a9cd3d966d453afd424d9ac54df414b80073bb51d249f4089185976fb316e254

Resubmissions

29/05/2024, 05:04

240529-fqp9bsbc8y 7

29/05/2024, 05:01

29/05/2024, 02:47

29/05/2024, 02:42

29/05/2024, 02:40

Analysis

max time kernel
349s
max time network
579s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
29/05/2024, 05:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

MEMZ 3.0/MEMZ.exe
Size

12KB
MD5

a7bcf7ea8e9f3f36ebfb85b823e39d91
SHA1

761168201520c199dba68add3a607922d8d4a86e
SHA256

3ff64f10603f0330fa2386ff99471ca789391ace969bd0ec1c1b8ce1b4a6db42
SHA512

89923b669d31e590189fd06619bf27e47c5a47e82be6ae71fdb1b9b3b30b06fb7ca8ffed6d5c41ac410a367f2eb07589291e95a2644877d6bffd52775a5b1523
SSDEEP

192:HMDLTxWDf/pl3cIEiwqZKBktLe3P+qf2jhP6B5b2yL3:H4IDH3cIqqvUWq+jhyT2yL

Score

7^/10

bootkit persistence

Malware Config

Signatures

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	MEMZ.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	MEMZ.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	MEMZ.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\system32\appwiz.cpl,-160#immutable1 = "Uninstall or change programs on your computer."	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\system32\DeviceCenter.dll,-1000#immutable1 = "Devices and Printers"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\sdcpl.dll,-101#immutable1 = "Backup and Restore (Windows 7)"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\system32\Vault.dll,-2#immutable1 = "Manage your Windows credentials."	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\FirewallControlPanel.dll,-12123#immutable1 = "Set firewall security options to help protect your computer from hackers and malicious software."	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\main.cpl,-102#immutable1 = "Keyboard"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\autoplay.dll,-1#immutable1 = "AutoPlay"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\SyncCenter.dll,-3000#immutable1 = "Sync Center"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\DiagCpl.dll,-1#immutable1 = "Troubleshooting"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\telephon.cpl,-1#immutable1 = "Phone and Modem"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\main.cpl,-100#immutable1 = "Mouse"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\srchadmin.dll,-602#immutable1 = "Change how Windows indexes to search faster"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\fhcpl.dll,-52#immutable1 = "File History"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings	control.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\powercpl.dll,-1#immutable1 = "Power Options"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\SyncCenter.dll,-3001#immutable1 = "Sync files between your computer and network folders"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\RADCUI.dll,-15301#immutable1 = "Manage your RemoteApp and Desktop Connections"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\intl.cpl,-2#immutable1 = "Customize settings for the display of languages, numbers, times, and dates."	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\srchadmin.dll,-601#immutable1 = "Indexing Options"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\DiagCpl.dll,-15#immutable1 = "Troubleshoot and fix common computer problems."	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\accessibilitycpl.dll,-10#immutable1 = "Ease of Access Center"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\system32\Vault.dll,-1#immutable1 = "Credential Manager"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\sud.dll,-10#immutable1 = "Choose which programs you want Windows to use for activities like web browsing, editing photos, sending e-mail, and playing music."	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\systemcpl.dll,-2#immutable1 = "View information about your computer, and change settings for hardware, performance, and remote connections."	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\main.cpl,-101#immutable1 = "Customize your mouse settings, such as the button configuration, double-click speed, mouse pointers, and motion speed."	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\devmgr.dll,-4#immutable1 = "Device Manager"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\netcenter.dll,-2#immutable1 = "Check network status, change network settings and set preferences for sharing files and printers."	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\autoplay.dll,-2#immutable1 = "Change default settings for CDs, DVDs, and devices so that you can automatically play music, view pictures, install software, and play games."	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\recovery.dll,-2#immutable1 = "Recovery"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\FirewallControlPanel.dll,-12122#immutable1 = "Windows Defender Firewall"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\Speech\SpeechUX\speechuxcpl.dll,-1#immutable1 = "Speech Recognition"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\intl.cpl,-3#immutable1 = "Region"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\fvecpl.dll,-2#immutable1 = "Protect your PC using BitLocker Drive Encryption."	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\RADCUI.dll,-15300#immutable1 = "RemoteApp and Desktop Connections"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\devmgr.dll,-5#immutable1 = "View and update your device hardware settings and driver software."	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\systemcpl.dll,-1#immutable1 = "System"	explorer.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3808065738-1666277613-1125846146-1000\{EFE43007-BA6E-4BB3-A8B9-730EBBEF1CD5}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\Speech\SpeechUX\speechuxcpl.dll,-2#immutable1 = "Configure how speech recognition works on your computer."	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\inetcpl.cpl,-4312#immutable1 = "Internet Options"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\system32\colorcpl.exe,-7#immutable1 = "Change advanced color management settings for displays, scanners, and printers."	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\fvecpl.dll,-1#immutable1 = "BitLocker Drive Encryption"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\timedate.cpl,-52#immutable1 = "Set the date, time, and time zone for your computer."	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\usercpl.dll,-2#immutable1 = "Change user account settings and passwords for people who share this computer."	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\system32\colorcpl.exe,-6#immutable1 = "Color Management"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\usercpl.dll,-1#immutable1 = "User Accounts"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\telephon.cpl,-2#immutable1 = "Configure your telephone dialing rules and modem settings."	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\netcenter.dll,-1#immutable1 = "Network and Sharing Center"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\system32\DeviceCenter.dll,-2000#immutable1 = "View and manage devices, printers, and print jobs"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\powercpl.dll,-2#immutable1 = "Conserve energy or maximize performance by choosing how your computer manages power."	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\timedate.cpl,-51#immutable1 = "Date and Time"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\accessibilitycpl.dll,-45#immutable1 = "Make your computer easier to use."	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\fhcpl.dll,-2#immutable1 = "Keep a history of your files"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\system32\appwiz.cpl,-159#immutable1 = "Programs and Features"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\recovery.dll,-101#immutable1 = "Recovery"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\sdcpl.dll,-100#immutable1 = "Recover copies of your files backed up in Windows 7"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\inetcpl.cpl,-4313#immutable1 = "Configure your Internet display and connection settings."	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\mmsys.cpl,-300#immutable1 = "Sound"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\mmsys.cpl,-301#immutable1 = "Configure your audio devices or change the sound scheme for your computer."	explorer.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
1736	explorer.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4120	MEMZ.exe
4120	MEMZ.exe
4120	MEMZ.exe
4120	MEMZ.exe
4120	MEMZ.exe
4120	MEMZ.exe
4120	MEMZ.exe
4120	MEMZ.exe
4120	MEMZ.exe
4120	MEMZ.exe
4120	MEMZ.exe
4120	MEMZ.exe
4120	MEMZ.exe
4120	MEMZ.exe
4120	MEMZ.exe
4120	MEMZ.exe
4120	MEMZ.exe
4120	MEMZ.exe
1384	MEMZ.exe
1384	MEMZ.exe
4716	MEMZ.exe
4716	MEMZ.exe
1384	MEMZ.exe
1384	MEMZ.exe
4120	MEMZ.exe
4120	MEMZ.exe
4040	MEMZ.exe
4040	MEMZ.exe
1384	MEMZ.exe
1384	MEMZ.exe
2728	MEMZ.exe
2728	MEMZ.exe
4716	MEMZ.exe
4716	MEMZ.exe
4040	MEMZ.exe
4120	MEMZ.exe
4040	MEMZ.exe
4120	MEMZ.exe
1384	MEMZ.exe
1384	MEMZ.exe
4716	MEMZ.exe
2728	MEMZ.exe
4716	MEMZ.exe
2728	MEMZ.exe
4120	MEMZ.exe
4120	MEMZ.exe
4040	MEMZ.exe
4040	MEMZ.exe
1384	MEMZ.exe
1384	MEMZ.exe
4716	MEMZ.exe
4716	MEMZ.exe
2728	MEMZ.exe
2728	MEMZ.exe
1384	MEMZ.exe
1384	MEMZ.exe
4040	MEMZ.exe
4120	MEMZ.exe
4040	MEMZ.exe
4120	MEMZ.exe
4716	MEMZ.exe
4716	MEMZ.exe
2728	MEMZ.exe
2728	MEMZ.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
2824	msedge.exe
2824	msedge.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: 33	680	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	680	AUDIODG.EXE
Token: SeShutdownPrivilege	1736	explorer.exe
Token: SeCreatePagefilePrivilege	1736	explorer.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
1736	explorer.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe

Suspicious use of SetWindowsHookEx 14 IoCs

pid	Process
556	MEMZ.exe
556	MEMZ.exe
556	MEMZ.exe
4560	wordpad.exe
4560	wordpad.exe
4560	wordpad.exe
4560	wordpad.exe
4560	wordpad.exe
4560	wordpad.exe
556	MEMZ.exe
4908	OpenWith.exe
556	MEMZ.exe
556	MEMZ.exe
556	MEMZ.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1576 wrote to memory of 4120	1576	MEMZ.exe	92
PID 1576 wrote to memory of 4120	1576	MEMZ.exe	92
PID 1576 wrote to memory of 4120	1576	MEMZ.exe	92
PID 1576 wrote to memory of 4716	1576	MEMZ.exe	93
PID 1576 wrote to memory of 4716	1576	MEMZ.exe	93
PID 1576 wrote to memory of 4716	1576	MEMZ.exe	93
PID 1576 wrote to memory of 1384	1576	MEMZ.exe	94
PID 1576 wrote to memory of 1384	1576	MEMZ.exe	94
PID 1576 wrote to memory of 1384	1576	MEMZ.exe	94
PID 1576 wrote to memory of 4040	1576	MEMZ.exe	95
PID 1576 wrote to memory of 4040	1576	MEMZ.exe	95
PID 1576 wrote to memory of 4040	1576	MEMZ.exe	95
PID 1576 wrote to memory of 2728	1576	MEMZ.exe	96
PID 1576 wrote to memory of 2728	1576	MEMZ.exe	96
PID 1576 wrote to memory of 2728	1576	MEMZ.exe	96
PID 1576 wrote to memory of 556	1576	MEMZ.exe	97
PID 1576 wrote to memory of 556	1576	MEMZ.exe	97
PID 1576 wrote to memory of 556	1576	MEMZ.exe	97
PID 556 wrote to memory of 2780	556	MEMZ.exe	99
PID 556 wrote to memory of 2780	556	MEMZ.exe	99
PID 556 wrote to memory of 2780	556	MEMZ.exe	99
PID 556 wrote to memory of 452	556	MEMZ.exe	109
PID 556 wrote to memory of 452	556	MEMZ.exe	109
PID 556 wrote to memory of 452	556	MEMZ.exe	109
PID 556 wrote to memory of 4812	556	MEMZ.exe	112
PID 556 wrote to memory of 4812	556	MEMZ.exe	112
PID 556 wrote to memory of 684	556	MEMZ.exe	120
PID 556 wrote to memory of 684	556	MEMZ.exe	120
PID 556 wrote to memory of 5040	556	MEMZ.exe	123
PID 556 wrote to memory of 5040	556	MEMZ.exe	123
PID 556 wrote to memory of 1380	556	MEMZ.exe	127
PID 556 wrote to memory of 1380	556	MEMZ.exe	127
PID 556 wrote to memory of 3548	556	MEMZ.exe	132
PID 556 wrote to memory of 3548	556	MEMZ.exe	132
PID 556 wrote to memory of 4560	556	MEMZ.exe	136
PID 556 wrote to memory of 4560	556	MEMZ.exe	136
PID 556 wrote to memory of 4560	556	MEMZ.exe	136
PID 4560 wrote to memory of 5104	4560	wordpad.exe	137
PID 4560 wrote to memory of 5104	4560	wordpad.exe	137
PID 556 wrote to memory of 2332	556	MEMZ.exe	139
PID 556 wrote to memory of 2332	556	MEMZ.exe	139
PID 556 wrote to memory of 2088	556	MEMZ.exe	141
PID 556 wrote to memory of 2088	556	MEMZ.exe	141
PID 556 wrote to memory of 2088	556	MEMZ.exe	141
PID 556 wrote to memory of 5012	556	MEMZ.exe	143
PID 556 wrote to memory of 5012	556	MEMZ.exe	143
PID 556 wrote to memory of 5012	556	MEMZ.exe	143
PID 2824 wrote to memory of 4928	2824	msedge.exe	150
PID 2824 wrote to memory of 4928	2824	msedge.exe	150
PID 2824 wrote to memory of 4068	2824	msedge.exe	151
PID 2824 wrote to memory of 4068	2824	msedge.exe	151
PID 2824 wrote to memory of 4068	2824	msedge.exe	151
PID 2824 wrote to memory of 4068	2824	msedge.exe	151
PID 2824 wrote to memory of 4068	2824	msedge.exe	151
PID 2824 wrote to memory of 4068	2824	msedge.exe	151
PID 2824 wrote to memory of 4068	2824	msedge.exe	151
PID 2824 wrote to memory of 4068	2824	msedge.exe	151
PID 2824 wrote to memory of 4068	2824	msedge.exe	151
PID 2824 wrote to memory of 4068	2824	msedge.exe	151
PID 2824 wrote to memory of 4068	2824	msedge.exe	151
PID 2824 wrote to memory of 4068	2824	msedge.exe	151
PID 2824 wrote to memory of 4068	2824	msedge.exe	151
PID 2824 wrote to memory of 4068	2824	msedge.exe	151
PID 2824 wrote to memory of 4068	2824	msedge.exe	151

C:\Users\Admin\AppData\Local\Temp\MEMZ 3.0\MEMZ.exe
"C:\Users\Admin\AppData\Local\Temp\MEMZ 3.0\MEMZ.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1576
- C:\Users\Admin\AppData\Local\Temp\MEMZ 3.0\MEMZ.exe
  "C:\Users\Admin\AppData\Local\Temp\MEMZ 3.0\MEMZ.exe" /watchdog
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4120
- C:\Users\Admin\AppData\Local\Temp\MEMZ 3.0\MEMZ.exe
  "C:\Users\Admin\AppData\Local\Temp\MEMZ 3.0\MEMZ.exe" /watchdog
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4716
- C:\Users\Admin\AppData\Local\Temp\MEMZ 3.0\MEMZ.exe
  "C:\Users\Admin\AppData\Local\Temp\MEMZ 3.0\MEMZ.exe" /watchdog
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1384
- C:\Users\Admin\AppData\Local\Temp\MEMZ 3.0\MEMZ.exe
  "C:\Users\Admin\AppData\Local\Temp\MEMZ 3.0\MEMZ.exe" /watchdog
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4040
- C:\Users\Admin\AppData\Local\Temp\MEMZ 3.0\MEMZ.exe
  "C:\Users\Admin\AppData\Local\Temp\MEMZ 3.0\MEMZ.exe" /watchdog
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2728
- C:\Users\Admin\AppData\Local\Temp\MEMZ 3.0\MEMZ.exe
  "C:\Users\Admin\AppData\Local\Temp\MEMZ 3.0\MEMZ.exe" /main
  2⤵
  - Checks computer location settings
  - Writes to the Master Boot Record (MBR)
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:556
- - C:\Windows\SysWOW64\notepad.exe
    "C:\Windows\System32\notepad.exe" \note.txt
    3⤵
    PID:2780
- - C:\Windows\SysWOW64\explorer.exe
    "C:\Windows\System32\explorer.exe"
    3⤵
    - Modifies registry class
    PID:452
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://google.co.ck/search?q=batch+virus+download
    3⤵
    PID:4812
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://google.co.ck/search?q=how+to+remove+memz+trojan+virus
    3⤵
    PID:684
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://google.co.ck/search?q=g3t+r3kt
    3⤵
    PID:5040
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://play.clubpenguin.com/
    3⤵
    PID:1380
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://google.co.ck/search?q=best+way+to+kill+yourself
    3⤵
    PID:3548
- - C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe
    "C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe"
    3⤵
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4560
  - - C:\Windows\splwow64.exe
      C:\Windows\splwow64.exe 12288
      4⤵
      PID:5104
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://google.co.ck/search?q=batch+virus+download
    3⤵
    PID:2332
- - C:\Windows\SysWOW64\calc.exe
    "C:\Windows\System32\calc.exe"
    3⤵
    PID:2088
- - C:\Windows\SysWOW64\control.exe
    "C:\Windows\System32\control.exe"
    3⤵
    - Modifies registry class
    PID:5012
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe"
    3⤵
    PID:5020
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://google.co.ck/search?q=how+to+remove+memz+trojan+virus
    3⤵
    PID:4640
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://google.co.ck/search?q=how+to+remove+memz+trojan+virus
    3⤵
    PID:2588
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://google.co.ck/search?q=facebook+hacking+tool+free+download+no+virus+working+2016
    3⤵
    PID:2588
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://google.co.ck/search?q=my+computer+is+doing+weird+things+wtf+is+happenin+plz+halp
    3⤵
    PID:4332
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://google.co.ck/search?q=virus.exe
    3⤵
    PID:4976
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://google.co.ck/search?q=minecraft+hax+download+no+virus
    3⤵
    PID:3056
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://google.co.ck/search?q=batch+virus+download
    3⤵
    PID:4092
- - C:\Windows\SysWOW64\notepad.exe
    "C:\Windows\System32\notepad.exe"
    3⤵
    PID:2104
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://google.co.ck/search?q=what+happens+if+you+delete+system32
    3⤵
    PID:3880
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://google.co.ck/search?q=what+happens+if+you+delete+system32
    3⤵
    PID:4168
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.70 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=122.0.2365.52 --initial-client-data=0x2e0,0x2e4,0x2e8,0x2dc,0x354,0x7ffbe8ef2e98,0x7ffbe8ef2ea4,0x7ffbe8ef2eb0
      4⤵
      PID:4712
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=2080 --field-trial-handle=2084,i,16024149741836033032,2964893277006476355,262144 --variations-seed-version /prefetch:2
      4⤵
      PID:5008
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=2140 --field-trial-handle=2084,i,16024149741836033032,2964893277006476355,262144 --variations-seed-version /prefetch:3
      4⤵
      PID:1684
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=2604 --field-trial-handle=2084,i,16024149741836033032,2964893277006476355,262144 --variations-seed-version /prefetch:8
      4⤵
      PID:3436
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3432 --field-trial-handle=2084,i,16024149741836033032,2964893277006476355,262144 --variations-seed-version /prefetch:1
      4⤵
      PID:1480
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3448 --field-trial-handle=2084,i,16024149741836033032,2964893277006476355,262144 --variations-seed-version /prefetch:1
      4⤵
      PID:1420
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4756 --field-trial-handle=2084,i,16024149741836033032,2964893277006476355,262144 --variations-seed-version /prefetch:1
      4⤵
      PID:4116
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=5060 --field-trial-handle=2084,i,16024149741836033032,2964893277006476355,262144 --variations-seed-version /prefetch:8
      4⤵
      PID:3324
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --no-appcompat-clear --mojo-platform-channel-handle=5204 --field-trial-handle=2084,i,16024149741836033032,2964893277006476355,262144 --variations-seed-version /prefetch:8
      4⤵
      PID:4468
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=4612 --field-trial-handle=2084,i,16024149741836033032,2964893277006476355,262144 --variations-seed-version /prefetch:1
      4⤵
      PID:3572
  - - C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=3684 --field-trial-handle=2084,i,16024149741836033032,2964893277006476355,262144 --variations-seed-version /prefetch:8
      4⤵
      PID:3928
  - - C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=3684 --field-trial-handle=2084,i,16024149741836033032,2964893277006476355,262144 --variations-seed-version /prefetch:8
      4⤵
      PID:2720
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=5872 --field-trial-handle=2084,i,16024149741836033032,2964893277006476355,262144 --variations-seed-version /prefetch:1
      4⤵
      PID:1744
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=5840 --field-trial-handle=2084,i,16024149741836033032,2964893277006476355,262144 --variations-seed-version /prefetch:8
      4⤵
      PID:4116
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=3600 --field-trial-handle=2084,i,16024149741836033032,2964893277006476355,262144 --variations-seed-version /prefetch:8
      4⤵
      PID:4048
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=5944 --field-trial-handle=2084,i,16024149741836033032,2964893277006476355,262144 --variations-seed-version /prefetch:8
      4⤵
      PID:4052
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --mojo-platform-channel-handle=5172 --field-trial-handle=2084,i,16024149741836033032,2964893277006476355,262144 --variations-seed-version /prefetch:1
      4⤵
      PID:2304
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=3896 --field-trial-handle=2084,i,16024149741836033032,2964893277006476355,262144 --variations-seed-version /prefetch:8
      4⤵
      PID:2664
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --mojo-platform-channel-handle=5888 --field-trial-handle=2084,i,16024149741836033032,2964893277006476355,262144 --variations-seed-version /prefetch:1
      4⤵
      PID:952
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://google.co.ck/search?q=my+computer+is+doing+weird+things+wtf+is+happenin+plz+halp
    3⤵
    PID:5092
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe"
    3⤵
    PID:4508
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://google.co.ck/search?q=how+to+send+a+virus+to+my+friend
    3⤵
    PID:4744

