory of 1888	648	firefox.exe	97
PID 648 wrote to memory of 1888	648	firefox.exe	97
PID 648 wrote to memory of 1888	648	firefox.exe	97
PID 648 wrote to memory of 1888	648	firefox.exe	97
PID 648 wrote to memory of 1888	648	firefox.exe	97
PID 648 wrote to memory of 1888	648	firefox.exe	97
PID 648 wrote to memory of 1888	648	firefox.exe	97
PID 648 wrote to memory of 1888	648	firefox.exe	97
PID 648 wrote to memory of 1888	648	firefox.exe	97
PID 648 wrote to memory of 1888	648	firefox.exe	97
PID 648 wrote to memory of 1888	648	firefox.exe	97
PID 648 wrote to memory of 1888	648	firefox.exe	97
PID 648 wrote to memory of 1888	648	firefox.exe	97
PID 648 wrote to memory of 1888	648	firefox.exe	97
PID 648 wrote to memory of 1888	648	firefox.exe	97
PID 648 wrote to memory of 1888	648	firefox.exe	97
PID 648 wrote to memory of 1888	648	firefox.exe	97
PID 648 wrote to memory of 1888	648	firefox.exe	97
PID 648 wrote to memory of 1888	648	firefox.exe	97
PID 648 wrote to memory of 1888	648	firefox.exe	97
PID 648 wrote to memory of 1888	648	firefox.exe	97
PID 648 wrote to memory of 1888	648	firefox.exe	97
PID 648 wrote to memory of 1888	648	firefox.exe	97
PID 648 wrote to memory of 1888	648	firefox.exe	97
PID 648 wrote to memory of 1888	648	firefox.exe	97
PID 648 wrote to memory of 2300	648	firefox.exe	98
PID 648 wrote to memory of 2300	648	firefox.exe	98
PID 648 wrote to memory of 2300	648	firefox.exe	98

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "https://s28667145.weebly.com/memz-download.html"
1⤵
- Suspicious use of WriteProcessMemory
PID:2440
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url https://s28667145.weebly.com/memz-download.html
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:648
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="648.0.2029581365\1039530034" -parentBuildID 20221007134813 -prefsHandle 1884 -prefMapHandle 1560 -prefsLen 20749 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {3c7810bc-a9e0-4999-8537-0b18dd216950} 648 "\\.\pipe\gecko-crash-server-pipe.648" 1964 17e9bd09558 gpu
    3⤵
    PID:2960
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="648.1.1876518651\1732847730" -parentBuildID 20221007134813 -prefsHandle 2356 -prefMapHandle 2352 -prefsLen 21565 -prefMapSize 233444 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {0035edce-077c-45e7-a015-7e9007eb9f31} 648 "\\.\pipe\gecko-crash-server-pipe.648" 2392 17e9ad0ae58 socket
    3⤵
    - Checks processor information in registry
    PID:1888
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="648.2.948933515\2070852033" -childID 1 -isForBrowser -prefsHandle 3040 -prefMapHandle 3016 -prefsLen 21603 -prefMapSize 233444 -jsInitHandle 1380 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {624577c8-ad95-41e3-adb7-5888bad3ffee} 648 "\\.\pipe\gecko-crash-server-pipe.648" 3048 17e9e21b258 tab
    3⤵
    PID:2300
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="648.3.894970016\788613295" -childID 2 -isForBrowser -prefsHandle 2840 -prefMapHandle 2812 -prefsLen 26066 -prefMapSize 233444 -jsInitHandle 1380 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {afa1370a-d4fb-4e83-ba54-2a24722e499d} 648 "\\.\pipe\gecko-crash-server-pipe.648" 3380 17e8e369158 tab
    3⤵
    PID:3008
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="648.4.340482547\596344540" -childID 3 -isForBrowser -prefsHandle 5164 -prefMapHandle 5160 -prefsLen 26206 -prefMapSize 233444 -jsInitHandle 1380 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e43c3704-a7e9-46d3-b763-5d3f7b48e081} 648 "\\.\pipe\gecko-crash-server-pipe.648" 5184 17e9c59c058 tab
    3⤵
    PID:4020
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="648.5.562929403\1386972774" -childID 4 -isForBrowser -prefsHandle 5320 -prefMapHandle 5324 -prefsLen 26206 -prefMapSize 233444 -jsInitHandle 1380 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f2794d8c-0378-40a6-b544-9bdd07e7e7c7} 648 "\\.\pipe\gecko-crash-server-pipe.648" 5312 17e9c59cf58 tab
    3⤵
    PID:3172
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="648.6.955187000\1317313109" -childID 5 -isForBrowser -prefsHandle 5104 -prefMapHandle 5596 -prefsLen 26206 -prefMapSize 233444 -jsInitHandle 1380 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2f7d339a-06d3-42f4-a670-8f30a38eb567} 648 "\\.\pipe\gecko-crash-server-pipe.648" 5604 17ea0734858 tab
    3⤵
    PID:1308

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3720 --field-trial-handle=3084,i,14217130992253490921,11543335378077656547,262144 --variations-seed-version /prefetch:8
1⤵
PID:548

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3780 --field-trial-handle=3084,i,14217130992253490921,11543335378077656547,262144 --variations-seed-version /prefetch:8
1⤵
PID:4688

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5964

C:\Users\Admin\AppData\Local\Temp\Temp1_memz-master.zip\MEMZ-master\MEMZ-Destructive.exe
"C:\Users\Admin\AppData\Local\Temp\Temp1_memz-master.zip\MEMZ-master\MEMZ-Destructive.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:5224
- C:\Users\Admin\AppData\Local\Temp\Temp1_memz-master.zip\MEMZ-master\MEMZ-Destructive.exe
  "C:\Users\Admin\AppData\Local\Temp\Temp1_memz-master.zip\MEMZ-master\MEMZ-Destructive.exe" /watchdog
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:6060
- C:\Users\Admin\AppData\Local\Temp\Temp1_memz-master.zip\MEMZ-master\MEMZ-Destructive.exe
  "C:\Users\Admin\AppData\Local\Temp\Temp1_memz-master.zip\MEMZ-master\MEMZ-Destructive.exe" /watchdog
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:1144
- C:\Users\Admin\AppData\Local\Temp\Temp1_memz-master.zip\MEMZ-master\MEMZ-Destructive.exe
  "C:\Users\Admin\AppData\Local\Temp\Temp1_memz-master.zip\MEMZ-master\MEMZ-Destructive.exe" /watchdog
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:4180
- C:\Users\Admin\AppData\Local\Temp\Temp1_memz-master.zip\MEMZ-master\MEMZ-Destructive.exe
  "C:\Users\Admin\AppData\Local\Temp\Temp1_memz-master.zip\MEMZ-master\MEMZ-Destructive.exe" /watchdog
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:5560
- C:\Users\Admin\AppData\Local\Temp\Temp1_memz-master.zip\MEMZ-master\MEMZ-Destructive.exe
  "C:\Users\Admin\AppData\Local\Temp\Temp1_memz-master.zip\MEMZ-master\MEMZ-Destructive.exe" /watchdog
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:2940
- C:\Users\Admin\AppData\Local\Temp\Temp1_memz-master.zip\MEMZ-master\MEMZ-Destructive.exe
  "C:\Users\Admin\AppData\Local\Temp\Temp1_memz-master.zip\MEMZ-master\MEMZ-Destructive.exe" /main
  2⤵
  - Writes to the Master Boot Record (MBR)
  - Suspicious use of SetWindowsHookEx
  PID:3168
- - C:\Windows\SysWOW64\notepad.exe
    "C:\Windows\System32\notepad.exe" \note.txt
    3⤵
    PID:1876
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=virus.exe
    3⤵
    PID:5252
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=how+2+remove+a+virus
    3⤵
    PID:5624
- - C:\Windows\SysWOW64\Taskmgr.exe
    "C:\Windows\System32\Taskmgr.exe"
    3⤵
    - Checks SCSI registry key(s)
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    PID:3784
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=how+to+send+a+virus+to+my+friend
    3⤵
    PID:4300
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://motherboard.vice.com/read/watch-this-malware-turn-a-computer-into-a-digital-hellscape
    3⤵
    PID:4940
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=dank+memz
    3⤵
    PID:2052
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=the+memz+are+real
    3⤵
    PID:1048
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=facebook+hacking+tool+free+download+no+virus+working+2016
    3⤵
    PID:4516
- - C:\Windows\SysWOW64\mmc.exe
    "C:\Windows\System32\mmc.exe"
    3⤵
    - Suspicious use of SetWindowsHookEx
    PID:5476
  - - C:\Windows\system32\mmc.exe
      "C:\Windows\system32\mmc.exe"
      4⤵
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      PID:2312
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=internet+explorer+is+the+best+browser
    3⤵
    PID:3936
- - C:\Windows\SysWOW64\control.exe
    "C:\Windows\System32\control.exe"
    3⤵
    - Modifies registry class
    PID:5960
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=what+happens+if+you+delete+system32
    3⤵
    PID:5972
- - C:\Windows\SysWOW64\calc.exe
    "C:\Windows\System32\calc.exe"
    3⤵
    - Modifies registry class
    PID:2816
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=my+computer+is+doing+weird+things+wtf+is+happenin+plz+halp
    3⤵
    PID:5712
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://play.clubpenguin.com/
    3⤵
    PID:4696
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=mcafee+vs+norton
    3⤵
    PID:4152
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=how+2+buy+weed
    3⤵
    PID:3580
- - C:\Windows\SysWOW64\mmc.exe
    "C:\Windows\System32\mmc.exe"
    3⤵
    PID:5448
  - - C:\Windows\system32\mmc.exe
      "C:\Windows\system32\mmc.exe"
      4⤵
      PID:2428
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=g3t+r3kt
    3⤵
    PID:5424
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=how+to+get+money
    3⤵
    PID:4172
- - C:\Windows\SysWOW64\explorer.exe
    "C:\Windows\System32\explorer.exe"
    3⤵
    PID:6216
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=is+illuminati+real
    3⤵
    PID:3444

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=19 --mojo-platform-channel-handle=1340 --field-trial-handle=3084,i,14217130992253490921,11543335378077656547,262144 --variations-seed-version /prefetch:1
1⤵
PID:5680

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=20 --mojo-platform-channel-handle=2424 --field-trial-handle=3084,i,14217130992253490921,11543335378077656547,262144 --variations-seed-version /prefetch:1
1⤵
PID:6004

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4820 --field-trial-handle=3084,i,14217130992253490921,11543335378077656547,262144 --variations-seed-version /prefetch:8
1⤵
PID:4568

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=22 --mojo-platform-channel-handle=5396 --field-trial-handle=3084,i,14217130992253490921,11543335378077656547,262144 --variations-seed-version /prefetch:1
1⤵
PID:1432

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=23 --mojo-platform-channel-handle=5816 --field-trial-handle=3084,i,14217130992253490921,11543335378077656547,262144 --variations-seed-version /prefetch:1
1⤵
PID:4252

