hxxps://github[.]com/pankoza2-pl/malwaredatabase-old

Analysis

max time kernel
438s
max time network
1171s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
26/03/2024, 15:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/pankoza2-pl/malwaredatabase-old

Score

8^/10

bootkit evasion persistence ransomware upx

Malware Config

Signatures

Disables Task Manager via registry modification
evasion
Downloads MZ/PE file

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Control Panel\International\Geo\Nation	cmd.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Control Panel\International\Geo\Nation	MEMZ-Clean.exe

Executes dropped EXE 36 IoCs

pid	Process
2876	MEMZ-Clean.exe
1388	MEMZ-Clean.exe
2076	MBRKiller.exe
624	CLWCP.exe
1704	waves.exe
4820	icons.exe
436	tunnel.exe
3504	BitBlt.exe
2836	icons.exe
2984	tunnel.exe
2480	CLWCP.exe
2628	scream.exe
4036	scream.exe
4528	scream.exe
2000	scream.exe
2680	scream.exe
1016	scream.exe
4464	scream.exe
1192	scream.exe
4292	scream.exe
1060	scream.exe
804	scream.exe
3764	scream.exe
4936	scream.exe
3944	scream.exe
3144	scream.exe
3212	scream.exe
4108	scream.exe
4948	scream.exe
2696	scream.exe
2800	scream.exe
4436	CLWCP.exe
5848	BitBlt.exe
5856	icons.exe
5864	tunnel.exe
5396	inv.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/3636-719-0x0000000000400000-0x00000000025C4000-memory.dmp	upx
behavioral1/memory/3636-777-0x0000000000400000-0x00000000025C4000-memory.dmp	upx
behavioral1/memory/3636-1264-0x0000000000400000-0x00000000025C4000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Update = "C:\\Users\\Admin\\AppData\\Local\\Temp\\7E54.tmp\\MBRKiller.exe"	MBRKiller.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
67	raw.githubusercontent.com
68	raw.githubusercontent.com

Writes to the Master Boot Record (MBR) 1 TTPs 3 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	MBRKiller.exe
File opened for modification	\??\PhysicalDrive0	Holmium.exe
File opened for modification	\??\PhysicalDrive0	Heptoxide.exe

Sets desktop wallpaper using registry 2 TTPs 3 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Control Panel\Desktop\Wallpaper = "clown.bmp"	CLWCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Control Panel\Desktop\Wallpaper = "skulls.bmp"	CLWCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Control Panel\Desktop\Wallpaper = "fnaf.bmp"	CLWCP.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
804	844	WerFault.exe	159

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
3928	schtasks.exe

Delays execution with timeout.exe 17 IoCs

evasion

pid	Process
4228	timeout.exe
508	timeout.exe
2504	timeout.exe
5872	timeout.exe
4688	timeout.exe
5388	timeout.exe
4332	timeout.exe
1600	timeout.exe
5804	timeout.exe
4848	timeout.exe
4400	timeout.exe
2936	timeout.exe
5344	timeout.exe
3680	timeout.exe
4788	timeout.exe
1088	timeout.exe
3196	timeout.exe

Enumerates system info in registry 2 TTPs 9 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Kills process with taskkill 14 IoCs

evasion

pid	Process
3920	taskkill.exe
1912	taskkill.exe
1440	taskkill.exe
2644	taskkill.exe
5664	taskkill.exe
5172	taskkill.exe
3160	taskkill.exe
3868	taskkill.exe
2752	taskkill.exe
5260	taskkill.exe
6080	taskkill.exe
6116	taskkill.exe
2000	taskkill.exe
5532	taskkill.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\Local Settings	calc.exe

Modifies registry key 1 TTPs 3 IoCs

Modify Registry

T1112

pid	Process
3144	reg.exe
1812	reg.exe
4660	reg.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 946383.crdownload:SmartScreen	msedge.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
3220	NOTEPAD.EXE

Suspicious behavior: AddClipboardFormatListener 3 IoCs

pid	Process
4396	vlc.exe
5824	vlc.exe
5868	vlc.exe

Suspicious behavior: EnumeratesProcesses 30 IoCs

pid	Process
2564	msedge.exe
2564	msedge.exe
3984	msedge.exe
3984	msedge.exe
2384	identity_helper.exe
2384	identity_helper.exe
2116	msedge.exe
2116	msedge.exe
3540	msedge.exe
3540	msedge.exe
2644	msedge.exe
2644	msedge.exe
3636	msedge.exe
3636	msedge.exe
1464	msedge.exe
1464	msedge.exe
4292	msedge.exe
4292	msedge.exe
460	msedge.exe
460	msedge.exe
2816	msedge.exe
2816	msedge.exe
448	identity_helper.exe
448	identity_helper.exe
3216	msedge.exe
3216	msedge.exe
2692	msedge.exe
2692	msedge.exe
5568	identity_helper.exe
5568	identity_helper.exe

Suspicious behavior: GetForegroundWindowSpam 4 IoCs

pid	Process
4396	vlc.exe
5824	vlc.exe
2904	OpenWith.exe
5868	vlc.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 35 IoCs

pid	Process
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe

Suspicious use of AdjustPrivilegeToken 22 IoCs

description	pid	Process
Token: 33	2928	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2928	AUDIODG.EXE
Token: SeDebugPrivilege	3160	taskkill.exe
Token: 33	4396	vlc.exe
Token: SeIncBasePriorityPrivilege	4396	vlc.exe
Token: SeDebugPrivilege	2000	taskkill.exe
Token: SeDebugPrivilege	3920	taskkill.exe
Token: SeDebugPrivilege	3868	taskkill.exe
Token: SeDebugPrivilege	1912	taskkill.exe
Token: SeDebugPrivilege	1440	taskkill.exe
Token: SeDebugPrivilege	2752	taskkill.exe
Token: 33	5824	vlc.exe
Token: SeIncBasePriorityPrivilege	5824	vlc.exe
Token: SeDebugPrivilege	5260	taskkill.exe
Token: SeDebugPrivilege	5532	taskkill.exe
Token: SeDebugPrivilege	5664	taskkill.exe
Token: SeDebugPrivilege	2644	taskkill.exe
Token: SeDebugPrivilege	6080	taskkill.exe
Token: SeDebugPrivilege	6116	taskkill.exe
Token: 33	5868	vlc.exe
Token: SeIncBasePriorityPrivilege	5868	vlc.exe
Token: SeDebugPrivilege	5172	taskkill.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
4396	vlc.exe
4396	vlc.exe
4396	vlc.exe
4396	vlc.exe
4396	vlc.exe
4396	vlc.exe
4396	vlc.exe
4396	vlc.exe

