hxxp://google[.]com

Analysis

max time kernel
960s
max time network
968s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
09/05/2024, 01:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://google.com

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3558294865-3673844354-2255444939-1000\{9174A219-E2BD-48E6-A658-E1E1A5DF4072}	msedge.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
3424	msedge.exe
3424	msedge.exe
708	msedge.exe
708	msedge.exe
4060	identity_helper.exe
4060	identity_helper.exe
2248	msedge.exe
2248	msedge.exe
1152	msedge.exe
1152	msedge.exe
508	msedge.exe
508	msedge.exe
508	msedge.exe
508	msedge.exe
2380	msedge.exe
2380	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 26 IoCs

pid	Process
708	msedge.exe
708	msedge.exe
708	msedge.exe
708	msedge.exe
708	msedge.exe
708	msedge.exe
708	msedge.exe
708	msedge.exe
708	msedge.exe
708	msedge.exe
708	msedge.exe
708	msedge.exe
708	msedge.exe
708	msedge.exe
708	msedge.exe
708	msedge.exe
708	msedge.exe
708	msedge.exe
708	msedge.exe
708	msedge.exe
708	msedge.exe
708	msedge.exe
708	msedge.exe
708	msedge.exe
708	msedge.exe
708	msedge.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeRestorePrivilege	2228	7zG.exe
Token: 35	2228	7zG.exe
Token: SeSecurityPrivilege	2228	7zG.exe
Token: SeSecurityPrivilege	2228	7zG.exe

