3872c12d31fc9825e8661ac01ecee2572460677afbc7093f920a8436a42e28ff

Analysis

max time kernel
150s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
08/05/2024, 18:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
MEMZ.exe
Size 16KB
Sample240508-xdmq4she5s
SHA256 3872c12d31fc9825e8661ac01ecee2572460677afbc7093f920a8436a42e28ff
MD5 1d5ad9c8d3fee874d0feb8bfac220a11
SHA1 ca6d3f7e6c784155f664a9179ca64e4034df9595
SHA512 c8246f4137416be33b6d1ac89f2428b7c44d9376ac8489a9fbf65ef128a6c53fb50479e1e400c8e201c8611992ab1d6c1bd3d6cece89013edb4d35cdd22305b1
SSDEEP 192:M2WgyvSW8gRc6olcIEiwqZKBkDFR43xWTM3LHf26gFrcx3sNq:JWgnSmFlcIqq3agmLH+6gF23sN
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

bootkit persistence

Malware Config

Signatures

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation	MEMZ.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation	MEMZ.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	MEMZ.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	Taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	Taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	Taskmgr.exe

Enumerates system info in registry 2 TTPs 9 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe

Modifies data under HKEY_USERS 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\sud.dll,-1#immutable1 = "Default Programs"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\DiagCpl.dll,-1#immutable1 = "Troubleshooting"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\fvecpl.dll,-1#immutable1 = "BitLocker Drive Encryption"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{DE4F0660-FA10-4B8F-A494-068B20B22307}\GroupByDirection = "1"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\mmsys.cpl,-301#immutable1 = "Configure your audio devices or change the sound scheme for your computer."	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f706806ee260aa0d7449371beb064c986830000	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{DE4F0660-FA10-4B8F-A494-068B20B22307}\GroupByKey:PID = "0"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\powercpl.dll,-1#immutable1 = "Power Options"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\srchadmin.dll,-601#immutable1 = "Indexing Options"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\systemcpl.dll,-1#immutable1 = "System"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{DE4F0660-FA10-4B8F-A494-068B20B22307}\FFlags = "18874369"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\RADCUI.dll,-15300#immutable1 = "RemoteApp and Desktop Connections"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\usercpl.dll,-2#immutable1 = "Change user account settings and passwords for people who share this computer."	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\intl.cpl,-3#immutable1 = "Region"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\system32\colorcpl.exe,-6#immutable1 = "Color Management"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{DE4F0660-FA10-4B8F-A494-068B20B22307}	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\autoplay.dll,-2#immutable1 = "Change default settings for CDs, DVDs, and devices so that you can automatically play music, view pictures, install software, and play games."	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\recovery.dll,-2#immutable1 = "Recovery"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\RADCUI.dll,-15301#immutable1 = "Manage your RemoteApp and Desktop Connections"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\FirewallControlPanel.dll,-12122#immutable1 = "Windows Defender Firewall"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\main.cpl,-101#immutable1 = "Customize your mouse settings, such as the button configuration, double-click speed, mouse pointers, and motion speed."	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\main.cpl,-103#immutable1 = "Customize your keyboard settings, such as the cursor blink rate and the character repeat rate."	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{DE4F0660-FA10-4B8F-A494-068B20B22307}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{DE4F0660-FA10-4B8F-A494-068B20B22307}\Rev = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{DE4F0660-FA10-4B8F-A494-068B20B22307}\GroupView = "0"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\powercpl.dll,-2#immutable1 = "Conserve energy or maximize performance by choosing how your computer manages power."	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\sdcpl.dll,-100#immutable1 = "Recover copies of your files backed up in Windows 7"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\accessibilitycpl.dll,-45#immutable1 = "Make your computer easier to use."	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\NodeSlot = "1"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{DE4F0660-FA10-4B8F-A494-068B20B22307}\IconSize = "48"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\Speech\SpeechUX\speechuxcpl.dll,-2#immutable1 = "Configure how speech recognition works on your computer."	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\main.cpl,-102#immutable1 = "Keyboard"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\srchadmin.dll,-602#immutable1 = "Change how Windows indexes to search faster"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\inetcpl.cpl,-4313#immutable1 = "Configure your Internet display and connection settings."	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\system32\colorcpl.exe,-7#immutable1 = "Change advanced color management settings for displays, scanners, and printers."	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{DE4F0660-FA10-4B8F-A494-068B20B22307}\Vid = "{65F125E5-7BE1-4810-BA9D-D271C8432CE3}"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\sud.dll,-10#immutable1 = "Choose which programs you want Windows to use for activities like web browsing, editing photos, sending e-mail, and playing music."	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\FirewallControlPanel.dll,-12123#immutable1 = "Set firewall security options to help protect your computer from hackers and malicious software."	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\accessibilitycpl.dll,-10#immutable1 = "Ease of Access Center"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\autoplay.dll,-1#immutable1 = "AutoPlay"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\SyncCenter.dll,-3001#immutable1 = "Sync files between your computer and network folders"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\recovery.dll,-101#immutable1 = "Recovery"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\DiagCpl.dll,-15#immutable1 = "Troubleshoot and fix common computer problems."	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\timedate.cpl,-51#immutable1 = "Date and Time"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{DE4F0660-FA10-4B8F-A494-068B20B22307}\Mode = "6"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\telephon.cpl,-1#immutable1 = "Phone and Modem"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\intl.cpl,-2#immutable1 = "Customize settings for the display of languages, numbers, times, and dates."	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\system32\DeviceCenter.dll,-2000#immutable1 = "View and manage devices, printers, and print jobs"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\sdcpl.dll,-101#immutable1 = "Backup and Restore (Windows 7)"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\fhcpl.dll,-52#immutable1 = "File History"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\main.cpl,-100#immutable1 = "Mouse"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\fhcpl.dll,-2#immutable1 = "Keep a history of your files"	explorer.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
4420	explorer.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
408	MEMZ.exe
408	MEMZ.exe
4508	MEMZ.exe
4508	MEMZ.exe
2832	MEMZ.exe
2832	MEMZ.exe
408	MEMZ.exe
408	MEMZ.exe
4584	MEMZ.exe
4584	MEMZ.exe
408	MEMZ.exe
408	MEMZ.exe
2832	MEMZ.exe
2832	MEMZ.exe
4508	MEMZ.exe
4508	MEMZ.exe
4508	MEMZ.exe
4964	MEMZ.exe
4964	MEMZ.exe
4508	MEMZ.exe
2832	MEMZ.exe
408	MEMZ.exe
2832	MEMZ.exe
408	MEMZ.exe
4584	MEMZ.exe
4584	MEMZ.exe
4584	MEMZ.exe
4584	MEMZ.exe
408	MEMZ.exe
408	MEMZ.exe
2832	MEMZ.exe
2832	MEMZ.exe
4964	MEMZ.exe
4964	MEMZ.exe
4508	MEMZ.exe
4508	MEMZ.exe
4508	MEMZ.exe
4508	MEMZ.exe
4964	MEMZ.exe
4964	MEMZ.exe
2832	MEMZ.exe
2832	MEMZ.exe
408	MEMZ.exe
408	MEMZ.exe
4584	MEMZ.exe
4584	MEMZ.exe
4584	MEMZ.exe
4584	MEMZ.exe
408	MEMZ.exe
408	MEMZ.exe
2832	MEMZ.exe