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3752 --field-trial-handle=2236,i,5367110156796017614,12594004256180761011,262144 --variations-seed-version /prefetch:8
1⤵
PID:4632

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=18 --mojo-platform-channel-handle=5204 --field-trial-handle=2236,i,5367110156796017614,12594004256180761011,262144 --variations-seed-version /prefetch:1
1⤵
PID:2500

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=19 --mojo-platform-channel-handle=5724 --field-trial-handle=2236,i,5367110156796017614,12594004256180761011,262144 --variations-seed-version /prefetch:1
1⤵
PID:4664

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3984 --field-trial-handle=2236,i,5367110156796017614,12594004256180761011,262144 --variations-seed-version /prefetch:8
1⤵
PID:540

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=21 --mojo-platform-channel-handle=4544 --field-trial-handle=2236,i,5367110156796017614,12594004256180761011,262144 --variations-seed-version /prefetch:1
1⤵
PID:4956

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=22 --mojo-platform-channel-handle=5416 --field-trial-handle=2236,i,5367110156796017614,12594004256180761011,262144 --variations-seed-version /prefetch:1
1⤵
PID:2932

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --no-appcompat-clear --mojo-platform-channel-handle=5584 --field-trial-handle=2236,i,5367110156796017614,12594004256180761011,262144 --variations-seed-version /prefetch:8
1⤵
PID:1712

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x4f0 0x4f8
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:680

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=24 --mojo-platform-channel-handle=5988 --field-trial-handle=2236,i,5367110156796017614,12594004256180761011,262144 --variations-seed-version /prefetch:1
1⤵
PID:2708

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=25 --mojo-platform-channel-handle=6120 --field-trial-handle=2236,i,5367110156796017614,12594004256180761011,262144 --variations-seed-version /prefetch:1
1⤵
PID:3252

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=26 --mojo-platform-channel-handle=6360 --field-trial-handle=2236,i,5367110156796017614,12594004256180761011,262144 --variations-seed-version /prefetch:1
1⤵
PID:2636

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=27 --mojo-platform-channel-handle=5920 --field-trial-handle=2236,i,5367110156796017614,12594004256180761011,262144 --variations-seed-version /prefetch:1
1⤵
PID:964

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=28 --mojo-platform-channel-handle=5948 --field-trial-handle=2236,i,5367110156796017614,12594004256180761011,262144 --variations-seed-version /prefetch:1
1⤵
PID:4432

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=29 --mojo-platform-channel-handle=6676 --field-trial-handle=2236,i,5367110156796017614,12594004256180761011,262144 --variations-seed-version /prefetch:1
1⤵
PID:3548

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=30 --mojo-platform-channel-handle=4528 --field-trial-handle=2236,i,5367110156796017614,12594004256180761011,262144 --variations-seed-version /prefetch:1
1⤵
PID:4992

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=31 --mojo-platform-channel-handle=6212 --field-trial-handle=2236,i,5367110156796017614,12594004256180761011,262144 --variations-seed-version /prefetch:1
1⤵
PID:3540

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=32 --mojo-platform-channel-handle=6820 --field-trial-handle=2236,i,5367110156796017614,12594004256180761011,262144 --variations-seed-version /prefetch:1
1⤵
PID:1516

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=6128 --field-trial-handle=2236,i,5367110156796017614,12594004256180761011,262144 --variations-seed-version /prefetch:8
1⤵
PID:4560

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=34 --mojo-platform-channel-handle=6240 --field-trial-handle=2236,i,5367110156796017614,12594004256180761011,262144 --variations-seed-version /prefetch:1
1⤵
PID:632

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc
1⤵
PID:4916

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=35 --mojo-platform-channel-handle=6756 --field-trial-handle=2236,i,5367110156796017614,12594004256180761011,262144 --variations-seed-version /prefetch:1
1⤵
PID:1632

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:4908

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{5BD95610-9434-43C2-886C-57852CC8A120} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1736

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
1⤵
PID:2660

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --no-appcompat-clear --mojo-platform-channel-handle=7072 --field-trial-handle=2236,i,5367110156796017614,12594004256180761011,262144 --variations-seed-version /prefetch:8
1⤵
PID:1016

C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=7248 --field-trial-handle=2236,i,5367110156796017614,12594004256180761011,262144 --variations-seed-version /prefetch:8
1⤵
PID:4764

C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=7248 --field-trial-handle=2236,i,5367110156796017614,12594004256180761011,262144 --variations-seed-version /prefetch:8
1⤵
PID:3644

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.70 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=122.0.2365.52 --initial-client-data=0x238,0x23c,0x240,0x234,0x2b4,0x7ffbe8ef2e98,0x7ffbe8ef2ea4,0x7ffbe8ef2eb0
  2⤵
  PID:4928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=2876 --field-trial-handle=2884,i,16087794237949082437,8062474105980914044,262144 --variations-seed-version /prefetch:2
  2⤵
  PID:4068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=3168 --field-trial-handle=2884,i,16087794237949082437,8062474105980914044,262144 --variations-seed-version /prefetch:3
  2⤵
  PID:1064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=3220 --field-trial-handle=2884,i,16087794237949082437,8062474105980914044,262144 --variations-seed-version /prefetch:8
  2⤵
  PID:4340
- C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=4448 --field-trial-handle=2884,i,16087794237949082437,8062474105980914044,262144 --variations-seed-version /prefetch:8
  2⤵
  PID:3176
- C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=4448 --field-trial-handle=2884,i,16087794237949082437,8062474105980914044,262144 --variations-seed-version /prefetch:8
  2⤵
  PID:1972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4768 --field-trial-handle=2884,i,16087794237949082437,8062474105980914044,262144 --variations-seed-version /prefetch:1
  2⤵
  PID:2524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=4788 --field-trial-handle=2884,i,16087794237949082437,8062474105980914044,262144 --variations-seed-version /prefetch:1
  2⤵
  PID:5092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=5224 --field-trial-handle=2884,i,16087794237949082437,8062474105980914044,262144 --variations-seed-version /prefetch:8
  2⤵
  PID:3976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --no-appcompat-clear --mojo-platform-channel-handle=5292 --field-trial-handle=2884,i,16087794237949082437,8062474105980914044,262144 --variations-seed-version /prefetch:8
  2⤵
  PID:2636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=5748 --field-trial-handle=2884,i,16087794237949082437,8062474105980914044,262144 --variations-seed-version /prefetch:8
  2⤵
  PID:2412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=6032 --field-trial-handle=2884,i,16087794237949082437,8062474105980914044,262144 --variations-seed-version /prefetch:1
  2⤵
  PID:4476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=6228 --field-trial-handle=2884,i,16087794237949082437,8062474105980914044,262144 --variations-seed-version /prefetch:8
  2⤵
  PID:208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=6228 --field-trial-handle=2884,i,16087794237949082437,8062474105980914044,262144 --variations-seed-version /prefetch:8
  2⤵
  PID:1112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=6292 --field-trial-handle=2884,i,16087794237949082437,8062474105980914044,262144 --variations-seed-version /prefetch:8
  2⤵
  PID:4236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=6436 --field-trial-handle=2884,i,16087794237949082437,8062474105980914044,262144 --variations-seed-version /prefetch:1
  2⤵
  PID:2172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --no-appcompat-clear --mojo-platform-channel-handle=6536 --field-trial-handle=2884,i,16087794237949082437,8062474105980914044,262144 --variations-seed-version /prefetch:8
  2⤵
  PID:1948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --mojo-platform-channel-handle=4832 --field-trial-handle=2884,i,16087794237949082437,8062474105980914044,262144 --variations-seed-version /prefetch:1
  2⤵
  PID:1908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --mojo-platform-channel-handle=6840 --field-trial-handle=2884,i,16087794237949082437,8062474105980914044,262144 --variations-seed-version /prefetch:1
  2⤵
  PID:2916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --mojo-platform-channel-handle=5436 --field-trial-handle=2884,i,16087794237949082437,8062474105980914044,262144 --variations-seed-version /prefetch:1
  2⤵
  PID:1712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --mojo-platform-channel-handle=6820 --field-trial-handle=2884,i,16087794237949082437,8062474105980914044,262144 --variations-seed-version /prefetch:1
  2⤵
  PID:1112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=5980 --field-trial-handle=2884,i,16087794237949082437,8062474105980914044,262144 --variations-seed-version /prefetch:8
  2⤵
  PID:2260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --mojo-platform-channel-handle=3644 --field-trial-handle=2884,i,16087794237949082437,8062474105980914044,262144 --variations-seed-version /prefetch:1
  2⤵
  PID:3560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --mojo-platform-channel-handle=3956 --field-trial-handle=2884,i,16087794237949082437,8062474105980914044,262144 --variations-seed-version /prefetch:1
  2⤵
  PID:5108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3692 --field-trial-handle=2884,i,16087794237949082437,8062474105980914044,262144 --variations-seed-version /prefetch:8
  2⤵
  PID:3336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
  2⤵
  PID:4132

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\06093650-8864-4deb-8643-58f8d5815963.tmp

Filesize
84KB

MD5
ab070d682d195cacc035f473daa31752

SHA1
0fef7eb6d18e83509ba0b6ca17f312879d24aac3

SHA256
27d9deede549c7b12041e58dcd7b3ff87b04b4a8f287dcba0da836423952b524

SHA512
55bf56fa294feba66dfcb7961fd51b31ba8087a1a79a75acb3f88b8000801af444e525b14a054b78b39bb64a1cc8f77746486ae043b0ac073f02c3f49a92cbd9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
bed6632afcff4e34c16fe82859f3ddf5

SHA1
e70d544aa708906e24fb017570f4e5ae5bcb33b8

SHA256
4b29abab985ef05e192f17342239cd0a10418638e7686b18db3af6b7f11eafb6

SHA512
aa1d7301251daa6a64a4e90eff720893d9093eb9181d0ac155766992435aa1e764f69a6850391e1c60f73a25633ee149d223d69bbc8dea6bb1802aa99b4a3704

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
4926c9ed21ca8883a6610976a3901776

SHA1
29ded732ec4bd7499041622ed7dae9e947a2d308

SHA256
a24c0601a24034139e15a5a53ae3d68630b4dee673fff163a23cdcf68d3692be

SHA512
8d8a0f9fbd65fd6b94526b9ae8d453d510476b9c98c17508eed84300bfb7267cfbcb19f4e10314fc729c9c4ae6b7b63416188031d021fa86d7e50f8d188f4488

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
311b8be3aed1d9445f11e6d14fb85aa5

SHA1
5bfa24bdd004ff8333150ff4fe93eb2870f9f12e

SHA256
e4c4ed78165afa0c6f861f9cfe47d80face1cb71bf93548c7fa20cb6b0411805

SHA512
b54bf95c27f6067fa15214f903f19453fee3f296c9aaaf28e3e0c63260037df93ae78bab0bd7f4ae417ff15f672dc31bbe5912a15c95af5ef2331b0ca159f421

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\20066375-d6f9-44dd-9a64-3cd355000282.tmp

Filesize
1B

MD5
5058f1af8388633f609cadb75a75dc9d

SHA1
3a52ce780950d4d969792a2559cd519d7ee8c727

SHA256
cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8

SHA512
0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old

Filesize
331B

MD5
af965c88d38cce482111751bb3f9b518

SHA1
38c0cfd88d1e9af0deaecfb33d63989829fbde95

SHA256
2ed13e88d859e8e7bde3024805d36867e9e6cc1fa6b541b85988e268305f2164

SHA512
8b3c76b4ad552d1e3b1de6ee829cf09f3f71790d031476e1686b85eaac42595cabb74e523d5ec2de8e62987b22c6a0b9428d9f393be8bc6199d694a2c85bd28f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_0

Filesize
44KB

MD5
af4a1392cf2d1783ec5496934cf60e06

SHA1
0966ba6a8dd366b4dcb3917f477cdf6a3e9c59f7

SHA256
f5c24c60013549ac44a4134f1f6900ef340233f4154970e29ccde663834d2009

SHA512
e229666cf3b646270883348171051500e7607942c9e9d55665f0ba8cf9a1366e66f32dccba5fc0b2be6f1b3b3e6f95ec32d7a4389859554ebaa1039983007fe5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_1

Filesize
264KB

MD5
dd8dac3b78f2989276b00cb4df7b0300

SHA1
d6abbf8aa61a1ff7ccbdefd5883838df3d5737db

SHA256
d6beef4f2ad27fa1c0d1246df96fef4cccffd497063505fca64cd113275227dd

SHA512
af7fe43c30d8c880829353aff9c30684f5cf188ffbfcdc42f6223d16995f559b32eb3f1ab207c46d0893550ec4d3d9dad7e5f9b0885b465a816912136b9d9984

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_2

Filesize
1.0MB

MD5
054058822edd0f348ab6c36f822b0c37

SHA1
39abb3a23578a506a76a20077b67cecb08194d7c

SHA256
9e7aecaf03683bde3fc8b0e667f290980dc7a101a1a9eeef1ff91cc455d19197

SHA512
b0120b620fecb3e99d9c9a6abb2c45bb61e68c394676c01186aa930f3911b211babd43d8af5e6a9b78d3e145ef92cff67462270e03e83f6d41b9aaa41e25cf41

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_3

Filesize
4.0MB

MD5
f5e2c132bb3177dc31ae47d14e54fc4c

SHA1
85c0ec4b57924c87ca534c60cecf0ee8a87580b3

SHA256
9be7f966d411e144f032dd726738cb7724602b7bf2ba58fed53518ca9e681570

SHA512
6fffc4b9fa20649105471dadda7b82005be3d3c464abf910a1d33fdecb46b24caad2ea7e0801bfc830d66727ef5c16da73eababafad47dc6af6115c02f3e31d1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000026

Filesize
181KB

MD5
97fb88364980db90536ac9f01328f521

SHA1
902d13a839c380b8a735a8a747d7bfe4d23ba593

SHA256
4d2697d7c08f77fe161bf31db43f160c340147b04668ef629050f13824c784ce

SHA512
a434fd475f0ace1bd4b49a5750d4ad2df39c6bc706499741f6a935c658991c002fbf62d5127c5eb0097480fbfc0ac8b698f1bd2808d5747b258846b1aba7af1f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000027

Filesize
135KB

MD5
740d117bcce3000419f83409b5cadff3

SHA1
2b2bc6b884da971ea67820e03d667ae7586398ab

SHA256
1535e1a94fa1b09b21f356eabe0adeaab711531878c9af4eaeb36b14fdbd5be0

SHA512
bae5067eeef72443768a25595e660ecf92d40e3584e78f7487227f7298eb88f27870879e718e6734d3b4a4126865b3c7a4d6a3eb50d0c822e39d142126348f89

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000028

Filesize
27KB

MD5
601b8bfa1ae0df0b57bc114c1c984b34

SHA1
ee1c51563f024f12ca6f3a06dbe7806612f113c1

SHA256
22b9a547a7d0433ef2abce0c7e9d8165f63bd86e260be5bea9b391eabe0c3917

SHA512
699d64b3064105e04e85d2070afe14f53fc51e7c499823672bb2b4f50aaf9b5a8f2c9b3ee7ea1dfa3466a0169a1193e7e8adc495de0a2adbc871e18e008735af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000029

Filesize
25KB

MD5
bd622649741c8cbf9f6875d4065555cd

SHA1
0a25970ce84e58cfc0841b869818dcc21d7a4301

SHA256
628bf175272f286b486f4d15b59f9920d8aeb668ff0725264b7e19b750133367

SHA512
9c80c32b4d1d70920d63517c822cd846e6a0c03312a20b621ac77b818ac86fffef8eb0d66123fab93f7f46697e76f2d21fb8641437997a6e403729bd2d736ed5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00002a