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
1⤵
- Drops file in Program Files directory
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:5008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.70 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=122.0.2365.52 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffbaeee2e98,0x7ffbaeee2ea4,0x7ffbaeee2eb0
  2⤵
  PID:3844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=3160 --field-trial-handle=3164,i,16530108533672916112,3267913202484022627,262144 --variations-seed-version /prefetch:2
  2⤵
  PID:5520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=3208 --field-trial-handle=3164,i,16530108533672916112,3267913202484022627,262144 --variations-seed-version /prefetch:3
  2⤵
  PID:2484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=3312 --field-trial-handle=3164,i,16530108533672916112,3267913202484022627,262144 --variations-seed-version /prefetch:8
  2⤵
  PID:5980
- C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=4388 --field-trial-handle=3164,i,16530108533672916112,3267913202484022627,262144 --variations-seed-version /prefetch:8
  2⤵
  PID:4920
- C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=4388 --field-trial-handle=3164,i,16530108533672916112,3267913202484022627,262144 --variations-seed-version /prefetch:8
  2⤵
  PID:2720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=4592 --field-trial-handle=3164,i,16530108533672916112,3267913202484022627,262144 --variations-seed-version /prefetch:8
  2⤵
  PID:3700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=4732 --field-trial-handle=3164,i,16530108533672916112,3267913202484022627,262144 --variations-seed-version /prefetch:8
  2⤵
  PID:3268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=4008 --field-trial-handle=3164,i,16530108533672916112,3267913202484022627,262144 --variations-seed-version /prefetch:8
  2⤵
  PID:5992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=120 --field-trial-handle=3164,i,16530108533672916112,3267913202484022627,262144 --variations-seed-version /prefetch:8
  2⤵
  PID:5720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=4384 --field-trial-handle=3164,i,16530108533672916112,3267913202484022627,262144 --variations-seed-version /prefetch:8
  2⤵
  PID:2288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=4616 --field-trial-handle=3164,i,16530108533672916112,3267913202484022627,262144 --variations-seed-version /prefetch:1
  2⤵
  PID:3452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=4968 --field-trial-handle=3164,i,16530108533672916112,3267913202484022627,262144 --variations-seed-version /prefetch:1
  2⤵
  PID:448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=5292 --field-trial-handle=3164,i,16530108533672916112,3267913202484022627,262144 --variations-seed-version /prefetch:8
  2⤵
  PID:3276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --no-appcompat-clear --mojo-platform-channel-handle=5452 --field-trial-handle=3164,i,16530108533672916112,3267913202484022627,262144 --variations-seed-version /prefetch:8
  2⤵
  PID:1556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=5740 --field-trial-handle=3164,i,16530108533672916112,3267913202484022627,262144 --variations-seed-version /prefetch:1
  2⤵
  PID:1660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --no-appcompat-clear --mojo-platform-channel-handle=4280 --field-trial-handle=3164,i,16530108533672916112,3267913202484022627,262144 --variations-seed-version /prefetch:8
  2⤵
  PID:3876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --mojo-platform-channel-handle=5952 --field-trial-handle=3164,i,16530108533672916112,3267913202484022627,262144 --variations-seed-version /prefetch:1
  2⤵
  PID:1824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --mojo-platform-channel-handle=6328 --field-trial-handle=3164,i,16530108533672916112,3267913202484022627,262144 --variations-seed-version /prefetch:1
  2⤵
  PID:4188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --mojo-platform-channel-handle=5812 --field-trial-handle=3164,i,16530108533672916112,3267913202484022627,262144 --variations-seed-version /prefetch:1
  2⤵
  PID:5092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --mojo-platform-channel-handle=5756 --field-trial-handle=3164,i,16530108533672916112,3267913202484022627,262144 --variations-seed-version /prefetch:1
  2⤵
  PID:2416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=6720 --field-trial-handle=3164,i,16530108533672916112,3267913202484022627,262144 --variations-seed-version /prefetch:8
  2⤵
  PID:4604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --mojo-platform-channel-handle=6852 --field-trial-handle=3164,i,16530108533672916112,3267913202484022627,262144 --variations-seed-version /prefetch:1
  2⤵
  PID:2292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --mojo-platform-channel-handle=6820 --field-trial-handle=3164,i,16530108533672916112,3267913202484022627,262144 --variations-seed-version /prefetch:1
  2⤵
  PID:1308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --mojo-platform-channel-handle=7080 --field-trial-handle=3164,i,16530108533672916112,3267913202484022627,262144 --variations-seed-version /prefetch:1
  2⤵
  PID:6080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --mojo-platform-channel-handle=7320 --field-trial-handle=3164,i,16530108533672916112,3267913202484022627,262144 --variations-seed-version /prefetch:1
  2⤵
  PID:1936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --mojo-platform-channel-handle=5284 --field-trial-handle=3164,i,16530108533672916112,3267913202484022627,262144 --variations-seed-version /prefetch:1
  2⤵
  PID:5768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --mojo-platform-channel-handle=6828 --field-trial-handle=3164,i,16530108533672916112,3267913202484022627,262144 --variations-seed-version /prefetch:1
  2⤵
  PID:2064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --mojo-platform-channel-handle=7644 --field-trial-handle=3164,i,16530108533672916112,3267913202484022627,262144 --variations-seed-version /prefetch:1
  2⤵
  PID:3432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --mojo-platform-channel-handle=7952 --field-trial-handle=3164,i,16530108533672916112,3267913202484022627,262144 --variations-seed-version /prefetch:1
  2⤵
  PID:4276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --mojo-platform-channel-handle=7812 --field-trial-handle=3164,i,16530108533672916112,3267913202484022627,262144 --variations-seed-version /prefetch:1
  2⤵
  PID:5728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --mojo-platform-channel-handle=7716 --field-trial-handle=3164,i,16530108533672916112,3267913202484022627,262144 --variations-seed-version /prefetch:1
  2⤵
  PID:936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --mojo-platform-channel-handle=7676 --field-trial-handle=3164,i,16530108533672916112,3267913202484022627,262144 --variations-seed-version /prefetch:1
  2⤵
  PID:1360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --mojo-platform-channel-handle=5588 --field-trial-handle=3164,i,16530108533672916112,3267913202484022627,262144 --variations-seed-version /prefetch:1
  2⤵
  PID:3116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
  2⤵
  - Enumerates system info in registry
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  PID:4788
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.70 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=122.0.2365.52 --initial-client-data=0x238,0x23c,0x240,0x234,0x2f0,0x7ffbaeee2e98,0x7ffbaeee2ea4,0x7ffbaeee2eb0
    3⤵
    PID:4072
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=2696 --field-trial-handle=2672,i,10534403279207093765,16210424007042871903,262144 --variations-seed-version /prefetch:2
    3⤵
    PID:5392
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=2732 --field-trial-handle=2672,i,10534403279207093765,16210424007042871903,262144 --variations-seed-version /prefetch:3
    3⤵
    PID:5992
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=2944 --field-trial-handle=2672,i,10534403279207093765,16210424007042871903,262144 --variations-seed-version /prefetch:8
    3⤵
    PID:2216
- - C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=4384 --field-trial-handle=2672,i,10534403279207093765,16210424007042871903,262144 --variations-seed-version /prefetch:8
    3⤵
    PID:4888
- - C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=4384 --field-trial-handle=2672,i,10534403279207093765,16210424007042871903,262144 --variations-seed-version /prefetch:8
    3⤵
    PID:5904
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4744 --field-trial-handle=2672,i,10534403279207093765,16210424007042871903,262144 --variations-seed-version /prefetch:1
    3⤵
    PID:5496
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=4776 --field-trial-handle=2672,i,10534403279207093765,16210424007042871903,262144 --variations-seed-version /prefetch:1
    3⤵
    PID:5208
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=5248 --field-trial-handle=2672,i,10534403279207093765,16210424007042871903,262144 --variations-seed-version /prefetch:8
    3⤵
    PID:5248
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --no-appcompat-clear --mojo-platform-channel-handle=5408 --field-trial-handle=2672,i,10534403279207093765,16210424007042871903,262144 --variations-seed-version /prefetch:8
    3⤵
    PID:5244
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=5712 --field-trial-handle=2672,i,10534403279207093765,16210424007042871903,262144 --variations-seed-version /prefetch:1
    3⤵
    PID:4844
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
    3⤵
    - Enumerates system info in registry
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    PID:1728
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.70 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=122.0.2365.52 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffbaeee2e98,0x7ffbaeee2ea4,0x7ffbaeee2eb0
      4⤵
      PID:5988
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=2232 --field-trial-handle=2236,i,11691272344442136073,14040982372947661638,262144 --variations-seed-version /prefetch:2
      4⤵
      PID:4288
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=2376 --field-trial-handle=2236,i,11691272344442136073,14040982372947661638,262144 --variations-seed-version /prefetch:3
      4⤵
      PID:544
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=2504 --field-trial-handle=2236,i,11691272344442136073,14040982372947661638,262144 --variations-seed-version /prefetch:8
      4⤵
      PID:4872
  - - C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=4376 --field-trial-handle=2236,i,11691272344442136073,14040982372947661638,262144 --variations-seed-version /prefetch:8
      4⤵
      PID:2284
  - - C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=4376 --field-trial-handle=2236,i,11691272344442136073,14040982372947661638,262144 --variations-seed-version /prefetch:8
      4⤵
      PID:5980
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4740 --field-trial-handle=2236,i,11691272344442136073,14040982372947661638,262144 --variations-seed-version /prefetch:1
      4⤵
      PID:3548
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=4768 --field-trial-handle=2236,i,11691272344442136073,14040982372947661638,262144 --variations-seed-version /prefetch:1
      4⤵
      PID:5176
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=5256 --field-trial-handle=2236,i,11691272344442136073,14040982372947661638,262144 --variations-seed-version /prefetch:8
      4⤵
      PID:2152
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --no-appcompat-clear --mojo-platform-channel-handle=5332 --field-trial-handle=2236,i,11691272344442136073,14040982372947661638,262144 --variations-seed-version /prefetch:8
      4⤵
      PID:1344
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=5284 --field-trial-handle=2236,i,11691272344442136073,14040982372947661638,262144 --variations-seed-version /prefetch:1
      4⤵
      PID:3940
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=5184 --field-trial-handle=2236,i,11691272344442136073,14040982372947661638,262144 --variations-seed-version /prefetch:1
      4⤵
      PID:2420
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=6108 --field-trial-handle=2236,i,11691272344442136073,14040982372947661638,262144 --variations-seed-version /prefetch:1
      4⤵
      PID:4048
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=6336 --field-trial-handle=2236,i,11691272344442136073,14040982372947661638,262144 --variations-seed-version /prefetch:8
      4⤵
      PID:1952
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=5780 --field-trial-handle=2236,i,11691272344442136073,14040982372947661638,262144 --variations-seed-version /prefetch:8
      4⤵
      PID:3688
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=6356 --field-trial-handle=2236,i,11691272344442136073,14040982372947661638,262144 --variations-seed-version /prefetch:8
      4⤵
      PID:3484
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --no-appcompat-clear --mojo-platform-channel-handle=6288 --field-trial-handle=2236,i,11691272344442136073,14040982372947661638,262144 --variations-seed-version /prefetch:8
      4⤵
      PID:864
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --mojo-platform-channel-handle=4164 --field-trial-handle=2236,i,11691272344442136073,14040982372947661638,262144 --variations-seed-version /prefetch:1
      4⤵
      PID:2860
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --mojo-platform-channel-handle=5760 --field-trial-handle=2236,i,11691272344442136073,14040982372947661638,262144 --variations-seed-version /prefetch:1
      4⤵
      PID:3464
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --mojo-platform-channel-handle=6604 --field-trial-handle=2236,i,11691272344442136073,14040982372947661638,262144 --variations-seed-version /prefetch:1
      4⤵
      PID:4252
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --mojo-platform-channel-handle=6756 --field-trial-handle=2236,i,11691272344442136073,14040982372947661638,262144 --variations-seed-version /prefetch:1
      4⤵
      PID:4796
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --mojo-platform-channel-handle=6520 --field-trial-handle=2236,i,11691272344442136073,14040982372947661638,262144 --variations-seed-version /prefetch:1
      4⤵
      PID:1380
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --mojo-platform-channel-handle=6336 --field-trial-handle=2236,i,11691272344442136073,14040982372947661638,262144 --variations-seed-version /prefetch:1
      4⤵
      PID:5220
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --mojo-platform-channel-handle=7068 --field-trial-handle=2236,i,11691272344442136073,14040982372947661638,262144 --variations-seed-version /prefetch:1
      4⤵
      PID:5256
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --mojo-platform-channel-handle=7092 --field-trial-handle=2236,i,11691272344442136073,14040982372947661638,262144 --variations-seed-version /prefetch:1
      4⤵
      PID:3384
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --mojo-platform-channel-handle=6760 --field-trial-handle=2236,i,11691272344442136073,14040982372947661638,262144 --variations-seed-version /prefetch:1
      4⤵
      PID:5636
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --mojo-platform-channel-handle=6160 --field-trial-handle=2236,i,11691272344442136073,14040982372947661638,262144 --variations-seed-version /prefetch:1
      4⤵
      PID:3128
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=7276 --field-trial-handle=2236,i,11691272344442136073,14040982372947661638,262144 --variations-seed-version /prefetch:8
      4⤵
      PID:5704
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --mojo-platform-channel-handle=7472 --field-trial-handle=2236,i,11691272344442136073,14040982372947661638,262144 --variations-seed-version /prefetch:1
      4⤵
      PID:4492
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --mojo-platform-channel-handle=7520 --field-trial-handle=2236,i,11691272344442136073,14040982372947661638,262144 --variations-seed-version /prefetch:1
      4⤵
      PID:4620
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --mojo-platform-channel-handle=5396 --field-trial-handle=2236,i,11691272344442136073,14040982372947661638,262144 --variations-seed-version /prefetch:1
      4⤵
      PID:5916
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --mojo-platform-channel-handle=7292 --field-trial-handle=2236,i,11691272344442136073,14040982372947661638,262144 --variations-seed-version /prefetch:1
      4⤵
      PID:3008
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --mojo-platform-channel-handle=3904 --field-trial-handle=2236,i,11691272344442136073,14040982372947661638,262144 --variations-seed-version /prefetch:1
      4⤵
      PID:392
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --mojo-platform-channel-handle=5428 --field-trial-handle=2236,i,11691272344442136073,14040982372947661638,262144 --variations-seed-version /prefetch:1
      4⤵
      PID:4612
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --mojo-platform-channel-handle=7164 --field-trial-handle=2236,i,11691272344442136073,14040982372947661638,262144 --variations-seed-version /prefetch:1
      4⤵
      PID:5188
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --mojo-platform-channel-handle=5448 --field-trial-handle=2236,i,11691272344442136073,14040982372947661638,262144 --variations-seed-version /prefetch:1
      4⤵
      PID:3444
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3492 --field-trial-handle=2236,i,11691272344442136073,14040982372947661638,262144 --variations-seed-version /prefetch:8
      4⤵
      PID:4384
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --mojo-platform-channel-handle=4016 --field-trial-handle=2236,i,11691272344442136073,14040982372947661638,262144 --variations-seed-version /prefetch:1
      4⤵
      PID:336
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --mojo-platform-channel-handle=7800 --field-trial-handle=2236,i,11691272344442136073,14040982372947661638,262144 --variations-seed-version /prefetch:1
      4⤵
      PID:2292
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --mojo-platform-channel-handle=7632 --field-trial-handle=2236,i,11691272344442136073,14040982372947661638,262144 --variations-seed-version /prefetch:1
      4⤵
      PID:4584
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --mojo-platform-channel-handle=5296 --field-trial-handle=2236,i,11691272344442136073,14040982372947661638,262144 --variations-seed-version /prefetch:1
      4⤵
      PID:5260
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --mojo-platform-channel-handle=7816 --field-trial-handle=2236,i,11691272344442136073,14040982372947661638,262144 --variations-seed-version /prefetch:1
      4⤵
      PID:4848
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --mojo-platform-channel-handle=8000 --field-trial-handle=2236,i,11691272344442136073,14040982372947661638,262144 --variations-seed-version /prefetch:1
      4⤵
      PID:364
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --mojo-platform-channel-handle=7840 --field-trial-handle=2236,i,11691272344442136073,14040982372947661638,262144 --variations-seed-version /prefetch:1
      4⤵
      PID:2292
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --mojo-platform-channel-handle=6976 --field-trial-handle=2236,i,11691272344442136073,14040982372947661638,262144 --variations-seed-version /prefetch:1
      4⤵
      PID:3780
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --mojo-platform-channel-handle=3492 --field-trial-handle=2236,i,11691272344442136073,14040982372947661638,262144 --variations-seed-version /prefetch:1
      4⤵
      PID:2960
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --mojo-platform-channel-handle=8676 --field-trial-handle=2236,i,11691272344442136073,14040982372947661638,262144 --variations-seed-version /prefetch:1
      4⤵
      PID:2948
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --mojo-platform-channel-handle=8796 --field-trial-handle=2236,i,11691272344442136073,14040982372947661638,262144 --variations-seed-version /prefetch:1
      4⤵
      PID:4792
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --mojo-platform-channel-handle=8492 --field-trial-handle=2236,i,11691272344442136073,14040982372947661638,262144 --variations-seed-version /prefetch:1
      4⤵
      PID:5800
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --mojo-platform-channel-handle=8376 --field-trial-handle=2236,i,11691272344442136073,14040982372947661638,262144 --variations-seed-version /prefetch:1
      4⤵
      PID:3220
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --mojo-platform-channel-handle=8656 --field-trial-handle=2236,i,11691272344442136073,14040982372947661638,262144 --variations-seed-version /prefetch:1
      4⤵
      PID:1720
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --mojo-platform-channel-handle=3748 --field-trial-handle=2236,i,11691272344442136073,14040982372947661638,262144 --variations-seed-version /prefetch:1
      4⤵
      PID:3140
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --mojo-platform-channel-handle=7924 --field-trial-handle=2236,i,11691272344442136073,14040982372947661638,262144 --variations-seed-version /prefetch:1
      4⤵
      PID:5800
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=8480 --field-trial-handle=2236,i,11691272344442136073,14040982372947661638,262144 --variations-seed-version /prefetch:8
      4⤵
      PID:6272
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --mojo-platform-channel-handle=8828 --field-trial-handle=2236,i,11691272344442136073,14040982372947661638,262144 --variations-seed-version /prefetch:1
      4⤵
      PID:2948