Suspicious use of SetWindowsHookEx 18 IoCs

pid	Process
1388	MEMZ-Clean.exe
844	Heptoxide.exe
3964	Holmium.exe
4396	vlc.exe
1388	MEMZ-Clean.exe
920	wordpad.exe
920	wordpad.exe
920	wordpad.exe
920	wordpad.exe
920	wordpad.exe
1388	MEMZ-Clean.exe
5824	vlc.exe
2904	OpenWith.exe
1388	MEMZ-Clean.exe
5868	vlc.exe
5868	vlc.exe
1388	MEMZ-Clean.exe
1388	MEMZ-Clean.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3984 wrote to memory of 3872	3984	msedge.exe	84
PID 3984 wrote to memory of 3872	3984	msedge.exe	84
PID 3984 wrote to memory of 1476	3984	msedge.exe	85
PID 3984 wrote to memory of 1476	3984	msedge.exe	85
PID 3984 wrote to memory of 1476	3984	msedge.exe	85
PID 3984 wrote to memory of 1476	3984	msedge.exe	85
PID 3984 wrote to memory of 1476	3984	msedge.exe	85
PID 3984 wrote to memory of 1476	3984	msedge.exe	85
PID 3984 wrote to memory of 1476	3984	msedge.exe	85
PID 3984 wrote to memory of 1476	3984	msedge.exe	85
PID 3984 wrote to memory of 1476	3984	msedge.exe	85
PID 3984 wrote to memory of 1476	3984	msedge.exe	85
PID 3984 wrote to memory of 1476	3984	msedge.exe	85
PID 3984 wrote to memory of 1476	3984	msedge.exe	85
PID 3984 wrote to memory of 1476	3984	msedge.exe	85
PID 3984 wrote to memory of 1476	3984	msedge.exe	85
PID 3984 wrote to memory of 1476	3984	msedge.exe	85
PID 3984 wrote to memory of 1476	3984	msedge.exe	85
PID 3984 wrote to memory of 1476	3984	msedge.exe	85
PID 3984 wrote to memory of 1476	3984	msedge.exe	85
PID 3984 wrote to memory of 1476	3984	msedge.exe	85
PID 3984 wrote to memory of 1476	3984	msedge.exe	85
PID 3984 wrote to memory of 1476	3984	msedge.exe	85
PID 3984 wrote to memory of 1476	3984	msedge.exe	85
PID 3984 wrote to memory of 1476	3984	msedge.exe	85
PID 3984 wrote to memory of 1476	3984	msedge.exe	85
PID 3984 wrote to memory of 1476	3984	msedge.exe	85
PID 3984 wrote to memory of 1476	3984	msedge.exe	85
PID 3984 wrote to memory of 1476	3984	msedge.exe	85
PID 3984 wrote to memory of 1476	3984	msedge.exe	85
PID 3984 wrote to memory of 1476	3984	msedge.exe	85
PID 3984 wrote to memory of 1476	3984	msedge.exe	85
PID 3984 wrote to memory of 1476	3984	msedge.exe	85
PID 3984 wrote to memory of 1476	3984	msedge.exe	85
PID 3984 wrote to memory of 1476	3984	msedge.exe	85
PID 3984 wrote to memory of 1476	3984	msedge.exe	85
PID 3984 wrote to memory of 1476	3984	msedge.exe	85
PID 3984 wrote to memory of 1476	3984	msedge.exe	85
PID 3984 wrote to memory of 1476	3984	msedge.exe	85
PID 3984 wrote to memory of 1476	3984	msedge.exe	85
PID 3984 wrote to memory of 1476	3984	msedge.exe	85
PID 3984 wrote to memory of 1476	3984	msedge.exe	85
PID 3984 wrote to memory of 2564	3984	msedge.exe	86
PID 3984 wrote to memory of 2564	3984	msedge.exe	86
PID 3984 wrote to memory of 4340	3984	msedge.exe	87
PID 3984 wrote to memory of 4340	3984	msedge.exe	87
PID 3984 wrote to memory of 4340	3984	msedge.exe	87
PID 3984 wrote to memory of 4340	3984	msedge.exe	87
PID 3984 wrote to memory of 4340	3984	msedge.exe	87
PID 3984 wrote to memory of 4340	3984	msedge.exe	87
PID 3984 wrote to memory of 4340	3984	msedge.exe	87
PID 3984 wrote to memory of 4340	3984	msedge.exe	87
PID 3984 wrote to memory of 4340	3984	msedge.exe	87
PID 3984 wrote to memory of 4340	3984	msedge.exe	87
PID 3984 wrote to memory of 4340	3984	msedge.exe	87
PID 3984 wrote to memory of 4340	3984	msedge.exe	87
PID 3984 wrote to memory of 4340	3984	msedge.exe	87
PID 3984 wrote to memory of 4340	3984	msedge.exe	87
PID 3984 wrote to memory of 4340	3984	msedge.exe	87
PID 3984 wrote to memory of 4340	3984	msedge.exe	87
PID 3984 wrote to memory of 4340	3984	msedge.exe	87
PID 3984 wrote to memory of 4340	3984	msedge.exe	87
PID 3984 wrote to memory of 4340	3984	msedge.exe	87
PID 3984 wrote to memory of 4340	3984	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://github.com/pankoza2-pl/malwaredatabase-old
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9dc0746f8,0x7ff9dc074708,0x7ff9dc074718
  2⤵
  PID:3872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2156,9369500017398476641,1315584612600830923,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2176 /prefetch:2
  2⤵
  PID:1476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2156,9369500017398476641,1315584612600830923,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2268 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2156,9369500017398476641,1315584612600830923,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2836 /prefetch:8
  2⤵
  PID:4340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,9369500017398476641,1315584612600830923,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:4960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,9369500017398476641,1315584612600830923,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:5072
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2156,9369500017398476641,1315584612600830923,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5516 /prefetch:8
  2⤵
  PID:624
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2156,9369500017398476641,1315584612600830923,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5516 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,9369500017398476641,1315584612600830923,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4088 /prefetch:1
  2⤵
  PID:2228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,9369500017398476641,1315584612600830923,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5240 /prefetch:1
  2⤵
  PID:1688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,9369500017398476641,1315584612600830923,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
  2⤵
  PID:3448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,9369500017398476641,1315584612600830923,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3368 /prefetch:1
  2⤵
  PID:3720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2156,9369500017398476641,1315584612600830923,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5648 /prefetch:8
  2⤵
  PID:3992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,9369500017398476641,1315584612600830923,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5212 /prefetch:1
  2⤵
  PID:2668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2156,9369500017398476641,1315584612600830923,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6080 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2156,9369500017398476641,1315584612600830923,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1360 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,9369500017398476641,1315584612600830923,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5188 /prefetch:1
  2⤵
  PID:2132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2156,9369500017398476641,1315584612600830923,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6200 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,9369500017398476641,1315584612600830923,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3968 /prefetch:1
  2⤵
  PID:3128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,9369500017398476641,1315584612600830923,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6444 /prefetch:1
  2⤵
  PID:2364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2156,9369500017398476641,1315584612600830923,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6212 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,9369500017398476641,1315584612600830923,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3344 /prefetch:1
  2⤵
  PID:2644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2156,9369500017398476641,1315584612600830923,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5968 /prefetch:8
  2⤵
  PID:4264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2156,9369500017398476641,1315584612600830923,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1756 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,9369500017398476641,1315584612600830923,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3124 /prefetch:1
  2⤵
  PID:1268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2156,9369500017398476641,1315584612600830923,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6240 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4292

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:552

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1504

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3880

C:\Users\Admin\Downloads\MEMZ-Clean.exe
"C:\Users\Admin\Downloads\MEMZ-Clean.exe"
1⤵
- Executes dropped EXE
PID:2876

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {c82192ee-6cb5-4bc0-9ef0-fb818773790a} -Embedding
1⤵
PID:1196

C:\Users\Admin\Downloads\MEMZ-Clean.exe
"C:\Users\Admin\Downloads\MEMZ-Clean.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://play.clubpenguin.com/
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of SendNotifyMessage
  PID:2816
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9dc0746f8,0x7ff9dc074708,0x7ff9dc074718
    3⤵
    PID:2648
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2044,2537117509275629560,3246197228342370247,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2060 /prefetch:2
    3⤵
    PID:1064
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2044,2537117509275629560,3246197228342370247,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2328 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:460
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2044,2537117509275629560,3246197228342370247,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2920 /prefetch:8
    3⤵
    PID:3164
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,2537117509275629560,3246197228342370247,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3228 /prefetch:1
    3⤵
    PID:388
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,2537117509275629560,3246197228342370247,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:1
    3⤵
    PID:2084
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,2537117509275629560,3246197228342370247,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4196 /prefetch:1
    3⤵
    PID:1088
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,2537117509275629560,3246197228342370247,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4128 /prefetch:1
    3⤵
    PID:888
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2044,2537117509275629560,3246197228342370247,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5200 /prefetch:8
    3⤵
    PID:4720
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2044,2537117509275629560,3246197228342370247,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5200 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:448
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,2537117509275629560,3246197228342370247,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4220 /prefetch:1
    3⤵
    PID:4768
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,2537117509275629560,3246197228342370247,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4304 /prefetch:1
    3⤵
    PID:3540
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,2537117509275629560,3246197228342370247,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5524 /prefetch:1
    3⤵
    PID:1580
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,2537117509275629560,3246197228342370247,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4116 /prefetch:1
    3⤵
    PID:2900
- C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe
  "C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe"
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:920
- - C:\Windows\splwow64.exe
    C:\Windows\splwow64.exe 12288
    3⤵
    PID:4372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=my+computer+is+doing+weird+things+wtf+is+happenin+plz+halp
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  PID:2692
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9dc0746f8,0x7ff9dc074708,0x7ff9dc074718
    3⤵
    PID:5108
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,2396855379825571923,7128199780914883275,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2148 /prefetch:2
    3⤵
    PID:4876
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2116,2396855379825571923,7128199780914883275,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2200 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3216
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2116,2396855379825571923,7128199780914883275,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2728 /prefetch:8
    3⤵
    PID:4336
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,2396855379825571923,7128199780914883275,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:1
    3⤵
    PID:1672
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,2396855379825571923,7128199780914883275,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:1
    3⤵
    PID:1248
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,2396855379825571923,7128199780914883275,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4408 /prefetch:1
    3⤵
    PID:2700
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,2396855379825571923,7128199780914883275,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4004 /prefetch:1
    3⤵
    PID:3680
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,2396855379825571923,7128199780914883275,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5184 /prefetch:1
    3⤵
    PID:4972
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,2396855379825571923,7128199780914883275,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5204 /prefetch:1
    3⤵
    PID:2912
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,2396855379825571923,7128199780914883275,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5776 /prefetch:1
    3⤵
    PID:5404
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,2396855379825571923,7128199780914883275,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5804 /prefetch:1
    3⤵
    PID:5412
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,2396855379825571923,7128199780914883275,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6112 /prefetch:8
    3⤵
    PID:5552
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,2396855379825571923,7128199780914883275,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6112 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5568
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,2396855379825571923,7128199780914883275,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3588 /prefetch:1
    3⤵
    PID:5876
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,2396855379825571923,7128199780914883275,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5584 /prefetch:1
    3⤵
    PID:4424
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,2396855379825571923,7128199780914883275,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2540 /prefetch:1
    3⤵
    PID:2500
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,2396855379825571923,7128199780914883275,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5260 /prefetch:1
    3⤵
    PID:5168
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,2396855379825571923,7128199780914883275,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5820 /prefetch:1
    3⤵
    PID:5760
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,2396855379825571923,7128199780914883275,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6232 /prefetch:1
    3⤵
    PID:2736
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,2396855379825571923,7128199780914883275,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5576 /prefetch:1
    3⤵
    PID:1828
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,2396855379825571923,7128199780914883275,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2196 /prefetch:2
    3⤵
    PID:5396
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,2396855379825571923,7128199780914883275,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6252 /prefetch:2
    3⤵
    PID:5268
- C:\Windows\SysWOW64\calc.exe
  "C:\Windows\System32\calc.exe"
  2⤵
  - Modifies registry class
  PID:5536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=how+2+buy+weed
  2⤵
  PID:4972
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0xfc,0x10c,0x7ff9dc0746f8,0x7ff9dc074708,0x7ff9dc074718
    3⤵
    PID:3548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://motherboard.vice.com/read/watch-this-malware-turn-a-computer-into-a-digital-hellscape
  2⤵
  PID:3784
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9dc0746f8,0x7ff9dc074708,0x7ff9dc074718
    3⤵
    PID:5596
- C:\Windows\SysWOW64\Taskmgr.exe
  "C:\Windows\System32\Taskmgr.exe"
  2⤵
  PID:5496

