hxxps://github[.]com/Endermanch/MalwareDatabase

Resubmissions

20-08-2024 19:03

240820-xqj6raybkf 10

20-08-2024 19:02

240820-xpw4xssbrj 3

20-08-2024 18:59

240820-xnkphayaqh 10

20-08-2024 18:53

240820-xj2r8asakj 6

Analysis

max time kernel
307s
max time network
305s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
20-08-2024 18:53

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

https://github.com/Endermanch/MalwareDatabase

Score

6^/10

bootkit discovery persistence

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
72	raw.githubusercontent.com
73	raw.githubusercontent.com

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	[email protected]

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mmc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	control.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DllHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	[email protected]

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe

Enumerates system info in registry 2 TTPs 12 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\telephon.cpl,-2#immutable1 = "Configure your telephone dialing rules and modem settings."	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\devmgr.dll,-5#immutable1 = "View and update your device hardware settings and driver software."	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a000000a000000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\sud.dll,-10#immutable1 = "Choose which programs you want Windows to use for activities like web browsing, editing photos, sending e-mail, and playing music."	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\intl.cpl,-2#immutable1 = "Customize settings for the display of languages, numbers, times, and dates."	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\main.cpl,-101#immutable1 = "Customize your mouse settings, such as the button configuration, double-click speed, mouse pointers, and motion speed."	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\SyncCenter.dll,-3000#immutable1 = "Sync Center"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\recovery.dll,-2#immutable1 = "Recovery"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\mmsys.cpl,-301#immutable1 = "Configure your audio devices or change the sound scheme for your computer."	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\FirewallControlPanel.dll,-12122#immutable1 = "Windows Defender Firewall"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\srchadmin.dll,-602#immutable1 = "Change how Windows indexes to search faster"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\MRUListEx = ffffffff	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\LogicalViewMode = "3"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\SyncCenter.dll,-3001#immutable1 = "Sync files between your computer and network folders"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\systemcpl.dll,-2#immutable1 = "View information about your computer, and change settings for hardware, performance, and remote connections."	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\DiagCpl.dll,-15#immutable1 = "Troubleshoot and fix common computer problems."	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\FirewallControlPanel.dll,-12123#immutable1 = "Set firewall security options to help protect your computer from hackers and malicious software."	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\intl.cpl,-3#immutable1 = "Region"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\telephon.cpl,-1#immutable1 = "Phone and Modem"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\FFlags = "1092616257"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings	control.exe
Key created	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\powercpl.dll,-1#immutable1 = "Power Options"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\system32\Vault.dll,-1#immutable1 = "Credential Manager"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\RADCUI.dll,-15301#immutable1 = "Manage your RemoteApp and Desktop Connections"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\Speech\SpeechUX\speechuxcpl.dll,-1#immutable1 = "Speech Recognition"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\inetcpl.cpl,-4313#immutable1 = "Configure your Internet display and connection settings."	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\accessibilitycpl.dll,-45#immutable1 = "Make your computer easier to use."	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\timedate.cpl,-52#immutable1 = "Set the date, time, and time zone for your computer."	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\mmsys.cpl,-300#immutable1 = "Sound"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\autoplay.dll,-2#immutable1 = "Change default settings for CDs, DVDs, and devices so that you can automatically play music, view pictures, install software, and play games."	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\sdcpl.dll,-100#immutable1 = "Recover copies of your files backed up in Windows 7"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\FFlags = "1"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\powercpl.dll,-2#immutable1 = "Conserve energy or maximize performance by choosing how your computer manages power."	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\netcenter.dll,-2#immutable1 = "Check network status, change network settings and set preferences for sharing files and printers."	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\system32\DeviceCenter.dll,-1000#immutable1 = "Devices and Printers"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\accessibilitycpl.dll,-10#immutable1 = "Ease of Access Center"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\fvecpl.dll,-1#immutable1 = "BitLocker Drive Encryption"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\timedate.cpl,-51#immutable1 = "Date and Time"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupByDirection = "1"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\srchadmin.dll,-601#immutable1 = "Indexing Options"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupByKey:PID = "0"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\systemcpl.dll,-1#immutable1 = "System"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\NodeSlot = "3"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 020000000100000000000000ffffffff	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\system32\colorcpl.exe,-7#immutable1 = "Change advanced color management settings for displays, scanners, and printers."	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 020000000100000000000000ffffffff	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\IconSize = "48"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\usercpl.dll,-2#immutable1 = "Change user account settings and passwords for people who share this computer."	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\main.cpl,-103#immutable1 = "Customize your keyboard settings, such as the cursor blink rate and the character repeat rate."	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\system32\appwiz.cpl,-160#immutable1 = "Uninstall or change programs on your computer."	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\DiagCpl.dll,-1#immutable1 = "Troubleshooting"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\Mode = "1"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\sud.dll,-1#immutable1 = "Default Programs"	explorer.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
2760	explorer.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3612	msedge.exe
3612	msedge.exe
2816	msedge.exe
2816	msedge.exe
4716	identity_helper.exe
4716	identity_helper.exe
2956	msedge.exe
2956	msedge.exe
528	[email protected]
528	[email protected]
528	[email protected]
528	[email protected]
528	[email protected]
872	[email protected]
872	[email protected]
528	[email protected]
1172	[email protected]
5080	[email protected]
5080	[email protected]
1172	[email protected]
528	[email protected]
528	[email protected]
872	[email protected]
872	[email protected]
912	[email protected]
912	[email protected]
528	[email protected]
872	[email protected]
528	[email protected]
872	[email protected]
1172	[email protected]
1172	[email protected]
5080	[email protected]
5080	[email protected]
872	[email protected]
1172	[email protected]
872	[email protected]
1172	[email protected]
528	[email protected]
528	[email protected]
912	[email protected]
912	[email protected]
528	[email protected]
912	[email protected]
528	[email protected]
912	[email protected]
1172	[email protected]
872	[email protected]
1172	[email protected]
872	[email protected]
5080	[email protected]
5080	[email protected]
5080	[email protected]
5080	[email protected]
872	[email protected]
872	[email protected]
1172	[email protected]
1172	[email protected]
912	[email protected]
912	[email protected]
528	[email protected]
528	[email protected]
528	[email protected]
912	[email protected]

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1100	mmc.exe

Suspicious behavior: LoadsDriver 6 IoCs

pid	Process
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
660	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 46 IoCs

pid	Process
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe

Suspicious use of AdjustPrivilegeToken 21 IoCs

description	pid	Process
Token: 33	1100	mmc.exe
Token: SeIncBasePriorityPrivilege	1100	mmc.exe
Token: 33	1100	mmc.exe
Token: SeIncBasePriorityPrivilege	1100	mmc.exe
Token: 33	1100	mmc.exe
Token: SeIncBasePriorityPrivilege	1100	mmc.exe
Token: 33	5244	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	5244	AUDIODG.EXE
Token: 33	1100	mmc.exe
Token: SeIncBasePriorityPrivilege	1100	mmc.exe
Token: 33	1100	mmc.exe
Token: SeIncBasePriorityPrivilege	1100	mmc.exe
Token: 33	1100	mmc.exe
Token: SeIncBasePriorityPrivilege	1100	mmc.exe
Token: SeDebugPrivilege	2252	taskmgr.exe
Token: SeSystemProfilePrivilege	2252	taskmgr.exe
Token: SeCreateGlobalPrivilege	2252	taskmgr.exe
Token: SeShutdownPrivilege	2760	explorer.exe
Token: SeCreatePagefilePrivilege	2760	explorer.exe
Token: SeShutdownPrivilege	2760	explorer.exe
Token: SeCreatePagefilePrivilege	2760	explorer.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
1100	mmc.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe

Suspicious use of SetWindowsHookEx 30 IoCs

pid	Process
816	[email protected]
528	[email protected]
1172	[email protected]
5080	[email protected]
872	[email protected]
912	[email protected]
2796	[email protected]
5380	mmc.exe
1100	mmc.exe
1100	mmc.exe
3536	msedge.exe
2796	[email protected]
2796	[email protected]
2796	[email protected]
1172	[email protected]
528	[email protected]
872	[email protected]
5080	[email protected]
528	[email protected]
5080	[email protected]
1172	[email protected]
872	[email protected]
872	[email protected]
1172	[email protected]
5080	[email protected]
528	[email protected]
528	[email protected]
5080	[email protected]
1172	[email protected]
872	[email protected]