2832	MEMZ.exe
4964	MEMZ.exe
4964	MEMZ.exe
4508	MEMZ.exe
4508	MEMZ.exe
408	MEMZ.exe
4584	MEMZ.exe
408	MEMZ.exe
4584	MEMZ.exe
4508	MEMZ.exe
4508	MEMZ.exe
4964	MEMZ.exe
4964	MEMZ.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
1536	chrome.exe
1536	chrome.exe
1536	chrome.exe
1536	chrome.exe
1536	chrome.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
5852	msedge.exe
5852	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4420	explorer.exe
Token: SeCreatePagefilePrivilege	4420	explorer.exe
Token: SeShutdownPrivilege	1536	chrome.exe
Token: SeCreatePagefilePrivilege	1536	chrome.exe
Token: SeShutdownPrivilege	1536	chrome.exe
Token: SeCreatePagefilePrivilege	1536	chrome.exe
Token: SeShutdownPrivilege	1536	chrome.exe
Token: SeCreatePagefilePrivilege	1536	chrome.exe
Token: SeShutdownPrivilege	1536	chrome.exe
Token: SeCreatePagefilePrivilege	1536	chrome.exe
Token: SeShutdownPrivilege	1536	chrome.exe
Token: SeCreatePagefilePrivilege	1536	chrome.exe
Token: SeShutdownPrivilege	1536	chrome.exe
Token: SeCreatePagefilePrivilege	1536	chrome.exe
Token: SeShutdownPrivilege	1536	chrome.exe
Token: SeCreatePagefilePrivilege	1536	chrome.exe
Token: SeShutdownPrivilege	1536	chrome.exe
Token: SeCreatePagefilePrivilege	1536	chrome.exe
Token: SeShutdownPrivilege	1536	chrome.exe
Token: SeCreatePagefilePrivilege	1536	chrome.exe
Token: SeShutdownPrivilege	1536	chrome.exe
Token: SeCreatePagefilePrivilege	1536	chrome.exe
Token: SeShutdownPrivilege	1536	chrome.exe
Token: SeCreatePagefilePrivilege	1536	chrome.exe
Token: SeShutdownPrivilege	1536	chrome.exe
Token: SeCreatePagefilePrivilege	1536	chrome.exe
Token: SeShutdownPrivilege	1536	chrome.exe
Token: SeCreatePagefilePrivilege	1536	chrome.exe
Token: SeShutdownPrivilege	1536	chrome.exe
Token: SeCreatePagefilePrivilege	1536	chrome.exe
Token: SeShutdownPrivilege	1536	chrome.exe
Token: SeCreatePagefilePrivilege	1536	chrome.exe
Token: SeShutdownPrivilege	1536	chrome.exe
Token: SeCreatePagefilePrivilege	1536	chrome.exe
Token: SeDebugPrivilege	3884	Taskmgr.exe
Token: SeSystemProfilePrivilege	3884	Taskmgr.exe
Token: SeCreateGlobalPrivilege	3884	Taskmgr.exe
Token: SeShutdownPrivilege	1536	chrome.exe
Token: SeCreatePagefilePrivilege	1536	chrome.exe
Token: SeShutdownPrivilege	1536	chrome.exe
Token: SeCreatePagefilePrivilege	1536	chrome.exe
Token: 33	3884	Taskmgr.exe
Token: SeIncBasePriorityPrivilege	3884	Taskmgr.exe
Token: SeShutdownPrivilege	1536	chrome.exe
Token: SeCreatePagefilePrivilege	1536	chrome.exe
Token: 33	3708	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	3708	AUDIODG.EXE
Token: SeShutdownPrivilege	1536	chrome.exe
Token: SeCreatePagefilePrivilege	1536	chrome.exe
Token: SeShutdownPrivilege	1536	chrome.exe
Token: SeCreatePagefilePrivilege	1536	chrome.exe
Token: SeShutdownPrivilege	1536	chrome.exe
Token: SeCreatePagefilePrivilege	1536	chrome.exe
Token: SeShutdownPrivilege	1536	chrome.exe
Token: SeCreatePagefilePrivilege	1536	chrome.exe
Token: SeShutdownPrivilege	1536	chrome.exe
Token: SeCreatePagefilePrivilege	1536	chrome.exe
Token: SeShutdownPrivilege	1536	chrome.exe
Token: SeCreatePagefilePrivilege	1536	chrome.exe
Token: SeShutdownPrivilege	1536	chrome.exe
Token: SeCreatePagefilePrivilege	1536	chrome.exe
Token: SeShutdownPrivilege	1536	chrome.exe
Token: SeCreatePagefilePrivilege	1536	chrome.exe
Token: SeShutdownPrivilege	1536	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4420	explorer.exe
1536	chrome.exe
1536	chrome.exe
1536	chrome.exe
1536	chrome.exe
1536	chrome.exe
1536	chrome.exe
1536	chrome.exe
1536	chrome.exe
1536	chrome.exe
1536	chrome.exe
1536	chrome.exe
1536	chrome.exe
1536	chrome.exe
1536	chrome.exe
1536	chrome.exe
1536	chrome.exe
1536	chrome.exe
1536	chrome.exe
1536	chrome.exe
1536	chrome.exe
1536	chrome.exe
1536	chrome.exe
1536	chrome.exe
1536	chrome.exe
1536	chrome.exe
1536	chrome.exe
3884	Taskmgr.exe
3884	Taskmgr.exe
3884	Taskmgr.exe
3884	Taskmgr.exe
3884	Taskmgr.exe
3884	Taskmgr.exe
3884	Taskmgr.exe
3884	Taskmgr.exe
3884	Taskmgr.exe
3884	Taskmgr.exe
3884	Taskmgr.exe
3884	Taskmgr.exe
3884	Taskmgr.exe
3884	Taskmgr.exe
3884	Taskmgr.exe
3884	Taskmgr.exe
3884	Taskmgr.exe
3884	Taskmgr.exe
3884	Taskmgr.exe
3884	Taskmgr.exe
3884	Taskmgr.exe
3884	Taskmgr.exe
3884	Taskmgr.exe
3884	Taskmgr.exe
3884	Taskmgr.exe
3884	Taskmgr.exe
3884	Taskmgr.exe
3884	Taskmgr.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
1536	chrome.exe
1536	chrome.exe
1536	chrome.exe
1536	chrome.exe
1536	chrome.exe
1536	chrome.exe
1536	chrome.exe
1536	chrome.exe
1536	chrome.exe
1536	chrome.exe
1536	chrome.exe
1536	chrome.exe
1536	chrome.exe
1536	chrome.exe
1536	chrome.exe
1536	chrome.exe
1536	chrome.exe
1536	chrome.exe
1536	chrome.exe
1536	chrome.exe
1536	chrome.exe
1536	chrome.exe
1536	chrome.exe
1536	chrome.exe
3884	Taskmgr.exe
3884	Taskmgr.exe
3884	Taskmgr.exe
3884	Taskmgr.exe
3884	Taskmgr.exe
3884	Taskmgr.exe
3884	Taskmgr.exe
3884	Taskmgr.exe
3884	Taskmgr.exe
3884	Taskmgr.exe
3884	Taskmgr.exe
3884	Taskmgr.exe
3884	Taskmgr.exe
3884	Taskmgr.exe
3884	Taskmgr.exe
3884	Taskmgr.exe
3884	Taskmgr.exe
3884	Taskmgr.exe
3884	Taskmgr.exe
3884	Taskmgr.exe
3884	Taskmgr.exe
3884	Taskmgr.exe
3884	Taskmgr.exe
3884	Taskmgr.exe
3884	Taskmgr.exe
3884	Taskmgr.exe
3884	Taskmgr.exe
3884	Taskmgr.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4896 wrote to memory of 408	4896	MEMZ.exe	83
PID 4896 wrote to memory of 408	4896	MEMZ.exe	83
PID 4896 wrote to memory of 408	4896	MEMZ.exe	83
PID 4896 wrote to memory of 2832	4896	MEMZ.exe	84
PID 4896 wrote to memory of 2832	4896	MEMZ.exe	84
PID 4896 wrote to memory of 2832	4896	MEMZ.exe	84
PID 4896 wrote to memory of 4508	4896	MEMZ.exe	85
PID 4896 wrote to memory of 4508	4896	MEMZ.exe	85
PID 4896 wrote to memory of 4508	4896	MEMZ.exe	85
PID 4896 wrote to memory of 4584	4896	MEMZ.exe	86
PID 4896 wrote to memory of 4584	4896	MEMZ.exe	86
PID 4896 wrote to memory of 4584	4896	MEMZ.exe	86
PID 4896 wrote to memory of 4964	4896	MEMZ.exe	87
PID 4896 wrote to memory of 4964	4896	MEMZ.exe	87
PID 4896 wrote to memory of 4964	4896	MEMZ.exe	87
PID 4896 wrote to memory of 2784	4896	MEMZ.exe	88
PID 4896 wrote to memory of 2784	4896	MEMZ.exe	88
PID 4896 wrote to memory of 2784	4896	MEMZ.exe	88
PID 2784 wrote to memory of 3036	2784	MEMZ.exe	90
PID 2784 wrote to memory of 3036	2784	MEMZ.exe	90
PID 2784 wrote to memory of 3036	2784	MEMZ.exe	90
PID 2784 wrote to memory of 1964	2784	MEMZ.exe	93
PID 2784 wrote to memory of 1964	2784	MEMZ.exe	93
PID 2784 wrote to memory of 1964	2784	MEMZ.exe	93
PID 2784 wrote to memory of 1516	2784	MEMZ.exe	95
PID 2784 wrote to memory of 1516	2784	MEMZ.exe	95
PID 2784 wrote to memory of 1516	2784	MEMZ.exe	95
PID 1536 wrote to memory of 4120	1536	chrome.exe	99
PID 1536 wrote to memory of 4120	1536	chrome.exe	99
PID 1536 wrote to memory of 2576	1536	chrome.exe	100
PID 1536 wrote to memory of 2576	1536	chrome.exe	100
PID 1536 wrote to memory of 2576	1536	chrome.exe	100
PID 1536 wrote to memory of 2576	1536	chrome.exe	100
PID 1536 wrote to memory of 2576	1536	chrome.exe	100
PID 1536 wrote to memory of 2576	1536	chrome.exe	100
PID 1536 wrote to memory of 2576	1536	chrome.exe	100
PID 1536 wrote to memory of 2576	1536	chrome.exe	100
PID 1536 wrote to memory of 2576	1536	chrome.exe	100
PID 1536 wrote to memory of 2576	1536	chrome.exe	100
PID 1536 wrote to memory of 2576	1536	chrome.exe	100
PID 1536 wrote to memory of 2576	1536	chrome.exe	100
PID 1536 wrote to memory of 2576	1536	chrome.exe	100
PID 1536 wrote to memory of 2576	1536	chrome.exe	100
PID 1536 wrote to memory of 2576	1536	chrome.exe	100
PID 1536 wrote to memory of 2576	1536	chrome.exe	100
PID 1536 wrote to memory of 2576	1536	chrome.exe	100
PID 1536 wrote to memory of 2576	1536	chrome.exe	100
PID 1536 wrote to memory of 2576	1536	chrome.exe	100
PID 1536 wrote to memory of 2576	1536	chrome.exe	100
PID 1536 wrote to memory of 2576	1536	chrome.exe	100
PID 1536 wrote to memory of 2576	1536	chrome.exe	100
PID 1536 wrote to memory of 2576	1536	chrome.exe	100
PID 1536 wrote to memory of 2576	1536	chrome.exe	100
PID 1536 wrote to memory of 2576	1536	chrome.exe	100
PID 1536 wrote to memory of 2576	1536	chrome.exe	100
PID 1536 wrote to memory of 2576	1536	chrome.exe	100
PID 1536 wrote to memory of 2576	1536	chrome.exe	100
PID 1536 wrote to memory of 2576	1536	chrome.exe	100
PID 1536 wrote to memory of 2576	1536	chrome.exe	100
PID 1536 wrote to memory of 2576	1536	chrome.exe	100
PID 1536 wrote to memory of 4956	1536	chrome.exe	101
PID 1536 wrote to memory of 4956	1536	chrome.exe	101
PID 1536 wrote to memory of 3060	1536	chrome.exe	102
PID 1536 wrote to memory of 3060	1536	chrome.exe	102