C:\Users\Admin\Desktop\MEMZ-master\MEMZ-Destructive.exe
"C:\Users\Admin\Desktop\MEMZ-master\MEMZ-Destructive.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:5124
- C:\Users\Admin\Desktop\MEMZ-master\MEMZ-Destructive.exe
  "C:\Users\Admin\Desktop\MEMZ-master\MEMZ-Destructive.exe" /watchdog
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:2140
- C:\Users\Admin\Desktop\MEMZ-master\MEMZ-Destructive.exe
  "C:\Users\Admin\Desktop\MEMZ-master\MEMZ-Destructive.exe" /watchdog
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:3728
- C:\Users\Admin\Desktop\MEMZ-master\MEMZ-Destructive.exe
  "C:\Users\Admin\Desktop\MEMZ-master\MEMZ-Destructive.exe" /watchdog
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:3332
- C:\Users\Admin\Desktop\MEMZ-master\MEMZ-Destructive.exe
  "C:\Users\Admin\Desktop\MEMZ-master\MEMZ-Destructive.exe" /watchdog
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:5924
- C:\Users\Admin\Desktop\MEMZ-master\MEMZ-Destructive.exe
  "C:\Users\Admin\Desktop\MEMZ-master\MEMZ-Destructive.exe" /watchdog
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:5612
- C:\Users\Admin\Desktop\MEMZ-master\MEMZ-Destructive.exe
  "C:\Users\Admin\Desktop\MEMZ-master\MEMZ-Destructive.exe" /main
  2⤵
  - Writes to the Master Boot Record (MBR)
  - Suspicious use of SetWindowsHookEx
  PID:4780
- - C:\Windows\SysWOW64\notepad.exe
    "C:\Windows\System32\notepad.exe" \note.txt
    3⤵
    PID:4772
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=best+way+to+kill+yourself
    3⤵
    PID:1344
- - C:\Windows\SysWOW64\regedit.exe
    "C:\Windows\System32\regedit.exe"
    3⤵
    - Runs regedit.exe
    - Suspicious behavior: GetForegroundWindowSpam
    PID:5236
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=virus.exe
    3⤵
    PID:4004
- - C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe
    "C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe"
    3⤵
    - Suspicious use of SetWindowsHookEx
    PID:5816
  - - C:\Windows\splwow64.exe
      C:\Windows\splwow64.exe 12288
      4⤵
      PID:1564
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=minecraft+hax+download+no+virus
    3⤵
    PID:1500
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=montage+parody+making+program+2016
    3⤵
    PID:3932
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=internet+explorer+is+the+best+browser
    3⤵
    PID:5872
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=skrillex+scay+onster+an+nice+sprites+midi
    3⤵
    PID:2948
- - C:\Windows\SysWOW64\notepad.exe
    "C:\Windows\System32\notepad.exe"
    3⤵
    PID:5020
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=batch+virus+download
    3⤵
    PID:2396
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=skrillex+scay+onster+an+nice+sprites+midi
    3⤵
    PID:3384
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=how+to+remove+memz+trojan+virus
    3⤵
    PID:1916
- - C:\Windows\SysWOW64\Taskmgr.exe
    "C:\Windows\System32\Taskmgr.exe"
    3⤵
    PID:4116
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://softonic.com/
    3⤵
    PID:5984
- - C:\Windows\SysWOW64\control.exe
    "C:\Windows\System32\control.exe"
    3⤵
    PID:7068

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x3d8 0x508
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1640

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc
1⤵
PID:3900

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{5BD95610-9434-43C2-886C-57852CC8A120} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of AdjustPrivilegeToken
PID:2336

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
1⤵
PID:5652

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:3556

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

624fc6be-e408-4e60-88b7-ed45fa235ceb.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\624fc6be-e408-4e60-88b7-ed45fa235ceb.tmp
Size 67KB
SHA256 e68118a90083b7568713dfaaf20e0203da8e3870fe5ac831ecce30406bbbc764
MD5 f54a17d2dc2a424f34d9a85fce81fdd9
SHA1 df3be6b9e4d00bb041f69e92531df657e554db6d
SHA512 d8da851454130a6757aa9f8d8aa8ca678bf52cacd1a66779846cd5b25024a919340bde6286e74d792c68c222bd6ce6a14fc35f0d29e1b239fe235aaa72423a11
SSDEEP 1536:GMrKiXSFcU+YT4T8E8KCwpuSllQ8QL251gJUVAf6IxNwIvf4p:GMuaSFc7h8luk8QL5USNwIa
MD5 SHA1 SHA512 SSDEEP

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 be0b82f3bcfc4bc730fa06634e7f39a1ed1357c4ae85731be62aebf6b12eef8e
MD5 d78b25a8965b6c93c45db28880f501c6
SHA1 14ba749851b24319dcf3332cf8439984bd9e02b2
SHA512 65516b8478db34e05ceec49f1592d22efe3c97e2aa30f3097ad4012b0789f1aafeeec905ed39618dbe4bd997081d0d97dd3c35c77f2debe61e88a5647a3c0cc4
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ebcb4538ce7cf11b586dacdc619fd6465d1403db23488c88160e1be94a514203
MD5 73c1c363a96249fa18ddb708f39bb49d
SHA1 358b078458fbf5b88ac1f751fed2b8aefa790a04
SHA512 b73ba879b5a145b09ab05245b37c783ed60bfc38c94e93b7efb6518cc718e9f0066eacd19693ca01b1f54abaeb8d4343f9c0bdd5a24ada6e4ada995f6dee4e52
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e4098a256f4478d542d40f8a199387ed4a9bf6228f72477c609eb4fe57b5eb5c
MD5 695647f8bd6dd4f56b587f93cf11b459
SHA1 69d074c0c4e69003caffe312998595653dea4398
SHA512 2ad66a11d624805ca1ff580ab1aad6b5dd2d38efeb17bd455a68b83c19f0100a173378c6a08f7331959c5d4c00c9de6bcd6ccedd6239b7add89bd80eb38b8bda
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 6106990afe2d5139e9808ebbec612c93734f4790ddf256c1f0179b77720d88c7
MD5 3ae0786f1b01f2968708801532df02fd
SHA1 a393388310b5551b76c321db02810f9be90d7636
SHA512 08346c884c9a232e7ddb297a514777b644623812fe45734bf03cfc9c6cd2dad7fef3dd227cbf67ad4286d494a1f4b456245b9c79be385548b726585e4ed19197
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_0
Size 44KB
SHA256 d0d33d708a22d463d5d1d81010ea47237306124620b9e483ee26f543dd34db8d
MD5 e6879bdf5f3c81a1654bf009d23dc4b7
SHA1 44090ded5c7afac55efecd7062e0076b89a72537
SHA512 5bc659371c18a61f2f2f1fe89b9ee6643d8c9552950b8563acfe2b6bc45f248793666f37e6ab7741d371e981cd18c52d61723d453f9fd5ee81fbb06a2afbfab6
SSDEEP 192:9QNVJMqcERtgiIGUyGibpRvFUUDvlQtgw9uA70Fu/o+krHfrghrB3k04D:9eO3Eo4GiFxJlQSwMAIFYRBv
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_1
Size 264KB
SHA256 5b03c0215b57a964bf6db94bad50fafbe4e764458d701699ddd9721d33e2a070
MD5 b0c12e0caddc035e4be1f97165fab850
SHA1 38341bf7e178586912ac661e5a11cebfd61b8c02
SHA512 68f4bfa64dcf91eb5a0632566ca6fc2f8ab19df11e0bd6ae86bf155cafbc40a8f55f18d3d2c7617f062453d94ed3d782aae618e991239a5e9f425979650a3921
SSDEEP 1536:E970cszUxz8JUyhrzSh4bHXPGqIo+d0eJ7uzink4RG7YlMNvb1Rb:O0cxriXtkn7uUk4R
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_2
Size 1.0MB
SHA256 e7ac4bfef40c07e77b627bdac2e0a991a6bcdae8f8833d4a3f8624fb85cc2069
MD5 2bb006e40d9c3839f13792f2bc673017
SHA1 2d4d34f7ff5b5748f01466be66494d57bfb3ae97
SHA512 e9089da3bc2d9fde7705a0886bf0d2e1a6d65171e9276c2fbd9c3cf6adc7a6d9e04d1f9aad7b74db0a473537711f8287da3b2496b0a3f271b705e10ff1b5748d
SSDEEP 3072:DTq7YFVUNUJdqvTaisRd7IqMu3d5u/Kd16Sz3dZuVuujECLe3tlbsHgJxNr27tw1:DTqq56Lj4nsHerWauQTdXIE5mGNmQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_3
Size 1.2MB
SHA256 de3a33e97d3a61cba040e0b43ffc6aa8eaa9689c4b9a783b65c4844449d742eb
MD5 2f8a92b4bcf44336ec78cfe5179c4867
SHA1 37324d14c284a84d8cdcfefc866832576a1621f6
SHA512 5610f73b4163b9803f13fb77b7f362a01f790838d2e5f6b107e4d3846fe4916282c3c1f63a35526ae6c084b4b8b215e24dda70ca507bbff28f87fd0cbc6fd8de
SSDEEP 6144:t78KMmUmHmpKM2UKfm4rB9K3mom9mcv5b7fpmi6kmX2FVyclMTm0Es2AOe0mArRr:tHrt5b7r6rOBsDErRXqQQxgn9rY3
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000003

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000003
Size 65KB
SHA256 98ccd25213615375c36eb190e46436c4e9ee1adf4542f01da6595d75ef19f383
MD5 1f3c4c3df77c57f87d1e0964f57359c5
SHA1 ef958756902a6b3891869576e2a6cbf6d9059785
SHA512 89f28c303896d2476aa7859116fffb606676316af74ed4abc370d19561603b73e02586920fe933c0e76b644121ed3b2aff75ffaef9c26a69312a3402d999a6d1
SSDEEP 1536:2cm8z4RWbCEeMGGNrIAeenJa9OHgm6HcGkSsK/6b/:BznleMNew4gHg9kSswU/
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000004

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000004
Size 56KB
SHA256 7a4db66ae76fac9deb23a43694d932d5b1bbfb6b1d6b184e9d908c5961c7085b
MD5 f085d38d5e917ccc4266e0d283354bc9
SHA1 c9325388b148678f32c04a7ea55231cf7b8a478c
SHA512 799ae1f6f1a31ec72d29fcdb995442ab17da497ba136feae3bfec0788b331012eb666dde1a95b95e6165de968fe46d4a2b5ff08c90817ebed2f0ebb14591c7c2
SSDEEP 1536:69FSVbaOGLD/8I+Etli8mMfJ7ZeOlLrjelBcnKIHzj5zfv:RcOGLDU633fJMOM0BTjNfv
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000005

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000005
Size 30KB
SHA256 2de7e29e82bd06fdc071f3a6f9af9d2d5b3b051dfeeb335be3b3677e24e66f94
MD5 8f275f3c748cfe377684dd90ed2fd2d5
SHA1 65fa8030eff79a8e49ad47905b26629426c15032
SHA512 1426d5ebf91a51a4e827c682f2349bf196a94edd510af6dfb1733eca19e4045ac37e8bf8197bbdd5852a9c5ce921c8ce4190a2cf7cb4feae21d55e072e018965
SSDEEP 768:46w28GH08pJzKsifwMmNU7LfF2/lYNto7eRG2t3:4z2r/zviYMQUPF2tYNt82t3
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000006

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000006
Size 31KB
SHA256 bf62913a7548899c0920a258904e5bfc50e0abb96af46f2be50e8a0e42cd9ca1
MD5 6ce4e6a94723410cea915401fb2405b9
SHA1 62b18c253f9a8bdb5107fdbc05e60e9ecae1662e
SHA512 2fcade70ae872bab3b9be201e68eed917844052aee6d27899cffd435fcedb6750295c91cb53a8995c241eefa2d8b46649b260d47e14c5ee404f7bbd15b328b97
SSDEEP 768:bOWvQ1D4qpZiZ4Q7Y5NesFapk24FJKkE/QoSQ2dOPFfXdMv1:JkD4giWQ7YXFapx4FZtQtM1
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000007

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000007
Size 115KB
SHA256 5d3401e10dc4094b8259e92be1360d4f9a31426e63dfa1e22cc7b2c42776b55d
MD5 9997cba53cca673ec3a7556a4ec44e10
SHA1 f950f3c07e5dcdaf3a0041d0b698daa481d9131d
SHA512 ca194f0b4277afa5fcb4621fd4a0c06ba147e4a6523a756cffbaf5165519fde078bc031b7edcad2e7d26eb5d373f24b5d256d28c694f828f51d8097107628ad8
SSDEEP 3072:YPxN04YGxWMzivSGru92lUPEdH+Z0QNYEX1PN59fd97nmZt:6xNZWM0YPEdW1NV1P5V9iZt
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000008

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000008
Size 31KB
SHA256 191f4b66ee855c72250fe7f4f7c92ad3a184e0c5f3b4df45f91a7796c5e38fff
MD5 49e4787d628bda07a6824bb05cc0d0bd
SHA1 4f27eccc6ced1c3a535ee1533876efc46d31aae1
SHA512 ab43ffd39189d0110644cb34196df0a336479f1e7081edcb9bd514fd82b67a0ef32a898ce2dd69cefc234522abd12e8cac905c87375a1c0406eac25c6e732bd8
SSDEEP 768:OE+lOCRTT7G7h5u8UKV2YZ8le4U3kQBMTAl2:UlOCRTnGd5uz898le4/QBMT7
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000009

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000009
Size 36KB
SHA256 e639622ea1c67e925da643a6716ab5b33a735a0b6eac359140b0ac6f0559fd24
MD5 61161079dc5d01494144c81e414b9429
SHA1 9580dd71a8e77396a3c9c42db0c6b4af6275310b
SHA512 7e82f741ce464d3acaafbff9d2cbdafa089352aefda4b3b6d7591da455aab0f8f8a3397ba9812ba2251256588cf275e5199e03f6119ab5f1afd4d60096b1df7c
SSDEEP 768:OreSG32Q2yKYnR7AMIO2SSR+n+hd5DoLen2z1ChXy8dHTXY+g+5l99G6:OrA20nrIlSsd5MLe2+NHHl9N
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_00000a

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00000a
Size 20KB
SHA256 0006eb5339d9faaffa495090e78ddaac63a26110d5408acf90c04ca6aea2025d
MD5 533eec86538a85c2b7fa3b1e03662284
SHA1 d0849b4dd704a518a0fe755d26c33addfcf606f0
SHA512 a1b5661903ac688e4f1296509d24b28946c9c3518cd358bbbac01afa492a9831277b8f4c305bf92030b3e0de5b6e023d166a167bd6538026054249b1ad21d568
SSDEEP 384:rMYrHiQoS4VNuD7ZOXPUVVBhlu7Q3wIYmisqLrmFWaj3c7RGeNmhzij:rtrHi64347Z4cVVBe7IwIYSiYzg70ecw
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_00000b