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2816 wrote to memory of 1612	2816	msedge.exe	84
PID 2816 wrote to memory of 1612	2816	msedge.exe	84
PID 2816 wrote to memory of 3532	2816	msedge.exe	87
PID 2816 wrote to memory of 3532	2816	msedge.exe	87
PID 2816 wrote to memory of 3532	2816	msedge.exe	87
PID 2816 wrote to memory of 3532	2816	msedge.exe	87
PID 2816 wrote to memory of 3532	2816	msedge.exe	87
PID 2816 wrote to memory of 3532	2816	msedge.exe	87
PID 2816 wrote to memory of 3532	2816	msedge.exe	87
PID 2816 wrote to memory of 3532	2816	msedge.exe	87
PID 2816 wrote to memory of 3532	2816	msedge.exe	87
PID 2816 wrote to memory of 3532	2816	msedge.exe	87
PID 2816 wrote to memory of 3532	2816	msedge.exe	87
PID 2816 wrote to memory of 3532	2816	msedge.exe	87
PID 2816 wrote to memory of 3532	2816	msedge.exe	87
PID 2816 wrote to memory of 3532	2816	msedge.exe	87
PID 2816 wrote to memory of 3532	2816	msedge.exe	87
PID 2816 wrote to memory of 3532	2816	msedge.exe	87
PID 2816 wrote to memory of 3532	2816	msedge.exe	87
PID 2816 wrote to memory of 3532	2816	msedge.exe	87
PID 2816 wrote to memory of 3532	2816	msedge.exe	87
PID 2816 wrote to memory of 3532	2816	msedge.exe	87
PID 2816 wrote to memory of 3532	2816	msedge.exe	87
PID 2816 wrote to memory of 3532	2816	msedge.exe	87
PID 2816 wrote to memory of 3532	2816	msedge.exe	87
PID 2816 wrote to memory of 3532	2816	msedge.exe	87
PID 2816 wrote to memory of 3532	2816	msedge.exe	87
PID 2816 wrote to memory of 3532	2816	msedge.exe	87
PID 2816 wrote to memory of 3532	2816	msedge.exe	87
PID 2816 wrote to memory of 3532	2816	msedge.exe	87
PID 2816 wrote to memory of 3532	2816	msedge.exe	87
PID 2816 wrote to memory of 3532	2816	msedge.exe	87
PID 2816 wrote to memory of 3532	2816	msedge.exe	87
PID 2816 wrote to memory of 3532	2816	msedge.exe	87
PID 2816 wrote to memory of 3532	2816	msedge.exe	87
PID 2816 wrote to memory of 3532	2816	msedge.exe	87
PID 2816 wrote to memory of 3532	2816	msedge.exe	87
PID 2816 wrote to memory of 3532	2816	msedge.exe	87
PID 2816 wrote to memory of 3532	2816	msedge.exe	87
PID 2816 wrote to memory of 3532	2816	msedge.exe	87
PID 2816 wrote to memory of 3532	2816	msedge.exe	87
PID 2816 wrote to memory of 3532	2816	msedge.exe	87
PID 2816 wrote to memory of 3612	2816	msedge.exe	88
PID 2816 wrote to memory of 3612	2816	msedge.exe	88
PID 2816 wrote to memory of 4672	2816	msedge.exe	89
PID 2816 wrote to memory of 4672	2816	msedge.exe	89
PID 2816 wrote to memory of 4672	2816	msedge.exe	89
PID 2816 wrote to memory of 4672	2816	msedge.exe	89
PID 2816 wrote to memory of 4672	2816	msedge.exe	89
PID 2816 wrote to memory of 4672	2816	msedge.exe	89
PID 2816 wrote to memory of 4672	2816	msedge.exe	89
PID 2816 wrote to memory of 4672	2816	msedge.exe	89
PID 2816 wrote to memory of 4672	2816	msedge.exe	89
PID 2816 wrote to memory of 4672	2816	msedge.exe	89
PID 2816 wrote to memory of 4672	2816	msedge.exe	89
PID 2816 wrote to memory of 4672	2816	msedge.exe	89
PID 2816 wrote to memory of 4672	2816	msedge.exe	89
PID 2816 wrote to memory of 4672	2816	msedge.exe	89
PID 2816 wrote to memory of 4672	2816	msedge.exe	89
PID 2816 wrote to memory of 4672	2816	msedge.exe	89
PID 2816 wrote to memory of 4672	2816	msedge.exe	89
PID 2816 wrote to memory of 4672	2816	msedge.exe	89
PID 2816 wrote to memory of 4672	2816	msedge.exe	89
PID 2816 wrote to memory of 4672	2816	msedge.exe	89

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://github.com/Endermanch/MalwareDatabase
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffade9146f8,0x7ffade914708,0x7ffade914718
  2⤵
  PID:1612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2068,7640459341070940392,10602362149711089194,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2152 /prefetch:2
  2⤵
  PID:3532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2068,7640459341070940392,10602362149711089194,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2208 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2068,7640459341070940392,10602362149711089194,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2808 /prefetch:8
  2⤵
  PID:4672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,7640459341070940392,10602362149711089194,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:1
  2⤵
  PID:2428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,7640459341070940392,10602362149711089194,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3420 /prefetch:1
  2⤵
  PID:4344
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2068,7640459341070940392,10602362149711089194,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5548 /prefetch:8
  2⤵
  PID:2004
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2068,7640459341070940392,10602362149711089194,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5548 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,7640459341070940392,10602362149711089194,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4740 /prefetch:1
  2⤵
  PID:4880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,7640459341070940392,10602362149711089194,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4664 /prefetch:1
  2⤵
  PID:4776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2068,7640459341070940392,10602362149711089194,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=3524 /prefetch:8
  2⤵
  PID:3996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,7640459341070940392,10602362149711089194,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3456 /prefetch:1
  2⤵
  PID:2988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2068,7640459341070940392,10602362149711089194,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6084 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,7640459341070940392,10602362149711089194,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6148 /prefetch:1
  2⤵
  PID:1084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,7640459341070940392,10602362149711089194,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6172 /prefetch:1
  2⤵
  PID:1388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,7640459341070940392,10602362149711089194,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4824 /prefetch:1
  2⤵
  PID:2220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,7640459341070940392,10602362149711089194,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6168 /prefetch:1
  2⤵
  PID:816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,7640459341070940392,10602362149711089194,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5964 /prefetch:1
  2⤵
  PID:4728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2068,7640459341070940392,10602362149711089194,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6232 /prefetch:2
  2⤵
  PID:2292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,7640459341070940392,10602362149711089194,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1284 /prefetch:1
  2⤵
  PID:5904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,7640459341070940392,10602362149711089194,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6140 /prefetch:1
  2⤵
  PID:6056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,7640459341070940392,10602362149711089194,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5744 /prefetch:1
  2⤵
  PID:2328