C:\Users\Admin\AppData\Local\Temp\MEMZ.exe
"C:\Users\Admin\AppData\Local\Temp\MEMZ.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4896
- C:\Users\Admin\AppData\Local\Temp\MEMZ.exe
  "C:\Users\Admin\AppData\Local\Temp\MEMZ.exe" /watchdog
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:408
- C:\Users\Admin\AppData\Local\Temp\MEMZ.exe
  "C:\Users\Admin\AppData\Local\Temp\MEMZ.exe" /watchdog
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2832
- C:\Users\Admin\AppData\Local\Temp\MEMZ.exe
  "C:\Users\Admin\AppData\Local\Temp\MEMZ.exe" /watchdog
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4508
- C:\Users\Admin\AppData\Local\Temp\MEMZ.exe
  "C:\Users\Admin\AppData\Local\Temp\MEMZ.exe" /watchdog
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4584
- C:\Users\Admin\AppData\Local\Temp\MEMZ.exe
  "C:\Users\Admin\AppData\Local\Temp\MEMZ.exe" /watchdog
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4964
- C:\Users\Admin\AppData\Local\Temp\MEMZ.exe
  "C:\Users\Admin\AppData\Local\Temp\MEMZ.exe" /main
  2⤵
  - Checks computer location settings
  - Writes to the Master Boot Record (MBR)
  - Suspicious use of WriteProcessMemory
  PID:2784
- - C:\Windows\SysWOW64\notepad.exe
    "C:\Windows\System32\notepad.exe" \note.txt
    3⤵
    PID:3036
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe"
    3⤵
    PID:1964
- - C:\Windows\SysWOW64\control.exe
    "C:\Windows\System32\control.exe"
    3⤵
    PID:1516
- - C:\Windows\SysWOW64\Taskmgr.exe
    "C:\Windows\System32\Taskmgr.exe"
    3⤵
    - Checks SCSI registry key(s)
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    PID:3884
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=how+2+buy+weed
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    PID:1972
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff8004b46f8,0x7ff8004b4708,0x7ff8004b4718
      4⤵
      PID:1104
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,11025651786981532730,16491519175205653872,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2156 /prefetch:2
      4⤵
      PID:5024
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2144,11025651786981532730,16491519175205653872,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2208 /prefetch:3
      4⤵
      PID:3808
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2144,11025651786981532730,16491519175205653872,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2728 /prefetch:8
      4⤵
      PID:1836
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,11025651786981532730,16491519175205653872,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3508 /prefetch:1
      4⤵
      PID:4764
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,11025651786981532730,16491519175205653872,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3532 /prefetch:1
      4⤵
      PID:3260
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,11025651786981532730,16491519175205653872,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4932 /prefetch:1
      4⤵
      PID:5136
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,11025651786981532730,16491519175205653872,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3744 /prefetch:1
      4⤵
      PID:5236
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,11025651786981532730,16491519175205653872,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5448 /prefetch:8
      4⤵
      PID:5440
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,11025651786981532730,16491519175205653872,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5448 /prefetch:8
      4⤵
      PID:5612
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://pcoptimizerpro.com/
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    PID:5852
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8004b46f8,0x7ff8004b4708,0x7ff8004b4718
      4⤵
      PID:5868
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1996,16765200109947020326,15201088528972816682,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2100 /prefetch:2
      4⤵
      PID:5684
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1996,16765200109947020326,15201088528972816682,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2452 /prefetch:3
      4⤵
      PID:5692
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1996,16765200109947020326,15201088528972816682,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2900 /prefetch:8
      4⤵
      PID:5300
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,16765200109947020326,15201088528972816682,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3416 /prefetch:1
      4⤵
      PID:3020
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,16765200109947020326,15201088528972816682,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3464 /prefetch:1
      4⤵
      PID:2420

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{5BD95610-9434-43C2-886C-57852CC8A120} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4420

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
1⤵
PID:4828

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1536
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ff80131ab58,0x7ff80131ab68,0x7ff80131ab78
  2⤵
  PID:4120
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1792 --field-trial-handle=1988,i,7446782961407727140,1165887351506180212,131072 /prefetch:2
  2⤵
  PID:2576
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2124 --field-trial-handle=1988,i,7446782961407727140,1165887351506180212,131072 /prefetch:8
  2⤵
  PID:4956
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2160 --field-trial-handle=1988,i,7446782961407727140,1165887351506180212,131072 /prefetch:8
  2⤵
  PID:3060
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3112 --field-trial-handle=1988,i,7446782961407727140,1165887351506180212,131072 /prefetch:1
  2⤵
  PID:4164
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3120 --field-trial-handle=1988,i,7446782961407727140,1165887351506180212,131072 /prefetch:1
  2⤵
  PID:5072
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4336 --field-trial-handle=1988,i,7446782961407727140,1165887351506180212,131072 /prefetch:1
  2⤵
  PID:1644
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4380 --field-trial-handle=1988,i,7446782961407727140,1165887351506180212,131072 /prefetch:8
  2⤵
  PID:1184
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4624 --field-trial-handle=1988,i,7446782961407727140,1165887351506180212,131072 /prefetch:8
  2⤵
  PID:2804
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4792 --field-trial-handle=1988,i,7446782961407727140,1165887351506180212,131072 /prefetch:8
  2⤵
  PID:2384
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4996 --field-trial-handle=1988,i,7446782961407727140,1165887351506180212,131072 /prefetch:8
  2⤵
  PID:3580
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5088 --field-trial-handle=1988,i,7446782961407727140,1165887351506180212,131072 /prefetch:8
  2⤵
  PID:3764
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=4804 --field-trial-handle=1988,i,7446782961407727140,1165887351506180212,131072 /prefetch:1
  2⤵
  PID:2520
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=3340 --field-trial-handle=1988,i,7446782961407727140,1165887351506180212,131072 /prefetch:1
  2⤵
  PID:2080
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=3464 --field-trial-handle=1988,i,7446782961407727140,1165887351506180212,131072 /prefetch:8
  2⤵
  PID:3168
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4616 --field-trial-handle=1988,i,7446782961407727140,1165887351506180212,131072 /prefetch:8
  2⤵
  PID:4624
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4520 --field-trial-handle=1988,i,7446782961407727140,1165887351506180212,131072 /prefetch:8
  2⤵
  PID:792
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5176 --field-trial-handle=1988,i,7446782961407727140,1165887351506180212,131072 /prefetch:8
  2⤵
  PID:4572
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5304 --field-trial-handle=1988,i,7446782961407727140,1165887351506180212,131072 /prefetch:8
  2⤵
  PID:3496

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
1⤵
PID:4404

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x150 0x41c
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3708

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1308

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1776

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3656

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5148

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 b3c089b311e12631e0a502e1792ff5bd2dc1d26be04349b06c2c17445487a0a2
MD5 e6097e86d728242bf60fb554f83e5e7f
SHA1 96e44cbcf147625dc57183626a749c26d45af147
SHA512 04d56d177a6d3a1fa06d1db0501120395dc00377c5e378fcd315cb50b1e866676c6ed723d771fa0a3b336c69c70779c7085e3e165378023ad2e0ba6653cf75b0
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 304b432f3c4c304e8945548d4b6c5fba2c4179c96881c94371bd3c24d065c4d3
MD5 25a447d1a55a22c6188a822b2b04979e
SHA1 369e189267333e3530395298d3941b401adcf7cd
SHA512 e2182e47359c2326e0e543122f3c722762a0415a6aa643db743ec3ed35590ac03e5d26e42e2d3baabac805a099fe6e1a84f0d0dacf2a845438d7f19e62edcf28
SSDEEP 96:9HiHRHdHzHpH1HuH6YHkH7HcgH0+HIH6M7H69HGYHGdHGpHGiVfHGpwVrHG2HGeS:9HiHRHdHzHpH1HuH6YHkH7HfH9HIH6od
MD5 SHA1 SHA512 SSDEEP

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 1KB
SHA256 6d4ac1f51b23a9bb942ce59d97e1335e681d1b8abcefd687291dbb45a9e259d0
MD5 8badf41fd59cd046f4436c1ab55c19b7
SHA1 08d00bd5b9d6c9bb4b05a0f380c5073462b8ddcf
SHA512 3cec450a9e064cbaae0ed5b8e7b8f5fda1fb4720211a6e540e90848c3452e5c161e1bf8b0be39118a2e9b6c0b9c161d64a6c6ff5cd58696960d08d287b915320
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 1KB
SHA256 5fa8818d1ad38032761422751b0bf3829ade4c492582df4a59bbc6c626730b5b
MD5 4afd4fdce1b89f1302b274f9b3e648b7
SHA1 ed453f371f9f884d690694a27009b45404f0cbe0
SHA512 bc04bf8f7307bae7a4964582e9cfbd4d63a53603c9613357004dd1ccd1be9dba1a2073f3746d7635af657dbd00a9d77762a71c80b22f0dc55f615aa41b755552
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 1KB
SHA256 24f12d47b3e77b454f1010c6906836d745b42dcfaeb88aa9a7076299dc2871a0
MD5 a491b06958f1a1324b6eeba121954f83
SHA1 fb4ca8c61dee66e480c378b56445690e5e0512e2
SHA512 4d0b074093b2106ec387bc8f7b7652ad62f9920875238594bca2214effde9b31d86ea18fb9b2702d6dbb1f2d6639acff79a59df7fdcdc5e0d91c71c4baf3d4f0
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 1KB
SHA256 3c873e62977f845c1599f6609bcf768b089c37e7112ca93e408830140db8e48f
MD5 fecd4b3bc307cbb7201dfced7e9cbb87
SHA1 d08370f00dcade254571ba6f3555459198c72da8
SHA512 7b8df9d4c544c54014c360798bc6e906790a5e2445483a9489c8a7ab71bc398bfb04432c6cafcffbada2c3f78e038c2e829a9e7edbc06c6e7b3cc04a9db47f15
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 7KB
SHA256 2bed0e1cef58177f792d68e3bf9d47f4116af9576589929da4b99939c0fea32d
MD5 b60c9b4116fd9a1abd2cd41eb93c3e0c
SHA1 54bea480dc51da9ff2d784703715b1d3ff2d571b
SHA512 b71efea53abb96135768d68bf9b025e49bd842a9370057c39dce25c4c903e33fec08ab80f0a39a45137afc2b2197a3f41d502b44d50ca99031b6e56c64b775e6
SSDEEP 192:p6NpEGgE8aJZT8syh+Fcla90pEKd5tjEsXtScR:p6NalgZlyqcdXtIsXtScR
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 6KB
SHA256 4f95f255030fa5a032f3ea302cd594fd53665f5e0e5f91fabe20a41a9e5a75d1
MD5 ce742fde0272f97f6f7a96c3bcb9c448
SHA1 67e5f596cb2ef36ae0dcca1ea78e281e035a5b62
SHA512 f20d8e81bb49af25a05f4266638f7ad8679f94a68add556346a7de1082fda37ab1f78d3511337e555c358d1d3058b503d850a694e1c4cd2bb57b44775d4fb715
SSDEEP 192:p6NpEGgE8aJZT89yh+FIgjVP5tjEsXtScR:p6NalgZ2yqL/tIsXtScR
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 6KB
SHA256 cd7e74547d2e3c6a2f927434cfc147dbbae9211c5517cfcaede1e5f9de22888b
MD5 4999f423a2567060c3d9e77fca6f3e1e
SHA1 8ad9d4328abd184ad6bca5efb0ce1d1c5c3fdd66
SHA512 666bf21cdd8c613e2e7913825173135f8f06b5019b731d6c84e6dda22f75b0ae7ffe45c6d7223e74f094ae9488e8e56bc2a3710324867a57eb6dbb6ea0f29ec1
SSDEEP 192:p6NpEGgE8aJZT8Yyh+FIgjVP5tjEsXtScR:p6NalgZ3yqL/tIsXtScR
MD5 SHA1 SHA512 SSDEEP

Submit Download

4cb013792b196a35_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\4cb013792b196a35_0
Size 2KB
SHA256 61fabb96d935ae43e1fd81b08708fb769d6370734639c5f8a2c7c0929b6acf55
MD5 a95d55a7ea95e0e9dfe1a516fe38dbd1
SHA1 58448c4a20f74a2efc13ed106f77cd717b84f24a
SHA512 f04089e789f065007c4e5420b3ee38ec65a02261733bfad59923313b27eeb2b0654162076b1fda3ac72581a5242691ac3346f7dc60e3f875f138ca8523377be7
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 96B
SHA256 3037453ff0c20be6efb678b17895f36b0072734c9d5cf5bb9e19e7c203f2b296
MD5 70c982fe2b98603bbb6eaf812024ffe4
SHA1 92771ad27bae48270359507d300211ffd91ec027
SHA512 0dad9b89e0d56385b31e57d288193a37d8862458197f53335f70fc7756f43e6ad7657dd4b55bef4367d895f94514960d7f5ddd272e47b31f43ae251429328ed0
MD5 SHA1 SHA512