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00000b
Size 45KB
SHA256 cbc5722bbd6e214e73c4302edb151d4402059ca08c724b9dc13262a54b60690f
MD5 97704306f534bda12cec7449d76d2722
SHA1 51e300d0e79b58bd982ec56823f182e07494954d
SHA512 1a82e2dfd33e6b43e8ba76047bce5a01c90be0ed96f6df9c3cdd94af0eefecc4763887917ef88b83d21e1ce7c954a1fbfa6aeb47b335c925f64945c83d14fcfb
SSDEEP 768:Up7U3qjDJw5IKc+UAp1sfhB1b9rJTeL8dDhsCi/2un0kHZfbFk5S:R3EtMI033GhB91FNieiHZTaS
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_00000c

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00000c
Size 27KB
SHA256 936356b6f02a4aec3689c9a717357725854be5d49bda955dc864d7ebbff00649
MD5 b5984a33a900d38c2fc3e103aeb3243c
SHA1 45eb62696ce8ac38544da6ce65539e9454daf326
SHA512 9d2d0935978c60b34046beb2aee874e4b1e948fbce23b8d2c66457276a5f308bf130a7eeb3887be769d2c9dcda3854f98ba2704b75f49792d1f945580038a048
SSDEEP 384:r4MEaSLdkav7ywTe9X5Ud7YC5C0jws6EB4wsQKSyMjnyzcUth3AJFrRBMYB0p6Tj:E/LdVWQC0jwsKDpMGzhzOpRBM2qqp1
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_00000d

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00000d
Size 48KB
SHA256 783cfd562fc94ff060056ec6c6651c55f7b80a1ab0f06fee0287019009d7ef91
MD5 c886a775b202a5484430dbdfab9ff130
SHA1 b2e8ae2d1fb1e7ad868203a3f0d21e7e182e1239
SHA512 46d52de8fc0e763e79530d4a9524730f2661781b0ebaaac99cc5793d12d67cf3db4f12512990fbb9a412f82b3c378a0b08fc8d660f28ff5ba95fc37bff00492e
SSDEEP 1536:qekDWcKx1p4/fzAvDzLR4Y4AugUB9UWqJ6YBmGBt+Q:AGX4/LyzFT4Augg9rq0wt+Q
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_00000e

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00000e
Size 18KB
SHA256 4802debe721cfca05e1c031dd5eb60ce0f4046f909bb821d5f05bedd84d0424e
MD5 67ce84a50bd06cd08bdf9bba4f999768
SHA1 a47bbe29934ab0dff36173a602ba818df76e9036
SHA512 49f38256bab65d46e0ee86b13b5117dc7cc3f9b25533ec1147dcff61433f71c9035adbab47d911cf556c929471d3f44d6de9ce83970990f968728e30873b48cb
SSDEEP 384:ncEYxZ62s1BRwvjjwxwicNWSdjYQRNQyIaAXcKYm6/xpSQ1:nTYI1BQjwxwicNVsEhRpJpL
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_00000f

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00000f
Size 19KB
SHA256 bd63aa812563452ede3a89029deebcdb169af35813ac43405a54d3b0b6b80206
MD5 f4e8dbb184f3b7f4a1651056c8568042
SHA1 34130ac36228a1ee9cb9905aa6fff8c34a0f26fd
SHA512 b49a4af7b78511bb672a14dcec0c62687506ae058eb0f27b8cbce984b9703ba68129b53af72e320dd891534c9da32cfa56da406e6c9210e92d8225b1c149e14e
SSDEEP 384:OB/RDvPeRWRX9dklc+Fg86oSBKRzArVh0P+rjFcGoFkU4DpiJriZ3nXsx59:OB/BvmYvaW86hwAMWBBU950XXsx59
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000010

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000010
Size 33KB
SHA256 b8176317465971819d6a686a59911764d7394aebd60cc5cdc7e3a4c348f372a2
MD5 b141a318d45239c582d28b3a5e439cb4
SHA1 c0402161ad94a631434653d5efd045bc42b8dc43
SHA512 2d554c2ef0b39114182f14fdee3ceaaa049e6a6f0425404dbf86b761fd2b2018a73ee3da6a8d66b3407cc55463878256a08e1d534aba0f2cefcc2e899e12be39
SSDEEP 768:uyLth1vlH7GI7RFCzfDM7Cx9+XYNCRIZglqyWLxGu:uithtR7cg73XYNCRgglqyWFGu
MD5 SHA1 SHA512 SSDEEP

Submit Download

738184b4bb16e32c_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\738184b4bb16e32c_0
Size 2KB
SHA256 7b4206b4b8bdfee33e6fae7963d8dc7bb3834aef8be8fe99c4ecd0182b962959
MD5 acec44018c09d72376e482e449ada1f7
SHA1 14b158fc4fd96cc53195e1df4ecd4d8322253d82
SHA512 e9c4206d00554fc6ead2a09380e8409ddcfa0820e42e2337a3679af741e68fc5820f6a5423e231d16b3e4e14d9a52f79bd9d6a9ffd73d1e008bebaed89703f7f
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 1930a571dcdcbc0e7a791008511948664355bc4cc0ae6a7a84ac6448157aa2b7
MD5 682d251a96ebdb2e11dd2ce798cce918
SHA1 fae00c75fb46146099d59a2e6ad89a6ad6c206ab
SHA512 6281144e48325ff09fccd5fa40a6c770277fc3ce29ba4f29850fd8cd61de58c50b3138be97145d4316462f5eb639bf0eab47b125a048893a6803c0cb9279617e
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 168B
SHA256 5e3a1f3c35a8dc2610dda2ee25b3b1ba9907b2959e5c55259b0947b8ea28f280
MD5 3d4819a1e186a2b6c5d728ff052f9a6a
SHA1 95596993e493818bd714beca22d8598c9f56dd61
SHA512 f483febbf96b0b917dc04e071c0b47f4c67a329db5ea55b877593a786cc24fda3c88127df64af01d0e3d62ded3f960a5b05350d09d035a5b65fc071a53f9d403
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 7cdba24107230bec711f599e0846723b5f4578b0fbdafa061e795e02ad335578
MD5 c3568ec3bfd98bf73996abdb03d0377f
SHA1 128fc0a5750763a74b12a8df404825946f59264d
SHA512 b2cbef5feead4ecc7e80233468601a1e2b8fd7b79d17bb60f2c57ce7990f8f576b3e688e499ec41c363442179b646e3b3dc54648f88b073856aea7278d31444b
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 fdce296725841e5ff3bdaf8f09f8a7e2a967a4fd7e7a425415fdb00083f95384
MD5 ba33485f499886456e32c9963b28b8ea
SHA1 b1a305128fc7b9679300035bc997f0ecf606389c
SHA512 48ae45bcaaf55fec73fa434c37a71e59faf0e132fee71c1d03d01ec542589fd75ce35e82ba85b61eb2ada7b3956d2099a14786b710427b485e0d25e4ea4c467a
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 82df9a9e7bbe8cca48a370c3e14953003185bd50259bba3291cc1d20dcf96cad
MD5 8819aecce4fdfedf58a85f5c3be674b7
SHA1 67c19081e45b5e394c9ecb1e63d6d1150c58854f
SHA512 eb91c4b02c66a9df128886ce34507764f967c856ae2a7f7ed3429cc3b96dc17772ea9892803a70a9b24f56ec958d5ebab3c10520dcc91d4c06b971b3bdacb73c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 846af70b35ba76b09d27cc36fe8cde66d80f2c7d5d4d1687804ac26fda291218
MD5 f5efb99e27633da2fe24f10fbfc0f13c
SHA1 71abca7537b6a1d6427547473a6ca1c3a9c5505f
SHA512 be0833cef412f589e1a4c509a99b6a15a428115af3a8a645797ce9db36922861c400038d5e478e894c50a9d3ff3ebadc634d99e221b3537f349ecaafff0d2cda
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 c6b1cd8118543ace1a21f1014f201658a54f5ed71fe5c30a54297979da02439c
MD5 bc0fff7109714c63ae595f60d5fd6890
SHA1 fed8b1c6ea65f4f044d999b9752d1893fc02fce3
SHA512 adea02f1268238de5827308eec5ef74c00af4e2f16d7b7ddfb806b6194df5ea917af2ace77f3a0ea2b8ce653fe95bd5ad39b5aaedfe3b5a64da5075e7ffdab6a
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 7957d4612e7201fa41ddba5e700864156c6d130d688a489866ddbe7e11a8c3e2
MD5 6b49777379ff70907d19f184514b67bb
SHA1 ba9a6aa69ca31a99c6e2bdb3c4286300018ec271
SHA512 ec7420e17092c648525ee082cec57c636e33dd890715740b51c0f3f6596a1c82a941342238a657d0aeb2b298c59e37ddc8833faeed4fd367af5f6d21da063466
MD5 SHA1 SHA512

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DawnCache\data_1
Size 264KB
SHA256 0e72e3b953d0eb1f9b87286f1e77fd2f68e9a273c81b70b45465e71721f428d0
MD5 59972dd2f2b27a573bc0675647d4894a
SHA1 126c63176c7786c7331d65ab5cde9da745202f7b
SHA512 a2bffa2e0ae996d4d1b3bf9fb82dc12e80a1bb6a24b3ffdcac1fa968bbaf39ace1f847c9ea206b7bfbfd6458a1a89e14bae06ea9407530881059e7881d5f186c
SSDEEP 3:MsEllllkEthXllkl2zEJllD:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Favicons

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Favicons
Size 28KB
SHA256 a93e7f46eaad00af69572d05c77c64f7e8fd24dd35ae8a88e54670615b5e8f3c
MD5 a71a10630995164093b6e57fc0bc188f
SHA1 d75c6667ec42eb577b9aecc76e5edab8a5d951bc
SHA512 1616931a9bc79ba50514297939678e4d6e2e247f2daa9f8afed83c35b49455c65c8432aedc2a26e5c70de984398d8090147dc4a3c87e4dd40a142e5a6a16b98e
SSDEEP 192:8SFZhuD8JZ7GY5aCBPo1ZU3fJPMp6PunXSTQhaG:HFLqY5aCpim3fJ16
MD5 SHA1 SHA512 SSDEEP

Submit Download

History

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History
Size 192KB
SHA256 a77b29c149dff88e8955bccc160f583bf8ea59e26ce8226d280659c5fafbcce0
MD5 d66394c27f7989efb841c701f49bc476
SHA1 30b4cdc222de578af46aa4fb8aaf9d205169072b
SHA512 a291fe60995ab2e8b49a1a1da3dbe8ec5058661c5e8822a12afdb16e0073435e513e6162574991865ee9dc2f0e950313b6c52981fc25b038fd6ace22d872ecc1
SSDEEP 192:pMFt/sEuKwJB30sW6Pyif+GGBE3upbHeStSVj3XJl7n0TqJ4oDQj1DCHK:k4JR26p/GBE3u1HeSt6JVDQj1D2
MD5 SHA1 SHA512 SSDEEP

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 8cd116158268de11cd79180ce074a6a20a9e56f15fc764049f2cef43a21257c9
MD5 c84c2e0c131adc8976ac2fcf71fc74be
SHA1 536fbc933e686f38d443b28500915830fc5bf86c
SHA512 c7e4d1f149b14a11ff8f611d5009617d74b79e8477f0dff7272c594f94a2269e8bde5483756d22cf266d2e97d824e169c50c16d16ed3e9b36f100a8f50dd9e4b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 24KB
SHA256 636ed8b948a936d1e45191739e32f85eb0f63d29942508b916e7bedc2ed42cd4
MD5 e191319c403bef470f2795580348a048
SHA1 1104997ca986680acfd8f94e635a72d7c0c17727
SHA512 2ae4befcdc24ae146807d8510d87ed9606efd586ae68eadee384e392ad7cc3a184e46c57629aae8aa764854de77f62619790516f6f8b6413d21858d12ff0ce2e
SSDEEP 384:/4BlUWe903DBeIcKqmpDHL0PTJhlfGhzDMMPPy/Kgmrmb2fPhlsIFazL+JkHWKh4:yXdr6dE2mF5YhnTK
MD5 SHA1 SHA512 SSDEEP

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 24KB
SHA256 462461c2f854ceb3753d8e87b640942e141b40c944d0f6959f3798d0d4b0f0ca
MD5 3f4bb713735fadb3204dfabd90f5557b
SHA1 a666bd827a55b50d20e6df50e058350aa5285d21
SHA512 d514441af60221678eaf6e5f89f00da5db5fd9724a2e2703f1ec145f3a91806d44f6b4a0ed239224b2af9de1acc56b6ec3eaa5c5c2c3054f3319de7ad4a118d2
SSDEEP 384:/4BlUWe9F03DBakqIcKqmpDHL0PTJhlfGhzDMMPPy/Kgmrmb2fPhlsIFazL+JkHY:eXdrKdE2mF5YhnbG
MD5 SHA1 SHA512 SSDEEP

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 27KB
SHA256 6586cdbb785382de743dcbd7f8bb385ff406f96d9ca77e824865994fef1e046b
MD5 b05e9076e424eecf955007abcf60a305
SHA1 651bf4a425914f2452a782ccece90d499243e55e
SHA512 b76eb2451a6c37063724557047d1cf24b9d62b17bddaa69f599733a7b3ede2f9e2b1cc4d51f3920fd7cad617415fc755bc15691b231013ebbaf1a1a2b37d6541
SSDEEP 384:Dr4BlUWe903DBeIcKqmpDHL0PTJhlfGhzDMMPPy/Kgmrmb2fPhlsIFazL+JkHWKz:KXdr6dE2mF5YhnT66b
MD5 SHA1 SHA512 SSDEEP