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4592

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3736

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4916

C:\Users\Admin\AppData\Local\Temp\Temp1_MEMZ.zip\[email protected]
"C:\Users\Admin\AppData\Local\Temp\Temp1_MEMZ.zip\[email protected]"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:816
- C:\Users\Admin\AppData\Local\Temp\Temp1_MEMZ.zip\[email protected]
  "C:\Users\Admin\AppData\Local\Temp\Temp1_MEMZ.zip\[email protected]" /watchdog
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:528
- C:\Users\Admin\AppData\Local\Temp\Temp1_MEMZ.zip\[email protected]
  "C:\Users\Admin\AppData\Local\Temp\Temp1_MEMZ.zip\[email protected]" /watchdog
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:1172
- C:\Users\Admin\AppData\Local\Temp\Temp1_MEMZ.zip\[email protected]
  "C:\Users\Admin\AppData\Local\Temp\Temp1_MEMZ.zip\[email protected]" /watchdog
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:5080
- C:\Users\Admin\AppData\Local\Temp\Temp1_MEMZ.zip\[email protected]
  "C:\Users\Admin\AppData\Local\Temp\Temp1_MEMZ.zip\[email protected]" /watchdog
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:872
- C:\Users\Admin\AppData\Local\Temp\Temp1_MEMZ.zip\[email protected]
  "C:\Users\Admin\AppData\Local\Temp\Temp1_MEMZ.zip\[email protected]" /watchdog
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:912
- C:\Users\Admin\AppData\Local\Temp\Temp1_MEMZ.zip\[email protected]
  "C:\Users\Admin\AppData\Local\Temp\Temp1_MEMZ.zip\[email protected]" /main
  2⤵
  - Writes to the Master Boot Record (MBR)
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2796
- - C:\Windows\SysWOW64\notepad.exe
    "C:\Windows\System32\notepad.exe" \note.txt
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1524
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=batch+virus+download
    3⤵
    PID:3056
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffade9146f8,0x7ffade914708,0x7ffade914718
      4⤵
      PID:1008
- - C:\Windows\SysWOW64\mmc.exe
    "C:\Windows\System32\mmc.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:5380
  - - C:\Windows\system32\mmc.exe
      "C:\Windows\system32\mmc.exe"
      4⤵
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      PID:1100
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=dank+memz
    3⤵
    PID:5944
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffade9146f8,0x7ffade914708,0x7ffade914718
      4⤵
      PID:5936
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=half+life+3+release+date
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    PID:4856
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffade9146f8,0x7ffade914708,0x7ffade914718
      4⤵
      PID:6104
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,9323902325957728319,2574246624024256665,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2136 /prefetch:2
      4⤵
      PID:5176
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2116,9323902325957728319,2574246624024256665,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2248 /prefetch:3
      4⤵
      PID:3168
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2116,9323902325957728319,2574246624024256665,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2744 /prefetch:8
      4⤵
      PID:2924
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,9323902325957728319,2574246624024256665,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3440 /prefetch:1
      4⤵
      PID:2548
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,9323902325957728319,2574246624024256665,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3456 /prefetch:1
      4⤵
      PID:1592
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,9323902325957728319,2574246624024256665,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5012 /prefetch:1
      4⤵
      PID:868
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,9323902325957728319,2574246624024256665,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5216 /prefetch:1
      4⤵
      PID:4744
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,9323902325957728319,2574246624024256665,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5596 /prefetch:8
      4⤵
      PID:4080
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,9323902325957728319,2574246624024256665,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5596 /prefetch:8
      4⤵
      PID:5976
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,9323902325957728319,2574246624024256665,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5664 /prefetch:1
      4⤵
      PID:2700
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,9323902325957728319,2574246624024256665,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5680 /prefetch:1
      4⤵
      PID:2292
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=2116,9323902325957728319,2574246624024256665,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5332 /prefetch:8
      4⤵
      Modifies registry class
      Suspicious use of SetWindowsHookEx
      PID:3536
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,9323902325957728319,2574246624024256665,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5256 /prefetch:1
      4⤵
      PID:4352
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,9323902325957728319,2574246624024256665,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5972 /prefetch:1
      4⤵
      PID:4976
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,9323902325957728319,2574246624024256665,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3956 /prefetch:1
      4⤵
      PID:2616
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,9323902325957728319,2574246624024256665,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5820 /prefetch:1
      4⤵
      PID:64
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=how+to+get+money
    3⤵
    PID:1432
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x120,0x124,0x128,0x11c,0x12c,0x7ffade9146f8,0x7ffade914708,0x7ffade914718
      4⤵
      PID:5156
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=the+memz+are+real
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    PID:4160
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffade9146f8,0x7ffade914708,0x7ffade914718
      4⤵
      PID:4668
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,18289354844463530392,13870904973216892666,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2128 /prefetch:2
      4⤵
      PID:2980
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2084,18289354844463530392,13870904973216892666,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2448 /prefetch:3
      4⤵
      PID:896
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2084,18289354844463530392,13870904973216892666,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2904 /prefetch:8
      4⤵
      PID:2656
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,18289354844463530392,13870904973216892666,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3204 /prefetch:1
      4⤵
      PID:804
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,18289354844463530392,13870904973216892666,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3216 /prefetch:1
      4⤵
      PID:5656
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,18289354844463530392,13870904973216892666,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4952 /prefetch:1
      4⤵
      PID:6076
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,18289354844463530392,13870904973216892666,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4956 /prefetch:1
      4⤵
      PID:5824
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,18289354844463530392,13870904973216892666,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5260 /prefetch:8
      4⤵
      PID:1120
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,18289354844463530392,13870904973216892666,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5260 /prefetch:8
      4⤵
      PID:4876
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,18289354844463530392,13870904973216892666,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5376 /prefetch:1
      4⤵
      PID:3764
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,18289354844463530392,13870904973216892666,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5392 /prefetch:1
      4⤵
      PID:5708
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,18289354844463530392,13870904973216892666,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4956 /prefetch:1
      4⤵
      PID:5456
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,18289354844463530392,13870904973216892666,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5712 /prefetch:1
      4⤵
      PID:4972
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=is+illuminati+real
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    PID:3288
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffade9146f8,0x7ffade914708,0x7ffade914718
      4⤵
      PID:212
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2232,4471362404713975240,11501365650098582509,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2272 /prefetch:2
      4⤵
      PID:4000
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2232,4471362404713975240,11501365650098582509,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2324 /prefetch:3
      4⤵
      PID:884
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2232,4471362404713975240,11501365650098582509,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2864 /prefetch:8
      4⤵
      PID:5708
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,4471362404713975240,11501365650098582509,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
      4⤵
      PID:5176
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,4471362404713975240,11501365650098582509,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:1
      4⤵
      PID:5732
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,4471362404713975240,11501365650098582509,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4976 /prefetch:1
      4⤵
      PID:2332
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,4471362404713975240,11501365650098582509,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5136 /prefetch:1
      4⤵
      PID:3908
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2232,4471362404713975240,11501365650098582509,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3236 /prefetch:8
      4⤵
      PID:6032
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2232,4471362404713975240,11501365650098582509,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3236 /prefetch:8
      4⤵
      PID:3564
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,4471362404713975240,11501365650098582509,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4444 /prefetch:1
      4⤵
      PID:1272
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,4471362404713975240,11501365650098582509,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5484 /prefetch:1
      4⤵
      PID:4380
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,4471362404713975240,11501365650098582509,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5188 /prefetch:1
      4⤵
      PID:1252
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,4471362404713975240,11501365650098582509,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5448 /prefetch:1
      4⤵
      PID:4124
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,4471362404713975240,11501365650098582509,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5804 /prefetch:1
      4⤵
      PID:5940
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,4471362404713975240,11501365650098582509,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2228 /prefetch:1
      4⤵
      PID:4836
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,4471362404713975240,11501365650098582509,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1896 /prefetch:1
      4⤵
      PID:1208
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,4471362404713975240,11501365650098582509,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2796 /prefetch:1
      4⤵
      PID:1824
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,4471362404713975240,11501365650098582509,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5692 /prefetch:1
      4⤵
      PID:2416
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,4471362404713975240,11501365650098582509,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2052 /prefetch:1
      4⤵
      PID:4604
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,4471362404713975240,11501365650098582509,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5716 /prefetch:1
      4⤵
      PID:3196
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=g3t+r3kt
    3⤵
    PID:1632
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffade9146f8,0x7ffade914708,0x7ffade914718
      4⤵
      PID:5328
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=best+way+to+kill+yourself
    3⤵
    PID:6016
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffade9146f8,0x7ffade914708,0x7ffade914718
      4⤵
      PID:3752
- - C:\Windows\SysWOW64\control.exe
    "C:\Windows\System32\control.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:1460

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1620

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:6092

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x4f0 0x2f4
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5244

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1216

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3632

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5788

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2888

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:2252

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{5BD95610-9434-43C2-886C-57852CC8A120} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of AdjustPrivilegeToken
PID:2760

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
1⤵
- System Location Discovery: System Language Discovery
PID:3808

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9e3fc58a8fb86c93d19e1500b873ef6f

SHA1
c6aae5f4e26f5570db5e14bba8d5061867a33b56

SHA256
828f4eacac1c40b790fd70dbb6fa6ba03dcc681171d9b2a6579626d27837b1c4

SHA512
e5e245b56fa82075e060f468a3224cf2ef43f1b6d87f0351a2102d85c7c897e559be4caeaecfdc4059af29fdc674681b61229319dda95cb2ee649b2eb98d313e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
27304926d60324abe74d7a4b571c35ea

SHA1
78b8f92fcaf4a09eaa786bbe33fd1b0222ef29c1

SHA256
7039ad5c2b40f4d97c8c2269f4942be13436d739b2e1f8feb7a0c9f9fdb931de

SHA512
f5b6181d3f432238c7365f64fc8a373299e23ba8178bcc419471916ef8b23e909787c7c0617ab22e4eb90909c02bd7b84f1386fbc61e2bdb5a0eb474175da4bd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
24796e94f34b4507a581a5bdccca86a7

SHA1
817f4322da7449806e80c8bac152e9cc6e3cb64b

SHA256
49853d54fa7d53305e1c52180f15e5e0a0ec92a4e1d4177c1c6bf5e4db8f7bb2

SHA512
5265123a98adf29d2e1dcf6c8edc42b64e036702b5e8ebcd90ddb02e898be77721c341ebe7feb3b3943197b04e95395f8ab841deddadce091a568d8e0763463e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e6b08134029c86e46f7511f971fd6fc6

SHA1
1123419b3c9368ad29a2137cd3056a567445f0e2

SHA256
384c9710adf0a455f101050797b05d68c9d4c5b6cb9136e5e4184c0d25e5c71f

SHA512
8d00314adaffde25600b75d0b4ca46b4cd9edfc02c1ce9b142b7fb5114a95768f38ae3656fffcff203a5dc6cea86fb5c5cd8c06bae16729b5f4857ce0ce24770

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
2fa38702a06f2c277f47288703904b65

SHA1
c2c1f3feae4aaade85f1c712aa652e34af74c97a

SHA256
cbe73e1d91243a07cf5790e4134ac6249a9fa69790c86e42b4f854136f54b362

SHA512
3e6b083d935c63f332c44ebb7a86aaf0cf87f78b166404a54350c3b53f79efe75f192c73ec1818fb8c577323b71e9c3b328c142924a93ba33701dcf85505f83d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
aa56a4c230ba9c41b8aed6ce11889c2c