Suspicious use of FindShellTrayWindow 42 IoCs

pid	Process
708	msedge.exe
708	msedge.exe
708	msedge.exe
708	msedge.exe
708	msedge.exe
708	msedge.exe
708	msedge.exe
708	msedge.exe
708	msedge.exe
708	msedge.exe
708	msedge.exe
708	msedge.exe
708	msedge.exe
708	msedge.exe
708	msedge.exe
708	msedge.exe
708	msedge.exe
708	msedge.exe
708	msedge.exe
708	msedge.exe
708	msedge.exe
708	msedge.exe
708	msedge.exe
708	msedge.exe
708	msedge.exe
708	msedge.exe
708	msedge.exe
708	msedge.exe
708	msedge.exe
708	msedge.exe
708	msedge.exe
708	msedge.exe
708	msedge.exe
708	msedge.exe
708	msedge.exe
708	msedge.exe
708	msedge.exe
708	msedge.exe
708	msedge.exe
708	msedge.exe
708	msedge.exe
2228	7zG.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
708	msedge.exe
708	msedge.exe
708	msedge.exe
708	msedge.exe
708	msedge.exe
708	msedge.exe
708	msedge.exe
708	msedge.exe
708	msedge.exe
708	msedge.exe
708	msedge.exe
708	msedge.exe
708	msedge.exe
708	msedge.exe
708	msedge.exe
708	msedge.exe
708	msedge.exe
708	msedge.exe
708	msedge.exe
708	msedge.exe
708	msedge.exe
708	msedge.exe
708	msedge.exe
708	msedge.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
1432	OpenWith.exe
1432	OpenWith.exe
1432	OpenWith.exe
1432	OpenWith.exe
1432	OpenWith.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 708 wrote to memory of 5108	708	msedge.exe	80
PID 708 wrote to memory of 5108	708	msedge.exe	80
PID 708 wrote to memory of 2036	708	msedge.exe	82
PID 708 wrote to memory of 2036	708	msedge.exe	82
PID 708 wrote to memory of 2036	708	msedge.exe	82
PID 708 wrote to memory of 2036	708	msedge.exe	82
PID 708 wrote to memory of 2036	708	msedge.exe	82
PID 708 wrote to memory of 2036	708	msedge.exe	82
PID 708 wrote to memory of 2036	708	msedge.exe	82
PID 708 wrote to memory of 2036	708	msedge.exe	82
PID 708 wrote to memory of 2036	708	msedge.exe	82
PID 708 wrote to memory of 2036	708	msedge.exe	82
PID 708 wrote to memory of 2036	708	msedge.exe	82
PID 708 wrote to memory of 2036	708	msedge.exe	82
PID 708 wrote to memory of 2036	708	msedge.exe	82
PID 708 wrote to memory of 2036	708	msedge.exe	82
PID 708 wrote to memory of 2036	708	msedge.exe	82
PID 708 wrote to memory of 2036	708	msedge.exe	82
PID 708 wrote to memory of 2036	708	msedge.exe	82
PID 708 wrote to memory of 2036	708	msedge.exe	82
PID 708 wrote to memory of 2036	708	msedge.exe	82
PID 708 wrote to memory of 2036	708	msedge.exe	82
PID 708 wrote to memory of 2036	708	msedge.exe	82
PID 708 wrote to memory of 2036	708	msedge.exe	82
PID 708 wrote to memory of 2036	708	msedge.exe	82
PID 708 wrote to memory of 2036	708	msedge.exe	82
PID 708 wrote to memory of 2036	708	msedge.exe	82
PID 708 wrote to memory of 2036	708	msedge.exe	82
PID 708 wrote to memory of 2036	708	msedge.exe	82
PID 708 wrote to memory of 2036	708	msedge.exe	82
PID 708 wrote to memory of 2036	708	msedge.exe	82
PID 708 wrote to memory of 2036	708	msedge.exe	82
PID 708 wrote to memory of 2036	708	msedge.exe	82
PID 708 wrote to memory of 2036	708	msedge.exe	82
PID 708 wrote to memory of 2036	708	msedge.exe	82
PID 708 wrote to memory of 2036	708	msedge.exe	82
PID 708 wrote to memory of 2036	708	msedge.exe	82
PID 708 wrote to memory of 2036	708	msedge.exe	82
PID 708 wrote to memory of 2036	708	msedge.exe	82
PID 708 wrote to memory of 2036	708	msedge.exe	82
PID 708 wrote to memory of 2036	708	msedge.exe	82
PID 708 wrote to memory of 2036	708	msedge.exe	82
PID 708 wrote to memory of 3424	708	msedge.exe	83
PID 708 wrote to memory of 3424	708	msedge.exe	83
PID 708 wrote to memory of 2908	708	msedge.exe	84
PID 708 wrote to memory of 2908	708	msedge.exe	84
PID 708 wrote to memory of 2908	708	msedge.exe	84
PID 708 wrote to memory of 2908	708	msedge.exe	84
PID 708 wrote to memory of 2908	708	msedge.exe	84
PID 708 wrote to memory of 2908	708	msedge.exe	84
PID 708 wrote to memory of 2908	708	msedge.exe	84
PID 708 wrote to memory of 2908	708	msedge.exe	84
PID 708 wrote to memory of 2908	708	msedge.exe	84
PID 708 wrote to memory of 2908	708	msedge.exe	84
PID 708 wrote to memory of 2908	708	msedge.exe	84
PID 708 wrote to memory of 2908	708	msedge.exe	84
PID 708 wrote to memory of 2908	708	msedge.exe	84
PID 708 wrote to memory of 2908	708	msedge.exe	84
PID 708 wrote to memory of 2908	708	msedge.exe	84
PID 708 wrote to memory of 2908	708	msedge.exe	84
PID 708 wrote to memory of 2908	708	msedge.exe	84
PID 708 wrote to memory of 2908	708	msedge.exe	84
PID 708 wrote to memory of 2908	708	msedge.exe	84
PID 708 wrote to memory of 2908	708	msedge.exe	84