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity
Size 2KB
SHA256 6d25fa2857cac11091c0054860406f8c51c84261f5f9cf233a5b9ac77abfe382
MD5 d798f1bbc5502b8b6dd22ca3b5afca49
SHA1 eae51672fa95017e7b31e49c593b30ada8bce564
SHA512 54acd564df0926f9aebdf30b00c6c8e4cb2c150d5a8cdffeca43f595a1f3437feb9f29774591e3c70c89ebb9da99dec944474aa2b4367bc4959c78be09e8c09a
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity
Size 2KB
SHA256 91466df409a2b18f3f86aa2d0cd1a7dc8e962eb67f86ca0d140e335edd0b3357
MD5 239057de83ebc6124ff23622762fbaf8
SHA1 3eeff99e294c48cbaa1b9b3eb5a92be3ca92f514
SHA512 4efffff8f6d39079e6f309269460cd3c9417cef9c53a4432fd252f68e896cec0da3c594a8d46bcfee1d426fc6c72536e30333e119973f044629b23401eb690f2
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity
Size 2KB
SHA256 1e22fcc43d9b553bc143f9ddf0eab0a4926b853db2712c7b013ba27f9a4a4eb2
MD5 6ed9c199f5bc544d5cc49dd257adb7c5
SHA1 d938c343ce234b15e3f3dc157ec6fc312231ddff
SHA512 93db5f61b0df9d760d19eae512cdd1f9a15d71d8eaf511fc2f390ec06e01aacf924664e24360fac8eba338e6073c6981dfcfa1512964615ecb38d7d077b5f326
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity
Size 519B
SHA256 75b6a340a3b695ad5dcd567195c2659055d65513887a5db0204f3bfa844408c5
MD5 52d8c1365155c45e5a18905e54ae1249
SHA1 7df49f8bd35560886f6f89a42d55cc4004556636
SHA512 b731835044c11aa0848163d53d8c5ce3b35585a8b4ed67243595fc11dc7153c62f29c31b75d2cdfd9f10df31542e801ad0a573cfda654e50279dd097b532f415
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity
Size 4KB
SHA256 70dd4480b4d7cb26a45c281cdc43a3216bada28f06849b275fe38ef438409e43
MD5 896e8117bc4ea13a4c2e528a9234b2fe
SHA1 76cade467c5cb63e6467f479fd3d332eb93097cb
SHA512 3a84f64f9b1cd22ade497d766389fc398cabe423332fb506ff12598374fc8a790e9366ef0d88b3bef9b12d722bd273451dfebd78c9849c32e61048dfe5b5013e
SSDEEP 96:4UKU5UHU2ZUOAUYBU/USFiUeFUfieUZUL2mEUOttUdeUgaUeUyUB+70UcngUdfSU:4UKU5UHU2ZUOAUYBU/USFiUeFURUZUS5
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity
Size 6KB
SHA256 b7bfa99c205c90cf228646f65f8b54bcbb391094262a210cf2f9d44d2b74320c
MD5 d72e55b9be6e06816bd8ca5fc8f2718c
SHA1 c3338d3831644d82ace97b3cdc9ed7744bbca253
SHA512 347101247905da8887eab28a26f912361f4fd32a103f5ae7c170d831feaecd84b58616b13c652959a2b33a3ee6c574fcf0c85953ca052aa31dbdda5d9d6820f9
SSDEEP 192:4UKU2HUiUHUSZUKAUYBU/USFiUeFUSeU/UMUFUs3o7UGUE1UOttUdeUuULUeUyUI:4hj/qVZ3AfAhibMKNuHY7zTlt/5SLl2s
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity
Size 4KB
SHA256 5bde71bbd57bcedbbf798f64e3e53009eb2383f8fc7752fc35aa6543ada5eb81
MD5 9a267e505b8f1828752edbaf84cfc4c9
SHA1 3b87bccff218a646263061595e009c88a6b12fba
SHA512 c7f07a3193fed5824b4eb5be44c74048e00d20d43600a5eac3fa63796a9061e343798d83a917c2f77e1a42be662c94b8fc3ae81e0cbaa7ab35cfb0daf12348a5
SSDEEP 96:4UKU5UHUOZUGAUYBU/USFiUeFUfieUZUL2mEUOttUdeUgaUeUyUB+70UcngUdfSU:4UKU5UHUOZUGAUYBU/USFiUeFURUZUS5
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity
Size 4KB
SHA256 255a64fedbdb281fa089730462af92540e6a70b21d180f49bd83b2cf1ebb91b0
MD5 13f8163d3865905587da690e9a37a46a
SHA1 4ee842b76a2a63dfb3e17ed2620bdaeec30ccd2a
SHA512 5042fa8134f658199f29a191af47e9bd8acbeeae59ebb321bea70f8daaf008999723023be2b8342c7e444391341631b3def04c36f10097657ac3fd4bb5e8c108
SSDEEP 96:4UKU5UHUSZUKAUYBU/USFiUeFUfieUZUL2mEUOttUdeUgaUeUyUB+70UcngUdfSU:4UKU5UHUSZUKAUYBU/USFiUeFURUZUS5
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 2431bfed5de391ad9bc5f962772038611140f08638999d45ba56377ee4b1039b
MD5 c891e76b70330dbc9d4599508860141a
SHA1 bfacdcb5f7c85a11429aebbe4691b32d661b74f7
SHA512 1f8013015a910457987ecf4e94f7fa39726bfe7cb3832a14dc2fe513f5610902ba394af2eafaed2e2537e26048cc6df15f294c4d49432ce271a033af431bc1ac
SSDEEP 384:sV65HXcyIsyWcu26fg+8ISeUSUx0G4qBVoQfhsr3vwsz/sWIltNM53QLs0WNYrNN:sc3ezupgBSUfZQ7TeF2ego
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 796e4fb9b897d12c7aa97d2e43b9d761ede1e92ea81d55094fdde5e11f8370ed
MD5 11ecd6cba78fe773e53ec9187fce3359
SHA1 9ef14b10a6414224340f47595afc472ff5ae965e
SHA512 c3f73fcf94a52fe8690c00950a47725d1fbedf604d01458ae7ac7f77efffb8a494dbdc5908314d0777d6fbbab29b648f0a294efc3ec822cd9f5a60ca2a2c8e5b
SSDEEP 192:sV65f/jXDcyIsyWcu2cwl0fYN0qnoorIBBSj+Fx07qzfKlzQjZi1xSd8sizd6hS6:sV65HXcyIsyWcu26fg08IBBSUx0GrKB0
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 20KB
SHA256 ab4bf9a1a640c7a67419ba1f85d8632da19fdfb570a9b8ec30271c2b7793a117
MD5 c1ff1173af20fc69818ab98c803813ed
SHA1 9d008a097745e8ac14f7f42d9ef42db0f503aa67
SHA512 4e1d5c6651cb5918228d897b6012c596c67006e6f36ffb0397eef1ffe4f22dd39d645a90807bbb3d540eec276545526a1b24ea49dc91a5bb47e5707a6c2778c9
SSDEEP 384:sV6jyHOcyIsyWcu26fglwOWIleUSUb9qCygBVoQiRtteNAitzsYoAJvwszdz/sW2:snuezupg9SUZx975ToFV2hzuD
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 20KB
SHA256 177fb46b48d4f7395ef57cd919c07e13ac3953f6eaefdfd17a7be35c08cadd48
MD5 22eb7cce39cc6c433a76bf176fbc6272
SHA1 8bd04481630e064115574d013bef71e9d5cc04cd
SHA512 919efa80f6fb3751a2ff559c3dc83b314889168482002695ac5c07d3cd87dc4284a9def5a99c46d1ca152224c0bdad2c14d5023951cebfe83e01f192d7834fc6
SSDEEP 384:sV6jyHmcyIs+Wcu26fgXwOWIGeUSUlsqCB+BVoQiRtteNAitzsYoAJvwszdz/sWM:snGSzupgSSUvx975ToFV2uJhD
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 20KB
SHA256 8f0e332472f75a79d87bbb49c2749fd5e9d39cf0be7395b58de7da208317a81d
MD5 d9aa35c6df4b45dd9d718b48dae0cf0d
SHA1 f2fa21b34dd47a8f10f2bec9434949a1617ea76c
SHA512 1ae02615e5bafcc9f08025fd4ef302208cba51e2d6564fd6668f0c4cd5a725b4b191de76c2da3b9f256a54b7a08771fc2991fe71c8a43bb2ebd382c305c730ac
SSDEEP 384:sV6jyHmcyIskWcu26fg0wOWIUeUSUlsqCsIBVoQiRtteNAitzsYoAJvwszdz/sWG:snGIzupgvSUux975ToFV2P5iD
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 21KB
SHA256 c0d27e55b74a09d0aabeceac5ab02b085b588ec38728490e4b63207ef1833786
MD5 15b14fd8249dcf2b23439c9b644baa70
SHA1 71d71b0d7a1efd768ef5ba9448e3405af49a96c6
SHA512 89ea9fe7ec03610767fa2f3f71d6440d725548ce3624316243fb8bf91f411b7ebf728e88069a837e3cfb767d9527214d6a8ba507e0923fe1e3f705459984c28a
SSDEEP 384:sV6jyHmcyIskWcu26fgMwOWwC3eUSfVlsqeq/n+BVoQiRtteNAitzsYoAJvwszdW:snGAzupgPS9ex975ToFV2lfGD
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 21KB
SHA256 6fcb55f09aea2c841183ed957321dffe32b49248dd1cf5ab40821c42a01453b1
MD5 b5df3a66896e61045169083ec9f1ed3b
SHA1 89e91518032bf3abc3204857f232c4d32563e915
SHA512 e09eba9ebc945f7616165f5c2c8419a66f6c82813fe0b0c7816e3ee4c32424e0ac1bb70ac88b4b90e3444a547276d607a8ea3ae9bea2cd8a840f7f5b1050e60a
SSDEEP 384:sV6jyHmcyIskWcu26fgwwOWwCmOfUSfVlsqeqP5/O+BVoQiRtteNAFNtzsYoAJvm:snGAzupgcS9Lk975ToFV2+y/GD
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 20KB
SHA256 aa8024d4625c90818a5a4d9d9510b1a5b80b48d98039dd3272658aed7cb0600f
MD5 dac1b7aa6fc98721f79d3fe06cc2b810
SHA1 c10c2cc2d2197b141037d85335cf41dec81bd55c
SHA512 14bfaf62b1d7b0d73997f00d9bf4bbb36331b1a90a54a9cda0d92b952e1284774cc22dd8c8fd181c5f91861650cebbf117e17013b66c3cdff2911f2b54aa5593
SSDEEP 384:sV6jyHmcyIs+Wcu26fg4wOWICeUSUlsqC5+BVoQiRtteNAitzsYoAJvwszdz/sWj:snGSzupgFSU/x975ToFV2zDhD
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 21KB
SHA256 7917491161e250b1ab31cd362a3fca1ef0a7e5227c2bab73fcb808a9ca175e35
MD5 51f77ad003dbd5d939126117decde5f3
SHA1 307ebb570fc3590f487da7b876bd5594c71d1333
SHA512 0c9adb3f873d60d0b778ebcbdc4c2d0d3cfcb52815c037493e315d3b55c9cab8893b0079bb4daeb232796b6b58455e1f774895ecef82d45336360501a4f5d513
SSDEEP 384:sV6jyHmcyIskWcu26fgfwOWwCleUSfVlsqeq/w+BVoQiRtteNAitzsYoAJvwszdQ:snGAzupgaS9nx975ToFV2o8GD
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 20KB
SHA256 6393f165b0889eeb6cc4cf31df87cf90db1854a120d357bf44ede76673afb0c9
MD5 20d9951ef5213a095e1989423e351314
SHA1 4f9b8a5d382ff11370ef19ed29185aed9caff94e
SHA512 d44e32428ebab08e6909b6bb673e4641c685619a99a408ed7b9c322ea170c3b2e7a742e81bfbd233a2856b25fe76e111325fb8553d561efa2bd617ac6da164f8
SSDEEP 384:sV6jyHmcyIs+Wcu26fgpwOWIDeUSUlsqCm+BVoQiRtteNAitzsYoAJvwszdz/sWF:snGSzupgjSU+x975ToFV2GFGD
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 20KB
SHA256 a9e727c7aced0fb4502f69c4d0fe94b5cb244546ba454b29463e7166ab932b14
MD5 3d93df8de1a2a7c39a0a5ea5e6b55a95
SHA1 b10cc64c5a7ae1d71b16882dd31d05596abea72c
SHA512 95d7db643c07948e79fee132283871e7c33d31829c7905eb2acce1b58dbce97a44f915a80ab61a00803d2b1c5600bfe8382ae52b158e835ed778082575da257f
SSDEEP 384:sV6jyHmcyIskWcu26fgUwOWI4eUSUlsqCN+BVoQiRtteNAitzsYoAJvwszdz/sWj:snGAzupg3SUzx975ToFV2cRGD
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 21KB
SHA256 2b27c1ac3f9a809d49d797fda8a4c3d22b54bdbf05b73457fa22d4855bec03d1
MD5 18605930377a8508ff5bda19fcfcc9d4
SHA1 afcf7a04dc24c4765494e800bd0d77510d74531d
SHA512 ace7451c450f194636c291c9ffd59c1a2eb91a6772d8d2355fd6f30a9329284adc88d320594148f49a45ec74ea8e123c2d95ce5122f2fd8401e05c42befdbb3d
SSDEEP 384:sV6jyHmcyIskWcu26fg4wOWwC4eUSfllsqCN+BVoQiRtteNAitzsYoAJvwszdz/n:snGAzupgOSNzx975ToFV2cRGD
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 21KB
SHA256 bdf44df84120857012c4718d45acb4e2def06c9a50a0d7f31afbafe43e6b7527
MD5 b3ee5088830890bf2e1ffa1c233bdec4
SHA1 7de87d75793cf8c3dd0f70c9a2a513e2ea328860
SHA512 55054639b2686b8f9c41b3a2131741924796cd07659f64c681275a1d0640a6a48a8741388b19210c4b113bd2f8f65c5cc2735cae1036884f90744d08f05e4b43
SSDEEP 384:sV6jyHmcyIskWcu26fg6wOWwCmeUSfVlsqeq/O+BVoQiRtteNAitzsYoAJvwszdM:snGAzupguS9Bx975ToFV2hRGD
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 db894b02cd90520baaa579c2a6950d44c207e161f95c0e02e8400399d74e0766
MD5 2c15515e2712158cf05e13ad0841868b
SHA1 e727481b11b973c183fe1ac6514394bc0cee9b6e
SHA512 4b7426e32d35213f9a79404e5079971629ab47c165ab3f729d854d5f2755a748012bf5bbb02e5b66b844bd16f9af91e185086893cc8e0e6bb33ec3cb0c249c16
SSDEEP 192:sV65f/jIQIsyWcu2cwl0fYNNqnoorIgBSj+Fx07qQxglzQj6gOizd6hS0U8FXJ:sV65HUQIsyWcu26fgN8IgBSUx0GqgBQ6
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 20KB
SHA256 f36d4153e8379bbd81c55c17266a219736b452f3fc6baeaa4ae36938c1840088
MD5 331f57244e9d13d3b98f98800916cfa3
SHA1 4cf9fec742626e0f01dae95a9305af83604479b1
SHA512 6e935a12a9d1a07d01f2456929227a5018a78dadb3a250f771981f5d03e536214460a71911ce4be39c30ddeaa54aef6675e5d5f101a4709511ee9721dc627d17
SSDEEP 384:sV6jyHmcyIs+Wcu26fgqwOWIMeUSUlsqCiiBVoQiRtteNAitzsYoAJvwszdz/sWk:snGSzupgBSUGx975ToFV2y5hD
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 21KB
SHA256 dd997a04cb30768f41d7ed08c92dad79fa387fb545759822c5a17d929ce5bcb7
MD5 2295fe4efa3865979de084a38fd86c26
SHA1 41294a26a5697229414e031eec6d305f07d6c6a7
SHA512 a031f1973f9c63538ccd9011486b30ec3b15183d434ed8cab8cb602d342492ee86f5a0dd7e09dde76f9c582e65e35d174e9a667beec980d8a16574d267b58c1d
SSDEEP 384:sV6jyHmcyIskWcu26fgAwOWwCZeUSfVlsqeq/W+BVoQiRtteNAitzsYoAJvwszdc:snGAzupghS9px975ToFV2IAGD
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 21KB
SHA256 49c2fb5178e8d468edae1509c2bcf9475671bcb52e6334ca0322876ac5f9eb09
MD5 d501134a8dca047175e243e6a8abc132
SHA1 40f723f1c1016f495057870745bc8605c961dc5a
SHA512 fcb1074528c1b8f16edcc74b8a3741a15b95eeabb6a104c3bc3f07959cc5070227055e9f0788e5e3758d8e7a84e612eb8e3684f81b663cd9643a88265df3836c
SSDEEP 384:sV6jyHmcyIskWcu26fgywOWwCleUSfVlsqeq/7+BVoQiRtteNAitzsYoAJvwszdr:snGAzupgHS9yx975ToFV28RGD
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 20KB
SHA256 dad17089f1b704a6d9b649c010b7ec3955fd9cdf483a1f11bfb74b64fcbdde08
MD5 6d281563367fa866ef37912794926df1
SHA1 c37e3be5d28897d43909c6807d508168c417889a
SHA512 f42de521a5570c6b94b1cf8917f042a1ab2006f6fb94db29560a0f32d3ad060545a4b8549381eeef0f708e6adb78fdd5528cfa5b8d80d5e47966977256752991
SSDEEP 384:sV6jyHmcyIskWcu26fgjwOWIseUSUlsqCl+BVoQiRtteNAitzsYoAJvwszdz/sW3:snGAzupg0SULx975ToFV2PqGD
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 20KB
SHA256 b7637a9949f4e1dfa759c906ba7ea8bff6e3de1649a5fe13f3814c0eb66725e4
MD5 e83f28591690761c5d1e9d03ba3a8447
SHA1 5ff78ec1829448c75e9bdaafd002be84778380cd
SHA512 9e1cdae5d2be113f5ce14069fcb85913250f70d6105b39119a061c92d82bf01ff88d17be94545c48d702b7253fed70a153ae104bd0cc5d79055f61e8e2a15cd6
SSDEEP 384:sV6jyHmcyIs+Wcu26fg0wOWIUeUSUlsqCsIBVoQiRtteNAitzsYoAJvwszdz/sW1:snGSzupgvSUux975ToFV2P5hD
MD5 SHA1 SHA512 SSDEEP