SHA1
37752b28407a087a5a753f730b6b9f8ff2033906

SHA256
290ed6ef66b3125d3a62c878cc657a593ec4eb9ff785658e3c2c22de7e39cc3a

SHA512
2c680d18da115e512a45c864a735ab58ed9dc55c5185765030c86bd5e9b9dace55eced24f7386c21584867d42de67fdb2d0927def31ee397a58e244eb87f3575

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\4cece851-0734-43ff-94c3-d523c084bb93.tmp

Filesize
1KB

MD5
baf9c635476f7ea42ea749f72290994b

SHA1
56949e700489c5705cf5723ea42a63cc96bfc2fb

SHA256
e7b78aef53044dab54050acfc7cc082bc6af28dafde4c5a9216ea8d2a5737eda

SHA512
af3300319853581799322ffe224a8963cb347c38713fc72fcf8a91e8ba0785264f3ee9639fd3cd149df1ec7db1e55f5e588707b595a332ce18daf66423e2e7a3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\data_0

Filesize
44KB

MD5
2c5b38a552dcaeaef11a2a75f049b24e

SHA1
f0de91bc16f313a9a5cffa25961f5c3c5557ddd8

SHA256
61074549b4a3ea498a310fc8eaf92830cb68a537c68e16d05da726a5d81accc3

SHA512
673f3973200022f4b288c445a7c869faac1861e97c33d14da08c7d0682c25f32d79e6fa48c87b8570bda4c1e8c2a06db326ef3d628cfb68ba81fbb24404f15a3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\data_1

Filesize
264KB

MD5
0a024375a3f7599f6e83870dc7f99e03

SHA1
378c44b289844f7f9a5be3826ff4a471460ccdd8

SHA256
ae8b8cd053b93e71ac1cfe520185ff5d71170add439ade58e60f6391d3620f89

SHA512
dc524fde9517af6078ed99dbe3c15664902d09bdcfc8d1b7c1c79e1dc2693a32457d4fb29702e1f653ac712fb665bb0968c04e01762e2f1764b6688165c81322

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\data_2

Filesize
1.0MB

MD5
7a8de18d8bace3d311b3835391d0841b

SHA1
8a113c0b7841171efc2e71c09c0e2de1773542f8

SHA256
6e2f88621842c47ae2625301b108057d904d20fa3e29eea3e872a753e97b9b79

SHA512
f3a1a11580fceb9ce52c8ff1be6ebc8c7f3537bd1796ac9fca94bd0cb539daf0005473d99bae34794f2033e668c52ea6ba9fb86f906a4795b78e0ffac9fa116f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\data_3

Filesize
4.0MB

MD5
d68d4b02ed59373934b6350ac7534eda

SHA1
72bbf063ba41856fad79714f700f85f12ecb0802

SHA256
032988d9c516ca3e478b02ae5ff290b0d6d82b9e604423958297c262bb79a5b3

SHA512
9161f6109c96f7434ad3053da94862c9a4df2a30ac4f25ade2b204efae6824cc6a3af479bb85ccc9e1bb2e0797ed3c048a6df497a4b3493fbeb3dfed1f17e128

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000016

Filesize
209KB

MD5
3e552d017d45f8fd93b94cfc86f842f2

SHA1
dbeebe83854328e2575ff67259e3fb6704b17a47

SHA256
27d9c4613df7a3c04da0b79c13217aa69992b441acb7e44bf2a7578ca87d97d6

SHA512
e616436f2f15615429c7c5c37de3990c3e86c5e1da7d75a0f524fc458b75d44a5be1a3648a628d63e1cf8aa062e08b538f2f2bc9c6a0b42157beb24f82c571d9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
3409686b4dbb2d0fe8491bf6f58d1307

SHA1
af1732766d0793ec7f4f3eff6bcf272d112aced7

SHA256
c98a65b2cbc7b14e2643fdda6067c093064b753217d02e7efe133302d5b77067

SHA512
8c87f14041f9ef107d06bb67ae1bd456cb49c05125689c61e3dca4aee1e24f1fb4aa519b2e46d2da52e9685cd286754649bae5fb4e22524ea70a489955a32088

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
3728e17a0575ce769c62957a6a89f720

SHA1
836f58abc6971d77122fea3d2e53ba58d3b95586

SHA256
874ef1ae26b92fb38d533ed0227cf33b098b9b3fd8755934e8236d289445f5d3

SHA512
da97bb617af25b961ccb7c829151cfb19d1929dd11c6e961fed0af57419924da01693f050cbb9b8a50936668bf1e8775003901baa62eb36ba2569e13aa83a138

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
fe7d412eb5556c505174616a3a4b51c8

SHA1
95093dd68c44c40243f5c0f7a3ff23d9cfe9d944

SHA256
873840ab7d7af269546b5b59dd84603a31800af40fceb5428bd1c6b0b4b70e2f

SHA512
2f13b05fc09e8e57c48d8023b95cd9fce2a7b913bbe2950793869c61c4232c4b04d5bbded67ee71732b051738a84b7830d146dddbcb56f3b803f9dc2b1990866

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
23b0fa9d55adc4b6511b1dfc572ba4f7

SHA1
d32fb507a774a596bc327008cb41f7c0a40fb552

SHA256
9d4bc960dec3cdb4af960efad05a509b3833b4938f6046f3faed89c72d85f67d

SHA512
7bb1de747c342477128b5057b41d5b98d4367f8405a0be83abb8ed9fa70da4e60b59f6a85837a8249472f377d084f105d487613eff131f0bc6f543edddea4343

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
f047b034d87c3d094251e11c63be25b1

SHA1
7449b3f11bd0e809048e1c32a8b88ab5c0e7d3c9

SHA256
a5f376d23db3e8ea412e3a78b2fd30cc3f28f73b386d8be5000b0a03ac0f1726

SHA512
abd7ee7c1cc2d004da9ef3ae1f67bf469aa69e70616c69ca0c2fef4a44afeac9c314f9ac0c617dd60d6b2aa81749642a41874f7dd97c566df34f0af9a7d18b00

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
9af1e19b05c414ce87e85a4a5ee87495

SHA1
059b93512cd1977e9d17e344aee99cd2fcf7665a

SHA256
f5938440e3ef4e7b4c1c22a1591eee48ef8c0aa51d29e83d29ad296a5be3d10f

SHA512
796e0246e5d96bcd072b686dfc2494bb5a314eb3da1e82875c698dcaffb3bbbb50fa3e60aae8ef38487a49ae88a3333096986c1442c45026fe4dcc125e1d04f2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
752f62ad1cf661511c995076ebaa96ed

SHA1
9a6ddf8120b62c7cdf24eae2a529a9387fd0f9fe

SHA256
4ab845aed9fd7de3c2b83ed630810115ff5759d054bfcd084a7a5584a0aa3696

SHA512
abd335b3df04608a80a6f60da4aa49a68016c75651ea439eb956575be048bd99c6090b5f43c55016d13a8ac88a69932db56b1c6356a8ab36667b41a04e916e65

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
43e43855605db84e43583cd967418fbb

SHA1
03fd8d8ccf64cf8caa4792bdef6282b8fc933a3e

SHA256
5cf48f71bc1595a2d6f679044bfca090a9fe941df2ddb5ff718594db04d9631f

SHA512
5e28474b594eb5cec30d2788f4bc752ef7e3e5e8a21cf6469b4b506078ecc1ae25134c58cc54b8fba8e8a0bbc45d9380b35fceb809dfaf3c3f75a091945c8abf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies

Filesize
20KB

MD5
39c3934d44c011a736cecae9bb9e148c

SHA1
99cf7f10e26a6ceb6322acf9df423e7967d404a0

SHA256
85d884ea3d36e27099f094140a2aa2b4d006450d99365b5e929d3085682bec51

SHA512
988ea306b1b5734241618416f475294d579bf9dbb45173899436b5ac63355a9d1ebfd5616d0160191df1e502709f092bccd89f664592bc3827201694fd532de4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG

Filesize
319B

MD5
7ab36188589ee2075cd3b2cc65ad6113

SHA1
80a1b934bc22d1df6de7c8af61515d7b55042683

SHA256
fc6f8cb841bb12ba5f4c919e099cabdb509ffa66b76a0fa74e74def30bcac404

SHA512
16cdb27a488e0285479b4ff123eeed16032f727cdc73e67a513a7ecc2b508dd1ae89156dfa651621a1e194f8182827634780642eaad393aa45cca92e8e4fd820

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Favicons

Filesize
24KB

MD5
80253fb577c76d194025abfdecc096da

SHA1
dadf9b5215d152b40931ae553c66e6910f1d0dd6

SHA256
3c90e821be451fecbeca013b7c8262f971db90f9897c43c1f311c4249a84d41b

SHA512
145afc5d468f5f705dd602ad10522da6646a432f1b3435114037d219cf164a76175213371da0cb1beff42eadd7fc8ee3056d8a4eddbce63e512f01f44cf2bc46