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.com
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8e1d946f8,0x7ff8e1d94708,0x7ff8e1d94718
  2⤵
  PID:5108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2188,9052939139607148367,16864177667161236043,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2248 /prefetch:2
  2⤵
  PID:2036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2188,9052939139607148367,16864177667161236043,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2292 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2188,9052939139607148367,16864177667161236043,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2688 /prefetch:8
  2⤵
  PID:2908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,9052939139607148367,16864177667161236043,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2700 /prefetch:1
  2⤵
  PID:868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,9052939139607148367,16864177667161236043,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:1
  2⤵
  PID:5076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,9052939139607148367,16864177667161236043,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4900 /prefetch:1
  2⤵
  PID:4980
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2188,9052939139607148367,16864177667161236043,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5200 /prefetch:8
  2⤵
  PID:3088
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2188,9052939139607148367,16864177667161236043,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5200 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,9052939139607148367,16864177667161236043,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5352 /prefetch:1
  2⤵
  PID:3100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,9052939139607148367,16864177667161236043,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4980 /prefetch:1
  2⤵
  PID:1156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2188,9052939139607148367,16864177667161236043,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5356 /prefetch:8
  2⤵
  PID:696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2188,9052939139607148367,16864177667161236043,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5376 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:2248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,9052939139607148367,16864177667161236043,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3512 /prefetch:1
  2⤵
  PID:3256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,9052939139607148367,16864177667161236043,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5576 /prefetch:1
  2⤵
  PID:3716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,9052939139607148367,16864177667161236043,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3604 /prefetch:1
  2⤵
  PID:4188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,9052939139607148367,16864177667161236043,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5888 /prefetch:1
  2⤵
  PID:4624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,9052939139607148367,16864177667161236043,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6008 /prefetch:1
  2⤵
  PID:4404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,9052939139607148367,16864177667161236043,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6156 /prefetch:1
  2⤵
  PID:2332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,9052939139607148367,16864177667161236043,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5572 /prefetch:1
  2⤵
  PID:3256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,9052939139607148367,16864177667161236043,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3592 /prefetch:1
  2⤵
  PID:3832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,9052939139607148367,16864177667161236043,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3512 /prefetch:1
  2⤵
  PID:4544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2188,9052939139607148367,16864177667161236043,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=6664 /prefetch:8
  2⤵
  PID:3688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,9052939139607148367,16864177667161236043,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5640 /prefetch:1
  2⤵
  PID:3452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2188,9052939139607148367,16864177667161236043,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4956 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2188,9052939139607148367,16864177667161236043,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5652 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,9052939139607148367,16864177667161236043,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2424 /prefetch:1
  2⤵
  PID:968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2188,9052939139607148367,16864177667161236043,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7068 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,9052939139607148367,16864177667161236043,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6816 /prefetch:1
  2⤵
  PID:4292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,9052939139607148367,16864177667161236043,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6612 /prefetch:1
  2⤵
  PID:3156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,9052939139607148367,16864177667161236043,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6808 /prefetch:1
  2⤵
  PID:4188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,9052939139607148367,16864177667161236043,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6556 /prefetch:1
  2⤵
  PID:2336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,9052939139607148367,16864177667161236043,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6904 /prefetch:1
  2⤵
  PID:1188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,9052939139607148367,16864177667161236043,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6844 /prefetch:1
  2⤵
  PID:2740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,9052939139607148367,16864177667161236043,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1264 /prefetch:1
  2⤵
  PID:2596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,9052939139607148367,16864177667161236043,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5512 /prefetch:1
  2⤵
  PID:4332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,9052939139607148367,16864177667161236043,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5516 /prefetch:1
  2⤵
  PID:5040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,9052939139607148367,16864177667161236043,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6568 /prefetch:1
  2⤵
  PID:3868

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2224

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1096

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4296

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1432

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\memz.by.iTzDrK_\" -ad -an -ai#7zMap12798:92:7zEvent24016
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2228

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f61fa5143fe872d1d8f1e9f8dc6544f9

SHA1
df44bab94d7388fb38c63085ec4db80cfc5eb009

SHA256
284a24b5b40860240db00ef3ae6a33c9fa8349ab5490a634e27b2c6e9a191c64

SHA512
971000784a6518bb39c5cf043292c7ab659162275470f5f6b632ea91a6bcae83bc80517ceb983dd5abfe8fb4e157344cb65c27e609a879eec00b33c5fad563a6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
87f7abeb82600e1e640b843ad50fe0a1

SHA1
045bbada3f23fc59941bf7d0210fb160cb78ae87

SHA256
b35d6906050d90a81d23646f86c20a8f5d42f058ffc6436fb0a2b8bd71ee1262

SHA512
ea8e7f24ab823ad710ce079c86c40aa957353a00d2775732c23e31be88a10d212e974c4691279aa86016c4660f5795febf739a15207833df6ed964a9ed99d618

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000008

Filesize
37KB

MD5
449575adc5b691252ccd790af54aa1fa

SHA1
08fbf2330df4d9b8863dbd25981ed28842f5c449

SHA256
7d773ed5be32890577b137400ab9d2e829cd966a7529a2cbdeba4d589fd50f1b

SHA512
031ff5e4c4b5d2a7911d8e7fcac5584eca2337daa1dfe1feaf5cf56ac574a7d6b8c2e64472279d58bd8234ddd0072d4468a72aa39c5716840a39237ee9cedf45

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000009

Filesize
69KB

MD5
aac57f6f587f163486628b8860aa3637

SHA1
b1b51e14672caae2361f0e2c54b72d1107cfce54

SHA256
0cda72f2d9b6f196897f58d5de1fe1b43424ce55701eac625e591a0fd4ce7486

SHA512
0622796aab85764434e30cbe78b4e80e129443744dd13bc376f7a124ed04863c86bb1dcd5222bb1814f6599accbd45c9ee2b983da6c461b68670ae59141a6c1a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000a

Filesize
64KB

MD5
d6b36c7d4b06f140f860ddc91a4c659c

SHA1
ccf16571637b8d3e4c9423688c5bd06167bfb9e9

SHA256
34013d7f3f0186a612bef84f2984e2767b32c9e1940df54b01d5bd6789f59e92

SHA512
2a9dd9352298ec7d1b439033b57ee9a390c373eeb8502f7f36d6826e6dd3e447b8ffd4be4f275d51481ef9a6ac2c2d97ef98f3f9d36a5a971275bf6cee48e487

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000b

Filesize
19KB

MD5
2e86a72f4e82614cd4842950d2e0a716

SHA1
d7b4ee0c9af735d098bff474632fc2c0113e0b9c

SHA256
c1334e604dbbffdf38e9e2f359938569afe25f7150d1c39c293469c1ee4f7b6f

SHA512
7a5fd3e3e89c5f8afca33b2d02e5440934e5186b9fa6367436e8d20ad42b211579225e73e3a685e5e763fa3f907fc4632b9425e8bd6d6f07c5c986b6556d47b1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000c

Filesize
65KB

MD5
56d57bc655526551f217536f19195495

SHA1
28b430886d1220855a805d78dc5d6414aeee6995

SHA256
f12de7e272171cda36389813df4ba68eb2b8b23c58e515391614284e7b03c4d4

SHA512
7814c60dc377e400bbbcc2000e48b617e577a21045a0f5c79af163faa0087c6203d9f667e531bbb049c9bd8fb296678e6a5cdcad149498d7f22ffa11236b51cb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000d

Filesize
88KB

MD5
b38fbbd0b5c8e8b4452b33d6f85df7dc

SHA1
386ba241790252df01a6a028b3238de2f995a559

SHA256
b18b9eb934a5b3b81b16c66ec3ec8e8fecdb3d43550ce050eb2523aabc08b9cd

SHA512
546ca9fb302bf28e3a178e798dd6b80c91cba71d0467257b8ed42e4f845aa6ecb858f718aac1e0865b791d4ecf41f1239081847c75c6fb3e9afd242d3704ad16

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000e

Filesize
1.2MB

MD5
25a7f8dea0207366b4b9d77569ff6f78

SHA1
57a20ac66704e6b2766c6946fafdec22f47ee79d

SHA256
502a9f82d39ef6fca4b4fc1bfd046b9736d8e232c8b1562eed0ca62d149bbfed

SHA512
db300662a1a49ae8417fb013462fc62ab20351c9c458cb60b0b22ec89c1cba410ae03301cefa6464dc58ed332ceb8a2d67eb6b8078c7f2127729594126133024

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
c1f95d175040344607ad37eecbb33603

SHA1
7c0816138c6b176006615a567bb9d4b58da8a648

SHA256
db7f6b98f33760295579c63bfaeac47c5f0e9a6f72d7649f448a02ba0150a5a8

SHA512
f98113250e300e3b837370589f9fd6d31ae063c657aef9bbe7ff56a5b158d41c114a55bdda72dd688fe7f3f45c4e30cb48e239ac73e495cc4971cb5c9be7aa49

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
f6945eeaf42aa1b92844b579ff727fbf

SHA1
4d7de54ae04f80def0c52c106e349d99a3d17055

SHA256
e17c1098be9dc52280435628c9a2fbabb9d8cd8f2d28856150240e773af9169f

SHA512
b13f38d91d5f889d7e05939812742f1fc43a91e7da1e37cc4a7f0b429f436dc639a48c69c5f936b261206a48cb77c905b0bba8790096d3079ac3c34f276ca261

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
3b9ee567010468b1d2a2c4f1a328b0d1

SHA1
d86387d4d3e707dea40a5bf7d2b5765429473fc3

SHA256
1cede33af36dd62ccb0a19b5a2d8965ac1230d3c41f53e80dbd4a5b5961c10b4

SHA512
2b7fb5f06da759b36eff2aaef537ffe097fe5ec2644fa9b9cd87cfe285d392a5068ea796b99139f50220fe7057fbb08470c454f791cf1e9f3970aeb5815f6dfc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
50bb9ebf64680dbb1fbd6a76d49ecb51

SHA1
22244751a088526747cbe345e422398a743678a7

SHA256
8a1f505232fba3231eb8ab8768792b4190869478d2752d6657fcc0669d10e13e

SHA512
22e6ab15b88868a616deaa174b53e5fbd8521efc1a84f37ba2a1a44c434c9bcea419fee303f61f4a71dff7c3d45a0b8708c4652d95255fdbe35adde2c5e9055f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
cce0799ccbf2bb343c13eb250d09f344