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 2ef400f3f66a57d2ff85b029e640a7ad1b872adf262dd53fa68b0c02969c75c2
MD5 fa45f1c5294c87c3c1176f5cecbceca9
SHA1 cd1fc4a1edf534491a90891a5f2ea95632861129
SHA512 22ca7a25ff38abfbfad951b419d416bdc6c08d94a58b03ddff4dbe0c4fb81a9bc656d3ee335bc9835f08c5477619a5fa2fcbb24181bf2c4f6fe89e538bb3e3d9
SSDEEP 768:oqwboW0FLEL6SkWFKCo68F1+UoAYDCx9Tuqh0VfUC9xbog/OVHZLl/xCJOrwA:oqwboW0xi6SkWFKCo6u1jaSZLBoJLA
MD5 SHA1 SHA512 SSDEEP

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 6b3c7871bd339c643f78b10f2c5b9ad7539f707407a94a45caedac74edfc2acc
MD5 c562ec68370ff839908f6c7e46748d4e
SHA1 dfb07c538a0c4ffe86ce024174f56dedd18f13f8
SHA512 c4bae57a57e46676aac53ed2648acde3d634578ac0c480b41838984355b797e8da829a44308237088ed3f8e605e8947a006e86d10b95adbcab57eb78c95fd69c
SSDEEP 768:oqwboW0FLEL6SkWFKCg68F1+UoAYDCx9Tuqh0VfUC9xbog/OVHZLl/xCJOrwtn:oqwboW0xi6SkWFKCg6u1jaSZLBoJLt
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\c5ce88bc72edbf8813410e12eaafa3c8e5ceb644\6a40abd7-03e3-43aa-89ce-9e9b1ad3c1f5\index-dir\the-real-index
Size 1KB
SHA256 d2d8dd25b4b531bb95253241ab87731919d33e48c69ca3ed9bd712e8183206f6
MD5 589109f485ab9c4ef73f752bb0a23cf1
SHA1 0edbb02559cf17090a61101e3f37f66710c1a337
SHA512 41d6fad5de4e065884540d9f23d00bfbb1fccb7b669337a7961bdfadc8c1f6b8418f5a6bda9d5bedfac67f55300d08ccff95680ce4e5267208dc229ac9b37277
MD5 SHA1 SHA512

Submit Download

the-real-index~RFe638199.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\c5ce88bc72edbf8813410e12eaafa3c8e5ceb644\6a40abd7-03e3-43aa-89ce-9e9b1ad3c1f5\index-dir\the-real-index~RFe638199.TMP
Size 48B
SHA256 fe88b61cdf9b51837d2c43af89afb9cc7f50447f904dee78831a7014bdd77c2f
MD5 245578b799e6e7328b0391735eae1647
SHA1 3292ac35d71e623efc0772873b80794254c53ce9
SHA512 42f65924b91e524419d697584f5feb6ae1449da0241c3ead578eaa79cef5f7a2b79a3b4e491da04554e41930880f9045f2f0e5dba895aa138cd5bd2098ca8f97
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\c5ce88bc72edbf8813410e12eaafa3c8e5ceb644\index.txt
Size 142B
SHA256 0240a01f81ba1adee6b9c91a64af3fa150f525295c5bec1eddae9fe0c69abadd
MD5 2b362cab404ee0c4865554531cdd83d8
SHA1 823531f3c999c7aef31f1bd646680162c31b31f4
SHA512 2c6c85474f9329ce721f0eb05b8d1156cf4976d8741d32c3b46dcced1dbae549426c00a1cf885318e53aaec8b68d98778330905c2e9ff68ced26abec6480aadd
MD5 SHA1 SHA512

Submit Download

index.txt~RFe6381d8.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\c5ce88bc72edbf8813410e12eaafa3c8e5ceb644\index.txt~RFe6381d8.TMP
Size 146B
SHA256 f0aee2f6c535924c10620f8451e14cf3428bfaefa2812575ee484445cc32daf1
MD5 fd2a593a850727bff338c6242186ed5d
SHA1 23ded5d5359db90bb930f2e4e2debbc1cc4a5695
SHA512 35909af5979ce11d34833773de7ee36dd3c920aad0aa589366ac507e86aac5d11e2bcc5a89aa8ffd0663d511147510f98211c7e9e52bd32142a72bce39b8056f
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 fe447181f41770ba3528ad38fa2cc21a650609d1ad1502178c2cc1440df672eb
MD5 82bc3127782b79b66becf0dfcd061948
SHA1 0650e3822567f7497608f5f25862d5f3c4c38a17
SHA512 3b1fb4b439bd569cb550e97f1e803b7280ff1bdb5fe5a00d90268a3b215ad400826ea3029c1c8dc663da3d116affdff2d207069d4cf1de1ab3b15d677fdb7600
MD5 SHA1 SHA512

Submit Download

the-real-index~RFe636084.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe636084.TMP
Size 48B
SHA256 f137161fb40d94e293b35f2a0864ddef603dafd4411e844f067d9f54961a3b58
MD5 50cadde197e4846411cd4d541c2119d7
SHA1 e6fdaf8a7b247f6c69e3e11352e4d3395b7ded86
SHA512 89688f12eab4a8fc94229d3b272c0fa5c4a0d1d430e822054969ac1082d266eb654122342c7b1ac768bf381e5ebb4561cf5ddd5d921e824b7e02708b7057b720
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\index.txt
Size 74B
SHA256 13b71108b56c61caef407caf23ff15edc4feffdad1bd80723bfa4c40caed4567
MD5 374e59d5f81d4a38553218f6f4b85a84
SHA1 970fec6bfd365f06fb8f41cc735db488e3149ed9
SHA512 73c92417b3a4238ae54f2d74f27a08f43b133743b3173a6ae7be01d56146b79ca6cf23994bffee4afadba3e924f0bdc6ce2362a48fbc51665af1ff6ecbb22fff
MD5 SHA1 SHA512

Submit Download

index.txt~RFe62fcba.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\index.txt~RFe62fcba.TMP
Size 138B
SHA256 9733d97dbc025cee25fd761149f81e5ed636c3eaf78952e8486bda7f6d829c9b
MD5 fc278c6cd363285aedcbf08391f7f02a
SHA1 f7a818fd0f33d8224e0acf6fdb1ce1d486a706e2
SHA512 1df412234f409ea44a2aa8ce3c17eee15ba3a8022ad3432c0b86edb79d0ddf144f5e1a662fab88e7323e3882ac29dc6d2ed0c6f9e28ad749896c3017e0b95570
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\IndexedDB\indexeddb.leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\IndexedDB\indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

dc65deab-4866-4c78-bfa4-a0a78d5dfb96.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\dc65deab-4866-4c78-bfa4-a0a78d5dfb96.tmp
Size 18KB
SHA256 c90815079d4c93cab363d3338714510a394325242fe4dea7be9ba7c0abfa8b50
MD5 50d66bb146dbb192ee19375702b0ee4d
SHA1 690eacc443f366adeace52883c027ff199b55b1b
SHA512 e231ed3a5b4f76909560e06df3cd6e3d3f255d214a05390f3e9388ccd6c66eb3f6cd13704307e9370720da1f46555cb48df990cc4bb91f16d4c05d3f10f0307f
SSDEEP 384:sV6jyHXcyIsyWcu26fgtwOWIleUSUx0GygBVoQAmeNAiZsYoAJvwszdz/sW4Ra4r:sn3ezupglSUDG975TUFV28egD
MD5 SHA1 SHA512 SSDEEP

Submit Download

ed8d1081-7dc2-4314-bceb-42d700fa8985.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\ed8d1081-7dc2-4314-bceb-42d700fa8985.tmp
Size 20KB
SHA256 263da40fb0fac82d371301917f78aa48142f32979875e294de5a85a28699a8c6
MD5 c829df50699e12083b2e0edddc595469
SHA1 506cd02f66c65e71cd2508805508012e95b99571
SHA512 acde6e4abfd2c7f53baa4ad03a0deaa859d465e6d2d65b6be9d3952aa5a4f265167307707f4a6b9847512935aad23bd68780bed7004e9a6602aa48d1cc6d5509
SSDEEP 384:sV6jyHmcyIs+Wcu26fgywOWIEeUSUlsqCu+BVoQiRtteNAitzsYoAJvwszdz/sWq:snGSzupglSUmx975ToFV2fFGD
MD5 SHA1 SHA512 SSDEEP