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x514 0x438
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2928

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2788

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1612

C:\Users\Admin\Desktop\Heptoxide.exe
"C:\Users\Admin\Desktop\Heptoxide.exe"
1⤵
- Writes to the Master Boot Record (MBR)
- Suspicious use of SetWindowsHookEx
PID:844
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c REG ADD hkcu\Software\Microsoft\Windows\CurrentVersion\policies\system /v DisableTaskMgr /t reg_dword /d 1 /f
  2⤵
  PID:1692
- - C:\Windows\SysWOW64\reg.exe
    REG ADD hkcu\Software\Microsoft\Windows\CurrentVersion\policies\system /v DisableTaskMgr /t reg_dword /d 1 /f
    3⤵
    - Modifies registry key
    PID:4660
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 844 -s 1224
  2⤵
  - Program crash
  PID:804

C:\Users\Admin\Desktop\DeathPlus.exe
"C:\Users\Admin\Desktop\DeathPlus.exe"
1⤵
PID:3636
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\7E54.tmp\DeathPlus.bat" "
  2⤵
  - Checks computer location settings
  - Modifies registry class
  PID:1052
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im taskmgr.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3160
- - C:\Windows\SysWOW64\reg.exe
    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
    3⤵
    - Modifies registry key
    PID:3144
- - C:\Users\Admin\AppData\Local\Temp\7E54.tmp\MBRKiller.exe
    MBRKiller.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Writes to the Master Boot Record (MBR)
    PID:2076
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks.exe /Create /TN "Windows Update" /ru SYSTEM /SC ONSTART /TR "C:\Users\Admin\AppData\Local\Temp\7E54.tmp\MBRKiller.exe"
      4⤵
      Creates scheduled task(s)
      PID:3928
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\7E54.tmp\noise.wav"
    3⤵
    - Suspicious behavior: AddClipboardFormatListener
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SendNotifyMessage
    - Suspicious use of SetWindowsHookEx
    PID:4396
- - C:\Windows\SysWOW64\NOTEPAD.EXE
    "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\note.txt
    3⤵
    - Opens file in notepad (likely ransom note)
    PID:3220
- - C:\Users\Admin\AppData\Local\Temp\7E54.tmp\CLWCP.exe
    clwcp clown.bmp
    3⤵
    - Executes dropped EXE
    - Sets desktop wallpaper using registry
    PID:624
- - C:\Windows\SysWOW64\timeout.exe
    timeout 5 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:4848
- - C:\Users\Admin\AppData\Local\Temp\7E54.tmp\waves.exe
    waves.exe
    3⤵
    - Executes dropped EXE
    PID:1704
- - C:\Windows\SysWOW64\timeout.exe
    timeout 10 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:4400
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im waves.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2000
- - C:\Users\Admin\AppData\Local\Temp\7E54.tmp\icons.exe
    icons.exe
    3⤵
    - Executes dropped EXE
    PID:4820
- - C:\Windows\SysWOW64\timeout.exe
    timeout 10 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:3680
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im icons.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3920
- - C:\Users\Admin\AppData\Local\Temp\7E54.tmp\tunnel.exe
    tunnel.exe
    3⤵
    - Executes dropped EXE
    PID:436
- - C:\Windows\SysWOW64\timeout.exe
    timeout 10 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:4228
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im tunnel.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3868
- - C:\Users\Admin\AppData\Local\Temp\7E54.tmp\BitBlt.exe
    BitBlt.exe
    3⤵
    - Executes dropped EXE
    PID:3504
- - C:\Windows\SysWOW64\timeout.exe
    timeout 10 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:4788
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im BitBlt.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1912
- - C:\Users\Admin\AppData\Local\Temp\7E54.tmp\icons.exe
    icons.exe
    3⤵
    - Executes dropped EXE
    PID:2836
- - C:\Windows\SysWOW64\timeout.exe
    timeout 5 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:1088
- - C:\Users\Admin\AppData\Local\Temp\7E54.tmp\tunnel.exe
    tunnel.exe
    3⤵
    - Executes dropped EXE
    PID:2984
- - C:\Windows\SysWOW64\timeout.exe
    timeout 5 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:4688
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im icons.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1440
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im tunnel.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2752
- - C:\Users\Admin\AppData\Local\Temp\7E54.tmp\CLWCP.exe
    clwcp skulls.bmp
    3⤵
    - Executes dropped EXE
    - Sets desktop wallpaper using registry
    PID:2480
- - C:\Windows\SysWOW64\timeout.exe
    timeout 3 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:508
- - C:\Users\Admin\AppData\Local\Temp\7E54.tmp\scream.exe
    scream.exe
    3⤵
    - Executes dropped EXE
    PID:2628
- - C:\Users\Admin\AppData\Local\Temp\7E54.tmp\scream.exe
    scream.exe
    3⤵
    - Executes dropped EXE
    PID:4036
- - C:\Users\Admin\AppData\Local\Temp\7E54.tmp\scream.exe
    scream.exe
    3⤵
    - Executes dropped EXE
    PID:4528
- - C:\Users\Admin\AppData\Local\Temp\7E54.tmp\scream.exe
    scream.exe
    3⤵
    - Executes dropped EXE
    PID:2000
- - C:\Users\Admin\AppData\Local\Temp\7E54.tmp\scream.exe
    scream.exe
    3⤵
    - Executes dropped EXE
    PID:2680
- - C:\Users\Admin\AppData\Local\Temp\7E54.tmp\scream.exe
    scream.exe
    3⤵
    - Executes dropped EXE
    PID:1016
- - C:\Users\Admin\AppData\Local\Temp\7E54.tmp\scream.exe
    scream.exe
    3⤵
    - Executes dropped EXE
    PID:4464
- - C:\Users\Admin\AppData\Local\Temp\7E54.tmp\scream.exe
    scream.exe
    3⤵
    - Executes dropped EXE
    PID:1192
- - C:\Users\Admin\AppData\Local\Temp\7E54.tmp\scream.exe
    scream.exe
    3⤵
    - Executes dropped EXE
    PID:4292
- - C:\Users\Admin\AppData\Local\Temp\7E54.tmp\scream.exe
    scream.exe
    3⤵
    - Executes dropped EXE
    PID:1060
- - C:\Users\Admin\AppData\Local\Temp\7E54.tmp\scream.exe
    scream.exe
    3⤵
    - Executes dropped EXE
    PID:804
- - C:\Users\Admin\AppData\Local\Temp\7E54.tmp\scream.exe
    scream.exe
    3⤵
    - Executes dropped EXE
    PID:3764
- - C:\Users\Admin\AppData\Local\Temp\7E54.tmp\scream.exe
    scream.exe
    3⤵
    - Executes dropped EXE
    PID:4936
- - C:\Users\Admin\AppData\Local\Temp\7E54.tmp\scream.exe
    scream.exe
    3⤵
    - Executes dropped EXE
    PID:3944
- - C:\Users\Admin\AppData\Local\Temp\7E54.tmp\scream.exe
    scream.exe
    3⤵
    - Executes dropped EXE
    PID:3144
- - C:\Users\Admin\AppData\Local\Temp\7E54.tmp\scream.exe
    scream.exe
    3⤵
    - Executes dropped EXE
    PID:3212
- - C:\Users\Admin\AppData\Local\Temp\7E54.tmp\scream.exe
    scream.exe
    3⤵
    - Executes dropped EXE
    PID:4108
- - C:\Users\Admin\AppData\Local\Temp\7E54.tmp\scream.exe
    scream.exe
    3⤵
    - Executes dropped EXE
    PID:4948
- - C:\Users\Admin\AppData\Local\Temp\7E54.tmp\scream.exe
    scream.exe
    3⤵
    - Executes dropped EXE
    PID:2696
- - C:\Users\Admin\AppData\Local\Temp\7E54.tmp\scream.exe
    scream.exe
    3⤵
    - Executes dropped EXE
    PID:2800
- - C:\Windows\SysWOW64\timeout.exe
    timeout 5 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:2504
- - C:\Users\Admin\AppData\Local\Temp\7E54.tmp\CLWCP.exe
    clwcp fnaf.bmp
    3⤵
    - Executes dropped EXE
    - Sets desktop wallpaper using registry
    PID:4436
- - C:\Windows\SysWOW64\timeout.exe
    timeout 5 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:5388
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\7E54.tmp\noise.wav"
    3⤵
    - Suspicious behavior: AddClipboardFormatListener
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:5824
- - C:\Users\Admin\AppData\Local\Temp\7E54.tmp\BitBlt.exe
    BitBlt.exe
    3⤵
    - Executes dropped EXE
    PID:5848
- - C:\Users\Admin\AppData\Local\Temp\7E54.tmp\icons.exe
    icons.exe
    3⤵
    - Executes dropped EXE
    PID:5856
- - C:\Users\Admin\AppData\Local\Temp\7E54.tmp\tunnel.exe
    tunnel.exe
    3⤵
    - Executes dropped EXE
    PID:5864
- - C:\Windows\SysWOW64\timeout.exe
    timeout 20 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:5872
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im scream.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5260
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im BitBlt.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5532
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im icons.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5664
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im tunnel.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2644
- - C:\Users\Admin\AppData\Local\Temp\7E54.tmp\inv.exe
    inv.exe
    3⤵
    - Executes dropped EXE
    PID:5396
- - C:\Windows\SysWOW64\timeout.exe
    timeout 5 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:3196
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im inv.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:6080
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:2936
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKCU\Control Panel\Desktop" /v WallPaper /f
    3⤵
    PID:3764
- - C:\Windows\SysWOW64\rundll32.exe
    RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
    3⤵
    PID:5172
- - C:\Windows\SysWOW64\timeout.exe
    timeout 2 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:4332
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im explorer.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:6116
- - C:\Windows\SysWOW64\timeout.exe
    timeout 3 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:1600
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\7E54.tmp\scare.mp4"
    3⤵
    - Suspicious behavior: AddClipboardFormatListener
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:5868
- - C:\Windows\SysWOW64\timeout.exe
    timeout 5 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:5344
- - C:\Windows\SysWOW64\mshta.exe
    "C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\AppData\Local\Temp\7E54.tmp\bsod.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
    3⤵
    PID:648
- - C:\Windows\SysWOW64\timeout.exe
    timeout 5 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:5804
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im wininit.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5172