Filesize
252KB

MD5
209397da5c3f21b31c8846d31b126ad5

SHA1
b3e5f650ce6ca03dc9a838ccd214420ecc95e866

SHA256
8a832002f401eb758dce927b88ffca6b56b670034ac6fe771810d841c138bd07

SHA512
d5ed42cb1ea5a57d208e9bb1d8d1d1da57adad8dca0b219b48f2dd986cc4c6c81a8cd0d5a41e961c498ffddeb3924f66841fc18733ee17d4cab93a5c95a601e3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00002b

Filesize
164KB

MD5
6c4c7684c73a0b58a73bf63a316a5cce

SHA1
32ea6b00e2ca6cccfa90950c0f6e3fd6bb5440e9

SHA256
4578b05e068172ae4980eff21da4a8f5d7ebe48d05f4f68e06d57e7257edf2fe

SHA512
1b300e37e3218a96b33242c6132a19317699a55e6bdea496b9d03f4ab800f4408322a1b8a735d3a25313eba826adf0e63d86b1dc587dc6370182102d33b36947

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00002c

Filesize
223KB

MD5
346e466161d77afede14d2858994f23b

SHA1
55124e02aa8ebcccdfbdbb5b776564aaeb860419

SHA256
a88ccecf85a6b43bef80bc033cc00307866d108e77f5a14412f1abbbed2745ba

SHA512
19bb673bcfd3d8b9cd1cb29c0864efa259630bf1977667161f0e299e727afa99da3c1693893af0466eb5c7238e548f7bb7e096039754a60c1f6ed93f7efa5955

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00002d

Filesize
42KB

MD5
c0d3f9cca8ccb37af8b5ae445507b5d9

SHA1
8ba888b62478cbb01d2bb6eb9f52846ac3475925

SHA256
8a73a5a3dbf6147d8975e89e0ac257b6fa51aa9acb9a45a063d03dd390102c45

SHA512
cd296c348bc2e37c3c4d6c9639b0172177d76e06edf5a3b976c7ad758846c4436805d583afb453dcf8f7924234e65ed1e4adaea196d0d6859fe5e9b381fd6bfe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00002e

Filesize
95KB

MD5
96403761a8fbee5f7c213a62a8acc2f8

SHA1
c18e55f0d40a7afc2eadc62599b1662e5c6c0da9

SHA256
c3c7217a05121b7a8f65e8ad0f68807742b0676cc70f6972e8f7725b50f2545a

SHA512
bfb69ffe008aa47195eb7de711fccbbdae31f4d83b5ecc0aa8fc145428d1a1f596e88794d8ba2d3931db3c539077195d46856023c8f8ac1a25a91dbd2bc9669d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00002f

Filesize
25KB

MD5
26be8858f3ccad078f122d9f610ca023

SHA1
21fb17d1791ecfb97cc1b6e465784b83c237c486

SHA256
d4ebf8d5a7f732a28a996fb841733eecb5f7248ce8c848835d842bde96194263

SHA512
1ea6f58d9c015f535d55fcf13b16ec5e659c33eb7b6a3efa2e581edcc3864e44de6925e9a9ecf3da531c477f060c28a9c1061e29b1f01d8862cac379f44638c4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000030

Filesize
71KB

MD5
2622102070ad197764d424824b88ee1e

SHA1
37d2164e7a3ffd5f0f019d1bf3a2deeb722c41e4

SHA256
ccf12c7a276b87793999b24d269f92ed4e2d40788ee5ffcd175377e31d26d076

SHA512
7da420ae577246784596da5b4626472596b85e4fd1363308e812bc0d1002665d495f545a88505c22c77a7b88a229dcab9e357d54f4504608022e4cfb782d7874

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000031

Filesize
151KB

MD5
ffbc8eed04ec42cbb1aba0a53f9a8cfc

SHA1
3c5357dfc3c808015de05a2e27b06679647b90bb

SHA256
604946d2826c1511435a1eaa40a042063a2b3af4cd2d50281184353b2a2e6ab4

SHA512
5faa3a705930f89b386dceb26c624950d4aa926f073350291da23f821c1d208d9cc417af879fb4f6f8fcc98a2b6a21f9993238f2b703da9a33a1b3b74d369478

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000032

Filesize
143KB

MD5
15ee4ebe739652d50f9cc6602f58ecd7

SHA1
e2e51bac7d7b7e22a3fddb1313bc89ede3ea1f58

SHA256
c6a3a0449b91563567280ed8fd3918c5ad8a8dbc7de39f1b331d3845eeb0aebd

SHA512
7e3868933c33b412cec69134eb4712d4f18e6792e341d455c3825349fbe2c1d2540e242584251a14747c73384098b1a94eaba639dbd02daeeb87d43c4e82f43d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000033

Filesize
18KB

MD5
7ccf118025a51a8d773f61754fdbe25a

SHA1
dbfe15c91ae0136bd2ad70e3249531a4b3be68ae

SHA256
d18d8745de69e878f6ff401eb8d910bfad3de5de586826b08102d502e650dad2

SHA512
7264f15bf498c59b148cc545be137138bc2a2fab3876e74ad97516bd921ab674d3d3e142442a6d36be0484a15a4de06e1158eac769ba84e16c468de94a3ddaa5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000034

Filesize
103KB

MD5
b2feed2062874bbf3f22364c2d407e48

SHA1
0afba4be99648f01cde16d855921c5216cc3145f

SHA256
02a61245dbaf2ee328ec25408c9d91d020447531901d0ca41374b1892bf8ad9d

SHA512
1dbff1bce166749790295e340851e4b09e0aa23d75ecaeafe019bb609e26fa6ff858ebe580249bd0620544651fbdfd2e8e195c3f9e26dc011a54ddc009cb20ae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000035

Filesize
211KB

MD5
24d18b22f526eff6f36796796169e599

SHA1
a44a2f7577f5db66714e57d8ac747cf150dddd79

SHA256
cd4a3ff111515151023be9ef6826e9d6556b5d170b9590f3151dc88d97ead4a3

SHA512
d4dfb35ca0377a66b93b4bd8e46551c9691b37c46741e356bc1974f5bf37ce07cfc9a18b877e1221f842c4291b0313538bc2be181710394ce224e3d2ba4a9d5d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000036

Filesize
104KB

MD5
8df00723388da0159aa17fcd7893617b

SHA1
841442f44fcd5baa13964d2ddaefa84f74021d8d

SHA256
3436d2b77ced719fa35c87fc890e16a2399cc97e77101b7aa893e5c92f652ad1

SHA512
953b12074fa208dc3526ab324336724b1da1eaa808249215d6075b773ed055843d58f15bc89e60c2e51eec78f07c7d2c4c827c166da82f861e337d3ad619a79b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000037

Filesize
25KB

MD5
3338588f71a3b5c980592524a081edae

SHA1
b43295c4dc664cd2749cbc6b4516b4f89059b6dd

SHA256
efc8b91ba0987b5c3661719f93aac0f25e20ca261f21a6025bd294073df6c74b

SHA512
6326a44d6a837375702ba0a3488e87f333c5f93f452ed3e9b1ece50c5233f78382d2f2c828f4589a82ae235c6c964706af75c188fc0a76fba2bf184d3c275516

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000038

Filesize
100KB

MD5
0afe7848b1a41190212e1250b271109a

SHA1
e0decfb39be01d517931774d3986ef4227cec5b3

SHA256
f862c4c1c2cc659f791920db09ad97e96b6a31a1a382e2c233c1618211a7288a

SHA512
ab465812a424ed438cdc61eb50f8e83307769c38873c98c5466e2466bab9e7805c3dcd8bb3c8339a79c181f64fafc3aac6d203d456d2f9bb08b9016df8ceb816

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000039

Filesize
218KB

MD5
45bc68be3092f01eaa7c0d9e20e54cb9

SHA1
81a968746f612c1a8ebeb9836d1f515837e1e759

SHA256
f1ee84cf209bebfc1b3502d344d80b721aa197392cee9dcf491db9e17726b475

SHA512
688104a3bf8d7c21a8d64ddb87075f6437253bc55936d2f74ec65bae16a8ded535e28fcc7448bcf4e716086100851dc34dc52bc26c37350d5b272f4294613f61

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\191b1fc7ad09ca32_0

Filesize
2KB

MD5
c2b3651234f1da447155c5c1c9ed0adb

SHA1
90f6157921b44edb6163311ef9150d4563c70de3

SHA256
9e91b886a89a30db3628ef38b9300a6bb6530b7132ad1d564b6644ed1b41e1b3

SHA512
c380d92f5e1d1e14af96eff18bb2fa9efd36549add6b8b93952b1649adb1efbcc4555bac6ca4407260fb5e14fdd8a55e57156612cf65c74fb1aec0c8d95234a9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\2c55a59d60bfe06e_0

Filesize
3KB

MD5
938cf963b644a52934f3884c567f0847

SHA1
4db87ee7c201142069685abc17a45a05326985ce

SHA256
51dce8fb313fc2e135ca5477701f3160d729786779e9c1b97cb4fb064e0012dc

SHA512
25572bf17ce8e986a60894ddb7596bd1d3e80a2f47843c68492db6bf952b2f3a3dc6f432951b72c4806590605dc92f9d53a600c0a96da19a7251f628094fc82b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\45fc8c6a524a83c2_0

Filesize
45KB

MD5
e20d57433fa5d7d8ed77967e9ecbc1ee

SHA1
3ce6bff9198eb5780c54b4d7f791ff2493458e34

SHA256
abfd5edb7d1a55e0af26b1f7d31d82c0df2b4952c91192685ab211ecc846113b

SHA512
e68ad56e49d4145cac5a8e9b5fc4bc2a464ec170f13ee92121bddf4a54db8c16c6bbc83e24fa6b3257b2dd5b9bf538e110ef08adbc9da85b4abea60b408cdadb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\542f3a7dacf1ef92_0

Filesize
1.4MB

MD5
e53840a92c5aba52d8f882bcc6217385

SHA1
53c1fb9dd08c52cf2d5f158cf9c54f6c6a028c7b

SHA256
a2f5730725ba6cafdf9b7a20017ffa2e2472d3466db630aa07f3e5338c8790cc

SHA512
d7088a2a46a2414eb50107ade3753e1d2140a56ff86e048d0c6c10cc3340dce8a49a6545673847629c07deeb20735bbcf9571543f9868d79af6805b093bcfb73

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\7ddb7429e81f85bc_0

Filesize
286B

MD5
70fb5f4feac23512345df5a26facae66

SHA1
c3f48b0cb3f99674d0cd162e362fd0e969c104c4

SHA256
c3712e03b4b73548ffe64af6fbed56c99d94c98dc6d4d5b0b9cce214fe4448a0

SHA512
ab5383586d653efffe5784130ad655da39e7f3b028ad836b4aca185c545505461191aa53ceec66cabff8cfde21a6cea9c10fd416cb83341dcd4dac569517ee48

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
826a64796b5659964166309049766834

SHA1
b4750ad0ba890ecbc45cb316d8231c76ed217b1d

SHA256
f90f6cd21f01fdeda54f793ecaa24aa65a767c8c39eb5f196c015bdb5d720628

SHA512
b3ad1cc03c9f6c2c1aaa3db5919d826bb75d400ce6fbf545d481f287d9d53a05b539082ad0cf72ff80a4ac3a7d7054e4a0f63c0cba7415e266211cf0a535b1c4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
704d5be92f65b1f111a03425265b8fd6

SHA1
8c0786e51417bb106f62286efb3ed7b8084d6b47

SHA256
27465ddc1a3d202c8225fa9e16d65a1114d335266057e88dfc4d6ea9afafc7bd

SHA512
ba09d27aa97073663dfca482a0174624d83535665ea3ce22a8fcc3e0f98762887a997df606dbac8691b8ee497c6ed94b9a87df155df9aed386af06da4b5c66eb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
62eb828fef2a1e968a1ab10dca64f5df

SHA1
cf6c5525726953aee22c7c02e759f58666f19c45

SHA256
d0d42266f0773eecc85655afbc8b82cdb9d701b8391927e896fe5f3ea2eac9e4

SHA512
1e8a13d8587db1c631b1be7097dd239230b2178774e7c865dba1b21b6fa6d8e7eabd7fe800d68a90edd5881a5df2ae3bbfb8ed5a52c4397646bb23ac1d5f1efd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
7343a7cd2f5645edd8bd51ff566e8919

SHA1
b36fcbad791c84e8ded9f62f46b084f1c1868899

SHA256
643b443e746b920b0dc0f12fc77294e76cd30c9ae829195951f99d786af709c8

SHA512
d94bb626ea6a10d4ddbfff9750b8e6d85a848a71a90da5a9f3b18a42564ad108eeb6ad9d0c6f0e13ab68308672fb3e87466b6c9e80234f38ff6d5b5e526833a0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DawnCache\data_1

Filesize
264KB

MD5
2f0661879ac7433882280de2a9e90ccc

SHA1
5548b77f8dd5df14a384c0dd80bde19d8f603876

SHA256
626b8012a1628c14c69ad968ca93264c07d905038c5348bdb3e641652d15f187

SHA512
af588106e27cfb969d6318420f070d966fda772bc1f8a0ecf6380e834f31492d76a1e4b70805e30a4f731ae55741fbcd170e5981779cbfea68a1de89bba7fe3e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History

Filesize
192KB

MD5
1fb451569065ed745dde24045ff7a986

SHA1
afc2b1ae68dc56d05c56a4028a0ec1ff49fcce92

SHA256
1a457910675bb2ae6812fab42e0f352669d715a136d8cf3e124d91e9aad689f7

SHA512
2842302cd22d7fe2a271cf32dd9c631bce3e2a297910e5adbcf6da2e6664f89a96458e88aa5db284d080a43f4e53cfa1972ba3f55f54c75eb8daf78421d32293

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
8KB

MD5
d8bd93b80999a6c826d9fd948747523d

SHA1
7eee0922b01d6a5a8f9badc07b3eaf2d41ea93ce

SHA256
a7a52cae10c124b485199f900f043d727f824eb41d2e3cb671c5532d37dbd104

SHA512
1654a73c594eb4d56d527de03ab4ab125ecbc4492f27a1ca56e5dab318d5b4f439eea47631a67f400c8eeda5457879f145df5915cd1bcf1cda38833f532ebdd8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
7KB

MD5
c837a605a2054d0e289718b07023a030

SHA1
7e35a9534919acce8e70abc5e2ad17f03de36de3

SHA256
c803f97a2105c2458d98e0e61b096614c2dee9821f0e2cd274fda8ed37fbe470

SHA512
c94d57285b25f8678dbe8fa65bcc6c353e18545ef269b27651a5ad8596248b5944172619eccf5dd697af5270f4ff9bb8d4d2b043ba52c50191043e57aa318a03

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
8KB

MD5
816a4eca62dd8d582d371bbcd3014097

SHA1
a50c32bf4c4e1fcabfbdbdbd22e815e5bd8984c2

SHA256
8a7cb13092ce96020c0bd21f378426c8449978954a6191ed915dc163eca5e10b

SHA512
c9cfced104a96b07d885b13dbbae06889bfe2978ccfbd4a29f81d8f9c4eee5476fb7a0dad3ca2cac679f078042879a8af24c054b95d005232ab0f733c231984d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries

Filesize
40B

MD5
20d4b8fa017a12a108c87f540836e250

SHA1
1ac617fac131262b6d3ce1f52f5907e31d5f6f00

SHA256
6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d

SHA512
507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
e8e0be3cb1d413c87b2ecf4be0e77d46

SHA1
39c55108cdd44e62484cca48c5a8a4d262440afc

SHA256
fbefc554f942c0838a504ff83b351605dac87f80066cd2b37023c340d204ac04

SHA512
7c90f22c9d3ed4717a898cf03ca2f934d0f018456b12b8103c56b97afad37de73365b975834f1859e9392f5da23bf5bee05d77819f3994e53a10cd9894a5e6d2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
f418ca813c23acd353a29ec7b8f61c02

SHA1
cb0a8861220d18ca5c3bcda84476279109a02614

SHA256
696d39832c6e73ad5261e33e4cccc2befae066fa1839c45e2ca364ad62cc2f24

SHA512
a6f8f8c02f23eaf7f0d949d70a20eb6fb68413edd2cd11afaa23bacdaac73d87116b092e7a066c3291ee9b3a5d832e47eb21718ba96ca9b1a0e3f88430cbf67b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
41545a616927dc95a0b405d549445e28

SHA1
08b74acb68c9faa2a9a42d9dc17b61bdffb117b0

SHA256
ef1fcb7f789a9038d0150f4147f464228af2969ed5439138596630f3cf8cb88b

SHA512
5e0c8e4f4b14e87e78774ba7fc39233743c32f75be6c05a7b36d25fab186269b5336ee6510886ae76e8b9d7444e488d6d3b99e4035953e0154faa9378d1a8a10

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
0a3940c924b92129c150b7aa21af6224

SHA1
17af7defaa5362793ae64afa4525be7a40280f88

SHA256
00c40280a037c00585aeff22303ae2612c3d6b54cc3622a47316bd8e6a14a19e

SHA512
180c4c7563acf32ef997e7d7d604e62e921271912791b92903cccd564a5fe234f608d8700cc954dc0473b7673ea50219280e3d84d5421eaf8beb0545fe0cf12e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
232ffdd333ab5c635a6f239225b7b5d1

SHA1
f8977b21b90d2f42825dc88d48322b2c7acc20f4

SHA256
9e1ba1637dd671908105e57ac2ae2ee686225eb312ac67e815083f9e6f6e0674

SHA512
e88c2216cb682e2caa95377e0111d554b9c1f8853c8d9d8e916fa43d32381e81541d43460b31bba59781be8134f8c92d1a9beba7942e5d5b9b2f70bbe39e8b82

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
2c7ff41e514d94cd1c0df7ea1ba16f33

SHA1
e1bb42644ea4683e25fbfcd1e879a338bdb3d453

SHA256
196e384dbe7f7e66babf32e587a33ec991b454ceceeb96c75cd1b2e5fdbe01fb

SHA512
57d341d53e67033cf0d25e1162304c63059fc1e6b30b2a3ec10cef4b8582476745da30e06f50cfb4af6cf85ce1870aff24f7013263871fe3f2c82e48f4a1b1b1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
679ce8e5660b47807ecca94b806aac92