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\GPUCache\data_1

Filesize
264KB

MD5
e9aba0d9fa04192b91a920d31e5c5e89

SHA1
e7c964e4cb122328b0b7f29b8a38173114c52153

SHA256
e84cf96c00e8b5dce3dfe4936a08657ea3caedf45f2d01c07ac1f763b4d6accb

SHA512
bc6ff6aeca269d0d5fc3ddb3c3785b3f6b20daf940fd961549ef6c77566029d6e454dd3a12ea564d1781145ed335147ef115de867281bab0c7cee95cec4e62be

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History

Filesize
124KB

MD5
d507c90d30217b84270bb5d1870c50b1

SHA1
4270d0408c5a12eb07382057e0dc543f576034c0

SHA256
b939535de8f8550285895ae1670e9fcc680f19a30bd2634fab1acfa689cd56f3

SHA512
cc1f79b1e9588b14071c1b4b20d79eb7775610773b465ea578dbfd4b811c5e11550a16d60f7c8a2673cb980dcf67868724487aadf9393db2c904cdc11981f195

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History Provider Cache

Filesize
1KB

MD5
bdbc5b3b15cc59360ae9ff76c3b244fa

SHA1
336dfe08c4517e86a8728ed519f11156b2a9ee3a

SHA256
00f91dbd4b73d6ebb355b525c40c44af60dcdd632217999ad4fe3911a61bb03c

SHA512
5a117693c5990ff04e033b27286eee11a57cd03eb53a46c57a7d928a1b68ed77b998b8c73130f50c87c4b4980ce8b3abee829484c40c43c80421bfc111039ff9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log

Filesize
16KB

MD5
5d6003753f7700d15cd4f30df01feba2

SHA1
f5ddb85b62cc39df40c77ec43c9afc75c171152a

SHA256
d065f226dfe70d0a530583de74d6e2ff461bd33b8acc267b24adccaa5ccf68d8

SHA512
32d1fe64e95d2cbe0ada9abe936d8a3f14638a9fad6bd23a8cf260aa87da4350f6827e5efa98de1e97f245e4c245aa42c459f711a6a5266cc466642275d1f40a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG

Filesize
331B

MD5
7649fd47404a19b49db6934f64e77400

SHA1
5d6e801310e13ba9ca60ee1cfc0c71a57fec7f74

SHA256
83798b00c6ea9ac52d38b734560feab7c01b71faabc15d115a4e3463a4d1cd94

SHA512
c6dc262c896ee645da6d3068b48d2b39f2e0a287f8265983d4e1d7589522f91cd171787523d4a7e3b34e9180179396d674fe908a4f3182e0c7129977c5ea63d3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
678B

MD5
e9a33488868126739d93df791fdcbd77

SHA1
33155104df0a833081cb09eb7540f2fbca5cce93

SHA256
ef692e09d1e6c74c7c54f4bbdb5745d0cfc788518297b98025b59c3162c86de2

SHA512
568c871dc9a6c2d3672e242e42b9757fcff5862a83ba1e8d7f37568891321c76e9b9cd850b2ea78ec47a4029bae9ab7b3bcdaa5e4a0143081be2606e59cad93b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
4ad410b8f802098c4a9dd85c0ca36b9c

SHA1
007db9b01f32863d5c865ab0bcb7aa7bd812ed56

SHA256
b7211a2b545a67bc391ae04f38cb75d883b9b07d4ecb8477d2593936808efd4f

SHA512
5221f433fe4a4c88d7dc70154a8e2375302cb888b8da418d36dafd22d5194b164735941a6a2a23d607d5dfa58384cb9008bba69784d25a72dc7d53da4715e58f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
5ef86152262b51be94eeee6af76338ad

SHA1
6013387c0d44531bd7c7cab21ee0e4b7fafa573b

SHA256
58edc7c18263f5e46b97bed665e9c4ead507d586fe31b77bcee0109d949dd194

SHA512
64a7a83767570449216633a84462f703c44dbd9efbbefd42859bd7f3d58b0abee294201ba7f2477edaf1b38e0c1c655dbc133dbdf05dd057a6d4fa7034d6ab0c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
7e5789a0b7354e5f9ffd397b0abfdd6d

SHA1
8ec91a678c2024a434925854c751389fd277a9e4

SHA256
85a0843081a17471dc1bf6cd6f654257aade053541638240aec71378d328a282

SHA512
f04308f28d266b99be0fd115665b0f423e5e602b80e0d0d8ec61cb7b5467c7c275bbc513f874387283c2f02579fc8225de91ad8a0dbdc25d40bac591126ef5c5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
90d7db186c52da11ef959017c449c8e7

SHA1
2e603c2c1d9a167b528bb2a94f55a07bb90ba623

SHA256
6d405af51bbe6770d51737c4ebbb962eb62e31850683ac7d6fd89f1b8d3aa8b6

SHA512
4c38eed4155cc8666c1b3b4a3e7c81f33b346094be4997122a1b3f2d5b78c8fa3ce1469b368b4aa30e6bcb3e7700ab1c3e21a2847feb86278dc93d394c380c3d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
0072e6dcc297240c4ca881e188cdfdc0

SHA1
d80cab003be873701c3c49b3349682c6e084165b

SHA256
76bd445d6a5fd273c01edff6115a110925ae0a038d222216cf695185432668bd

SHA512
51abd7c012a99e40442858c3823bfff7986df91bbd882528ac48181c08e30f600ec3726eaa225a5e1177f2df53a0b68ffc0ae927939844cf23b4023cde4685c9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
1ac54477234c44f4814c8efe8657269f

SHA1
666c2f0ad8211f74d8f02faa2a963a4e4abeaa41

SHA256
ebbc41005ed894648bbf39443e1a827fc98f552134bead8880ed8015ab761b2e

SHA512
013c99b80f71f3175e730418a8a208fd22161938cd1b956e46c555921f895c3f5f3f07559b6f38288c629a20be29f170d6d67555ac4f74deaf3c3608c068961a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
a65b9eb959a98fdf90e2760110bb4699

SHA1
705aac85b0d9c8e8b6a9ee54eacf18815938f3c0

SHA256
6e8658d384ae4194ebdc161f7efdac71e398351579ace7409380225bad60869a

SHA512
92c221a4160c258630dc5da8d28e245d2ad1ee4ab5b01be1f012c3df95ce4f22d172841bf6e5233e922c3b7b18bc16d7046ded05eba97590fb230263850436fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
bb72d1b5efe4ed4e3a3d731740d9da49

SHA1
0c56f604f9e1688118af4892c5561647a6b46431

SHA256
0d13a2bd1c75fa9f0f1bec4cf9d38f221df11ac6772f529a8b4b62d700171320

SHA512
2e0c2c1939b64eebe782697ac72c0087d9357c44501f2e9e314bb374d1ad87848a704c148d2fe317766646acf09c38c461bf816ffb1a0fdc4ff06946b8f4b4b4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
430248f6c04af4e10fe5a852c240eb64

SHA1
e1e3821f95f3d68a11bda370e2dc46f7bea343c7

SHA256
c0c1908a4b01517bfbdaa97c8bab903fbcddc5923e5f88392d261de664c1fe6d

SHA512
6331915118e2dba472efc050dc9802f894da257eaf5cb7d52c47b56628772d3620b68c5a4c6476393481f11fadb64f0b53f11dd19386bee596ae4fed604b117b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
42c7b0d7c84e5de48b6c757b0c089c6d

SHA1
f977b2a33cad5d3999fff8dbf32ed6daafc078fb

SHA256
3f55dbf6f94e8a7449517b9b93509d0dc9b6ee51b16fd6b9aa9a558e44245f9f

SHA512
a44a9966b2ff4c4d10f7f33d014f17f2679531d78aad8ca764f578641d4cd9024811edf66d3377e239ab9dd20b9ca01c184221fc7f07573adfc06eab68fd659b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
6037039cc1ad2dcc6eb38d08afc23ebe

SHA1
094e0c5a0b831c0746e56e426b1bb9215576a118

SHA256
8d6a3e549a2b1c0e029d0e26766c92f159714ede36e9c60c3ede4663a78be11c

SHA512
b0ddd2dfe6f89077eddbf813b63cd5647305e5b8fbce05260f7355c073069f64c9ecabb73feb3aa893fdcde67d26d67b94a202652f6abe534ed600f21cba9301

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
b6d03e05bca842b460ffd01f91b6295c

SHA1
7e22ae209b1a87d356387ed574b25b1fdf82858f

SHA256
1a0d2e2127a8a6f24d939abd3957c041ee37cb77ed462758b5afafd4a609b106

SHA512
591a95cc9424fe6242d51067de1100861d810d51f5998bda1f819292cf71ea76d514fe046486c3812eca9bbdb80e98dc513d4cbdce8e0534b65f7027bd0e8d66

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
4f0f5dd3ae5bd41418479bb683860dfb