SHA1
619ee617910c65a5eb09cf07663f16e358ee0d38

SHA256
56da94d263d209fd193fa70d5dfc131ecffb841b4b8bffe7c63b5e14a9c57cde

SHA512
dee3dbe32aa6dfaea8cbb4fd996f778a6590424b5f612bc1186216dc6db2e454088b3bf35f82d8a8f54939bc9beefeabc1436865b282413b008dbad07030df29

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
64a2a2d819651239b5790bf9f132bd43

SHA1
4113ebc6eb0b98799eeccfcab7b6f3d1d157c0e2

SHA256
f189ccc7fbd024b154eefc60816046f8229e7e69f9c7ef0692ba68a0a45d86d7

SHA512
237649d88a4d86354bce1781b2f32c56b99e788c18d6f092dad4e92cafbf63a72d67a1e1a50a888f489314a87a5f57eaa2af0793abd85d77af98ed809730ef7e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
9b928cfc438da62efa61839370c286eb

SHA1
75876d1bba424de19c3ca731e761b356acacb3a0

SHA256
23ebc93bd0e84085fb97d6596e496ce3ff37ca6702916a3629bfc91103f7f837

SHA512
712b22597ca64fa86b8779797509f91ec72d4048da3b74c146e7a3b13305690c0731b90f1338c8d641ffa661f56b6cdb7da4e35998ec6b9e5f87a6a169ef5e5e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
c78f4c28ae76ddc710997d45ec1bec09

SHA1
949cbe107656443d7783d68f0ec28408cce16123

SHA256
bbf9b218001ad81f444bb0c1c04bd7d3d4559d70cb7e8ce200e404954911bddf

SHA512
960e5623fe937489254c354de7bff7ed928e46ae99f37f4f7b5ecb1c00be6dfe62f4e3c8eacefb4f2651cf8739e5e688b58b30e20c2d8f1aee62367890e5683b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
2df2cc2b848999f25cd2ac282975c9e2

SHA1
3c01a0e303c76758da97c57d314af4823dfa38cf

SHA256
81edc80ef832fdeb6477d4090f8bd1cc640f55bf0918d17fda040d387cbf762f

SHA512
0325748f7a27c82800f7c2a9551ea3fa263a5ed9ddbc174c2dbcdd3d95c1e7b20120a699d0d86ef24a45229ab0bc266e256224f719bdbcd4f9e832abc818a294

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
68dfb15af5547ca92bf45673729de457

SHA1
78e183a0d3e94e609368d5591f137769f168921f

SHA256
ab41193454c6dd46883652fc4e9469957fd95f8d926bcd93cee676c89a2b63f6

SHA512
3a09bb3d46fa17705a769ab75fb8fcf0360dc34ea3785cabc6100bce0b593209541b9bfc70805494f8c6dbdb88e0230a615684a9403843d9d0962279e7309ce0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
ccbd97495552497684cad56a0191094b

SHA1
c6bcf6bb610bb3de492d7c24c6b115490977206c

SHA256
60ac250cbbe224640bf84c103f74223e0c19ff013768eb0863f6da0c7595cd2f

SHA512
383b73aed94f8aa0b7e943dde2e03c7675af84b7701745df70ee0e0838533bd299c4b90e2e4d2e2defaad34ea3c1bababb3d6a85d805261071ed863dcf1a1b46

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
444ae933a720caa81215f6944ff03842

SHA1
8dc95490eee3a844ab94196c5059908f5fefa16d

SHA256
8b5b9f9afea55bf998e0bce41bc3c732dd8411e2addd33fbe5d7641933e2b5e1

SHA512
26a0ddc76630a701539db5e5d476ec46902b88ca9e90796204654c704fd0117e658fbe638bb128c9f60fa5e96bb7dcf128d8b964e610f857ffda4596cd70d189

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
09524b8d862493f9738d6f971f8d7873

SHA1
f630113ea2a1227d58e757a1f3e1df3cf3c1f887

SHA256
93c3fa21ea4e1f60209ff320e6980a199f6c41126bbd5f26696e2cd4fed28f3c

SHA512
3251cfb82392b87f6574d3cd52afd4beb3185e2ab626d9f72b7d36b9150021279094135e1843a82e92519855c01f866bf6ac615068c15aec0dc7b32c2ff2b990

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
34da5aedc131cecad98458c689feb834