SHA1
b9a2fa009de0af57205790dd8f2b9e09f5e4409f

SHA256
1b98bad878cdf08100f232f6a0b7ebce93144f5a32cc0cf38a2dfe060de0e349

SHA512
9c70b049302bf7e3aa24937cf97ffacd8ca81629ca42d2ecf3b15a9613bf0e665e9b1f91998ed8eab0845c515d73a0a6a6b66eb7b64d1b7217373decceefff1e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
987edf6463acf7178fc10987aacf0935

SHA1
bbdd581d78536a934c6227519c658bf266068802

SHA256
03439f0a7d5e3f5ef37f92c9c93a34311dadc4b5810f3d4fc6bbb66ca37a84d6

SHA512
776dc740f14b5e890146dcf2619b9b5bc5c471f80261abee91cb45e48fa692fa372953ca4264266a40c091223a158d5996bca65e9572abbb89765a430dfec03c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
d37fb760671f8462875480dc31d2c125

SHA1
0927c27f9987a103eb629ea641ea8a0ab302ba12

SHA256
0131c526075f6f4f1e939b9aea2f60b6786777e659a52fb9c6359df99862461f

SHA512
413a18c4364f553f4ea07af304a92be53c23e4f221ae0ae17e8706bd457f92255a7ff30edd2a5e5c05dd84d2b2a89e1e75b57e411f7a981ba0ca8cbba6cb47f4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
50ad511a3f0372c2d8b4ddb09bff9fe3

SHA1
85b717eec716f1195aa2e281bbf35205473e3622

SHA256
28bebbaaa62754eba25623fc485fd69665d41bdac708393266edbfc859bdc315

SHA512
d287c0cc822be48d8da198fa362e54da8526274b38b1ab23cb0be56b1f65e90e89122d636f74546617c5552f3ae831051f0cd78ce6bc38fe8a61b9a2971cef8d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Nurturing\campaign_history

Filesize
20KB

MD5
9dea1a87b2993be7a38e84bda726f1ad

SHA1
7f3d3f6af6459cf8c8e805886f00d6ba0d7940c5

SHA256
6edb5f50d1540fe28f090d9ab4ce5c2171ed56e43cf901013e19e9fed50340b9

SHA512
dea38db920a507ccb70154827d5f9601b7fef72c9e314fb810e6717fd153ecf6e9d7575a28f35645b2829b02a284b65e18ffcd4c597c30ecc52ecad5674ee412

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
12KB

MD5
273e198da7e6985699873f48918e51eb

SHA1
68b1671e3f5a450cc0f2ab94fde85ad06384ed9c

SHA256
d45a607425fa1af196f3c58bc3ad3bca57750de8b43ee1da26bc93240eba1c19

SHA512
cb7378ed2df0a26df3de644d814de4d3db6eb62a13ed2113c40679243dc1d8a38f7bc5f340b9703fc50cc43a5e6fac578ac59ab8aaea474e347d2dcb7265115d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
12KB

MD5
25befa868bc90ff71edb9f638f123dfa

SHA1
d7ac4550be59accdb9b6545a1dff2eb42818d047

SHA256
da9398e4a424a1865818c8f6122c0d59a795727481bd91df62bde1cddd02bd6d

SHA512
dd6a93c3c285e90a8553aef3fc6e26af08e4d2add96f7257c9c95925f030e94863bbae444da7c7693f6adc505a450564442d227547292a7a3845db4f46c913de

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
13KB

MD5
f57db6cbae75177810d9f27f2c95a109

SHA1
ff08e539b23e3ffe06416fa063fcb999bca949fc

SHA256
06462e1c9afe5b6ed9da1af3446dabce2917dde420f023b47b8e6843615e50fe

SHA512
397e0e9047f0d5deb6122f4f0ee67dddd1615ebac8ff1da80f476f690fb33d2ae4d9e0d01d933eb43edc8d569b36cde04bc6e6732b0c5632c804f5a1bfda94d8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
13KB

MD5
1ce7801d39957d6b4ad6467c72845285

SHA1
e8e8d9ae9be967711ff59ebb8ecb018e2bd528d8

SHA256
b2513c4f992e566b0bb419be6411411b28c110e1cb189bb50a8f5d52fa30a4e9

SHA512
8064bc3284b572888b4450f70f6d765b705f28833e1f1384a5d3e8a0d4057a898b0fd5b495480900c3f334a2c1754647463caf96b03fa0bc0be27c584797b1d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
30KB

MD5
c5f69e20e1667fd5112dfbebd763e260

SHA1
59700a2da7d42a89ea765264fbc351f24e9ce9a2

SHA256
cae57df8311eba5deef72bb2ffd9c9be0e05f4e99e2cc2332952567fde4213da

SHA512
5923c06b5add9b106a70b3501814b7cf0c43d50e96629e76a748d6b844a46c700b5ffa7d1bfa80488f8bfbe18a23859d32eb1360058aec3d9061ed2724bffe8c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG

Filesize
347B

MD5
ea58f6c5d38e2154a4ef1b1a92a0274e

SHA1
8b8d8660f5f4a678e9da1e495a53de95bc8979c8

SHA256
eaf4ecbcfaf830320b8b8b0e4bb0cb934a9391e7297d1128bf95cef704acc2d9

SHA512
13cad2ceb90aab5ae0469c754e3f8d4724679e241114fa097a3d0697f255e2936f38d0d6ee0a1af70646d712bda386b9dc6de5b6ec0769bf250271dc9a0e9104

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG

Filesize
323B

MD5
14555890530188dcc6233d1a0327e45c

SHA1
79c8cf2bd9ba0c9fe3d3a81f197fa31ee87c9ad4

SHA256
54fe08d2b18b6df79485a8fd25dca2c08c397c767e6226fd1c3cfb827b92c847

SHA512
9d0552756869e8d5711dd0f6abaca85531cb33273dcdad1886a590a6c812f05badedc7dbe5874d21852df9d97c8e1e8e30220c73c4820f8196cfa2031b67f66d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Visited Links

Filesize
128KB

MD5
212ad87cee17ea23db4b80656b01385f

SHA1
751acb408ec2f4da8f0abe820ce7e6a977620baf

SHA256
bc672f4f25c0b3c7e9025f6f172cf9c5e910b1687e493795b35ca0a4abfb509e

SHA512
a2906f5f2acc141409b9e360d564b20527959c60816abcfc02e0fce8c79ade58c3176e2a16a12b73079cbb6bea46a42b9553d8c60ce33a2348cbf9ae3dc686d7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Vpn Tokens

Filesize
28KB

MD5
599549ca7050fda41d48cd1d92212e59

SHA1
9e44dec26d7dbced9ca1214da493f613f9cb0150

SHA256
8eb4364904924eac8f323797cec4569b52c109a32d2d848af8fe3e4fd87eacba

SHA512
bd0da72d7582c887cd2e451841d8dcedf84b7d631220f696ad1b73611e88c77a6a974781b288a422c28cdf91fa74a2d5ca779403282f717a4a59de31b352e933

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data

Filesize
220KB

MD5
8f17658f16417371fe2089a3fbf67c87

SHA1
5a210b48b72a1644b4c302b1afe9f63ee8aea437

SHA256
101476d7de83395ba1f1264fcd509837a1e7bcb856632b2800cc474fcc605135

SHA512
329907b06e643336f5bd76843fc19e4568cbd2938dd62cb4b7883c3b4afa98fb7d5208251bd26eb4a7f0d860e59e434531f67a6aebcded9fc5479b0a16209010

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\1\CacheStorage\index.txt

Filesize
142B

MD5
6ef274729d52c0695f6671357a8ce97e

SHA1
8c079e91b238189dd4f25ff0e6d47e846ab73db7

SHA256
e12b26abd55842c7d1cf3a8b67c4ce95e4943996461757251fa17392339ad486

SHA512
8e79a4d7d826ddecfa808ae29026c803c92dfdd89b06b51b4735591a60f794cd1b9222c338af77ed81e37ee02e796012bed341b9427c39b3f075fa0d7e6aaa84

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\1\CacheStorage\index.txt

Filesize
78B

MD5
59c95d1d4b34093e77f871dbf1bb9ae5

SHA1
357ba3bb3eb64c04b285bb290b7040130a88ec4e

SHA256
de1c14e6c1e1e7dbb9d495946727f0f18e8403fe54a6a12738880ece292ddaf0

SHA512
04fb38bca03c5f92c42b6bc241d94ca64c892ed0df5db621f2328821fe8a0c06755e42c1ff70dc00e63a877e6cf4dd4b22077ac25a3e1c70cb8f2b579cb8253b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\1\CacheStorage\index.txt

Filesize
142B

MD5
7b2743439ff5c1ad025d41ebad0e9b46

SHA1
e5243f1529603626447f32def14168ead0098c09

SHA256
183a9c612450b524b652d806d1f19b2d9c4733f65a68b0fc88df291e684fdfa7

SHA512
c8d6d9e8c5927a763e32da763942cc272b3bdb26ffbcbd33804c969210fe2c0c7533a61e5dd92228400be2f3a5681dc028019158300188f560f8c1ac0593b620