SHA1
b7b4d85d9850efc39bec01cf4c470ab1ddb1f927

SHA256
6480cb6fb2da8cfc3a29db82e7ebfd400a5ca303a62d6913d0f0108a6a6dd13e

SHA512
bdcb88c3e9ab3480677004104c5d5b34db94c3197853fca93b1cd885cf5866a0c1289e5b32bc57cd6026aef716b07f01b818099726f63b54cf020b9acefac139

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
1c74edfc716d7d2330714b3737308098

SHA1
146e6bdb36989beae3e71b2a2031782724a63b53

SHA256
aeb8847b9d39a8d830143c9fa7570e0b7606f482a920961b05795e36dc12a240

SHA512
e3a258365f24e2bf14157d4fffd9a220b6847d62f33723a3855582d9665f15d047ed77c1b475a3d62d551589e151c1de87e7b28105ffc52172727dd1f219074e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
cc8b111b1caa9f9caf3f890a3a630782

SHA1
26f491a7c75da398584ec3159f16ef4e86811c27

SHA256
6415b2fb5b699509f81a8f9412cd4b79901bf2055bf75bcc6b67dfcebcb3385b

SHA512
97f0dece879334dd430022b580a1065aef7c00f62b87c414e7255134c8592af54e219f093113c38e742aeb4decb5bb52fdb599f6656a17797f285c321b1bbbbf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
ed1b064852a7be88704d6f1b4e48d4ce

SHA1
ee83fa7aa78080a02c3832517b6bec139e55a3fd

SHA256
cb690018ffab74998979e23d9e846ec9addf90d6943e684ed63cbb4199bc2e6f

SHA512
5bb06aca62ce736430493c0d8532fa9cd98834402ac1538911a2745e545838bdc7c508715c2cd53095a8e5fd81883184a9d0f49ba2145a7a790c8eca2885258d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
c1451a6b5722e88d76067bb987f02c7a

SHA1
71d1025098336d38957a41884666c5220c21a9aa

SHA256
f07e02cfa4a495a6f753196529de5c8782f483f21ec15d414e70095e9d4e3333

SHA512
ebfda74d8b0115eb3db2be76119d4ba0ba29340af2c383cc501ceff3dad9c9308c004d1cf19ebdb434e830154bf1c8b6cde614398574a75010bb8224375c6a13

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
8cc89cecf99ec1a287f0288afeb1504b

SHA1
fc263f94b7ea29ee07d2b0bcea436f25fcc71896

SHA256
735695ed749c6d2252be3406bef95fe0a68bcaab5b387e2d04676fdc6fe6b188

SHA512
1ab5c71af2c0ca870c5cb8bc0c6ee916907f27666f43f7858f46a28ba41f24272988c6f1691bca36ec35a7959e25813af2a6bb717821faaa13f20645d184cc98

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
31de20926228c290454f37724ef320b0

SHA1
860068f93df4762075d003b3027ff6972997ba30

SHA256
e3f04e1cfa985864771abbb7de53743b05960bb062ac51d3f523f6e033e6cf98

SHA512
e7bc149f8743a91f9efbe09d4e9d4f05aa3250ed7b419c6744c6178100d792b00f5c808a7b1d6f58e5486cc2d6524e138bc4652a600239c96fa6b9b77bcc33db

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
52095dfd23afa9fdecd09c2c59add62f

SHA1
845effffeeb408d11c8d88415605d6f9b37c43f9

SHA256
f6910b6287ce6a76c45b4821f973b5f5a91c29854eae35912532e878c08e5f82

SHA512
93c128266aece51a388721da07c130b8e3c8bc6aedb5a834987e168fc93ad41634be48157baa34c00beac6dc40909992f16dae8284d5831df2f972003675916b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
5bd727bfa7a8a94411b71e10b6ccd1b4

SHA1
90f20079ec4265a65e7f5a7b529bb5d8b67dc0ed

SHA256
11133d4e12ac5d1d9a6eacdfb6c4dd1f5483946f2079cc5244998842eb658824

SHA512
046fe93f9a285ad44230018cb2344293db13b112d7b9d40930dc9dc6deda0503418eb1cd6b516821ec882b35e3c3cd90b5d957582d6ff2327a184bd5d01240c6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
ac7a5e5e6792ebc77472aa20f435f3e6

SHA1
26d632a41c91d11988416bf568e9a067b2436313

SHA256
d37b362c1bed6a4a7b6feae6d6cdf55238ab3bb29076f8975338e8b867f57415

SHA512
e62fc3fbf338e349a072c3fc00d56ab347dc48fcb570b26314fe1f0142e6b421c16e486105633d8af081ffe346eef33b96baad2d72af6ee3e08c72a94bfdd820

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
2c8bb5f60dd8f1c3482cf0de84455af6

SHA1
99df706c90e2d90e1e7e32085e5bbb0ebae65af5

SHA256
6b755a03a9c6a6dec9184e87c731234ed7704a426636a6cc1dc90ec1e0ea6773

SHA512
f12e5dc3b5d591b90ffe569367d6f4a0e62f851ce2311b7aecacd91a26d2d7f2b7b72d5ccb5953868dd787153e8420a0d1f8e3e7b6ffa171407223aa641ab584

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
3cff973756bc4e4d58bea11a2f8ecd2e

SHA1
fa6e0b1972feff7e7cce0afb9713af725df26f51

SHA256
49868bb47a648806e25e9c90391fa8292aa347bdecb82c92c205677f4720fb74

SHA512
8e5e808d86b89612ba607285bb840ea743b87584fd2de6c61a72ff9630816a9a5100d0d7cce67ab4f1894dbad674c6a09879485d3b6b86e25e8b459ffe436d9d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\000003.log

Filesize
2KB

MD5
f5de8408480fd5315c156c462989b186

SHA1
e344c1ab71a1b90aea3a5885ad572077791dc30e

SHA256
b0471b485d04f079af4646229a47777a6ddaf693680c32935003572efb08aa70

SHA512
98b591e1e874a7379a70c1594bce8ada6d9658325a3681a5b6a0caae911c6862fb33a9b1f4665311aa40e3d6c270f63c3a55c165b882d0ce5bae234e35b2f8ae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG

Filesize
319B

MD5
a76fa9f47caab11c80a2fb3c35e01fe3

SHA1
21f30c7b2907af5af9a3bc4955c11dcd8e5ead85

SHA256
c7bdc6b65a7f6bcf6ea81d2d9c958f8dd10a0a485127e653f2582c9e189f52f6

SHA512
34a41c9f6402f14fc2a6232f2557a4ed9bb89ea21aa35fb69c27d423fc963bf9833282fb2c063bc148621c198bbb1ac67f68a4b036e6979707fcebf8388433b7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sessions\Tabs_13368653644276142

Filesize
12KB

MD5
432f688fe649ea89347c7865c4058c29

SHA1
dcf6f1e6eb57235b35ee211b4a042b28b315e6c1

SHA256
f77cd95a76fe7f6a7fd5b5e710a76e81a21d2ffe694846d2b9efee7860b4359b

SHA512
39a9598ea7d818347e2bd2865f63f2046b44390db0df2786a96fc8a8e8a1bfa9578ef4eff23b1b38f851fb683d210103bc61deed03ec17f53b34fd238cc2374b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\000003.log

Filesize
184B

MD5
db6f879b2f427cb10dedab452b3bd073

SHA1
f45ac2432ba9562c4ddc9b6d6ae958ac2c25d9f8

SHA256
ff8d7ef63f44f31d879c3b7693a7b66427ef9fe88d972004e94d77168b58f615

SHA512
05fd30389a655c7598d576dbffd60b5f6179d6cdc4fa1aab71ae2550cb081bff13c9046b0ad5d4078d4ff439b265e7482bb8b3061eb99970f58511507df17ef7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG

Filesize
347B

MD5
8d549c64f73e0efc7ec45424fe0bf712

SHA1
c4af0e7daf9c398863262cd0c47b13352321dc0b

SHA256
7889b9d8efd8c98f88e07d1b0cef98c5c6edbe266e37e6fba386aa0f4493a2a3

SHA512
c7cc142184aa726f73f1a9b5058e4cdb18f7e9c38ae84e5597170908ce03a34fcb9ddb4de040d471fca6905e4d95daf79918249c858b580ee681f7f71c6b268b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG

Filesize
326B

MD5
4eb27a23cad2dad22b200e543a1aaf9f

SHA1
1317074caae702f606127098b518f634b8174f4c

SHA256
9ccd822e3afa72d6af2a62feb5376caa4e7230d7e8d3ac7fc0c384d2556735e9

SHA512
0a31b466d1cbf25ad7e0e89dadfcebc49d675e330411694af79fea20a72ce495bf6c525c292a5a55fc6fdb13cf50ad310f5a96b0952470a669fd8ba7c3381355

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
23a4236f0d9db6de069f5d5e9f16ff5d