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Size 13B
SHA256 da3e73d31020d249d320f01fc40220043e34ebc99fccaec56c5a97f671a8f227
MD5 9f0786e66f4c80870bd874b7aba0a394
SHA1 74d461c9049086ea0301b956203e7cb59438160d
SHA512 f766b4ee7c28886c1901cf76c1c917e296ddfd3cf843f4f27d7a73db37247ae0dfb8c3f343c4ba124d20f4475e0fb4cf60860215480341715bb907d73630cc6e
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 67KB
SHA256 1891c0f83a2885b43acc02c44dec68c44856abe6212083524bca80dd7a9c34d2
MD5 890a2dff568d37f280a13c4b5d04337c
SHA1 98ebed51805e42428eaa0d11a161404ddc34cc57
SHA512 0919b65e29c93c2767f21175e8193f4c3e200981648e38e61ec42c78f4bebf5d10e18d8627a0d2d293a47cef8803561cdb7b678c657df8ffebb8e1492535b119
SSDEEP 1536:kMrKiXSFcW+YT4T8E8KCwpuSllQ8QL251gJUVAf6IxNwIvf4p:kMuaSFc1h8luk8QL5USNwIa
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 67KB
SHA256 794f4b3fe26feb73e0f72f32ec4b378f567868397f781e459eab2e4639d8f085
MD5 6e7b7415e2bf806cead380d468b227fe
SHA1 5208867a8fc26d94ec959d0a76648618ef959438
SHA512 e0cf94bf635f9e34d175146607194b13c3717aae52a3a8d4369f8eef416dea99a56ed65e210c1ec98debdf2bd529f7ef9de46d1a9d0d03835e1438cda5e1bd11
SSDEEP 1536:TrKiXSFEn+YT4T8E8KCwpuSllQQQL251gJUVAf6IxNwIvf4p:TuaSFEqh8lukQQL5USNwIa
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 67KB
SHA256 1b57ee571369c43522657e53998a91fec5b7a7ae66b98927754a194fd4266879
MD5 5fc14258580d185550f88ef52a46e431
SHA1 a9f5a22975116c61aca6ef04c656072a70b07ca0
SHA512 b5c624c7c3f08920c107ca0ca115d5b8cae543b153546f34b2f08be80023e44a5c215cb67d1c017e1643e01aada938298f4094f42b4f50fcc2ddcaa65c902ff0
SSDEEP 1536:arKiXSFPi+YT4T8E8KCwpuSllQ8QL251gJUVAf6IxNwIvf4p:auaSFPJh8luk8QL5USNwIa
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 71KB
SHA256 906957356331915ac4d10a6ffa478698597f70261b21d299956a3bc94bfa7c4e
MD5 cbb3b23e6638375989d6f4877de39b0b
SHA1 db328c15fb9c4e39bc35408127926a8a526c44f2
SHA512 0d61a16840b8cac539879104dd80ea1150b540e6beeb6f534975c9c081c370aee48cfbd5d397223508582a497c25adb8bff4e3ed42fa4949814f7a27bf93bec0
SSDEEP 1536:QrKiXSFfR+YT4T8E8KCwpuSllQPy251gJUVAf6IxNwIvf4p:QuaSFf0h8lukPy5USNwIa
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 71KB
SHA256 9c53cb334a6f1e28c4a32a6ec18c395e02c6392901f524f27e3f65385bfe8726
MD5 73c6f55e72bc4b82cce779fe769c0b07
SHA1 d29f6f49d6f7ead2e06e0ab74dc406e94c6a5abe
SHA512 8e8253d0ffdcfc0111a3c6e3bff94d77f196d493da76d7840d634dfeb8b672e66ee1f1decb648bc12a0a55ca457e783ddc3a61df21dce2ad96ecb6effa552176
SSDEEP 1536:rrKiXSFOQ+YT4T8E8KCwpuSllQ0Y251gJUVAf6IxNwIvf4p:ruaSFOPh8luk0Y5USNwIa
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 67KB
SHA256 82f2eab5e377aadf4d2588ef881a3d62a10472255c29ef8182edc593931800d9
MD5 40ad87278acef4627c86e1bb112b353a
SHA1 2bf9a1d755ceade188b7494c225eb8d388916076
SHA512 9e707d6be3707368bc1c2fe84c48abd0b2b648700427e5381f829e716d7ec7f068739bebea19d1680ce64d3951e7931af6c0317f6bb36e7b94f1f5760d1c108a
SSDEEP 1536:trKiXSFU4+YT4T8E8KCwpuSllQQQL251gJUVAf6IxNwIvf4p:tuaSFUnh8lukQQL5USNwIa
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 67KB
SHA256 d8359a698a5154699530acd48dffed07f0a237b4a4a6e4a5c507aee790001a78
MD5 7d732e80f4e67e9121f9ec60e0434aa8
SHA1 b11881d0f76fc7af7623c2284e3cbeca049522d2
SHA512 54d4da8b9321064687d3f486848b26a9f9b9e4387af13792197355ad1af8a10aa15edf0a9edbd63689d9785fc1eadecabf52f2b64d7b1259a2814f4f6101eea3
SSDEEP 1536:TrKiXSF9Y+YT4T8E8KCwpuSllQQQL251gJUVAf6IxNwIvf4p:TuaSF9Hh8lukQQL5USNwIa
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 67KB
SHA256 bcfcaec45da4c139d0daa7f11fe252f415b6edc7dcb620d8e175c555562be9ea
MD5 de836203774d9f24c5ec7999ae6e736b
SHA1 b1ebed7ff682833b65104ddbad9ec69acbb380a0
SHA512 0c5a2e5f0018449d7009fe847e0ea1c7d62918f7b952d7757e781b9347854a547db12deef108482dfa855aedcce06a246409295c0d291ffc5708c9bec1007f1f
SSDEEP 1536:+rKiXSF7sR+YT4T8E8KCwpuSllQQQL251gJUVAf6IxNwIvf4p:+uaSF7s0h8lukQQL5USNwIa
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 67KB
SHA256 7f3708426d8c499ba10abf13a995e7efeaf47945b0a3a9d509f5b18ed38e6e82
MD5 8c03f524adf5d0becf2f7b1a54242794
SHA1 bf25634ae80ba461f2ddd344983f7e97632b0d9c
SHA512 ff31cdcd1bbfa2d945699f55de6bd07f0c83512213507b500d27b643cec3b06dff98fd0926247a38332ad3f3d4b2b319d1e254591fdbb3b60963f3d2f744741d
SSDEEP 1536:MrKiXSFWH+YT4T8E8KCwpuSllQQQL251gJUVAf6IxNwIvf4p:MuaSFWKh8lukQQL5USNwIa
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 67KB
SHA256 6e5cb71cd2a032a9e1989777a5ccc76479fab73c069403f9177c98ae310d29d1
MD5 132531165b6c2aa73cf130e9ac278bdb
SHA1 76d3217412fc2a312ed068b6e372f41f08cf37b5
SHA512 5efcf5a51b29337e8a91d3710eccc20d5b04b7e7e9b75ec3b74056d4f5acd093212e74efb1cfd0cde7b1165bfc4a31953a0f4ac7df348e46d2d78033e5db537b
SSDEEP 1536:8rKiXSFCt+YT4T8E8KCwpuSllQQQL251gJUVAf6IxNwIvf4p:8uaSFCoh8lukQQL5USNwIa
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 67KB
SHA256 d9cad66cd11a73509cfc811bcbf571f16969335b2e4a40f7e9a9b50ff7bb3271
MD5 e6d0ef4f83a6baefae76a5126ac128e8
SHA1 18e94498d7822bef97259c164c44c052f8c53b1e
SHA512 4e052ff81ab012202cfd5421371ad5622cceb273999a2b66187178fd3c26cd81aa839dccf6d95e61507b48196a49c66cf149e340f4d6af47c06dacb904a6fce4
SSDEEP 1536:erKiXSFk9+YT4T8E8KCwpuSllQQQL251gJUVAf6IxNwIvf4p:euaSFk4h8lukQQL5USNwIa
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 67KB
SHA256 b9707059b9f0956c756f537f3e6228ccece0e2b0663297aeb70bb3ed92305593
MD5 a214ee2e1487198d58f869d02ebcffd1
SHA1 f0c4a5219222f840d003efe60a96f990d622d5fb
SHA512 0e57655803889e6c307ab6a9f6e308e365e7d0b8804ff532aeaf6a0243fb02f08727866d687d5e0ece91d30d8e1f469dc68d2c10ccf9451125744769256c638b
SSDEEP 1536:IrKiXSFX++YT4T8E8KCwpuSllQQQL251gJUVAf6IxNwIvf4p:IuaSFXth8lukQQL5USNwIa
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 67KB
SHA256 e6967f91fe95f104079ce690fa69f5c7c19bc1b840a0199126621a0c58c58f51
MD5 21b2d8214b78ff3864d1548c1dcfcf4a
SHA1 8dae287e85833e16a096d20460d4c3491baa7f6b
SHA512 c6c48498fcf2b989694f164dee80120411c4a2ab017503f8f9f964655698361997b32b407e5a3b137dc66ce93c04f7c95298b9316d0b98e6688d67e59e953c5e
SSDEEP 1536:TrKiXSFho+YT4T8E8KCwpuSllQQQL251gJUVAf6IxNwIvf4p:TuaSFhXh8lukQQL5USNwIa
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 67KB
SHA256 c79afac8c21abc48b19c707073d8dcc05a5037e2a2d7510d53807dce4b91b878
MD5 0fba7294fbcd2c712189a12aa6684935
SHA1 601bf6a867adb54bde653302c252d6d94382c120
SHA512 c1d609241ffd299f31b5c53feaed7c465ca929ef37ff25c32c01e8c4fc4b7ca0392fe286505a9a403ff904676579e722b73405f4ebfbf13fafdb35a6bd219f71
SSDEEP 1536:trKiXSFtF+YT4T8E8KCwpuSllQQQL251gJUVAf6IxNwIvf4p:tuaSFtwh8lukQQL5USNwIa
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 67KB
SHA256 c7e8f9f4c0710e46839d85ed01301790b83a4e3741f556d590b94ffec8e16d45
MD5 281f571f3f10ef503f0e524eed187233
SHA1 c54001ea64f3278fa8f6964719a913e7c92a312e
SHA512 48be2c8cb1e9dc67f50c532d0aa66b8457560a303f1745f1cca67566677565d705b537666dc035aa5cf24aa6c0db7db762283185fab2304ee6ab5fafe503f707
SSDEEP 1536:SrKiXSF33+YT4T8E8KCwpuSllQQQL251gJUVAf6IxNwIvf4p:SuaSF36h8lukQQL5USNwIa
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 67KB
SHA256 dbd5b94d1575273452c453ba6c3afced34f72ae53bc0a8fde26c725a72d9fbec
MD5 661bb6b1bb015595748c66b8ac86a3b7
SHA1 c7728eb970eace6e70a480faad9563b4ce7634f7
SHA512 a6dc070334df4c92be4944358bd5aa34b07b8597414aaa6c387c7f8e94fa9ae10a046920180f2bf076304e375302cd188910b37d73b53aef7b3f9073bd17ef25
SSDEEP 1536:TrKiXSFq7+YT4T8E8KCwpuSllQQQL251gJUVAf6IxNwIvf4p:TuaSFq2h8lukQQL5USNwIa
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 67KB
SHA256 a44bf7eb234da71772da1c7b09cbcb68d81202c6d445d12fd4b34aa8a74ea86c
MD5 cc90a5d91e7336e350ba8084d32d6c64
SHA1 00ceaf5ade05dcb622c0357fac4e05332fae5ed8
SHA512 da6e6ca33be75938431d995ff81f373100b3a0047a8fb5c90435182b7b4b394b5bfe454d34f0e7c60ecef6dceef0a3cd0e1ee2a40fa3f39baa85d32cf550b11a
SSDEEP 1536:FrKiXSFpC+YT4T8E8KCwpuSllQQQL251gJUVAf6IxNwIvf4p:FuaSFpph8lukQQL5USNwIa
MD5 SHA1 SHA512 SSDEEP

Submit Download

uriCache

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\SmartScreen\local\uriCache
Size 9B
SHA256 3d6f3f8f1456d7ce78dd9dfa8187318b38e731a658e513f561ee178766e74d39
MD5 b6f7a6b03164d4bf8e3531a5cf721d30
SHA1 a2134120d4712c7c629cdceef9de6d6e48ca13fa
SHA512 4b473f45a5d45d420483ea1d9e93047794884f26781bbfe5370a554d260e80ad462e7eeb74d16025774935c3a80cbb2fd1293941ee3d7b64045b791b365f2b63
MD5 SHA1 SHA512

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations
Size 86B
SHA256 f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed
MD5 961e3604f228b0d10541ebf921500c86
SHA1 6e00570d9f78d9cfebe67d4da5efe546543949a7
SHA512 535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472
MD5 SHA1 SHA512

Submit Download

1e3bcd01-ef88-4c5f-bdad-1439defd149a.tmp

Path C:\Users\Admin\AppData\Local\Temp\1e3bcd01-ef88-4c5f-bdad-1439defd149a.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 442KB
SHA256 a9f4281f82b3579581c389e8583dc9f477c7fd0e20c9dfc91a2e611e21e3407e
MD5 85430baed3398695717b0263807cf97c
SHA1 fffbee923cea216f50fce5d54219a188a5100f41
SHA512 06511f1f6c6d44d076b3c593528c26a602348d9c41689dbf5ff716b671c3ca5756b12cb2e5869f836dedce27b1a5cfe79b93c707fd01f8e84b620923bb61b5f1
SSDEEP 12288:tESTeqTI2r4ZbCgUKWKNeRcPMb6qlV7hVZe3:tEsed2Xh9/bdzZe3
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmpaddon-1

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon-1
Size 2.2MB
SHA256 6072a87c5ac2177471c14541b4a670fd1d1f82ecee8aa4db51be3fcf28215271
MD5 a8d3da8dd105d8ff9d74ccf1781f3d5a
SHA1 32e5683bc1a6f3578d74f6f7017b3255d2a291c2
SHA512 1065a472a84e69461bddcdc9f29bdc8a896dc1e356e49f5708f8ddd0b142ba18e0fd3ac4d947a255db1ad7b1a63379b03ab3dca03c0cffa4bc6114d3c5e8eddc
SSDEEP 49152:wXQ1cJvEZR7+56mfLrZqNvniDpd1c/GA5pLPXiN6csCflASd/vot:H1U8Z456mfLrmvnit0n7G6cvflASpot
MD5 SHA1 SHA512 SSDEEP

Submit Download

6824f4a902c78fbd.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms
Size 9KB
SHA256 85c41c7ce50a6993b0c836bda0a485aa3981b4cf4ac60e9ddfcb63a7c2f5f2ce
MD5 645cc419c5daa54e402e01c3e8f49d1b
SHA1 a41646a66ee594a5c8189a97e951458d30c66f2d
SHA512 c8218a34b2fff03e0de6cc6d1140fadbb4cb89fb9621705b4d58c3b74ee486181d102d9344e8e646c65f1945b74f4b82b63d2ed3e5ece0287e1913cb3350e61a
SSDEEP 48:3DYdTgkfIJ5UgdwRaUz+DYdTgkfIJ/6BdwRa2NEDYdTgkfIJ/adwRaGK8lYDYdTH:zpkahpka/BEpka/dlWpka5SlWpkajE
MD5 SHA1 SHA512 SSDEEP

Submit Download

bookmarks-2024-03-26_11_47vPADsxW7vnEuNc4tFS3g==.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\f97d9gc7.default-release\bookmarkbackups\bookmarks-2024-03-26_11_47vPADsxW7vnEuNc4tFS3g==.jsonlz4
Size 952B
SHA256 0436d371f2a5372585dfe705739ca5e27c1b71505c97156927c516729102b972
MD5 3fd2bbed04cf90d7d9119ee273e2f9f8
SHA1 08e8a10ab1ca13e0cffaeed7e20dd5ed8d9ec915
SHA512 4b394a66dcfa18e65241a2b075b1f26cad902c30d23f4f289be68876ff113a3b77045e0488703ea5be8e2c2bcdd2a7f5cddb145c9b028edc0e9e84a8534489bc
MD5 SHA1 SHA512

Submit Download

broadcast-listeners.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\f97d9gc7.default-release\broadcast-listeners.json
Size 204B
SHA256 9cf589357fceea2f37cd1a925e5d33fd517a44d22a16c357f7fb5d4d187034aa
MD5 72c95709e1a3b27919e13d28bbe8e8a2
SHA1 00892decbee63d627057730bfc0c6a4f13099ee4
SHA512 613ca9dd2d12afe31fb2c4a8d9337eeecfb58dabaeaaba11404b9a736a4073dfd9b473ba27c1183d3cc91d5a9233a83dce5a135a81f755d978cea9e198209182
MD5 SHA1 SHA512

Submit Download

data.safe.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\f97d9gc7.default-release\datareporting\glean\db\data.safe.bin
Size 9KB
SHA256 f79ec133cff85ca26a21aa5ca56e3ae1984a8349e969280ac054d9ef579f3df5
MD5 db709d38a1e1f9c018c598af84f8917d
SHA1 ce3c341aaf320acf186134c13f1b90db20266438
SHA512 702eda1d6a60022fd5b3504816849a243c130a2314afd425a00e56cd3d62e11d99b7a2388ce907c807213d846e7ebfbee857ccc45142f03ade020815fcf8d13b
SSDEEP 192:I62vTbtOOJQvxYt859WtpvUS4bYbubkbJbkbGbdbrexP02kMD/4Qn:8btTJ+et859WtpvU5bYbubkbJbkbGbdo
MD5 SHA1 SHA512 SSDEEP

Submit Download

4037fffd-a0d8-4388-8634-442fabe65de1

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\f97d9gc7.default-release\datareporting\glean\pending_pings\4037fffd-a0d8-4388-8634-442fabe65de1
Size 734B
SHA256 976042731e0c59bf18249c272777c83375cf7af8ae002efbf23d64c939f94632
MD5 8f227dd61ab1b349f773e31931000663
SHA1 226182d6e311d209a8fa22d45e27250434452664
SHA512 2ba355842ca9995d96fb65a7342fdacb9da1203255dc2b0e99228735498607bf8ae4be7acd28fcc6238c3e5a3d15828801743c798b00170c16f49e470a04b58d
MD5 SHA1 SHA512

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\f97d9gc7.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll
Size 997KB
SHA256 1ed7877024be63a049da98733fd282c16bd620530a4fb580dacec3a78ace914e
MD5 fe3355639648c417e8307c6d051e3e37
SHA1 f54602d4b4778da21bc97c7238fc66aa68c8ee34
SHA512 8f4030bb2464b98eccbea6f06eb186d7216932702d94f6b84c56419e9cf65a18309711ab342d1513bf85aed402bc3535a70db4395874828f0d35c278dd2eac9c
SSDEEP 12288:vYLdTfFKbNSjv92eFN+3wH+NYriA0Iq6lh6VawYIpAvwHN/Uf1h47HAfg1oet:vYLdTZ923NYrjwNpgwef1hzfg1x
MD5 SHA1 SHA512 SSDEEP