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\1\CacheStorage\index.txt

Filesize
142B

MD5
5e639c710fe564b45c504b3d03fa44a3

SHA1
eef469208bd8cdce663b8d4061db249eb4e5e304

SHA256
ecf8450ac9292886111d2a17ebc81c0bf3de6938dd2d321b296f86112b17d0d4

SHA512
87d1e6492097a855e51cc1feb2d51f1fc0ca0daf00a34638bebb698efb34c1c5133cfd57b2f6b232899a825382a7eab58633c3522253b1eff5c057cca9c62abc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\1\CacheStorage\index.txt

Filesize
142B

MD5
cec00ee8dd9e7105e42204bf77886380

SHA1
c25c5ff671822718a623ca8f0f8d07de71626d67

SHA256
3428aa669378c60da437950db98d8f8aa85b037569687e0675bb2d53b4a9ef79

SHA512
6e37a46347cbdd8a93ba63695ca91cca68e92380f246f0bf795fe9e9263d252d78edc110266cc48526abea582b4eb7ef586349286dd3104632d2eb8bb649c14a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version

Filesize
13B

MD5
9f0786e66f4c80870bd874b7aba0a394

SHA1
74d461c9049086ea0301b956203e7cb59438160d

SHA256
da3e73d31020d249d320f01fc40220043e34ebc99fccaec56c5a97f671a8f227

SHA512
f766b4ee7c28886c1901cf76c1c917e296ddfd3cf843f4f27d7a73db37247ae0dfb8c3f343c4ba124d20f4475e0fb4cf60860215480341715bb907d73630cc6e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
84KB

MD5
d971c375002e557aa805a4b002338f87

SHA1
28a85e79e5ac25c41a756c66024e76956c303702

SHA256
cfb02c73c8a46ac8e51b404992b462992eee73495de30dcf212ab552dd02d530

SHA512
e76493ed647090f0fc91986a3288d18ae5f70488d0e7029771222986dbb1eec869f37598524ddd8a003f4848223f3ea45013720efa16c6aaab30df61cd2baefe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
84KB

MD5
9da37aad881863fc1b94bf38e8349ccc

SHA1
c23ae5340d609128c205e82a3ce92c99e21799c1

SHA256
765a524c3b97e534a91e434a786b0a4b13620f67d3e40d9461422e417393f0e3

SHA512
117870aef8a08315573bb61799c2e698b94a49ea3f84d3d3801c957a35f32b7f49d2e50a4cb42c734757d245e9da77e9735fe2026b11ad72176b3093931ec427

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
84KB

MD5
0028ea84e9f0f6d1dc0c5281d626e3a1

SHA1
3fa18ed11ad9786e55c43408da0df20fcc33a636

SHA256
df4c223e80abeb15e5c4dd16a9f2beb6832566aebb2c8dc27a99c074c3fcda61

SHA512
898ffa50a7f117485fdbce993b11082b8124f35127a3c668bcbe80c4a5791b3022bd43f3bf8edc81ff0d5d82c426b68b47bd6a2ae3b4ffe783467a4bc4039e16

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
84KB

MD5
da6dfeccc3990a1a42f63d857e24eaea

SHA1
5fc34c6fccb3b42906e848e4bccdf391e5aec190

SHA256
788ad8616c696f057bb61846ec461803ebb3d2f55b6c848b666a399fb1205788

SHA512
e0d74c64d5ff0e7aa782f69b13e480ce1bf8c9d70dbea7f00e8a777df8294fff9f2002fbed14b9a35a9ec1fbc59befb7945d1f4b19ee06fb5c8ae6931765cacc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
88KB

MD5
5e10adca323e69225a0ac873544ec54f

SHA1
e2654d3715fe8e50b30e59834af5a2f4eb51a28e

SHA256
1170f836849baa9716f4dddbc612bd99c3a39061f56f5915ba07fe5d53d645b0

SHA512
6af746df5704287b60a9fa620dee688c7f0d85d6e82e1fd617f547682017dcd0d2594b3b588d6586cd28ec882b8a65340205663235668d907205448adbdca762

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
84KB

MD5
1406618eea236a63b53e757951340486

SHA1
f24e232f0a55bb1f01d88aa2a2475cf6eb4266ae

SHA256
c1dd49b4e1ae9978114dd11b5b066dbb0db5e9162ff96ef6ac9e72f4c3b20698

SHA512
b4869978a8a9f09d804da69591676695891607dfa481d82a83a6611801f8506b10b375b82cc56fad7a45ec7fb36a85ca535033c899af6e7dd7d39accd20ba8c2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
84KB

MD5
0c44824c80e3643330890b6ba96f8567

SHA1
a84b4c6418602e5ef646f7e771755bca670ef6e9

SHA256
fc2f9f6162b5ba28de2be45fc826224f42f9c4b7728a79508c68f47b9d2675ee

SHA512
b7b7d44890583b58463cdfdd27cbbcb89d0df9ef44dcc427c25428eaf165958eadfcc90aaa66ed317f4580cb9c81627267fc6b3b73cd9c4ec7c808d13129f830

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
88KB

MD5
0be4da58196fe670ed3b9e5c31160208

SHA1
3d2174ed199717a9e6fa9c9d6de2e9f6c8d789a9

SHA256
56ee66ba75cca76830ac3ca6baba332742acc3f0389c0d00367107b0464d35a1

SHA512
dd600d1fb2239cb67acda759e2bfcd06ae1fd5343176b3770071911253efc9c2f51881e6188c02446adb143aff8aba5c6e7fbef7f0d6f245be05291e0ba3a370

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
84KB

MD5
d07bff17f0432d886d7c2b14c473a972

SHA1
49850e06993f843d62cf50fbfd83f292f256b860

SHA256
10bbf51b0737ffb4cf6b2f1b97d5b780e84c29691ecce2fdc651d4d13a3477c2

SHA512
f10cae277ee64f9cf22b9add14f1da059182327efdef5dccaa49dbd117f59e78f3b913e3cab7858fe15dac1396e0318972076b8cc148af26903a2413f1434ee0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
84KB

MD5
1e5af3d55ca73eb8137dc3a7bec18a90

SHA1
f4ecf2171892c5217768f817d7df3cb99be4cc79

SHA256
2b752c15b11a4320ccb15bc39d1995691d6a7b6b17d060647188bbffe8a94337

SHA512
48eff320cf838c798fe79d823e9d52df5cc3ba8b44920ce1ca6e9a04e8259e8ad7bb54a2b556b1f28711155d7cfd9f5d7a99fe04d05307ad31ef77b4d41c9007

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
84KB

MD5
03203b72bb59f8678cc7b4a32e95ec2b

SHA1
54c4bc05eebcc9903024ba4a3971302406f20cff

SHA256
dcd96d7124fe3e9ecfa6d09364217bd898a32be818efef7facd8e084028c6941

SHA512
218b2faad6087c27863b8e7cf045fcecc65c7c38d8cca8322714c12e3eb3d0921f92dccf32e23c0c867d2c7d9ec9b48283761e960de96e1bdbc1c47da9926d24

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1

Filesize
264KB

MD5
647a24b9c3663f51daea7d9f648c2038

SHA1
9db1e3efc2dd2f394f945d88435a0c356472705c

SHA256
1ff5a535ff7b51201e77f1bcaaa1a0e6c111e232b276ae6a575238ada016a789

SHA512
79deef47a3a5d484c12922c76af066f48c98afa39b33618a5603bee253505d852664c422b1e90aeea32f7b6bb5ddd833b441f412477f73b2df78631d72d1620c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\SmartScreen\local\uriCache

Filesize
9B

MD5
b6f7a6b03164d4bf8e3531a5cf721d30

SHA1
a2134120d4712c7c629cdceef9de6d6e48ca13fa

SHA256
3d6f3f8f1456d7ce78dd9dfa8187318b38e731a658e513f561ee178766e74d39

SHA512
4b473f45a5d45d420483ea1d9e93047794884f26781bbfe5370a554d260e80ad462e7eeb74d16025774935c3a80cbb2fd1293941ee3d7b64045b791b365f2b63

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\SmartScreen\local\uriCache_

Filesize
1KB

MD5
1f59c33b8e5cd2931a066f48f057d13d

SHA1
bf4123a41bf0dd7ebe26ed9dc5f10fae28585542

SHA256
1c1cbd8e2e06d6f3f6acbe75c897eacff37667f3ca486bc1a67c9ff0c178f8ca

SHA512
a2043e7677d9cbc7d24060cb15cb76235d8e8df5972deb33329e728bb63c70fd831174080ffffb00676fbc0885129ef1d7fa2e3c57e966ad83885d879eb76a37

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations

Filesize
86B

MD5
961e3604f228b0d10541ebf921500c86

SHA1
6e00570d9f78d9cfebe67d4da5efe546543949a7

SHA256
f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed

SHA512
535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472

Download Submit
C:\note.txt

Filesize
218B

MD5
afa6955439b8d516721231029fb9ca1b

SHA1
087a043cc123c0c0df2ffadcf8e71e3ac86bbae9

SHA256
8e9f20f6864c66576536c0b866c6ffdcf11397db67fe120e972e244c3c022270

SHA512
5da21a31fbc4e8250dffed30f66b896bdf007ac91948140334fe36a3f010e1bac3e70a07e9f3eb9da8633189091fd5cadcabbaacd3e01da0fe7ae28a11b3dddf

Download Submit