C:\Users\Admin\Desktop\Holmium.exe
"C:\Users\Admin\Desktop\Holmium.exe"
1⤵
- Writes to the Master Boot Record (MBR)
- Suspicious use of SetWindowsHookEx
PID:3964
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c REG ADD hkcu\Software\Microsoft\Windows\CurrentVersion\policies\system /v DisableTaskMgr /t reg_dword /d 1 /f
  2⤵
  PID:4064
- - C:\Windows\SysWOW64\reg.exe
    REG ADD hkcu\Software\Microsoft\Windows\CurrentVersion\policies\system /v DisableTaskMgr /t reg_dword /d 1 /f
    3⤵
    - Modifies registry key
    PID:1812

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc
1⤵
PID:2260

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4164

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1312

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2904

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2340

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 844 -ip 844
1⤵
PID:4660

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3764

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3976

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5816

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Pre-OS Boot

T1542

Bootkit

T1542.003

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Defense Evasion

Modify Registry

T1112

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4d6e17218d9a99976d1a14c6f6944c96

SHA1
9e54a19d6c61d99ac8759c5f07b2f0d5faab447f

SHA256
32e343d2794af8bc6f2f7c905b5df11d53db4ad8922b92ad5e7cc9c856509d93

SHA512
3fa166b3e2d1236298d8dda7071a6fcf2bde283f181b8b0a07c0bb8ba756d6f55fa8a847ca5286d4dbabc6dace67e842a118866320ac01bd5f93cccd3a032e47

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4b7cee476b1e96afa54110bdec6332dc

SHA1
4b93fc5de93dfe70510d1e8691ce783875883c11

SHA256
3b3725a1636251828072eb91f929e04e9d3e5494997934039c44df9ec5e3b348

SHA512
7a8c1344220b50219ae16f8bb0af454805199dcdc057856605ef782fceabaaa10bc7b378554b0c473a0a429371eebdcac8ae691b72c5a11e5363e17dfd57b990

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
3c8a628a24ad48e4f9c35f2e23131cb3

SHA1
d7db3c6d4ddcefc34989d360a42268d7f45c9509

SHA256
2b83e4ef9c87887b957f8c53a6cd90f644f685ffff97fede4718987d87b1d195

SHA512
7ca0c8f7651cfb339950123841d925bcdd529109a2e1d4586f99d9e4b6b7d05f9f85da3da5c2ef8d169ef56257bfa133eff4ab64663e83e82042347609698caa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
91c00951acc7056e23ef340c7032bc0b

SHA1
ec527c3288aaa005e27bed1d4c165d3594aae15a

SHA256
42370b6dde54f02c8e2f49019ac0c3d8fa882a321c49dbe4d940799f41cf2cbc

SHA512
256e80c8c90c75838acc2472380022eb8597351d857ac9d15841cda9ff348eb5cf6507696b0f94794cfcc4f2c277ffc77710ec30b66a7edb102fd61c933df915

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\8d803bc7-c33a-437a-a9fb-5a975c534c48.tmp

Filesize
1B

MD5
5058f1af8388633f609cadb75a75dc9d

SHA1
3a52ce780950d4d969792a2559cd519d7ee8c727

SHA256
cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8

SHA512
0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\937dc58e-496e-472a-a0a7-b1f1b69cce45.tmp

Filesize
2KB

MD5
b65c90a463b4f5dab171b9b15706789d

SHA1
ce01e2311971174f94f68af98bb38a29ed5b7500

SHA256
0ee3ec308b79aef723da84d0d9f75078607067c9a5d5401b40a94230e512d10e

SHA512
669c7b0d6f32c20d98ea9d89c157d19137bd94c43577f1257b1bed874c50f16e2aaf05eac30318513db585c2db2ea813a431ed0b56124ae46e7683e84ec56ec8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000011

Filesize
112KB

MD5
d6432ec77eca2ef0059ef14192bc2a72

SHA1
d7f23e4db31753043703c91d4018ae05b6b0bc8e

SHA256
814a7c942439026ba9db24e6281f8f2af844b927c55ea71c69a1ff8881c01d45

SHA512
8ae21dc71d0fa2df0d5f92043b0a704e9c5f0aba99279f9433c1d5f440a1be437bce5c5e325e4739500de997831fb7c581da308d8e54bac2208a10b4a8e1b1d2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000016

Filesize
64KB

MD5
5520e2df09b4f23c1b7a9642e240eb1f

SHA1
793c8040244f31a0464c78e82e0c7c5d38dd6324

SHA256
a0a7a32becc41306d7becbef96fc63e8925ca180b35c06edaf7eee39e1664d39

SHA512
8ae4e6dae688fc9bf09762ccee1189450669abc3079c22bbe1cafaef618d702905cafc66d643665a208f2d0ee137e318cd0dbb7a9bc8faa41a1fc7d0682496fb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
80ba44afd0c206e781f43eaeae738894

SHA1
00e1d4a3ac70cbc0aacf5e202579614e657f1523

SHA256
f8848c2fdaea36178f3ba66aed2e2c80d2c1ac91add138f09b3c45f5bf884d39

SHA512
a073ae33dc14cf6ec649d1c48a2f6b4c6f71732b082497dd152b6f93d7d82f1746f7c6d3b256c9f8f2b88bd81e155152e975e86a0cfd3a4b1bddd7371dbe3d1d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
7591a2d9bf729185231206386d59ee01

SHA1
a2953d75dbe332921b38bdaa8dde8945efeaf1ec

SHA256
d340cc6bc8a0031ae2413fc4ff7fb3eaacbd3f180f9dfe9c0c0889f13edd4482

SHA512
f1935bfafeaf69265f7345dc04cdac9e93ed945d0372b1a1da270c1693b539d22e923ad833fc861fa341884a8036d1cc9fd6de8fe94426c5318ed001db7b2208

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
a73a112c9e742a4d9dd6dfd2a50b6a9b

SHA1
60fa562bbe62fd18f720466f1664c7e856fae3b6

SHA256
aae5b6e7db6e7e514ff29394f106a6d3beeca8cdbf27b7ab7814983f67b721e8

SHA512
3e0dd6ae8a7863f62bcfe77089710a7931ee79fb9c9481504868523d788e4ad956d67d96a00fbd226f946ba7451b947232baaadbe912b4abad37a8d2c71c4f87

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies

Filesize
20KB

MD5
bb5b98f8910286b82fdc5d5feedbdc95

SHA1
740215f9265b0a745800215a4ca2292178d085ad

SHA256
4d3fe68e6277ff825463343496d79efc4299b416569d8ebc8529b495f82c0e23

SHA512
ef4954fd7e56a1e8bad1b04aac4f8e79bd0c9ef81b9641f078739562a34d995a158a42d286d46b157c986d93f67429ef4005def36da85be34dc52ea78bd2b80d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Favicons

Filesize
20KB

MD5
9fe432c0cc17de15fdf93cbdef76e3e4

SHA1
b35b62c91e93c3183fddfed78bd9df0af8b022c3

SHA256
b6ee70416ceda8d076f74bac8e2805e3d925e16708a6acdab76b74c5304b0bf2

SHA512
cbe90cbe91f031b676baf705664397cf992ddc9d805008e01174ed4471479aedb2ef273965a9c507afbec561a70a7d83287878eedadb3ad4b79259a941e7cc28

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\GPUCache\data_1

Filesize
264KB

MD5
9fe93d6a30c9a266e3884608f717a787

SHA1
a587510c06c6169165399be29430d6e91a9b64f5

SHA256
d8de911ada12f12812096383fa7bc57c37922320d0b933f49cfca3b20dc25ed5

SHA512
fb6d296fdee9fb5b8efe64d930afffc7964c7bf16c1536f92fdb2f4da931f4022ed3f90635f7bacbf59407ac8d3c4f38e907ba9953adf8dafa3707b2beea6223