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\f97d9gc7.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info
Size 116B
SHA256 f526e9f98841d987606efeaff7f3e017ba9fd516c4be83890c7f9a093ea4c47b
MD5 3d33cdc0b3d281e67dd52e14435dd04f
SHA1 4db88689282fd4f9e9e6ab95fcbb23df6e6485db
SHA512 a4a96743332cc8ef0f86bc2e6122618bfc75ed46781dadbac9e580cd73df89e74738638a2cccb4caa4cbbf393d771d7f2c73f825737cdb247362450a0d4a4bc1
MD5 SHA1 SHA512

Submit Download

LICENSE.txt

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\f97d9gc7.default-release\gmp-widevinecdm\4.10.2557.0\LICENSE.txt
Size 479B
SHA256 2af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539
MD5 49ddb419d96dceb9069018535fb2e2fc
SHA1 62aa6fea895a8b68d468a015f6e6ab400d7a7ca6
SHA512 48386217dabf7556e381ab3f5924b123a0a525969ff98f91efb03b65477c94e48a15d9abcec116b54616d36ad52b6f1d7b8b84c49c204e1b9b43f26f2af92da2
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\f97d9gc7.default-release\gmp-widevinecdm\4.10.2557.0\manifest.json
Size 372B
SHA256 e92d3394635edfb987a7528e0ccd24360e07a299078df2a6967ca3aae22fa2dd
MD5 8be33af717bb1b67fbd61c3f4b807e9e
SHA1 7cf17656d174d951957ff36810e874a134dd49e0
SHA512 6125f60418e25fee896bf59f5672945cd8f36f03665c721837bb50adf5b4dfef2dddbfcfc817555027dcfa90e1ef2a1e80af1219e8063629ea70263d2fc936a7
MD5 SHA1 SHA512

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\f97d9gc7.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll
Size 1.1MB
SHA256 5806aad23b1d73af3584ad289abe3819d879a0d45b23dc962d9d01725e7abbf6
MD5 59bbf9423d97604ba682736a69f8aed8
SHA1 2feae273efa2848fd93ff77750c47443839d7ef5
SHA512 6a9bc811b7526d5e7a156db1b1bea377308097f518e48c89d10960467746e524bc8f24818045d6d7368a99bc62b0dbe33ea5e35a84630c5dc4b582ad439870b5
SSDEEP 12288:EUtZJXsJ+8h5q6R6iHxNKqc6xGUETJt59yq75NP11KtXnlVU2eauS1dbSb:5Xs+8hHvu59775NPalVU2eau7
MD5 SHA1 SHA512 SSDEEP

Submit Download

widevinecdm.dll.lib

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\f97d9gc7.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.lib
Size 1KB
SHA256 33899a3ebc22cb8ed8de7bd48c1c29486c0279b06d7ef98241c92aef4e3b9237
MD5 688bed3676d2104e7f17ae1cd2c59404
SHA1 952b2cdf783ac72fcb98338723e9afd38d47ad8e
SHA512 7a0e3791f75c229af79dd302f7d0594279f664886fea228cfe78e24ef185ae63aba809aa1036feb3130066deadc8e78909c277f0a7ed1e3485df3cf2cd329776
MD5 SHA1 SHA512

Submit Download

widevinecdm.dll.sig

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\f97d9gc7.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.sig
Size 1KB
SHA256 68a03f075db104f84afdd8fca45a7e4bff7b55dc1a2a24272b3abe16d8759c81
MD5 937326fead5fd401f6cca9118bd9ade9
SHA1 4526a57d4ae14ed29b37632c72aef3c408189d91
SHA512 b232f6cf3f88adb346281167ac714c4c4c7aac15175087c336911946d12d63d3a3a458e06b298b41a7ec582ef09fe238da3a3166ff89c450117228f7485c22d2
MD5 SHA1 SHA512

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\f97d9gc7.default-release\prefs-1.js
Size 7KB
SHA256 8c0f429e1e3593f9e94ddb4391bb7eb5810ab729b9b5f9c71f79d01a78cf6498
MD5 28ce8c2b235ce0bab4a73527da1b12eb
SHA1 2ba381bc7b5f0ef7e0f7fde7a5495a028dacf680
SHA512 88a100e235af0bd4eb30dcc220a92091bc07306fd8fc3c94cd473639c07c02f40a8697c0b8194052f6b78fd1f988c7a86071ec283221f531251832c2b1074eea
SSDEEP 96:xHOgnUTBPqGqrdc88eOTzSFPXAnpjPHnj+sRBw8HwXa:sgnQCRrdc88e/PXojvRBw8HwK
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\f97d9gc7.default-release\prefs-1.js
Size 6KB
SHA256 ba05c43868745fae1aa2654848810ac67f247038a88853153c4341ec0ec8cc9a
MD5 43fb89f79dc56bc2005a181d6c60bc1d
SHA1 d246add48287d29fd82b30219692287b4d65da80
SHA512 a094e5f2a8a1d8bc4a0e5b104c22fe790f2ad6a116c71a9696445c07f67f6c6db67ccec34c44118b8b5a62e62611d9bf46e0733efcebbd8d25a1dbc2ecf98610
SSDEEP 96:xHOnnUTBPqGqrdc88eOTzSFPXAnpjPHnj+iBw8Hw1a:snnQCRrdc88e/PXoj5Bw8Hwc
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\f97d9gc7.default-release\prefs-1.js
Size 6KB
SHA256 b1a3727a0055bfd8568a2fc44940eef6de2fdbe6dcfc94fadb442353cd2aa02b
MD5 b12cbf805203d890e533988e2afa2fda
SHA1 6f87afe2696a887aec77f4495a5b5a7bd4c590b3
SHA512 cfc15dc965cd1bd01a2d3aba4a7a0eb41cb75abf01f430810e9271b3c282592ef8d0789f06f57422140733eb6e0206aa59c26e438e10c87114fe9c4c643cc949
SSDEEP 96:xHcnnUTBPqGqrdc88eOTzSFPXAnpjPHnj+dBw8Hw1a:qnnQCRrdc88e/PXoj6Bw8Hwc
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\f97d9gc7.default-release\prefs-1.js
Size 7KB
SHA256 26a499d8faeb7c0bfe089d7a16e230d66c318bfc41f9fda3f8214bbbc73d761b
MD5 54f1cca0cae46484f8672d2bc3595b2e
SHA1 1e6f9dd1800b66dad0d3dccd2625093d48ed00f0
SHA512 a57ae88c52907ca35e74de1984e88240963c15001ad5c7c7958499100f008d8ad289c859d8c17bad5ecb913c120fd8014fb1e748c93c06f342069d73b4235f6f
SSDEEP 96:xHODenUTBPqGqrdc88eOTzSFPXAnpjPHnj+sRBw8/kp0RwBAa:s6nQCRrdc88e/PXojvRBw8/kp0RwBz
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\f97d9gc7.default-release\prefs.js
Size 6KB
SHA256 23582788936b3c06d542eb56491cab222cf69d69030e5226da4972b1ff3111fd
MD5 9d2b23eb4811ec3e2b0d279b63365709
SHA1 8a9335338e8f1bfcc404408743a5fce989ef6b93
SHA512 9c64e19d696571653d9e51c68083f1edfe346bc9a39eda26e462c4a5a5a9fc3c95f61ad8b9ea4593a91b997789180b9e6b7f008ed77f2d56e425e44447e18c9f
SSDEEP 96:xHc5nUTeqGqrdcxleOTzSFPXAnpjXbHnj+UBw8Hw1y:q5nIRrdcxle/PXIjvBw8Hwk
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\f97d9gc7.default-release\prefs.js
Size 6KB
SHA256 841a3f8925dce3364d9bd66a8d5699b7671f5b63db51b4d12e74a9cee4b179a1
MD5 e9f4bd22fcc766eac4738bf74b85c118
SHA1 3381f53bd71ec0772d493402a12cfbd291195e15
SHA512 637e05a161faa602644c4f65aad272e216f5b35eb10c1282e0163d1cc0e07a498dde94f29401ed4de220ac75f3e97d4f7b1e310e77543eee75a9d8076497d943
SSDEEP 96:xHc5nUTeqGqrdc88eOTzSFPXAnpjPHnj+UBw8Hw1y:q5nIRrdc88e/PXojvBw8Hwk
MD5 SHA1 SHA512 SSDEEP

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\f97d9gc7.default-release\sessionCheckpoints.json
Size 90B
SHA256 00ad9799527c3fd21f3a85012565eae817490f3e0d417413bf9567bb5909f6a2
MD5 c4ab2ee59ca41b6d6a6ea911f35bdc00
SHA1 5942cd6505fc8a9daba403b082067e1cdefdfbc4
SHA512 71ea16900479e6af161e0aad08c8d1e9ded5868a8d848e7647272f3002e2f2013e16382b677abe3c6f17792a26293b9e27ec78e16f00bd24ba3d21072bd1cae2
MD5 SHA1 SHA512

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\f97d9gc7.default-release\sessionstore-backups\recovery.jsonlz4
Size 1KB
SHA256 54f36f57d8f38627e4718e9fe0ab49d5f96ef2b779282fb84b2b17f583317a9f
MD5 dc74a5bb19c366a3814ba869e864db89
SHA1 c413ff91b0e61360127af5ae0aa39545772e0726
SHA512 cb577b79855378a0ea30abbb11c093c2c004d0889315eff49104582972505300ca3bf3c636cf85d9ca69e282f23303a90fc31f6f1cb663299a24a079a9b24e5a
MD5 SHA1 SHA512

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\f97d9gc7.default-release\sessionstore-backups\recovery.jsonlz4
Size 1KB
SHA256 14010deba1a3a397be2ce544feda9fab82585fb0aec3401a381ef24f67b65d7d
MD5 86b78bf7d3452ac267706626817f2e40
SHA1 e0a10578d2fa02b9f1ca35b462a688378edf7b3a
SHA512 c91a95bf9b8fc2fd2c5464fbb11e1848ea51210dc19cc9dc597fb5b47a7190401a2a5762960b1172510c83f8c6ee3c7628410a449edbe831ea14f7f1e68855bd
MD5 SHA1 SHA512

Submit Download

sessionstore.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\f97d9gc7.default-release\sessionstore.jsonlz4
Size 849B
SHA256 9e7ca07d16b411abb9a7115c97c15f1279984dbd07a039c15003299ea2ddb79f
MD5 de3b7879d1e33f4d8b6d8affc75e1cd2
SHA1 5b2ba882aca095198859094961dcd23c74127dfa
SHA512 b535d8041338d74c50be4910a5736f5d0a012a7dbe4e27897c499994e7c52cfc0b8060f5fe67a9dfdfbf6958521736ab5fa985abf34e4222d65dbb63e0799023
MD5 SHA1 SHA512

Submit Download

targeting.snapshot.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\f97d9gc7.default-release\targeting.snapshot.json
Size 3KB
SHA256 4de8e3f727b2359899f26f0c392dce6287042efc9758828c33b901dfa1b4f64f
MD5 92ce101bcdda7d1366bd8db3cbc0679f
SHA1 4f2c5de3aecd9fa24c6f897613d0f04eebb872c0
SHA512 0789830cfb83e59fa87525b0399ac1874eb329a43591ffa4dd4cbee9997a10fdf350c2ada8bf1fbb8fd0b820ea17e928e5d503e047bd9f70d44b66018e6b2ca3
MD5 SHA1 SHA512

Submit Download

memz-master.ekvA9kok.zip.part

Path C:\Users\Admin\Downloads\memz-master.ekvA9kok.zip.part
Size 17KB
SHA256 319bf6087040d17b87f46cd05f5ee064c291ba9ca46e1910f28d1f4c57cb3d96
MD5 4790677e05d72ef7429dddf35562bf4a
SHA1 4243d6ea53db7e8cc0c355e70d6cffb54787b90b
SHA512 a93c5f691938bc1bdd9ef20b975f0b22cf494543e7df82ec31838bf811552ead5cd855959be4e47186ee7de944be005030f52f58b9dc85e7cde719cb97b794e3
SSDEEP 384:svCxvUI97GtSIiO0mw3pxspoCWdZs7n52mbFimtuckPXEKyuGSXCfAKrLwWtc:svZIZiAOnw3pcoYnFXoXEKyuZSAoLwWq
MD5 SHA1 SHA512 SSDEEP

Submit Download

note.txt

Path C:\note.txt
Size 218B
SHA256 8e9f20f6864c66576536c0b866c6ffdcf11397db67fe120e972e244c3c022270
MD5 afa6955439b8d516721231029fb9ca1b
SHA1 087a043cc123c0c0df2ffadcf8e71e3ac86bbae9
SHA512 5da21a31fbc4e8250dffed30f66b896bdf007ac91948140334fe36a3f010e1bac3e70a07e9f3eb9da8633189091fd5cadcabbaacd3e01da0fe7ae28a11b3dddf
MD5 SHA1 SHA512

Submit Download

memory/3784-829-0x0000000005720000-0x0000000005721000-memory.dmp

Download

memory/3784-836-0x0000000005720000-0x0000000005721000-memory.dmp

Download

memory/3784-837-0x0000000005720000-0x0000000005721000-memory.dmp

Download

memory/3784-830-0x0000000005720000-0x0000000005721000-memory.dmp

Download

memory/3784-831-0x0000000005720000-0x0000000005721000-memory.dmp

Download

memory/3784-835-0x0000000005720000-0x0000000005721000-memory.dmp

Download

memory/3784-841-0x0000000005720000-0x0000000005721000-memory.dmp

Download

memory/3784-839-0x0000000005720000-0x0000000005721000-memory.dmp

Download

memory/3784-840-0x0000000005720000-0x0000000005721000-memory.dmp

Download

memory/3784-838-0x0000000005720000-0x0000000005721000-memory.dmp

Download

memory/4116-2578-0x00000000056B0000-0x00000000056B1000-memory.dmp

Download

memory/4116-2583-0x00000000056B0000-0x00000000056B1000-memory.dmp

Download

memory/4116-2585-0x00000000056B0000-0x00000000056B1000-memory.dmp

Download

memory/4116-2587-0x00000000056B0000-0x00000000056B1000-memory.dmp

Download

memory/4116-2586-0x00000000056B0000-0x00000000056B1000-memory.dmp

Download

memory/4116-2584-0x00000000056B0000-0x00000000056B1000-memory.dmp

Download

memory/4116-2582-0x00000000056B0000-0x00000000056B1000-memory.dmp

Download

memory/4116-2580-0x00000000056B0000-0x00000000056B1000-memory.dmp

Download

memory/4116-2579-0x00000000056B0000-0x00000000056B1000-memory.dmp

Download