SHA1
b1a8d7d7026c42748e203f10e2c7d82b1daec54c

SHA256
24e499fbf0c529216f78d62f0ca003e7f5dd7039fe65cd72bfbf0e6e525d7200

SHA512
971ddc3a467c1a28531600b04a9de1826acc2b5552aa53040029f29a6692c47974709cae5cefe4d0d38d2d57cd01d723e00034eaed71ace408706d79c1784c9d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
2e423c821ef7c71a9db3cc32cca6eaa9

SHA1
8641d4bff41f19dfccf8e755c2c43d4e9de7f1f0

SHA256
80d892eee81fedbe297b7a0f32f0382e11b89e6471e0b3b908cd83706ad05827

SHA512
b52117a99f2005bce7d445c16b1f6a8b49d36a9aed2635e3ff4cfac96d090dab0899164536b6c05c439888c03acda615265f5fa460d439f4c7dc815e0a4fc6ce

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
df1e526ea3327897c34bbf6c9fb933b0

SHA1
77c5bdfbb5ab6f5f8b18f88fb33881c582489a63

SHA256
7e11b8c23967e94fe2e122b5de5df9d5f4e277922b20a7c087c29b458d2c9c39

SHA512
16a3b236f4dfa2b40631cbb284de433fbea9cbeaa0ec91f0d2bf4f17e676752d86bcc50d553d0388344f9321825a2ad004e91e931ded284b64905827dc0cc864

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe579097.TMP

Filesize
538B

MD5
b05c8ccae65bbbf8d9f8841d00ea33df

SHA1
dd938480eaa6c0bd7b8752c28aae16cff3488a54

SHA256
a6fa308869b12fb4df78fe0993536354c43b332469197b5302087b81a7a61262

SHA512
8930b294148a7e220c4c5398259d3f3d027dc50b92ca0ded53b3a59798805d10a64c90ce7410b8fa37507c90e39b154b7bf1c296cc57ff18ff1f12bb9355e940

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
c23755d18e1809467c407c9401617c62

SHA1
e9cca8c3fc9018772118ed3077bacb9181b95233

SHA256
b4b0f8549ba3025bd1c9ac4d05000a432522e25d0a0a5d7514a16835650cd034

SHA512
c7c8f71c35d07e792a91bb26bfc2eccbe5ef2d9b491bc23ffd9836c73caee7a964bd563577992be68b39b24c3b74af9719cf4afc80d72f013c38b9d50484657f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
625ae05daf1fa50e1097b1c75c87384e

SHA1
4fcca32bb35879793a80827144c062809d61b926

SHA256
351d3a872efbc03507a48848d6154f8044f1f5908941058a0297d44f78451a79

SHA512
75f8e7241b18ad2e4b711d86761211734e9c07c5bf5bb01948d0e40da78a8ef3adba94b0ed34cbb8e18ac3959f1c003acda9418c887614d617dd33a9bc3ff461

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
29b483fa0012be11b879c164f356fbb6

SHA1
85285ad4a61452132e7cdcf047474190937c068f

SHA256
a2841b95ec279bdcabbe32447efc0ee4b08bf1a9c8ce2bbc89318681e29baaaa

SHA512
6b20abc1ab803c85876249ec195e6c9056fee39c2b7f1a642045f93f5827f241a7f7957d7c575822a4e4988ca8b1943d5febba30368a7279aa2b65aa218ba119

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
34aaf1c53345aaf93739421d634ecd21

SHA1
b85158a4c55f8e717fb0c097e302a8ae2c387d53

SHA256
561eb271231402988a349d1bee60f841c43c067b8767c3941160d8e64212aa8d

SHA512
a64ff7d0ceaa454492f1b9b71e02678ec2e153b14ce4b5670f2c41d31b9885181c2823772ddc72b45f0eb79b3171fea2b2addf4fad167110050895b3a52e7c42

Download Submit
C:\Users\Admin\Downloads\memz.by.iTzDrK_.rar

Filesize
17KB

MD5
352c9d71fa5ab9e8771ce9e1937d88e9

SHA1
7ef6ee09896dd5867cff056c58b889bb33706913

SHA256
3d5d9bc94be3d1b7566a652155b0b37006583868311f20ef00283c30314b5c61

SHA512
6c133aa0c0834bf3dbb3a4fb7ff163e3b17ae2500782d6bba72812b4e703fb3a4f939a799eeb17436ea24f225386479d3aa3b81fdf35975c4f104914f895ff23

Download Submit