SHA1
5fd376466762287b805af0e313ed9aa3d083ec7b

SHA256
12b0a1aa6a9c5bf901d4a30a68d4fff048c6841fc327dde70a7fc39e7c9c1ccd

SHA512
8e882cdad99a1e053ac023729300dbe711a34686b313d9aba33ac08e47b73e1d375251a6188128d3065ac25b1652d0dd347d68f3fb6f56175d35478d9ab2f47c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
af6d6639f3519aaf773899644d143141

SHA1
4ef31cbcb0aa95e4d6f8e07183b4b704c52d6464

SHA256
79a387096124f1c61c4428ed034fc3592b4a1c720ad455fd5081ff9ccd980518

SHA512
1ca75f0027613506162f200a13258217f21d17eb5f43ef5bbea6207a8014d412f6123aeb481299659a7a73082178235b75cde435cc3e67dcc9ba7563232153f2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57dd9e.TMP

Filesize
1KB

MD5
b380f786393fc1241708940e52b6a0dd

SHA1
28a965509591240c69ba946f2c7e566403b09481

SHA256
7532e6af2f7d47f46dcafddd055bd270e5e0adeec718eef401f2283dc0da6aaf

SHA512
0f13059400a6a7a04e8b604ddfa4999d4aafcdfbea3052b562b2b303f3916e65dfc0da7f024b73cf99190ee736a3a67fe9dbdea1de7314e3129f94ffe81331ae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Visited Links

Filesize
128KB

MD5
4846d7adbdf46e32952b8775435196d2

SHA1
62824eb9c6254100f5d35602de53919a9b17dccf

SHA256
fb66dac49b0d309a065d550217ae9f54b386db5ee2ec6cde9951b434aa6e5aa0

SHA512
684c2c36704f29c2e764212398ec4d5160c261ff0f062150925700437643f3e4ac71208cf8b1926f9dd7623125feb97ec2a7ada54fb76878fe8ccba8b4ce0eba

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
aefd77f47fb84fae5ea194496b44c67a

SHA1
dcfbb6a5b8d05662c4858664f81693bb7f803b82

SHA256
4166bf17b2da789b0d0cc5c74203041d98005f5d4ef88c27e8281e00148cd611

SHA512
b733d502138821948267a8b27401d7c0751e590e1298fda1428e663ccd02f55d0d2446ff4bc265bdcdc61f952d13c01524a5341bc86afc3c2cde1d8589b2e1c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
60e3f691077715586b918375dd23c6b0

SHA1
476d3eab15649c40c6aebfb6ac2366db50283d1b

SHA256
e91d13722e31f9b06c5df3582cad1ea5b73547ce3dc08b12ed461f095aad48ee

SHA512
d1c146d27bbf19362d6571e2865bb472ce4fe43dc535305615d92d6a2366f98533747a8a70a578d1f00199f716a61ce39fac5cab9dd67e9c044bc49e7343130e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
589c49f8a8e18ec6998a7a30b4958ebc

SHA1
cd4e0e2a5cb1fd5099ff88daf4f48bdba566332e

SHA256
26d067dbb5e448b16f93a1bb22a2541beb7134b1b3e39903346d10b96022b6b8

SHA512
e73566a037838d1f7db7e9b728eba07db08e079de471baca7c8f863c7af7beb36221e9ff77e0a898ce86d4ef4c36f83fb3af9c35e342061b7a5442ca3b9024d2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\e761ff74-c38f-43ce-81b3-9a0d1b84f568.tmp

Filesize
1B

MD5
5058f1af8388633f609cadb75a75dc9d

SHA1
3a52ce780950d4d969792a2559cd519d7ee8c727

SHA256
cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8

SHA512
0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db

Filesize
72KB

MD5
eec696be75ac4dcaf2c7fd237c23466d

SHA1
c27cb8047bb9a229af92086e4732cfd5dba8533f

SHA256
3b5c9da4b5ba76ec0cce74fb36b878b450fbae88f0c0339dd67da9e1c80eb580

SHA512
b2502fe9480403cdfb7c453ff728a295f45b8913008339e6a979cc6d2f71a2208b4ab2eaeb34871a69f2b765ef5839713fa46d72250684aab9c564e6eadb6c45

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log

Filesize
3KB

MD5
973f5a0bb85d708cbf136a87b83cf4a7

SHA1
19df05c5c01c5fef3bf55bffa2c7687567cfd7e6

SHA256
ff829db7e040c75d7049aaa4dc66433976e8e90a85e7638aacfe464cadbedf6d

SHA512
479d14b7e9fc29a3042fb79ffbf8d51ea8efa19b8a414c874a83a8e4f3335c37bd1adad4ae0ce609e662c847320a7a9bc404bc25367809fc39dd31ba58da8c99

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG

Filesize
322B

MD5
d6988e5841c3f03f3d9e66bda44b7a06

SHA1
beec20693c6f1c73aae23373405eb3011747ea9a

SHA256
471277956f72ec116772b7ff5cf82b6c7779450dab3a895b8e53d81087587fb1

SHA512
c4f5df6609e48b1c8ff6e01f2ede4432eb8401247383b3043fe2fe17b4b4745d743ef9a98a68e0fac83631978a39e467674f1422ec71622022088308cd2b7871

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log

Filesize
565B

MD5
07f86c9f5a68681b8bb66766465175e7

SHA1
7d5798d6104eb4275aba527ad6247a3a95cd5116

SHA256
15124baa9c6a5c9b77c2d33951c979c270e7a2f86167ef06b49a1cca2cb482b2

SHA512
cc9d33faf2823ae96d3cd9fd414e088d00d75f9a4b2bd695b9f5a2b6cdb10640807599846167fbefea6d4ffb94f488d552517a6bd1d9fe029fc20c8cd4206b92

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG

Filesize
340B

MD5
3bc42b18e2b517411552a1c5bc3e2f01

SHA1
7a8206e1de4c3aeae3174d827a4902287b97a25f

SHA256
f993300b61b40834b51ca30cd94b7304318e387054eae0a82587a198e2d3bcb0

SHA512
e187d58f7cb1793849e2799af2b02c85de4df026713ee22165070909799df4ac5e935b01435155c1ad5e17659f594abe59606a6f675c7f9c5099f081611eb630

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\data_0

Filesize
44KB

MD5
6383e665dbb52e4334c14db9da6a82d7

SHA1
fe3bbd69b6f926bb5661553196a106f08c32d3de

SHA256
1bd577937625690943e68d5ad54a5330016b25cef11f02b7bb13ca124a9aebf7

SHA512
3069da7d53973941ef9b0baaa124383d9b6fe231728a02666b099b196428ccbf43f80932c87cfcb287c83e56372a3a7990ba5aacce6a8f9b4da0b7a0b1c76235

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\data_0

Filesize
44KB

MD5
b89bad63a22603a47e6454150d09322b

SHA1
10159664d5020086a25853e81346a57b65384b6c

SHA256
4a75fb883553d49d6c88cb190454dced2e92ee914c673b1b6bc2bb1cf1fe4328

SHA512
0ae779d1fc341a56e1e14e8a91f501c7cb5bafac1998e1284f101958a0a3ba80105d0024570886b6f248bb6b18a89dc017060d4e88969ee2a98ee5223f2bff8f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\data_1

Filesize
264KB

MD5
44a543736d0cab509cde0729eb77099b

SHA1
761ee1495bb8e9091f1cb639037ce2a4168e9829

SHA256
6007ee6daef46e1e4e6d9c8e10d80828305817e42d1199000485472a436ebdbe

SHA512
f897f5157fd19847939d38009cda095f27244fa3fbebee6fdc1b6cbd1ebdd1e59f6ca4edd9cfdeace7d3e9d0055b9485bcebd153589b0a6ba72d056560de5f27

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\data_1

Filesize
264KB

MD5
899d453ba8277668dddf6c833130ed48

SHA1
18c9d0842cf6ca5041af8654577a7d82612a7eb8

SHA256
80d0c886cef156557fcfe8933d9302c467bd2226b356ffc8432d50e39bbbefa6

SHA512
756c5481368eca49a650069d6d34fcf17f99d531773bb7aa8289ab2b32399f31df823017e7549de7d7471554a93016860198e1116aec26e6cc59109f55f2b2e7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\data_3

Filesize
4.0MB

MD5
5e167f8d4242795f51c962efc81f2632

SHA1
119bb23b931328416b933c3f18cbe307bfec8538

SHA256
9fcde6b53aa8178ea969d9535f4d46acad9a580091625778877bc25a1b80f81d

SHA512
03359c31de6e8159282ca9396a4b0989c1dfc57a40ee5eaad28235d39cc022af08fac1b5f295019487cdc2114c014f5a3ca266de203958f9b8567309ffbd1808

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\f_000001

Filesize
16KB

MD5
f55234db88c6538e3f4ad45c114435f1

SHA1
c4dba9a32f50f2d9a27ce81a1d62f7587751e6b6

SHA256
bf139ca7efd187c36f3ec33691f427205a63ca2707af18bc25430637928d713a

SHA512
8a621fa5044977bce987b8259dc850faf83f4e82f4df1a7a689dbbb0b9b065676842f7ac462b77f66c3ef892c3272960bf5de4c0dd4f02e85430b368867feda3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version