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History

Filesize
124KB

MD5
2e2e42b0ec6236607c87dfbcff83cc64

SHA1
250e7b563ead53ba1aca4e397acc5d023f7e9fa4

SHA256
2d04f22014123df850a7f9ca4c76a3a29ed0bdd062cc1799928162bddf8272b4

SHA512
02f77c93f99e3b908a022d43c62eb868e68a613a77e9d3360884b7a93f3aca9c5ba8967ec1d2e090ca8c2b6db042260978bfdcb5f535ee33001471d07b9dbe69

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History Provider Cache

Filesize
3KB

MD5
1c8fa869784f45d6c1190cc3c4a156f3

SHA1
93c72f1a687f418c8033cc32431f863065c76119

SHA256
c70255c78328bd3ab6f33eada3cf43f83eb2f2645c52187ee3f13ce11ed33090

SHA512
eb4ebdbc9786b7cc1301d648a290cb245cd7d0b8960d85c05094eee6fd069e78a8bcee9a732db9b31c920216e122fe0ebae8e167149593ea91170e5bbe5db1b8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log

Filesize
12KB

MD5
9ed35fc50f0a2d73b44a627cef159282

SHA1
3b72a575578de051b65f4491742f43932a4bafcd

SHA256
7fb7c76ebcd4725d34380b4e7a5dc5fbb8e77177dc8d91b20932177e27eac692

SHA512
4ce50f9f1ef0d5dbc14f4f02711d3ab64c2f18cc62b8475c7b2b3153344cc3f2b78c7490044430a9b91ed7ce0f75ab712a9351a8b2387bf5109ef7d0a2a168bc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG

Filesize
334B

MD5
e0e4712e258a906db7f573abb94bf368

SHA1
3f99ed87e72aebd2553c047d54bf2535b7578a32

SHA256
cd6c68e7cb548354730209599d36e23c5193bb02906e23cbae61c919152e2f4b

SHA512
317cad09aec57c40a588112da4bd6efb3b40188148cfc0d94faba003fdc2c1217290f33ede2bac9176b6774750ec7a7bcb16471295305082fd4a186b299a06c1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
579B

MD5
a81eeb7d6f42bfcfbb98875778806381

SHA1
6788d38670dc670a230bfce93c3816bf1a450e0f

SHA256
cc751404fb47c5f62606deadfded74d69cde51a6ff4b1cca2e386e0fc9754d9c

SHA512
baaee9ff38d15dbeb3e701fb74e54ae708b696b000cf43fa1505aa4b40413f37f59655bfc82b7369cab2382f9aeb62bd1a9a6bcb57b2efdd452f58bd46bc2cca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
579B

MD5
be85a012866f82533b134a3e7c03581c

SHA1
8f361377763dc0f643a3c2746149ca5850c5d8c0

SHA256
7c0534066657219aeecf9763515dbb8eeb5b0cc4509d25ed75d5347476f443a0

SHA512
38aa3dc3c36a5319162d52fb0bdb7588dfa9fada5247c49ee53d870b7d928ea5be1387e176e8caf3dd6cad9b6975d432eae587c0103f8dffc56f17ef887ae621

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
579B

MD5
46fa4f5f7344089589d117bd7599b3a9

SHA1
b6cc1fe19e527d4a372c97e4d195ed94eee40030

SHA256
223280d95a13f1af6af06459bbf230874500c212a2e16f63914eff3f22e8b57a

SHA512
6b680aedde7e806802652aab9ab31cb21438bc8756b063955e6f03bbbdf1273f7d47c40ec1a19fe27537afeb8d6cc219a246d31f7c6822b481649fe296e2a45c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
0fc636835d19324fa35d51002858b63c

SHA1
33e17ba00d5fc8e7202b0c6ee26a7851e597e705

SHA256
ea34f5f0ecdc04144a1955f3430249674339545a486f580e59d0ed56753e68cf

SHA512
71d528813c4035eb1ab098787863a753206d0f04aae2fdfcf736293ba5faedf9c8ed6ed30c29759fcdcea3ccca27ef2517db31d751de908466c3a1495737f445

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
fe6de4b7ae80d68e765519cfddb8ed6d

SHA1
8b848da5256cb8640e41e47355616b87bec880c3

SHA256
075d4acb3f8040ba134f90aeab4b1fed23bb2dced106275b59b4f14d7c0c62b8

SHA512
a16bfffaf2b2d37552dbfdeff1376dd3223138505a4b1f8ca88e3b7fa971bdc13de80a18f849b7200bb929a17ef8c573b2b014d80bfd17412a91460675b9241f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
b27a47347ce1e3a199c6506d594a2b72

SHA1
240ca41bd1a27da725942d081b9b4198404de979

SHA256
61dfe9a9f9e06250fb85663a3a1ccbb9ed3f9cb6779016d6f353fccf42fd896a

SHA512
9ab26e48748c85ca6f46837b0395f780a773eacd3775e244e71df70d072d4695dd435524c2101bcd54475202356f0c876c4ecc748080b53c6df3109373909fe7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
b8aa7495a322efe293be02721387c896

SHA1
1ddf4a2cdfaebbbd3bc369acdbe9dd0deb5108fa

SHA256
c198df592d8604b3ef608d08c494e2d422b07d69ab9fd71b5190deb48be5245a

SHA512
b46b209a7c31a263ad4a34b64715bdb23e4eadae2805236fa21bb0859242286846f1cea570a1e08148eab882ef25f89ce720ee6f24e40e675ec672af23b2d7b0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
98926b234c34eb799c66d9d4d74eea6a

SHA1
740707801efc6253f0b3ee87b5a1a79b51efb7de

SHA256
a2306a296a370024c6248a31d642b08f1c51a4e27c4c3d463d9164adaa9359cc

SHA512
39dd425d1b8b85d9c978aa1d7579989287bf2efc92c6c6f2e3a2af45cad0ecde400e67fefc4cfafff97e8962b9458b33280b637dc724d3a33428cca484b3f3c7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
024c9764faa6813cbcdee5f05c20eafb

SHA1
7bd874230e79e3e6f0d5d926f2ae50234b59502a

SHA256
b203f54896e33b784852ddd4af39dfb331fcf2cca7750fc80bb87b31c434b6c2

SHA512
806acc269e8516df8ac85a6036d9042424ca5096e4b2bd0e0e2cd662c4f6344c1ebc2cea7d03c56fcb621d9a2822e9648daaab3abd3698b31cd1be95dc5b0d81

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
565952ecd8239c280951b59633e50243

SHA1
6ff392bf029fa7774afbde14940b305e9eaf2444

SHA256
b41c0e981ba9cce6c26395603ff18ecdf59c40085c5939417b570da5be779b7e

SHA512
eb346a130cfd45560a5201900317fef0f45cbf9d713884ad2faf163abb4a374a6be33178b0325deec1476264e221c9880312d5ba54dd05be2b5affa0b72c9362

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
f383f46f1ec1bd0186c2bd3748c756cb

SHA1
489aa37ea394106a88f8c1a32674a226932c9d19

SHA256
b77f41cbf176a72e91150bab0d7bf11c2fbf184f4b7f210bbe31a143d8003551

SHA512
93315d27add6dc99ebb1277955dbc84246dd2e9d7f25878620da351d2a89ea9139c1efa17cb0f51008749e6a89ec5b99d43cff83acc1e419ef2b9fbb98a8d770

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
c93328b8537102e516f1eb615cbcad3a

SHA1
f215c871ccea0ca614860a178b3f70e5bb8b2614

SHA256
b67823d8ef918b385d1726f4d5852fe80b950ef0fdfdb6af7dc8deb4b7e7b221

SHA512
a44565e9fc36792075e8f2807cdcae90a1b229a90b95ee8afd8468a58d9ec6a2d4dcfe5187d3366058d0ff82df7af37a253338ed96037a6aa375ca5d66e133aa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
7371b314ec1f50a6518b8bf9eabda46a

SHA1
d5ca8295935a0108b49a7d8799b03bcdc9df870b

SHA256
4be78e2486f91bd358f2059cc4293c1442291f6e54563a32e0c3810784ebf560

SHA512
4f87c26bbfc524c3c45c8773b118a1b56420cb376126a8dc4de2803e332406ffee075c5492b1b6812d7dec07dbfab6016d1df5f9b4368739cbf038c11179585f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
486b9076156ee1535e15cb5c73c42fcb

SHA1
de912df399290c11996ed596306f99e0eb9a9a3b

SHA256
1120bb0fad5a4bff79af7b7bafe80eacbb6b78963e31f473e45e538e6e298d2f

SHA512
3cf072b2f8b3b15c3feacf1d8b99872bb7e3321cf140530c2d5cce0c5f05b8ae9df829ff6c4b0153591672d061e25772e58fe22af713d057d0240d22b377bc22

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
b4e4804ce7e176a5820244b971e63655

SHA1
d905218a2a8dded0f2aee1dc3cf72a24c0ecfc08

SHA256
e6e92bd63a852b5ab75183b1610568861d2841289b43991c70a45069bc8f1a3c

SHA512
c2c7d2e1c825e40499378db1f765929f65ff95483d6fb985f01bab67341e843fbafb874e5cb7523311a4184ffce01a0d403057d4b4002dff7358f52031c4acf7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
8dd50b0a0775aa0f211b2ad843366433

SHA1
5cc6aab10fb64cf62ff1f35f038eefb13aecb805

SHA256
860b89c9818fb987fb584d79f84ae35d5a000a0003c1b55983177d1ad4802f83

SHA512
c9ab07f974f6865e38a1d74d0406dfef6993bdddc825779eafcfc6a81d6bf82f1b406f295d4ca6659611101299db7da6b6e5d57aa1213f4f569d9762d90a59f8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
403700673c3d3900cfa0241672032389

SHA1
fc655c94deed61f7202823d02c8f3bc1afe089e7

SHA256
9b5d4f4041ce1f5b31c20f1e39be0e311cb6c4acf1b5f39fa4874d7934ff2398

SHA512
100970696bcb45e7ddce55c72d4cf388d1cc066f533ea3aa225d9dc0ae0c4b153299b16666a4e6b94129632020b437de4671ef073ee47791d8d41e7ae05051a5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
c2ef1d773c3f6f230cedf469f7e34059

SHA1
e410764405adcfead3338c8d0b29371fd1a3f292

SHA256
185450d538a894e4dcf55b428f506f3d7baa86664fbbc67afd6c255b65178521

SHA512
2ef93803da4d630916bed75d678382fd1c72bff1700a1a72e2612431c6d5e11410ced4eaf522b388028aeadb08e8a77513e16594e6ab081f6d6203e4caa7d549

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
1c7ec27d94da04714401b9adf0b17756

SHA1
3e18d51664cd7c8036552c1557391ae0e7d3363d

SHA256
57be391e5772faf9845cc18c3b6c5e428c1181feaa56c5dd4c4d16472c9ebb52

SHA512
067ce3414a4fdadf8b1fbc79cd0abfdbde43e60b848d9f06e1310f3c1192ab2135347d570baa9c1eee1da941f70e66a85ff4a82fcd6286268c542c97a5f2ba24

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
90B

MD5
f26a38d5103fbfd710709a5688c743d0

SHA1
3f84d2eaaa0cec3c0710d71ecd5b32e9e84ad3ef

SHA256
d82a48131d9e448377661f4624d4b52b1bc94081e63e7e39e2731c333bacd04d

SHA512
dcabf0299fbae3b7ec1e11f71a0d6f57574fc6de65a72d8ea10a4fe60131a6586abf20eee4b861ae5e3ba7412939826880376756bc69f07891717b361571a9b0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
26B

MD5
2892eee3e20e19a9ba77be6913508a54

SHA1
7c4ef82faa28393c739c517d706ac6919a8ffc49

SHA256
4f110831bb434c728a6895190323d159df6d531be8c4bb7109864eeb7c989ff2

SHA512
b13a336db33299ab3405e13811e3ed9e5a18542e5d835f2b7130a6ff4c22f74272002fc43e7d9f94ac3aa6a4d53518f87f25d90c29e0d286b6470667ea9336ae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\000003.log

Filesize
889B

MD5
ce91b47dfe4da59143f7e97ce87b0118

SHA1
c9c65d9d11cbb005f5ae0d245867ab75b1a5dd34

SHA256
b3eae637bdc9ad601923e0e968616b559e2e3f2f8d1aa5f9260eadf7baef3c12

SHA512
32e392036530ce235d5f3211aa6e23b0c2d4f64032aa89221764e1a5dc181f11cbb82bef718762de9317a7cc1f56b4a7e767bd98c33e8fb90b647e7aee2bd03f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG

Filesize
322B

MD5
b90d1d749b38f6e355d38e8d66e1f11b

SHA1
bc7f7d5b311d97127ae3a72492b075ecefaa6bdb

SHA256
bdfeb40283415c9c0e92416f2348ac3df97cc91acfcbc3918c3c8398da7fe6c6

SHA512
d24ed64c1e752c8c3bd8c09457d0f1d78951c26db12be6d4e1fe4d53e0c4582cf25ef2c39b26a26ec401fe4424262a91eb2ebebfd0b9c68c69da0626f2e50236

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sessions\Tabs_13355939732182458

Filesize
13KB

MD5
49b78cf59c9d94ccb57f5f2014bff7e1

SHA1
8a5b146df168a8f576e8dd2789bc3b2855a68e49

SHA256
20ccad708c1cd2ac2990d58bb7c01ef1af9d9135ac59b3b4bcafc8d7c3f3fe74

SHA512
63ad6c08ff25fcb800559ffe4edd6e15f0509ecd8dc97434a61bfed69d1c2809f882d7bdb0e68df032b976640d99f714b6f37c6a299fc1700a6789efc915baaf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\000003.log

Filesize
112B

MD5
c96dd22a73603314c47a4ab324271aa0

SHA1
25795062664dcd27fc95b7e7d4ffc81c7b4b6f77

SHA256
bcbde7e55b1fe4c989f6ff3a0e22bb82850c459df50765b595916fa027a48f5e

SHA512
c8ca772e5cea734d5ae0c7cc167ffabff054b748f3a4ab21f56bc3ac2426e4430cb8cc87ef5dfde507822e14786bab6bc5d6a260a9d36da3d244590f24bd5370

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG

Filesize
347B

MD5
02c86025bbd2316bc9dc6831dc60da25

SHA1
1a14e7cc7592ab117a002077701cdc5f1c17cce0

SHA256
85f5ed7fe6dbf1930603501042d06c42a0a410c8f9f1ded0ce8e88b70387d730

SHA512
0c7513a2f22847c7484952b7c3fff0221b11979890437bd3545f199804e63b0df732b8ae279badc1a112f531ec8a52c4fe853388edd2748bf82aa546b72d1f7c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG

Filesize
323B

MD5
e20e55325f8e9bf8632427ca065b51bf

SHA1
598410232dbbb7ff5fb58726e82dae8d134008b3

SHA256
d8bfadb31a0b3cee23de4e82663e637786d07b3e01a794e2135c7265d5306949

SHA512
4e5dd8a49b988a3ba3474b99ea25e859f13284b88c1850eec988a4c8101a58abbab1efbe84b0a034a3cfeb6a53fda97c731db7e41b36c152bee0ba4229fe58f0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
3d5aa40ea14f8a7ba92e0e348774e27e

SHA1
2f6b11ab32284d352d623ccffec0c5123323f779

SHA256
97580b06e61bc960c998f7c5fb9a7c0770adfce2b446a617f7d6f8fb6341fcef

SHA512
72650d9d260b61b4e5ade19bf210a40939acafe7f10ffca69ebee44e71c100eddd59e9e7dd701ed606b5c1fc222b31481f9b976e6074375c74b4892709a554e4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
874B

MD5
b3b05c3f2a2fe2fed434c66adc8ffbde

SHA1
8030d150a62dd2287a4e2760093813b2ca1ebe5d

SHA256
8887fe3ddba6ff2719b343c9322538247284ce567f9108ce6d634c20af02593b

SHA512
18369a2a4209e64aa48a85cdecbf9dfeff74d8b80911254700dee4cb6a923941ae1b677cd7efc96fad6e9da7cb28ff4d0d71fd86339ae2abdf1edd446e7ddbab

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
3a69c6d7458cc63dd6380f695f58bb06

SHA1
2d2af897da031400b98d20030b5b61f32e8c7bc5

SHA256
35cfc397fef8c2b0f54529390a3830d904b598d91bc78229031fa8ce6423c347

SHA512
5a38e7f5386564aa87b1e81b9a20e413996ad09a6aebb6110c872d5f44a0102304cfa274b2748d25c6998dca1ae7d990fcce28cfb04238700785ca2c961a8763

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
ff5a1f2ac6ae6fda8934e74277a974d3

SHA1
b13191db4d47451b7e54b05f8bbc34cab4ec08e9

SHA256
bc89d2b076c7832b8af52998b7e336912fa3ca71dc7201e399fee6f0a23f2d7d

SHA512
6bc93be8a1ebc79ce0bfecb60b2261e2746e01ddb20c88f88e4912cd4d2864a8ecb63543b718f67a324980a639e0d462c3642189e045af4e869ae907d14f48b0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
2d380665f9a9bdb81ef6a13d86551782

SHA1
e8f3070144a93b4953a832102c239e3a192f858f

SHA256
d6aedb9b3f6265467c7dfa5884c66d82cf4444320266a0324bab2d8a455b6827

SHA512
8207c0bee8e46da18ab9f88d7b8982644ec458b7ec4205c40ff407adc4c543217dc5b0dc5f851b56ce5bda5bb3fcb77e1aaf5f05eaa8a6b4c1223d669aa3e965

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
3d1422b845e9a3c8933c10579424a661

SHA1
28651b00d22ac87cf4fff73296a6206351b42100

SHA256
b00f9395e334a704d4174680cdf9c8651289ee8d0312b0e26975d7daff4bc7d9

SHA512
8e3ddf1f4fde92ec61a622eb6c9f1e295249596822ba03eeb7b804905e25c9dc5113dd43dae0acd0ba938d7d63c49adec472b091e80b91626b8f595ae32f12d1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
5d9fea5e353a7d073ad54945c5f4405d

SHA1
8213bc60cb859024bfbd87687b521a0f528d5fe6

SHA256
279f88eee5c7d7a5db63e1aaaf989c983f501f6faf5a3f16a7449ba7aa3ef15f

SHA512
47a72fb0a4c25d753414bc1bcde0e3539e204f6a925f218678afcf58dfe6df1b3571237e5797cd3bc695e92c58693d18cb1d5a43bf0d60771718fb790d6f8a2a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57a930.TMP

Filesize
539B

MD5
ec321a25278914068413657a62ccd78c

SHA1
d35bb5d4df8c0bf2bf58d09ff6ba9d8a27324b48

SHA256
c5a068ab0669d238b87fe46b88f7c78f52404aa61040319b363e90c3ea310dc9

SHA512
2079890ab677020b67d31185e70a34e9af55eb7d3e3d034e44e00d5fed97b2c3ef67674e4a99c7a99856720066e93ec37579d208ed42abb8929f795df472ed50

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Visited Links

Filesize
128KB

MD5
96004b3a01eb19547fd84c499232ddd2

SHA1
a85ae33d604ea616063b58742d041337cab76799

SHA256
ae25f7fe748a546fe480f098bcef02a1129fa5854dc64438b545c5243b6f8380

SHA512
44b915e551b5541181a086e37a3c1dba5be70e5e1e422d465623452cfab3c8db5f626a5bddbd6d31bfc362ae3ce15743ee548724bcfa9ed982a734916fc24a2d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
aefd77f47fb84fae5ea194496b44c67a

SHA1
dcfbb6a5b8d05662c4858664f81693bb7f803b82

SHA256
4166bf17b2da789b0d0cc5c74203041d98005f5d4ef88c27e8281e00148cd611

SHA512
b733d502138821948267a8b27401d7c0751e590e1298fda1428e663ccd02f55d0d2446ff4bc265bdcdc61f952d13c01524a5341bc86afc3c2cde1d8589b2e1c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
589c49f8a8e18ec6998a7a30b4958ebc

SHA1
cd4e0e2a5cb1fd5099ff88daf4f48bdba566332e

SHA256
26d067dbb5e448b16f93a1bb22a2541beb7134b1b3e39903346d10b96022b6b8

SHA512
e73566a037838d1f7db7e9b728eba07db08e079de471baca7c8f863c7af7beb36221e9ff77e0a898ce86d4ef4c36f83fb3af9c35e342061b7a5442ca3b9024d2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db

Filesize
72KB

MD5
d593dbeef3ac22ba9abff9497a15fe51

SHA1
9e613ead99033e77be43befd6401092493f509e4

SHA256
b9dfb4e78f16ab54fee1d9dc3877c1628c4fddf9c57573978274ccdaab3a642e

SHA512
28280fa2041ccd60c8c5897c8b8065f360ce728c9c7a45bffed0407301fbc9a952b4a21d2dce3e748d91da68ab78f8e703d9e4edcdce8eeb367ddcf2ce8c2559

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log

Filesize
19KB

MD5
e4877a6b811ec07ff6bb3f9809bfe270

SHA1
65b313806c34c65b291ba6c124a81b7c837ff092

SHA256
fbf357f34f62cb9131f6184edd6a96b130aa3d5481f9e59194d772b460b6f3ae

SHA512
e551c59cd91b48bc211161f975f23059e72463e60383d3b05c3ff4891bd25c5bd75a4239173235f203f6703dc55fa43e1d4c35e02603793d294037a74e9e982f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG

Filesize
319B

MD5
560bda602ee15b4816d4522aa5e724c7

SHA1
87504ed99e918ea70d069b2d1930ee8770b8b4e4

SHA256
beb3a649a83a8a76a53177aa1cfc3a28aa841b0f256bde89045d4466e18e8aa5

SHA512
86eed294466eca10d9a9867b2016f3b0270a2d8ad0f7944baefd5b6ffe9d35024ed4c8d88aefde93b7b425a31e471f943edff600d2b51b4f66d8ae2542d0b1e4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log

Filesize
594B

MD5
d44642249c949d8caef84ea21688d8b4

SHA1
4a8f415a6fc0938b23229b2775c06614bed944b3

SHA256
7cf323b635b48649cdbff71a7def5702d081c087d5f486cd4cc72abe6f48838f

SHA512
37aa4c49b89559572f1dd08feb2315002a3d0c9ec2a93a73abfeb76db677b29bdc49ace21ccc5b007ac09e452e364cb059c6e268629c2a1061bd179856c59706

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG

Filesize
337B

MD5
fb20056ff3964bad045d4a2ed7a090f0

SHA1
bb4b67dab15afc5b56f67de83a6f7d8ce0785fa0

SHA256
47158bdffce3057757739d3ba70d1eb9bc4f27b7f607633c7ba12f8b88e8e2c8

SHA512
f5ee025ec326261a370457014e34875f0ecde38965b4659d24c5363e72bec7beb5c8e01262500d7a754cce1a0ae9304275ab590b3e5840dc1ce800d70c6b0315

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\data_0

Filesize
44KB

MD5
d1a33b9bae0935aaa15db248ffb28218

SHA1
b979b5a40b9f5301f274421b8796ffa01756a148

SHA256
411a48457f3cef7f6516afd4733f18c50a24787eaccdc94cbd0ad638bfdc1cc5

SHA512
495d9d783304212e5fc3ea4301dc888e4cfbd17311b85f6fa0001ea7879177a427cf5992521556f97024344ec3ec1a4faffa506aaa68c65ab277baa60c0d9a47

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\data_1

Filesize
264KB

MD5
38d0615a224823b1be86e98bd5a841fa

SHA1
2138543a23fdafe27e5f6f348226407aeeb24ab4

SHA256
79788e0bbbd9247b01d1c9f9f0b2bf7a7977a32dea9dc5f59b62874c2068af87

SHA512
8b9d8244be42b1438781ea71b8eee1bed5b73c59f2eaa211a6cea9b8577b40da6d0f495e3c64346c8eabea2deaec75b9bfef8ac9976d1721c343d872f2b1388b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\data_3

Filesize
4.0MB

MD5
82ac4678907b4b08ba72e68db377e6c7

SHA1
0520952facdb62d18bbc2fa92371c19e8e32006e

SHA256
93ff5e5f8798bdcbefd2de4cbc169fc2b4d4d6739cd7f494c989c98ddfdfc954

SHA512
d3ad3eeed64d6799f4966506ad369eed48d9a9f226f46c6171116d1c551d3d3192efde5c1e9a743fc1a7230fbb65d1837928589ad0b1850ec0968780c26618f3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version

Filesize
11B

MD5
838a7b32aefb618130392bc7d006aa2e

SHA1
5159e0f18c9e68f0e75e2239875aa994847b8290

SHA256
ac3dd2221d90b09b795f1f72e72e4860342a4508fe336c4b822476eb25a55eaa

SHA512
9e350f0565cc726f66146838f9cebaaa38dd01892ffab9a45fe4f72e5be5459c0442e99107293a7c6f2412c71f668242c5e5a502124bc57cbf3b6ad8940cb3e9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
e70fdff85616721369e2b402813c6054

SHA1
b70f6902546aad0a73dae1a583a05d99f98c354e

SHA256
e9f4942c9e7e0737af23859d80a7be1ea481c6ee349143705f66d56af46645e8

SHA512
ba088dd94f8f2c2595e6676d19dc54a37e9ea5ab871176efd41aeca05caf4732734910188f78a033a08da6ccfdee597fa6a3d4c724d69452448948038c31eaf7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
14KB

MD5
b495ee47667851f7750fa5b4e13f0ca1

SHA1
93894dcf232b3030e0889b41792418591499239c

SHA256
507f4473c5a7ac85f6a727e52f571bbaf6079c3d8f3228a32b24d0c2de652aeb

SHA512
906593586581ab089279dd57f71643b9eb4c22dabf1f3d51168e45dcf1ec090bc5400fe90dd066dc1a6cf9ccc631ef1df92bda2c434a9847522ff1710e5c948b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
acc5db9bd46895a9789066c01f2cd69c

SHA1
6d64e2bcf3eaea81fb8e82c40e45315a0f0d93ef

SHA256
429a058b0cd8929459c8b5964a0f5cf29fd3812a46d06c49efe76f7019b342ba

SHA512
47b1193e69bfd5ab8251ea2c647f09d935b23953e2e1b6c032e442874b0c38420b5472a2035e02ca4b6df0ff8846c66c3b799791e1b0658324f981cc7bc1c56d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
14KB

MD5
4287088c1474aecdd436eeca137a2721

SHA1
b7c940cc17b651d3a673a2bf0728cb3a301eeae6

SHA256
5ca31dcf5971acb98371a005c48048fdb0b2f753865957b2ad14fa81f67d2035

SHA512
5dcbbe432e4790422f09d304c286c8056e8f591eb25efa6db42d8e7d9a30ed3ec639352e16ce138d3fef4c2a37885af18808fe62b81cea1333f57eab19668d68

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
14KB

MD5
347eff4a8dd6d976512ee2eedf2bac4f

SHA1
2ec4a194ad1b55d939383d170b97b62556fe1d1e

SHA256
a3922d4f49eb984e99726d99776209df32eb44c408f312b1f9537cf48cc40652

SHA512
b12023b8643f6031a541882f734cc01b4eeb64112a05dc9f096dc5a6e337ea953e16e558122d32de393bd4735de6bf25d0a956ed4dd60fe889628e156e7dba55

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
7978fee5998ee4ce8f26199779888c63

SHA1
87e1702d502e3baaaf47f6d130ef25f1d9ccdc0c

SHA256
c7d454e912650b148e28ebf3929979d6bcfa5da999b6e5bb0134d0bfe9776acf

SHA512
5467b60c3bc44409e60b26900856efe63f26a84a7d2d51fd68c28f3f8d9cb8fc480f4486e79f5cef0315e38895626d92b87440fde088f9e4a7dcbffeaa91b7d0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
14KB

MD5
1c67996cb3095b582fcb1ebb1977f67d

SHA1
6a3d8b6bdeb2dd793eac098d6902e820f255b8d7

SHA256
ac7dfa41ebc709306fdc82507a71818ba2ed3dcf7061aafb3365d41d90b8c00c

SHA512
5887d2c27ab838a555e25ee8aa3b12a1402ee65cb4db2ecdccb86a2e5bbda175c3e4e36088397eed46c8eb35e2ca54a2bc76bc94e74861fcdc8e2bc77bf0774e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\GPUCache\data_1

Filesize
264KB

MD5
a69f436288f872430e2ab668dea7b8e1

SHA1
3ae465780bd95711e4b1d6462b2ae8539499fd18

SHA256
f46a0099cd6fd635f44ac355e0045537664932a9749843e8b0411bc2effd0d50

SHA512
12197025ec58e52d1795c230dde3449b892209f25ce5c12bd33f567085af080997bf4071bf35eae71f59c26b3b6a983483de322b8bc688b12c366cd82bd05e5a

Download Submit
C:\Users\Admin\Downloads\DeathPlus.zip

Filesize
5.6MB

MD5
bb9a659a4f74978306746f8da8d6d4e2

SHA1
fc71356c47e186d7c77028ab0c30c93d32bb8c7d

SHA256
a90a15bf872a295754c0f0f05bb47d34ef64ae690dbec66a35bcb642975c8671

SHA512
b18fe532c5f5a6dc2d8e9fd04704f9f5db6e5e2a32d967ed430efc04e94291f93a4bde5abb838d4acf0e141d5a626d445ad2871f69f768453992b8dc6e496884

Download Submit
C:\Users\Admin\Downloads\Holmium.zip

Filesize
27KB

MD5
ce680a4306861fb0ae70e79040ace3ee

SHA1
114cabfdbe5b1d982c0bc278b8bf495352404ff5

SHA256
a97bd1aacf6d85ee6aee774e039a65c954f97a7379eddad73ac101f0f3fbaa4a

SHA512
08e31c568ef8ad2256de29df48a0e27d556e3c404967ab0dce50beb7b28309e0393f2e05c47da72cbfd3e150a9b0aabf07c040f0a42bb0ee6fc5a25896f63890

Download Submit
C:\Users\Admin\Downloads\MEMZ-Clean.exe

Filesize
12KB

MD5
9c642c5b111ee85a6bccffc7af896a51

SHA1
eca8571b994fd40e2018f48c214fab6472a98bab

SHA256
4bbf7589615ebdb6c769d6d2e7bdcb26072bac0cda6e225a4133ba8819e688d5

SHA512
23cc74b5a7bdf70ba789d1730a0009414cfb9c780544e3d8d841be58782b9a9a089969c4295a0da25d07285505992386486d6ff0524e75605b96bb99cd3aaa1c

Download Submit
C:\Users\Admin\Downloads\Mercuryx86.zip

Filesize
2.1MB

MD5
7a8b4ccf90e58c3cc8dea0bd4bafd823

SHA1
2961ea58979e7ccdbfe4eb271021e9900a26a240

SHA256
b333674fc274c0b32cbd61f2fbb3318b1a1385c730f0fe9d4e0855647d2c60cc

SHA512
7e171a90e03287442e39113406a8727c19bb99a3ed2418ff6e91058719b4831684d3bb9c424766d858e390e8df2153f2749a4138d49674319fd06225f8ba4b22

Download Submit
memory/436-784-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/624-764-0x0000000000400000-0x0000000000484000-memory.dmp

Filesize
528KB

Download
memory/624-758-0x00000000021F0000-0x00000000021F1000-memory.dmp

Filesize
4KB

Download
memory/804-860-0x0000000000400000-0x000000000047A000-memory.dmp

Filesize
488KB

Download
memory/804-819-0x0000000000630000-0x0000000000631000-memory.dmp

Filesize
4KB

Download
memory/1016-855-0x0000000000400000-0x000000000047A000-memory.dmp

Filesize
488KB

Download
memory/1016-802-0x0000000000640000-0x0000000000641000-memory.dmp

Filesize
4KB

Download
memory/1060-859-0x0000000000400000-0x000000000047A000-memory.dmp

Filesize
488KB

Download
memory/1060-813-0x0000000000630000-0x0000000000631000-memory.dmp

Filesize
4KB

Download
memory/1192-809-0x0000000000640000-0x0000000000641000-memory.dmp

Filesize
4KB

Download
memory/1192-857-0x0000000000400000-0x000000000047A000-memory.dmp

Filesize
488KB

Download
memory/1704-778-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download
memory/2000-798-0x0000000000640000-0x0000000000641000-memory.dmp

Filesize
4KB

Download
memory/2000-853-0x0000000000400000-0x000000000047A000-memory.dmp

Filesize
488KB

Download
memory/2076-753-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2480-792-0x0000000000740000-0x0000000000741000-memory.dmp

Filesize
4KB

Download
memory/2480-793-0x0000000000400000-0x0000000000484000-memory.dmp

Filesize
528KB

Download
memory/2628-795-0x0000000000640000-0x0000000000641000-memory.dmp

Filesize
4KB

Download
memory/2628-850-0x0000000000400000-0x000000000047A000-memory.dmp

Filesize
488KB

Download
memory/2680-800-0x0000000000630000-0x0000000000631000-memory.dmp

Filesize
4KB

Download
memory/2680-854-0x0000000000400000-0x000000000047A000-memory.dmp

Filesize
488KB

Download
memory/2800-828-0x0000000000630000-0x0000000000631000-memory.dmp

Filesize
4KB

Download
memory/2836-789-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/2984-791-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/3144-820-0x0000000000570000-0x0000000000571000-memory.dmp

Filesize
4KB

Download
memory/3144-864-0x0000000000400000-0x000000000047A000-memory.dmp

Filesize
488KB

Download
memory/3212-821-0x0000000000750000-0x0000000000751000-memory.dmp

Filesize
4KB

Download
memory/3212-865-0x0000000000400000-0x000000000047A000-memory.dmp

Filesize
488KB

Download
memory/3504-787-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/3636-719-0x0000000000400000-0x00000000025C4000-memory.dmp

Filesize
33.8MB

Download
memory/3636-777-0x0000000000400000-0x00000000025C4000-memory.dmp

Filesize
33.8MB

Download
memory/3636-1264-0x0000000000400000-0x00000000025C4000-memory.dmp

Filesize
33.8MB

Download
memory/3764-861-0x0000000000400000-0x000000000047A000-memory.dmp

Filesize
488KB

Download
memory/3764-810-0x0000000000570000-0x0000000000571000-memory.dmp

Filesize
4KB

Download
memory/3944-829-0x00000000022F0000-0x00000000022F1000-memory.dmp

Filesize
4KB

Download
memory/3944-863-0x0000000000400000-0x000000000047A000-memory.dmp

Filesize
488KB

Download
memory/4036-796-0x00000000004F0000-0x00000000004F1000-memory.dmp

Filesize
4KB

Download
memory/4036-851-0x0000000000400000-0x000000000047A000-memory.dmp

Filesize
488KB

Download
memory/4108-866-0x0000000000400000-0x000000000047A000-memory.dmp

Filesize
488KB

Download
memory/4108-825-0x0000000001FD0000-0x0000000001FD1000-memory.dmp

Filesize
4KB

Download
memory/4292-858-0x0000000000400000-0x000000000047A000-memory.dmp

Filesize
488KB

Download
memory/4292-812-0x0000000000630000-0x0000000000631000-memory.dmp

Filesize
4KB

Download
memory/4396-772-0x00007FF7EFC00000-0x00007FF7EFCF8000-memory.dmp

Filesize
992KB

Download
memory/4396-773-0x00007FF9E3A50000-0x00007FF9E3A84000-memory.dmp

Filesize
208KB

Download
memory/4396-774-0x00007FF9CBB40000-0x00007FF9CBDF4000-memory.dmp

Filesize
2.7MB

Download
memory/4396-775-0x00007FF9C9A70000-0x00007FF9CAB1B000-memory.dmp

Filesize
16.7MB

Download
memory/4436-868-0x0000000001FE0000-0x0000000001FE1000-memory.dmp

Filesize
4KB

Download
memory/4436-874-0x0000000000400000-0x0000000000484000-memory.dmp

Filesize
528KB

Download
memory/4464-856-0x0000000000400000-0x000000000047A000-memory.dmp

Filesize
488KB

Download
memory/4464-808-0x00000000020E0000-0x00000000020E1000-memory.dmp

Filesize
4KB

Download
memory/4528-797-0x0000000001FD0000-0x0000000001FD1000-memory.dmp

Filesize
4KB

Download
memory/4528-852-0x0000000000400000-0x000000000047A000-memory.dmp

Filesize
488KB

Download
memory/4820-781-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/4936-862-0x0000000000400000-0x000000000047A000-memory.dmp

Filesize
488KB

Download
memory/4936-811-0x00000000020D0000-0x00000000020D1000-memory.dmp

Filesize
4KB

Download
memory/4948-830-0x0000000001FD0000-0x0000000001FD1000-memory.dmp

Filesize
4KB

Download
memory/4948-867-0x0000000000400000-0x000000000047A000-memory.dmp

Filesize
488KB

Download
memory/5396-1049-0x0000000001FB0000-0x0000000001FB1000-memory.dmp

Filesize
4KB

Download