Submit Download

the-real-index~RFe591eaa.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe591eaa.TMP
Size 48B
SHA256 d07e6088179b3552b15bb3c9abadc3b276483911d80375ffcb1d7b1c3e6e7280
MD5 8717beb372f21d4ca290995f42d4c00b
SHA1 e0d9de117ab1bc03eca637809d35f68cd1a7cd39
SHA512 c506d56308bcde132c50bd3658e24bef8988f6fce95818f98e74cff875a0b5065b70d76ad0f849ea0f45ae45d846ab95bfc13180f53a347944c797ae47308a7c
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 278KB
SHA256 5306118edfc896afa1f4ef237cb58a7a588e31695681c60c348f3bf4c52cab73
MD5 dea8c56147dea6b2321b5ec72357b0f7
SHA1 f9de3fef647747f5fbe5ea58f892743299c04a83
SHA512 1fcd8006e0ffb14ffd1c5d20355c0311f6b1729370dd85953e5b15fc4a62ba6b88cce5068ed0ce9c06bb9ce3e558f9ce8d0296f636b837aa27c4c9fbe70db9fb
SSDEEP 6144:CzARoOQ5kxp07KhCRtw+YrI1Qo5yzkpeXjnJFzXsWk:aUo95k07SCLYEjCkpeXtFbg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 257KB
SHA256 fd1a28eae551f4dc28e78c41040e9dabc756fd5e5c58ddde6fbde325ebd404d0
MD5 45ca30a83c6bd3af1e93967154043750
SHA1 9225b23e2695406951e7505127ddfedcf7d53b62
SHA512 39efa152012e4aee7bfb3500f31ecd093d3080bf4ce6f2dd472fb260317a8ac9b85b9de2107a02dbe88320937c6185668bda4f89fad296041a3e0cfab48b1396
SSDEEP 6144:9/rI1Qo5yzkpeXjnJFzXsWiQYRPILxZnhLMJjX0EeGzY2rLs:5EjCkpeXtFbOQ5fnReEFsLLs
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 257KB
SHA256 e6d818b78a3fd487c35b7a5e3f8c698fbed204bff9477abbf34e1ee376048cf7
MD5 2dbd44e8f0db861c7948fac40098945a
SHA1 2081a4bca1de3119842d3a4d0d19fcaa0e600d04
SHA512 5f954891bb32288976b0830bf11dd9e2e6020c096fb7f6b2270d1eac57c55cac6f03908633f75df36628d94861307fce70ac80fb0ae3dc242e108ea30d742a79
SSDEEP 6144:CD5kxp07KhCRtw+YrI1Qo5yzkpeXjnJFzXsWk:A5k07SCLYEjCkpeXtFbg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 336KB
SHA256 061f0daf624f7ad779ee18fa34c99fee65a73150c2ee2360bdf02259a8dd5807
MD5 258f4a026aff9c46e06165e4323626ab
SHA1 c63b2cacf70df1c9c6555b5478585740ca1ade54
SHA512 516c201a282f908de1032b91545925a07f1832016074784188fdb02011c3ee033a685663d1845d67cf9ad80cb7e4fbec5159458f7823406b64b1f0eac26443bd
SSDEEP 6144:C+ARoO+oW77Ghx6Z5kxp07KhCRtw+YrI1Qo5yzkpeXjnJFzXsWk:TUol7GhxS5k07SCLYEjCkpeXtFbg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 342KB
SHA256 b9ab4fa8177974b38fe8436b837cd8b52cdabcd2663b54124e456e964ceb21c7
MD5 c098f6d99c8212dfe10551bd8c03ad71
SHA1 e7a6f3a42244c309948f9654f63a16dd63c709c6
SHA512 95797eedb3e1852f89fea454472038f8a8f02bc13be27d018861278d326811e761d738791cfe013eb93ffd093447424a3518a64a4e076de66bf27e225b4f94c8
SSDEEP 6144:CmARoO+oW77Ghx3Zj5kxp07KhCRtw+YrI1Qo5yzkpeXjnJFzXsWk:HUol7Ghx3F5k07SCLYEjCkpeXtFbg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Module Info Cache

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache
Size 89KB
SHA256 a3ffb072c7b70dd9f4ed738291dee1012ec78e60faff46a25f2d1d59ed0efdab
MD5 bbac4ff0d855c13a0cb4967863ac9ab7
SHA1 5232aba707929394aeece713128a8692aef86cbf
SHA512 0f31611cc2025187d1498da4589a664c0947b78ae91a4a03111c9a85b207a3318d3d5df35a90392fb0b13849e05db546e2b084e6c55408bba0a65a9cfd04384a
SSDEEP 384:YWtKxEQPuOyeY+R7bBDsHgCFp2+fBWE0TDFg/AQqoJjnbvOcSB1+8gWz77Xsm6YG:4iQCHO2PGMMngqxKKJO+o
MD5 SHA1 SHA512 SSDEEP

Submit Download

Module Info Cache

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache
Size 93KB
SHA256 c45552d42ab4938149d3caab2ea51f4b32cbcef9e8e1eeb1ba35a3bbfeed9215
MD5 2fbaf412fb461d3b5a146506fef89dab
SHA1 f04e75c97044574ddd40dad6d1ad6832639eac67
SHA512 ff474fd5b81946ef2856e3537865144573df6df5534315f21c01e02aaf7bd5f29d67fa128af00a8a8d486f2ab80967dc2c0a05e05120613ec0cbf75877b19853
SSDEEP 384:aWtKxEQPuOyeY+R7bBDsHgCFp2+fBWE0M2DFg/AQqoJjnbvOcSBpv+8gWz77XsmU:6iQCHO0PGMMngqxKKJO+A
MD5 SHA1 SHA512 SSDEEP

Submit Download

Module Info Cache~RFe591728.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache~RFe591728.TMP
Size 88KB
SHA256 9837b9f89951bac274202f8d35dd7e1feb35b2c6709e811cfa59a4182184c380
MD5 655874f288550eb81ee83f9b0e3a46c7
SHA1 fdcb7dc46627caf5e31a67116210d182456f266f
SHA512 180e0040162d225f94ee6a93bde134c31a5c3d863e170eafc516561b122f29813967e7bb1d6a51b248b69a5bcf3eb40a193532a75a641d586afbd1c6c1b2aa15
SSDEEP 384:QWtKxEQPuOyeY+R7bBDsHgCFp2+fBWE0TDFg/AQqoJjnbvOcSB1+8gWz77Xsm6Yo:wiQCHO2PG4MngqxKKJO+2
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1
Size 264KB
SHA256 4cf2f61c9a9d28ff99c739d17f3c5f287bad7b0a01647b6a77c3af9a36b63246
MD5 1e8d4b315cdad34ca843b290752da0d3
SHA1 0c91c77d597bdf080025a033e880064923cb2f72
SHA512 9b9393eb8ac93b90369036f8fc1d60202524ecc7323224dd4bc4c1a86661e2acf0aaf3d15ec8c00b27fad2602ac1ea6fadf7f0cdc0e515dbaff065bbed0b7cab
SSDEEP 3:MsEllllkEthXllkl2zE/l8pTK1:/M/xT02zlS
MD5 SHA1 SHA512 SSDEEP

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 9d8e24c91cff338e56b518a533cb2e49a2803356bbf6e04892fb168a7ce2844a
MD5 612a6c4247ef652299b376221c984213
SHA1 d306f3b16bde39708aa862aee372345feb559750
SHA512 34a14d63abb1e3fe0f9927a94393043d458fe0624843e108d290266f554018e6379cba924cb5388735abdd6c5f1e2e318478a673f3f9b762815a758866d10973
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 02d4984e590e947265474d592e64edde840fdca7eb881eebde3e220a1d883455
MD5 56641592f6e69f5f5fb06f2319384490
SHA1 6a86be42e2c6d26b7830ad9f4e2627995fd91069
SHA512 c75e689b2bbbe07ebf72baf75c56f19c39f45d5593cf47535eb722f95002b3ee418027047c0ee8d63800f499038db5e2c24aff9705d830c7b6eaa290d9adc868
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 f33785a7fd12b80cc9c7e6c1e7e619fc15ef40dd5dc9f7653216fec80cc19ac2
MD5 66fecd84c82f67b578f7bddba718b164
SHA1 2334c0936bd9885b14c2e48a31d6c8a854272f64
SHA512 038961238fbb20e06bc56b63d8cac5cac6f96b36781c7ee102bec75da613ff618442a5b2cdc8c2103317244d5e06e6e4edb4c1f247cf00edd7d971d1a5a9e000
MD5 SHA1 SHA512

Submit Download

7301c1a4-f463-4100-bde1-df23b55770cf.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\7301c1a4-f463-4100-bde1-df23b55770cf.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\data_0
Size 44KB
SHA256 4cb0f5c18ddf60c1a3d02d83faad2c4ed7cc152d962bcc3b710a7de8b781d64a
MD5 a6f5b1e2e650e28434ca3cb53fa57ff1
SHA1 11b87e8e1961354d89c1ecdbac16efbad61d5eff
SHA512 b375652773b7e858c8d860614bcea73459f623ea8187696eb33256bca3adf955b4312b36d1d4ec58c1c16ff10b0afe8c311fd199a334667b3dce1d65f7be9c57
SSDEEP 24:d4YkjaiI19ko0QNt9hhogFlXtqharBtKp:6aiIQo02t9huAdJ2p
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\data_1
Size 264KB
SHA256 77065c452556312c161096bec66110d486e7ec616853cdfb13c6e44e797fe1fc
MD5 eafc23419b1e8d9530de800184bf8267
SHA1 c3681121c6fbfa315aaa31ee3842fa00e5154a3a
SHA512 fd1609aaa0bbee0f250cb7efbd6c10f4583f9e17508d8eee2468068e06c8da0ab991bdc5aebbf9ddfb0b497eb4e2f3bfa71f49843335e2063ffb1a7aafca8c65
SSDEEP 96:UFidMGdVTA02cGwoBciJIoYNgpl9pxlP:U4dMIVTA06BVIod/nxlP
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\data_2
Size 1.0MB
SHA256 f290f03028d8897ed18c6bcf59699a8d682706ffdcb617c10697872e7282c617
MD5 55c1dd8240457c56907255cd086a7bf3
SHA1 4cec7f24361ac554e8a521bb3b067973c68986f0
SHA512 9c2470a458b8ddd2e04a0ff0626e47dcd1baf3212538f5dcc4d7640d04707fc29f5e9ac91db5bb6622a5c50138930e3a80cfcb3cbd82a703232b603de61eedd1
SSDEEP 96:VSabhtXqMHyCl8m7N0ag66fANA+bTn48LER:VS4xqM8ra4ANAubrLER
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\data_3
Size 4.0MB
SHA256 3766884feb1b3eef5946d8645d617089d5794afcceee979a14c95403a62d8f7e
MD5 a6ab671e528e1a9f87d2f45b87c3f017
SHA1 f83ef5d115fc87f07f8f9314b95d12dc0a20decc
SHA512 7c55ff46b21e314068d8324fd19abf0e2568505043604308aa59ab8179386b32f2b5ac9f168bff2ac48fe713b285160dc52da4fdddc0504d7dc619f3e57b7dfa
SSDEEP 768:uljBtksnTzgLSX/IsSX/IsEgqrVO++tw/9CICFbQLlx:wjBtkAosLsEg1u/9C3BY
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000003

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000003
Size 199KB
SHA256 d692f27c385520c3b4078c35d78cdf154c424d09421dece6de73708659c7e2a6
MD5 585ac11a4e8628c13c32de68f89f98d6
SHA1 bcea01f9deb8d6711088cb5c344ebd57997839db
SHA512 76d2ed3f41df567fe4d04060d9871684244764fc59b81cd574a521bb013a6d61955a6aedf390a1701e3bfc24f82d92fd062ca9e461086f762a3087c142211c19
SSDEEP 6144:ianBWt/P9tws961G1Q2PfhIW4yEZ53mX4Xwle:ixk2ZIW4yEjWi
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 144B
SHA256 7fbf4f4714d4f6841fccda085357ded622bdefc2dd84d0d6cb9f4982092f9d60
MD5 1797a267de072a9693575de28ec52616
SHA1 3faf2b5b6c17a7d18ecb4a1634cfb37a8a1a19ab
SHA512 e0f07efe50df468e70071d79825718174addaab38e144723c00723b4b1a424d7f8d7618875be7eaed5df4adf99f18992fc8728b6b5193195dac926576b79971e
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG
Size 319B
SHA256 25956aca7d6a59700027cc03ae9683c2d4315710576cfad275d7691734a28a23
MD5 43d85457b99f24377d7c602d63871a94
SHA1 05986891700b7920ce1bc33ebc59360d736f2bae
SHA512 91aa0fdd96a7c93581414fd4dbeb557fb9eb2507422280a29ce6e59c5f8e2ab161f9d96595cd965dc5d3c7ac5c55d99763c22edac1fd21abb79e2925f2e1ed54
MD5 SHA1 SHA512

Submit Download

Favicons

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Favicons
Size 20KB
SHA256 fb7c0d4f928b735ec6fe9405e6a2ca6c09b91f10c16ec399fea42c6a4748286f
MD5 8afe44a6ad13ebd40bab31ce12129306
SHA1 f56a0a4020e52f9ffa5c075e3c6cdb7a042358bf
SHA512 e17d918bf1f25cfea676e25ad1039610d9fe40f87dc5086fd671fc8c506f416c322f98a6eeb63675f14899dd1c257f4c2c0be6836fb27d9bb1b644bd32c72eed
SSDEEP 48:KBmw6fU1zBv/HQMXGfYbrz1LMpbp+2gjGCHkJ/AztYZIHfydlhlBI8HvU7eLLmXX:KBCyvIwgelS9nsH4/AztcDuuoKwFz
MD5 SHA1 SHA512 SSDEEP

Submit Download

History

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History
Size 124KB
SHA256 a1995b11d3999098694e62dcc0aba10de1306182259f03a535b60c016d40ae40
MD5 05bdf7caf745fe379f70f247c184c9d8
SHA1 fe21eae85aece0ddbb74d6bec2f3bcc01cefd1cc
SHA512 5ae601b3b4cd2ca5f0de43710a68aabd589ea22ee1e51223d3d0138558c4a4b726aba5b23d586c45d0a5cc49823f462995444ebd25e8b6ea38e09cd6a240e7de
SSDEEP 96:xabP2TkU+bDoYysX0uhnyTpvVjN9DLjGQLBE3unzq:xIP2Tj+bDo3irhnyTpvVj3XBBE3unzq
MD5 SHA1 SHA512 SSDEEP

Submit Download

History Provider Cache

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History Provider Cache
Size 6B
SHA256 e708be5e34097c8b4b6ecb50ead7705843d0dc4b0779b95ef57073d80f36c191
MD5 a9851aa4c3c8af2d1bd8834201b2ba51
SHA1 fa95986f7ebfac4aab3b261d3ed0a21b142e91fc
SHA512 41a1b4d650ff55b164f3db02c8440f044c4ec31d8ddbbbf56195d4e27473c6b1379dfad3581e16429650e2364791f5c19aae723efc11986bb986ef262538b818
MD5 SHA1 SHA512

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log
Size 121B
SHA256 f69c28e9ff4fbea6936bc75cf70a37db39c49977d88f3b4f2dcf60481f4c07e3
MD5 96a65888d13c58ca24dfa2e98b2625e1
SHA1 ef275920e7aabe893cba25e2bbab04890d8ca135
SHA512 eac25ae6e1a35f2627a988810286be0efdb4db3aa0bae9f87657408a878b5b6c9e2ebde9154fa8f558751875e8680ee8614720eb9e4328f2620142d40e73d3db
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG
Size 331B
SHA256 5612890e52a4001d306fd0a78040187fbcb9e8e461353c9f203d3f9180457b42
MD5 655efd6ac0081f7c6a3f574780da10ff
SHA1 ed47f48f5924a1fbee1aac2bb6a1159ac047e2d3
SHA512 36f90d50b6ee6d90dfc75b6f4174c244bc176367f6b2b7c482fb8c99336504ec6996691a66fbf842f11e47b654cd6ec7b1aea162d07d023469be9539c95692c9
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 814B
SHA256 65fe4912909b897e154e5a459573ceee682440cfe4227f33f676b9a6119e9a93
MD5 8f2ae466aec019b2da73c16fd63be99a
SHA1 08b8e9077d3c4393d0a70a9763c410c46ab0e0c3
SHA512 b6e39802a59ddca1873c0c3788856e8e3afa79b35e3bc180e3012c793b6d9a9a0addfc40ede63a28c41e5def10ddb60ee698d5251e9ce4e366dc769a0b49107d
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 814B
SHA256 a3afdfcebd91c47555062e0d5898bf27686af3bb6462449c6e45333bb07d6642
MD5 8b6453f168c0b4cf69e8ef090046e497
SHA1 b071958562e056edea811bc847873155b77c2a13
SHA512 0b2845151a35400ace8fc51925344cce71a97196c67569dc1618ec9079bd95d162235a8c9a916e6d0d9d102a47d4fbd2a24889d18db839a05ba932b46fdfcb69
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 deaf653450e9f09487e0c9b99d0528e52c33b28c1cb16bb101ca4a0c0ac6b2a6
MD5 e88b867b1dba5950f4372c305f9a53bd
SHA1 c7a7eaf126455feb353094df224c434f2f7ab191
SHA512 4e39bb50690692773609dede3ed5745e3bcefb637749c57132bfae127847612758ffe74fce127fcc27122793100b22551093d700d1d0a481bfa117e1fafe3539
SSDEEP 96:n5kgP1xn2wpvWMoiVmdeHk4cUWQyV+VDCziEwb:n5ke/n2GWMXOro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 f637cb71361e313fee3e57d1b83362f869f4c7585a3cae54a8e7e54adcfbe2c1
MD5 62b60c4e2c82b0df6b2269c93fa7557e
SHA1 712d438dca8b14a46cf1d9b4638fafdd56c658aa
SHA512 f28bc329efa12c065ec0f9b4c57e2ef9a4c6e1e88bc4ed0cef21e8728229712b2c275bbbce22e9e2f62f0206bf36fbaba487d58566a6d6317f0553deb470a976
SSDEEP 96:n5k/P1x32wpvWMoiMR5mdeduC1Gqki7KyWQyV+VD7AiEwb:n5kH/32GWMM3uCIqqlg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 f1f18b78c46aacd362dc92b253738e6cba9b1a55394cd2a912346e59b045e995
MD5 48f92557c1014e5803761677c5b4d1f8
SHA1 91645e5bb81e1aff9400d6362e241d5e10a833d8
SHA512 ad741e3d54cbbad89103a5aa3cd16a34c1495c90fbd7baa9adde35b535691b4c852ea1d169bb72afadb1bbc28103fc6232cf152da2832ded51c9cfe99afa39a6
SSDEEP 96:n5k/P1b32wpvWMoiMR5mdeduC1GqkV7WUWQyV+VD7ziEwb:n5kH932GWMM3uCIq3rt
MD5 SHA1 SHA512 SSDEEP

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\000003.log
Size 538B
SHA256 285a55da5a7dd7491baa2a06cac328b8df47d95852757f6049cb35ef0340d616
MD5 82b36f6ba09ad7821660a42d58ae361c
SHA1 429539218a8b3f7fe01200dd6ff0f99912580091
SHA512 adf6097f1c13170bdde00aa5e23b4af9659b119ada23c6de00b8b0c1ad0b0f4fcd9cee0116d711bd99037844d21a2c012a5147c4715a4659af63c737336547c8
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG
Size 319B
SHA256 19be0cb6608a9f5c7d60daa9df7bf1c76770c532e66986288c4fd042d0c1f985
MD5 b9e2e5c25e7d779f0b4bfdbca96b66dd
SHA1 53fe605a0245776532ae0f94883a0b06f2e76679
SHA512 233dbb1a9d5b0c9774ad9f79818bd981d61fd2a30cb10a66b963be74d9fb122aee3f1ddcc1a64bdd0d3c8d99c58799ba1259daa48ef735867c28b472497c7e31
MD5 SHA1 SHA512

Submit Download

Tabs_13359667622463842

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sessions\Tabs_13359667622463842
Size 2KB
SHA256 4e28e7ee9ecf7ecc9b5dd1e8ba22f01b19b45c107b50dd45e844ba4660c38170
MD5 7aa2e1ee770fc4d9d0fc45871597ee9a
SHA1 196dfde4ec32fd123cab740a3fa0ee93cb3bf52c
SHA512 cf42075838fe55b9b31f45b4ca6560ea53db9e6f594bc522de9a92ea34ade47bcc00fd99b9c2146f638bd4c5f627c52cbf4cd1e5842b6c99a207b5093572c8c7
MD5 SHA1 SHA512

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\000003.log
Size 112B
SHA256 167cd9e3321e8cd13ed663fffe8d76c80ff1652f415619016ca7a0b843132eff
MD5 106088e551b829512777def3365de72d
SHA1 ab764c187b109ff17af3ef2d52795a68c3fbd006
SHA512 eda450b4c210d0492841db0152eb14c05aaf03b829dcbe948673a08b1976da7690ff2512efa7a0a61ea70b0fbede3b013c164b870983ff195577cb8d6e81752a
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG
Size 350B
SHA256 b4a993e1e23afa71827a47aa104fc7f9529f9a598c4c6aea50e9f740165e3d9f
MD5 fed767287c01c372ac7ce89a7a7f4b37
SHA1 f60a2b33f2f9513c577eb8b13513b1e0c1c675a1
SHA512 8685f25e0273b79ccb3aab80d2cce87e5b5e97c0d6e820fadf2fd75cc95e2ef7f93ecbc428e9700e72642e0256b0a7ff2f5d03a15b6533ac8c151bdcc05c6491
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG
Size 323B
SHA256 916731c51ce6c9ab756d3a3306a6642ded4cfc1820d86ce6da19838b7616f9a0
MD5 e203f2404f30a52da00bdd4f441bdcc3
SHA1 059b4af27de0a1b9dffc020bd7da0697ef795e4d
SHA512 17f61c882fb3a64d425c887bed41095fdfb14ffa0db7026cccebd12938e6cea6842adea55d571707d9d144adf3c92cc9eb0ba1ccf01bacbf18030d98b0e1e6fc
MD5 SHA1 SHA512

Submit Download

Visited Links

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Visited Links
Size 128KB
SHA256 e4277492c69e2d667821fb1ed2e06d114a639822b860ca1815f52837385f653d
MD5 ed44703267b23e6eae01435decffc5c2
SHA1 731bf38d31f3d7d367baa642c75adea7d6bcb3dd
SHA512 54bc1c0f6a7a876acceef7ca005dd41d8fc38460b4078cfc5b2139d062a4180730704e6c42c1a0a0d7c3d1fa0eee0db4ab4f758a1e4ac83881f3a819eef74a70
SSDEEP 3:ImtVfu2wtlQdWlthppltl:IiVm2QlQYtf
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

load_statistics.db

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db
Size 44KB
SHA256 71e1aae939e87024d49c806341dbae958be9c8bcdb5b57d4bad7b8cee390d2fe
MD5 517061223de83ae5890fa7e8c4262790
SHA1 00e2efc3f683b192dfa9a074884ac36cfdaf8b94
SHA512 66574b0d30af64eb074e91d9f29b2ffff1495e3904923bb39f754cf866155a076c638327a07e51e77e43702c79dd05b6f4d90e2fd7988a7b56c0a9f16187eb99
SSDEEP 48:TtUYVAKAFXX+/8hq04d0OMkphyxxLqSCMphy/oeWfkDEc:4Ns/8M042OMkLyxxGFMLy/cf2b
MD5 SHA1 SHA512 SSDEEP

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log
Size 187B
SHA256 facbc1877a05171c0050fdf39e8b0194ac1582ea3191f5b6c188684f8e72858a
MD5 0a53ada71f01324abbe81ef28a5a22b9
SHA1 a9864c810d96086d34b0bfd2f8bbdabae79b19d5
SHA512 218c39853d11bad04f9314d93480633fb8d504a2c23d20c77db6bd104680dbfe4e21b76ac93631d9364a2f4690d7b6f11029427ccf3eb933780f7b6c74602f28
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG
Size 319B
SHA256 f545ef5779a68e93d3c0dc9e15540d491272ad55aaf8fc2f77b7dd1c4bd12135
MD5 d465c155b5a0231f0cbe57c75c4bdc7e
SHA1 1a9c1935b3ed0cc67b15e98ce52d3094e0441e7b
SHA512 afa6632b9f9a2035fea020da1ad4172ac2b23f01b84a70194a7c9aa38b6503833b760582639f2a1d522b9bbd3e7a787d6fd7fe509798f8836286558239cddb87
MD5 SHA1 SHA512

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log
Size 594B
SHA256 7a57eb26a4229c5febea3d9a8324d44aba950a1fa95aa6f35857ea57a0aac1d7
MD5 b5db066eec0026d4623150dfcafad7dc
SHA1 84c0125f3d473198859703afbc76f9fa73738263
SHA512 00c20fa652c7ea3903bd2d733acfc4d73305596b97c6b124410c6cf370d213dce5ca03b54ee52c0d381a14260636992d4e6cb5783baa1a9df6678be9f5579262
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG
Size 337B
SHA256 e7694066026b6d2a62252f0b5ab21171a8ed41fc09e51b9c50f762b67ab659fe
MD5 3acb9e407ec7d9f15906370188f91a9c
SHA1 ce54552a840bf39d45fedc02906b3aa248650a70
SHA512 8668dae7b0f281ad44039b83a85c489f891f83497901a220d57ae438f387669f18a5151035e3c7fbbec8ab9665663ce857ebaab945a9b7606b38f16b03e131d0
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\data_0
Size 44KB
SHA256 c6e0bdd25d83c106b0369b2deb94602fdaa43eb28dcfa8e0d456511c11eaf91e
MD5 34e3cf20fda6b890036579d3d7a824a4
SHA1 0f671666029afb37a9833dc79f88b851bfeb9b88
SHA512 9174cf7aef4e224dc40c78f5228e51cca02a0e1d85b6354cd1feb16f0255e77482ed9e55d28012bbdcf61873259e52673996ac8e21535de351171f13aa8d28a1
SSDEEP 24:doCEnGws82B/QdO9z9ojUv3tjkEn0zyjCE:0UxkB
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\data_1
Size 264KB
SHA256 a39627130b6071f43f767e1705c99ecaa07622fa03ef0c0bb2fd7d80c651f1e5
MD5 43239c2ba8d9aa21867db7c973ab90a7
SHA1 3f4f435599ff7cfce421bc4e63a16472aac5bd6d
SHA512 aef3c76e2613130810406a75f48ab449496802c32567c0d5cd9850f446fc3faad5abbde2e149670235e479f9d9140d9cb9912228ae52ec42ee77af206ee94fef
SSDEEP 96:1bjSp1jSknjSdHjSVpN/jSojSswPjSdwjS7CjSGVynjSG0mjSdcjSCjSGEjjSD1O:147KOoy4Z
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\data_3
Size 4.0MB
SHA256 e847b286a61c0842087288f397317f1cd9232bb64a118b19b5af4f94204f7a9f
MD5 2d6aaec38309a2da5515a19066e17df7
SHA1 fddb6a1c0041708ae809a086ee26fa3517c7d3f8
SHA512 34e3f0153be53bc89c88e4f0f78cce54363703b246eb56267bc32675bf3dfa3f57b1d16532b14fdad6e153077c54f9e5b57f43f2e915a4ded460eaf744b94b01
SSDEEP 1536:PI82vNFtYNDHbeoApSylyeZ+lvil8JMKjloJURO6VOkMelyStoTKJAQtVaqLXW3C:PubtaHylyeZ+lvhn26OQMLSOTWQx
MD5 SHA1 SHA512 SSDEEP

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Size 11B
SHA256 ac3dd2221d90b09b795f1f72e72e4860342a4508fe336c4b822476eb25a55eaa
MD5 838a7b32aefb618130392bc7d006aa2e
SHA1 5159e0f18c9e68f0e75e2239875aa994847b8290
SHA512 9e350f0565cc726f66146838f9cebaaa38dd01892ffab9a45fe4f72e5be5459c0442e99107293a7c6f2412c71f668242c5e5a502124bc57cbf3b6ad8940cb3e9
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 36a1a00213c1ebf6046a7628cf96b368ef66644ad062a7b24adb7e62916c2a55
MD5 abff93ead03e2d3cf005bbb2fdccfd15
SHA1 3b2f9dcfe024c4dc4b856d265a821b2f7e1d23ab
SHA512 eaa45920b1b9898c640fad4edfc214550ce73986beff58397641e5df6d7a82baad8203c5875f72d6d4516794a5dabb7d2ce61c9b9637c8a72951481464ce32a2
SSDEEP 192:ZoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupOPe2RUUy4Vcr+OblfBhDaw:F9iIxuERzA83h09RZxY8Bcr/XDafEBBN
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\GPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

9cd93bc6dcf544bae69531052e64647ec02f2bb4.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\9cd93bc6dcf544bae69531052e64647ec02f2bb4.tbres
Size 4KB
SHA256 03d59107aae6282dc16e12c81b4a19cedc1c43ef41a4443cc67d417f46039aca
MD5 714e3047547e9028d517d29d28904fcf
SHA1 509572388317749e38043a4617b0286b09079cb1
SHA512 daad8f2082a9e51a20800604d86053ca5c356f36bc7dfd0aad1d9de88347de245adcf3f1476de1b67fa467b70e4007811281b0c92a06d8dce10d97e8abd3ea8f
SSDEEP 96:I0Y3xY30f4MJ0MvASZLyKRh3zXCICqFAg6GpU6MB:I0Qf5R4SZL5DXcWAg6GlI
MD5 SHA1 SHA512 SSDEEP

Submit Download

note.txt

Path C:\note.txt
Size 218B
SHA256 8e9f20f6864c66576536c0b866c6ffdcf11397db67fe120e972e244c3c022270
MD5 afa6955439b8d516721231029fb9ca1b
SHA1 087a043cc123c0c0df2ffadcf8e71e3ac86bbae9
SHA512 5da21a31fbc4e8250dffed30f66b896bdf007ac91948140334fe36a3f010e1bac3e70a07e9f3eb9da8633189091fd5cadcabbaacd3e01da0fe7ae28a11b3dddf
MD5 SHA1 SHA512

Submit Download

memory/3884-311-0x0000000005FF0000-0x0000000005FF1000-memory.dmp

Download

memory/3884-310-0x0000000005FF0000-0x0000000005FF1000-memory.dmp

Download

memory/3884-309-0x0000000005FF0000-0x0000000005FF1000-memory.dmp

Download

memory/3884-308-0x0000000005FF0000-0x0000000005FF1000-memory.dmp

Download

memory/3884-307-0x0000000005FF0000-0x0000000005FF1000-memory.dmp

Download

memory/3884-306-0x0000000005FF0000-0x0000000005FF1000-memory.dmp

Download

memory/3884-305-0x0000000005FF0000-0x0000000005FF1000-memory.dmp

Download

memory/3884-294-0x0000000005FF0000-0x0000000005FF1000-memory.dmp

Download

memory/3884-295-0x0000000005FF0000-0x0000000005FF1000-memory.dmp

Download

memory/3884-296-0x0000000005FF0000-0x0000000005FF1000-memory.dmp

Download