Filesize
11B

MD5
838a7b32aefb618130392bc7d006aa2e

SHA1
5159e0f18c9e68f0e75e2239875aa994847b8290

SHA256
ac3dd2221d90b09b795f1f72e72e4860342a4508fe336c4b822476eb25a55eaa

SHA512
9e350f0565cc726f66146838f9cebaaa38dd01892ffab9a45fe4f72e5be5459c0442e99107293a7c6f2412c71f668242c5e5a502124bc57cbf3b6ad8940cb3e9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
e83985819381c6c1e6069f89c2231cfb

SHA1
d29c22b0632269338e4e37a7ece7d68c1c50b52f

SHA256
fbe099fbffba9f0efd20486c2e255ccea766786888c98d7f0e9b3fc71274f019

SHA512
ad92d03c382aee30c6ed0ca971117401f2f7667f5ac9c019ee501a2670360033f1570fc4486f67b5708e12d951eeb8aa14cec1cce1a6168a2bc593aadbae0d77

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
714036d1d0fc20fa1e2bef8c732e35b4

SHA1
c5321ad1b4c0e6f8c22ba32ae73abd94f5e1e3bd

SHA256
63967ef6d5537dc14ed88094913e104deae1f8c94fcf4ab4bc4efe60b5a323b4

SHA512
dfdd4c6d3df4bacbee8d2095356e636dce8a7c0c7ddf89397555d074be0400bba9184a3cf5ff43d28afd60f7f994e9f7a30e0dab6fdf81a1c8623bec2b4da1bd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
912a1f7c5f065d4f36fd22f868c87e1c

SHA1
7c9c84dd8e668dbba4565be989944b9f29d468c0

SHA256
005751f1a2d4f2f17be980b753b54d75105dbeb722e17cb0b0342321ff9ade60

SHA512
8656f4f77e30899e5de4f427717d7215de616cfbc4d9164dc48ab2542faec08e52785531cb235add6ade4b4c00a23d0b2f17b7c6bc91cf4ddf444b3311cd5f48

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
9fe13ce87fa1cfe086b5fa3ffc8ae425

SHA1
f727a6fc2f2029894167ebe717dce1dfc92d5186

SHA256
733a5e6ac385689895ffc16021e96eb06e2e33b609aa80d207961651ef39ba9c

SHA512
9f0105c40bf26b7bdaa3384a12fd7bc92babf5fe421d2a91f732dfa52213bf480f3e25d4dff75c6d348b858648c3864ca06cef20fd7523948528fe7697391c42

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
25cc04536171c9954c2026135b5da3fc

SHA1
5f694ec0362a76b21ee9d45a1458119941ed62b2

SHA256
34ff400b5a7c6ad98e97edf60758ec334d828b6ef6b19f35bd50af383bdd96d6

SHA512
3239ca00510445b31bbd3b227341cb15bef92186de1480c80f4e3ebbefa540c4d138521890a5721867a2bf5370cb6809e488487c68792d868582578612c8f554

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
2571359efac50a1f7753ec01c7fb1319

SHA1
26add159488eb1675c426e04427446684e0085ce

SHA256
d06fded7bd3e4cbbdfee8301e870e6a7c8ffe063e0ac40ecfa265f8d1ba70ab3

SHA512
cc65de90d46ec8811caff5ef9144f144e63969213c9d0ae7b6e449794ddf6ef6c1babd60025c8e09aea53ac9093d03eb32e505194469130dd13de95d88bc0f2c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
70448f4c35042dd2956869c7027d5c3d

SHA1
ce494f46a81ae818bbb173a4f848dd317bb73cff

SHA256
5c7e97e4b7c32398dc4a558d95390545c8e08da1d36c7361bca10f041ae943f2

SHA512
f9b9c69eda8c61abe026c265cbadfbd13e4dbc62a486a4df3893fdb84d1d0dde649289126566058780c98e6d9b985a5eb2601c571eb64677cf035787c16b27e0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
a10372109c0133ae1dbe78ba5309b7a3

SHA1
da931c01334cb9f2c5ed6ec850ba9ca6a4eef3c8

SHA256
8957c6e80278df87be5b91bc391f252d07628c52cce732b526b22f87124eb899

SHA512
9121c99c1f9777a801600e717bcf67cc512627a65291a3c5b215a5a97df803379aef909003d1b28e508d195c601fa15c26bbccab0d2cbb7e9400d49891230da9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
d1386b870b3cd74094e65da16094d6d6

SHA1
ab301a4b433e986ef5100b064063797daa84f60d

SHA256
e4244431c3d2134ee3422efb1c2edeaedeaed6388779560533de74bdb1fb4a98

SHA512
b9a5fecb1b83e863ff705a2b8567f61e97830cb0d8f85e141ad6d22647604d7b83c8056629605c696fec9b03ed4278dad196b5c028e5da0c0042be6b51185ae1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\GPUCache\data_1

Filesize
264KB

MD5
ce6d5444a3cd56c66213bbd0494b9874

SHA1
965dd8703b287df175df0c5f5e4a28c1503ec691

SHA256
96d2f85867eef0464e66c6cc6418d96cb9feb7a1ec5485fde98f33621d21da83

SHA512
7de136ecd54a15e6e2b15f8904004a222ad67893c598d147cffe02479552283966df801ab611860ba952da1b2a70f8ed0fbb302360fb5f4a780f61b79834ff4c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\GPUCache\data_1

Filesize
264KB

MD5
6345ec30e78f406241e7fb6e3250dbca

SHA1
a41f900f1f02889c94dd30abbcc6f9d8c00b4e78

SHA256
1ae0bbe49db6f5f7aea3b4e606ec1773ed2d1c71ac5d208208d6573193b9dcf3

SHA512
04e8a744462faa5b160657214ce31148366766fba5126d7c913532b406cb27007cd94f78c7a2dbc6e7bedd6db2d334bcf59e8db6725c1862f80ed1381f86e3f9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\9cd93bc6dcf544bae69531052e64647ec02f2bb4.tbres

Filesize
4KB

MD5
ebfb9e34454c30a6b4eca8b7ac9284d2

SHA1
fa8090f5f53fce76a6dcfe4e233c7729e5e098c9

SHA256
865519b0377e5c2ff37e0fd262a20250b893064fac15d7d8addbb8caaee46aa1

SHA512
0484098b96cd0ae7f6e6c8379211ff46b7d6509e869663355c705028d7b0ad010403ac724fde73e7c39b45256fd516a7b0b183e86c9146558ecbb339c17c993f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_idx.db

Filesize
28KB

MD5
cac361231d57be07f657f8f170419067

SHA1
610f67b60194dacab7a6cbf8ea8172ae95494f44

SHA256
0817f5d045c96b3a00a03252ecaf5fc6cc87f4e7401acefb39fb2c2a44994fb0

SHA512
8d96f9dd7fb3cc18698d7d334c72180f8679a4b18bf2402b9001f231ce828454b6580e43c3a72232613bdbb98da361292cdcfed940024e65ada5bb21c210e162

Download Submit
C:\note.txt

Filesize
218B

MD5
afa6955439b8d516721231029fb9ca1b

SHA1
087a043cc123c0c0df2ffadcf8e71e3ac86bbae9

SHA256
8e9f20f6864c66576536c0b866c6ffdcf11397db67fe120e972e244c3c022270

SHA512
5da21a31fbc4e8250dffed30f66b896bdf007ac91948140334fe36a3f010e1bac3e70a07e9f3eb9da8633189091fd5cadcabbaacd3e01da0fe7ae28a11b3dddf

Download Submit
memory/2252-1059-0x000001C9E1330000-0x000001C9E1331000-memory.dmp

Filesize
4KB

Download
memory/2252-1057-0x000001C9E1330000-0x000001C9E1331000-memory.dmp

Filesize
4KB

Download
memory/2252-1056-0x000001C9E1330000-0x000001C9E1331000-memory.dmp

Filesize
4KB

Download
memory/2252-1055-0x000001C9E1330000-0x000001C9E1331000-memory.dmp

Filesize
4KB

Download
memory/2252-1058-0x000001C9E1330000-0x000001C9E1331000-memory.dmp

Filesize
4KB

Download
memory/2252-1060-0x000001C9E1330000-0x000001C9E1331000-memory.dmp

Filesize
4KB

Download
memory/2252-1061-0x000001C9E1330000-0x000001C9E1331000-memory.dmp

Filesize
4KB

Download
memory/2252-1050-0x000001C9E1330000-0x000001C9E1331000-memory.dmp

Filesize
4KB

Download
memory/2252-1051-0x000001C9E1330000-0x000001C9E1331000-memory.dmp

Filesize
4KB

Download
memory/2252-1049-0x000001C9E1330000-0x000001C9E1331000-memory.dmp

Filesize
4KB

Download

Resubmissions

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads