hxxps://github[.]com/Dfmaaa/MEMZ-virus/blob/main/MEMZ[.]exe

Analysis

max time kernel
112s
max time network
112s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
17/10/2024, 04:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://github.com/Dfmaaa/MEMZ-virus/blob/main/MEMZ.exe
Sample241017-eterbsvfmn

Score

8^/10

bootkit discovery persistence

Malware Config

Signatures

Downloads MZ/PE file

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	MEMZ.exe
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	MEMZ.exe

Executes dropped EXE 7 IoCs

pid	Process
1608	MEMZ.exe
4064	MEMZ.exe
1088	MEMZ.exe
2096	MEMZ.exe
3200	MEMZ.exe
1484	MEMZ.exe
3304	MEMZ.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

flow	ioc
56	raw.githubusercontent.com
57	raw.githubusercontent.com
58	raw.githubusercontent.com

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	MEMZ.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MEMZ.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MEMZ.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe

Enumerates system info in registry 2 TTPs 12 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133736120320068612"	chrome.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4088	chrome.exe
4088	chrome.exe
4064	MEMZ.exe
4064	MEMZ.exe
4064	MEMZ.exe
1088	MEMZ.exe
4064	MEMZ.exe
1088	MEMZ.exe
1088	MEMZ.exe
3200	MEMZ.exe
1088	MEMZ.exe
3200	MEMZ.exe
4064	MEMZ.exe
4064	MEMZ.exe
2096	MEMZ.exe
2096	MEMZ.exe
4064	MEMZ.exe
3200	MEMZ.exe
4064	MEMZ.exe
3200	MEMZ.exe
1088	MEMZ.exe
1088	MEMZ.exe
3200	MEMZ.exe
1088	MEMZ.exe
3200	MEMZ.exe
1088	MEMZ.exe
4064	MEMZ.exe
2096	MEMZ.exe
4064	MEMZ.exe
2096	MEMZ.exe
1484	MEMZ.exe
1484	MEMZ.exe
4064	MEMZ.exe
2096	MEMZ.exe
4064	MEMZ.exe
2096	MEMZ.exe
3200	MEMZ.exe
3200	MEMZ.exe
1088	MEMZ.exe
1088	MEMZ.exe
3200	MEMZ.exe
1088	MEMZ.exe
3200	MEMZ.exe
1088	MEMZ.exe
4064	MEMZ.exe
4064	MEMZ.exe
2096	MEMZ.exe
2096	MEMZ.exe
1484	MEMZ.exe
1484	MEMZ.exe
2096	MEMZ.exe
1484	MEMZ.exe
2096	MEMZ.exe
1484	MEMZ.exe
4064	MEMZ.exe
4064	MEMZ.exe
1088	MEMZ.exe
1088	MEMZ.exe
3200	MEMZ.exe
3200	MEMZ.exe
2096	MEMZ.exe
1484	MEMZ.exe
2096	MEMZ.exe
1484	MEMZ.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 24 IoCs

pid	Process
4088	chrome.exe
4088	chrome.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
6092	msedge.exe
6092	msedge.exe
6092	msedge.exe
6092	msedge.exe
6092	msedge.exe
6092	msedge.exe
6092	msedge.exe
6092	msedge.exe
1472	msedge.exe
1472	msedge.exe
1472	msedge.exe
1472	msedge.exe
4088	chrome.exe
4088	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4088	chrome.exe
Token: SeCreatePagefilePrivilege	4088	chrome.exe
Token: SeShutdownPrivilege	4088	chrome.exe
Token: SeCreatePagefilePrivilege	4088	chrome.exe
Token: SeShutdownPrivilege	4088	chrome.exe
Token: SeCreatePagefilePrivilege	4088	chrome.exe
Token: SeShutdownPrivilege	4088	chrome.exe
Token: SeCreatePagefilePrivilege	4088	chrome.exe
Token: SeShutdownPrivilege	4088	chrome.exe
Token: SeCreatePagefilePrivilege	4088	chrome.exe
Token: SeShutdownPrivilege	4088	chrome.exe
Token: SeCreatePagefilePrivilege	4088	chrome.exe
Token: SeShutdownPrivilege	4088	chrome.exe
Token: SeCreatePagefilePrivilege	4088	chrome.exe
Token: SeShutdownPrivilege	4088	chrome.exe
Token: SeCreatePagefilePrivilege	4088	chrome.exe
Token: SeShutdownPrivilege	4088	chrome.exe
Token: SeCreatePagefilePrivilege	4088	chrome.exe
Token: SeShutdownPrivilege	4088	chrome.exe
Token: SeCreatePagefilePrivilege	4088	chrome.exe
Token: SeShutdownPrivilege	4088	chrome.exe
Token: SeCreatePagefilePrivilege	4088	chrome.exe
Token: SeShutdownPrivilege	4088	chrome.exe
Token: SeCreatePagefilePrivilege	4088	chrome.exe
Token: SeShutdownPrivilege	4088	chrome.exe
Token: SeCreatePagefilePrivilege	4088	chrome.exe
Token: SeShutdownPrivilege	4088	chrome.exe
Token: SeCreatePagefilePrivilege	4088	chrome.exe
Token: SeShutdownPrivilege	4088	chrome.exe
Token: SeCreatePagefilePrivilege	4088	chrome.exe
Token: SeShutdownPrivilege	4088	chrome.exe
Token: SeCreatePagefilePrivilege	4088	chrome.exe
Token: SeShutdownPrivilege	4088	chrome.exe
Token: SeCreatePagefilePrivilege	4088	chrome.exe
Token: SeShutdownPrivilege	4088	chrome.exe
Token: SeCreatePagefilePrivilege	4088	chrome.exe
Token: SeShutdownPrivilege	4088	chrome.exe
Token: SeCreatePagefilePrivilege	4088	chrome.exe
Token: SeShutdownPrivilege	4088	chrome.exe
Token: SeCreatePagefilePrivilege	4088	chrome.exe
Token: SeShutdownPrivilege	4088	chrome.exe
Token: SeCreatePagefilePrivilege	4088	chrome.exe
Token: SeShutdownPrivilege	4088	chrome.exe
Token: SeCreatePagefilePrivilege	4088	chrome.exe
Token: SeShutdownPrivilege	4088	chrome.exe
Token: SeCreatePagefilePrivilege	4088	chrome.exe
Token: SeShutdownPrivilege	4088	chrome.exe
Token: SeCreatePagefilePrivilege	4088	chrome.exe
Token: SeShutdownPrivilege	4088	chrome.exe
Token: SeCreatePagefilePrivilege	4088	chrome.exe
Token: SeShutdownPrivilege	4088	chrome.exe
Token: SeCreatePagefilePrivilege	4088	chrome.exe
Token: SeShutdownPrivilege	4088	chrome.exe
Token: SeCreatePagefilePrivilege	4088	chrome.exe
Token: SeShutdownPrivilege	4088	chrome.exe
Token: SeCreatePagefilePrivilege	4088	chrome.exe
Token: SeShutdownPrivilege	4088	chrome.exe
Token: SeCreatePagefilePrivilege	4088	chrome.exe
Token: SeShutdownPrivilege	4088	chrome.exe
Token: SeCreatePagefilePrivilege	4088	chrome.exe
Token: SeShutdownPrivilege	4088	chrome.exe
Token: SeCreatePagefilePrivilege	4088	chrome.exe
Token: SeShutdownPrivilege	4088	chrome.exe
Token: SeCreatePagefilePrivilege	4088	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4088	chrome.exe
4088	chrome.exe
4088	chrome.exe
4088	chrome.exe
4088	chrome.exe
4088	chrome.exe
4088	chrome.exe
4088	chrome.exe
4088	chrome.exe
4088	chrome.exe
4088	chrome.exe
4088	chrome.exe
4088	chrome.exe
4088	chrome.exe
4088	chrome.exe
4088	chrome.exe
4088	chrome.exe
4088	chrome.exe
4088	chrome.exe
4088	chrome.exe
4088	chrome.exe
4088	chrome.exe
4088	chrome.exe
4088	chrome.exe
4088	chrome.exe
4088	chrome.exe
4088	chrome.exe
4088	chrome.exe
4088	chrome.exe
4088	chrome.exe
4088	chrome.exe
4088	chrome.exe
4088	chrome.exe
4088	chrome.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
6092	msedge.exe
6092	msedge.exe
6092	msedge.exe
6092	msedge.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
4088	chrome.exe
4088	chrome.exe
4088	chrome.exe
4088	chrome.exe
4088	chrome.exe
4088	chrome.exe
4088	chrome.exe
4088	chrome.exe
4088	chrome.exe
4088	chrome.exe
4088	chrome.exe
4088	chrome.exe
4088	chrome.exe
4088	chrome.exe
4088	chrome.exe
4088	chrome.exe
4088	chrome.exe
4088	chrome.exe
4088	chrome.exe
4088	chrome.exe
4088	chrome.exe
4088	chrome.exe
4088	chrome.exe
4088	chrome.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
6092	msedge.exe
6092	msedge.exe
6092	msedge.exe
6092	msedge.exe
6092	msedge.exe
6092	msedge.exe
6092	msedge.exe
6092	msedge.exe
6092	msedge.exe
6092	msedge.exe
6092	msedge.exe
6092	msedge.exe
6092	msedge.exe
6092	msedge.exe
6092	msedge.exe
6092	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4088 wrote to memory of 1548	4088	chrome.exe	84
PID 4088 wrote to memory of 1548	4088	chrome.exe	84
PID 4088 wrote to memory of 3136	4088	chrome.exe	85
PID 4088 wrote to memory of 3136	4088	chrome.exe	85
PID 4088 wrote to memory of 3136	4088	chrome.exe	85
PID 4088 wrote to memory of 3136	4088	chrome.exe	85
PID 4088 wrote to memory of 3136	4088	chrome.exe	85
PID 4088 wrote to memory of 3136	4088	chrome.exe	85
PID 4088 wrote to memory of 3136	4088	chrome.exe	85
PID 4088 wrote to memory of 3136	4088	chrome.exe	85
PID 4088 wrote to memory of 3136	4088	chrome.exe	85
PID 4088 wrote to memory of 3136	4088	chrome.exe	85
PID 4088 wrote to memory of 3136	4088	chrome.exe	85
PID 4088 wrote to memory of 3136	4088	chrome.exe	85
PID 4088 wrote to memory of 3136	4088	chrome.exe	85
PID 4088 wrote to memory of 3136	4088	chrome.exe	85
PID 4088 wrote to memory of 3136	4088	chrome.exe	85
PID 4088 wrote to memory of 3136	4088	chrome.exe	85
PID 4088 wrote to memory of 3136	4088	chrome.exe	85
PID 4088 wrote to memory of 3136	4088	chrome.exe	85
PID 4088 wrote to memory of 3136	4088	chrome.exe	85
PID 4088 wrote to memory of 3136	4088	chrome.exe	85
PID 4088 wrote to memory of 3136	4088	chrome.exe	85
PID 4088 wrote to memory of 3136	4088	chrome.exe	85
PID 4088 wrote to memory of 3136	4088	chrome.exe	85
PID 4088 wrote to memory of 3136	4088	chrome.exe	85
PID 4088 wrote to memory of 3136	4088	chrome.exe	85
PID 4088 wrote to memory of 3136	4088	chrome.exe	85
PID 4088 wrote to memory of 3136	4088	chrome.exe	85
PID 4088 wrote to memory of 3136	4088	chrome.exe	85
PID 4088 wrote to memory of 3136	4088	chrome.exe	85
PID 4088 wrote to memory of 3136	4088	chrome.exe	85
PID 4088 wrote to memory of 1652	4088	chrome.exe	86
PID 4088 wrote to memory of 1652	4088	chrome.exe	86
PID 4088 wrote to memory of 3844	4088	chrome.exe	87
PID 4088 wrote to memory of 3844	4088	chrome.exe	87
PID 4088 wrote to memory of 3844	4088	chrome.exe	87
PID 4088 wrote to memory of 3844	4088	chrome.exe	87
PID 4088 wrote to memory of 3844	4088	chrome.exe	87
PID 4088 wrote to memory of 3844	4088	chrome.exe	87
PID 4088 wrote to memory of 3844	4088	chrome.exe	87
PID 4088 wrote to memory of 3844	4088	chrome.exe	87
PID 4088 wrote to memory of 3844	4088	chrome.exe	87
PID 4088 wrote to memory of 3844	4088	chrome.exe	87
PID 4088 wrote to memory of 3844	4088	chrome.exe	87
PID 4088 wrote to memory of 3844	4088	chrome.exe	87
PID 4088 wrote to memory of 3844	4088	chrome.exe	87
PID 4088 wrote to memory of 3844	4088	chrome.exe	87
PID 4088 wrote to memory of 3844	4088	chrome.exe	87
PID 4088 wrote to memory of 3844	4088	chrome.exe	87
PID 4088 wrote to memory of 3844	4088	chrome.exe	87
PID 4088 wrote to memory of 3844	4088	chrome.exe	87
PID 4088 wrote to memory of 3844	4088	chrome.exe	87
PID 4088 wrote to memory of 3844	4088	chrome.exe	87
PID 4088 wrote to memory of 3844	4088	chrome.exe	87
PID 4088 wrote to memory of 3844	4088	chrome.exe	87
PID 4088 wrote to memory of 3844	4088	chrome.exe	87
PID 4088 wrote to memory of 3844	4088	chrome.exe	87
PID 4088 wrote to memory of 3844	4088	chrome.exe	87
PID 4088 wrote to memory of 3844	4088	chrome.exe	87
PID 4088 wrote to memory of 3844	4088	chrome.exe	87
PID 4088 wrote to memory of 3844	4088	chrome.exe	87
PID 4088 wrote to memory of 3844	4088	chrome.exe	87
PID 4088 wrote to memory of 3844	4088	chrome.exe	87

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://github.com/Dfmaaa/MEMZ-virus/blob/main/MEMZ.exe
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4088
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffab283cc40,0x7ffab283cc4c,0x7ffab283cc58
  2⤵
  PID:1548
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1916,i,6872785427802281673,12679459733905199072,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=1912 /prefetch:2
  2⤵
  PID:3136
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2144,i,6872785427802281673,12679459733905199072,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2176 /prefetch:3
  2⤵
  PID:1652
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2248,i,6872785427802281673,12679459733905199072,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2408 /prefetch:8
  2⤵
  PID:3844
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3124,i,6872785427802281673,12679459733905199072,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3152 /prefetch:1
  2⤵
  PID:1972
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3148,i,6872785427802281673,12679459733905199072,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3196 /prefetch:1
  2⤵
  PID:2696
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=5096,i,6872785427802281673,12679459733905199072,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5048 /prefetch:8
  2⤵
  PID:2384
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=5104,i,6872785427802281673,12679459733905199072,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5320 /prefetch:8
  2⤵
  PID:5004
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=5112,i,6872785427802281673,12679459733905199072,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5328 /prefetch:8
  2⤵
  PID:3600
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=5008,i,6872785427802281673,12679459733905199072,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5480 /prefetch:8
  2⤵
  PID:2472
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=5012,i,6872785427802281673,12679459733905199072,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5748 /prefetch:8
  2⤵
  PID:640
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=5132,i,6872785427802281673,12679459733905199072,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5624 /prefetch:8
  2⤵
  PID:2492
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4572,i,6872785427802281673,12679459733905199072,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5576 /prefetch:8
  2⤵
  PID:2876
- C:\Users\Admin\Downloads\MEMZ.exe
  "C:\Users\Admin\Downloads\MEMZ.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1608
- - C:\Users\Admin\Downloads\MEMZ.exe
    "C:\Users\Admin\Downloads\MEMZ.exe" /watchdog
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:4064
- - C:\Users\Admin\Downloads\MEMZ.exe
    "C:\Users\Admin\Downloads\MEMZ.exe" /watchdog
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:1088
- - C:\Users\Admin\Downloads\MEMZ.exe
    "C:\Users\Admin\Downloads\MEMZ.exe" /watchdog
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:2096
- - C:\Users\Admin\Downloads\MEMZ.exe
    "C:\Users\Admin\Downloads\MEMZ.exe" /watchdog
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:3200
- - C:\Users\Admin\Downloads\MEMZ.exe
    "C:\Users\Admin\Downloads\MEMZ.exe" /watchdog
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:1484
- - C:\Users\Admin\Downloads\MEMZ.exe
    "C:\Users\Admin\Downloads\MEMZ.exe" /main
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Writes to the Master Boot Record (MBR)
    - System Location Discovery: System Language Discovery
    PID:3304
  - - C:\Windows\SysWOW64\notepad.exe
      "C:\Windows\System32\notepad.exe" \note.txt
      4⤵
      System Location Discovery: System Language Discovery
      PID:2912
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=batch+virus+download
      4⤵
      Enumerates system info in registry
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      PID:2352
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffaacc546f8,0x7ffaacc54708,0x7ffaacc54718
        5⤵
        
        PID:532
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,11357861683461826651,1968999153397468655,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2084 /prefetch:2
        5⤵
        
        PID:4492
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2072,11357861683461826651,1968999153397468655,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2172 /prefetch:3
        5⤵
        
        PID:2104
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2072,11357861683461826651,1968999153397468655,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2764 /prefetch:8
        5⤵
        
        PID:2388
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,11357861683461826651,1968999153397468655,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3192 /prefetch:1
        5⤵
        
        PID:2492
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,11357861683461826651,1968999153397468655,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3208 /prefetch:1
        5⤵
        
        PID:2148
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,11357861683461826651,1968999153397468655,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4836 /prefetch:1
        5⤵
        
        PID:5492
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,11357861683461826651,1968999153397468655,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1
        5⤵
        
        PID:5604
    - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2072,11357861683461826651,1968999153397468655,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5252 /prefetch:8
        5⤵
        
        PID:5808
    - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2072,11357861683461826651,1968999153397468655,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5252 /prefetch:8
        5⤵
        
        PID:5976
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,11357861683461826651,1968999153397468655,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5044 /prefetch:1
        5⤵
        
        PID:6080
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,11357861683461826651,1968999153397468655,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5356 /prefetch:1
        5⤵
        
        PID:6088
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,11357861683461826651,1968999153397468655,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5780 /prefetch:1
        5⤵
        
        PID:5368
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,11357861683461826651,1968999153397468655,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5828 /prefetch:1
        5⤵
        
        PID:5408
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=best+way+to+kill+yourself
      4⤵
      Enumerates system info in registry
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      PID:6092
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x10c,0x110,0x114,0xe8,0x118,0x7ffaacc546f8,0x7ffaacc54708,0x7ffaacc54718
        5⤵
        
        PID:5380
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2200,6244725734388985587,12773614393027895856,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2212 /prefetch:2
        5⤵
        
        PID:5780
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2200,6244725734388985587,12773614393027895856,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2264 /prefetch:3
        5⤵
        
        PID:5700
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2200,6244725734388985587,12773614393027895856,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2848 /prefetch:8
        5⤵
        
        PID:6112
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,6244725734388985587,12773614393027895856,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
        5⤵
        
        PID:5688
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,6244725734388985587,12773614393027895856,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1
        5⤵
        
        PID:5312
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,6244725734388985587,12773614393027895856,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4876 /prefetch:1
        5⤵
        
        PID:2676
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,6244725734388985587,12773614393027895856,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5064 /prefetch:1
        5⤵
        
        PID:5064
    - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2200,6244725734388985587,12773614393027895856,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3896 /prefetch:8
        5⤵
        
        PID:624
    - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2200,6244725734388985587,12773614393027895856,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3896 /prefetch:8
        5⤵
        
        PID:1780
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,6244725734388985587,12773614393027895856,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
        5⤵
        
        PID:5212
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,6244725734388985587,12773614393027895856,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5300 /prefetch:1
        5⤵
        
        PID:1556
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,6244725734388985587,12773614393027895856,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5092 /prefetch:1
        5⤵
        
        PID:5216
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,6244725734388985587,12773614393027895856,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5088 /prefetch:1
        5⤵
        
        PID:4496
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=montage+parody+making+program+2016
      4⤵
      Enumerates system info in registry
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      PID:1472
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffaacc546f8,0x7ffaacc54708,0x7ffaacc54718
        5⤵
        
        PID:6108
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2200,12675933301423006106,14980628821092892546,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2212 /prefetch:2
        5⤵
        
        PID:5512
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2200,12675933301423006106,14980628821092892546,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2264 /prefetch:3
        5⤵
        
        PID:4552
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2200,12675933301423006106,14980628821092892546,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2992 /prefetch:8
        5⤵
        
        PID:4676
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,12675933301423006106,14980628821092892546,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:1
        5⤵
        
        PID:1564
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,12675933301423006106,14980628821092892546,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:1
        5⤵
        
        PID:5308
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,12675933301423006106,14980628821092892546,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4880 /prefetch:1
        5⤵
        
        PID:1436
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,12675933301423006106,14980628821092892546,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4212 /prefetch:1
        5⤵
        
        PID:2648
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --field-trial-handle=3544,i,6872785427802281673,12679459733905199072,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3560 /prefetch:1
  2⤵
  PID:976
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --field-trial-handle=5600,i,6872785427802281673,12679459733905199072,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4660 /prefetch:1
  2⤵
  PID:1252
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5344,i,6872785427802281673,12679459733905199072,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4228 /prefetch:8
  2⤵
  PID:2556
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5084,i,6872785427802281673,12679459733905199072,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5348 /prefetch:8
  2⤵
  PID:5236

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:1816

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3016

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5212

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5264

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5928

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1488

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5360

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5164

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 96dc743ae8c105fbac8903f5bdf8ea8b959838330fae59b165828bb684e5f287
MD5 9e74fb2b152366f0c096cf6c19492c0a
SHA1 f785094d0d1efbed5774842f65501ead59c3787c
SHA512 f2a94cbc262862faeb6ae21d82fcd06cab6f0c0b1687c279ca65e655fc78813890ba3fa4f8679987b511a6355457775adaba5690105ab148267e3a94fdfbaa21
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 49fdbcc1e16f5feb3eabff92b2845321d9a5eff5f84da8cd87b2d2f21abaa506
MD5 ca281ea36fd52fbed6cade24e942cb50
SHA1 06562332547067b6dcca6ae698d8ff148ba642a2
SHA512 c062564782b45853ea6a1bb452361f1a83c68b38a67c9e4df98f286bf9e6d1d54940a7c0becaa89b5b20aa917589d78a7a245eecec70e9ae782cf41c9e2bf124
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 81f0906ba4a58f1a8e44cfec2fab21f9dacb9c52ce4d6f8eaf7fed8e428c4d4b
MD5 c8f08f487a638370eb43c5b325563453
SHA1 08c1fbbebbf1b0fd20dc4926547eb181de88c6db
SHA512 ab637392cb3e9ed2f4ce364b42c9de89f54513a5a5bdca644d1d5b3f6c790c4f6ee67629d59ee744610cdcd7dc8896b8a6d824cdcb2071eecf5d242c649da5ac
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 1KB
SHA256 6f4a83baa2c90dd6b95779d6632cffd390c400145d7f72e74a909eed90f36b7f
MD5 a24d182667929f9876ea5f2f65480899
SHA1 4977e66bdecfd795c851038d9b7ff03803600b4c
SHA512 f854abe26587a5f2d9487aba39701536fcb406012327faab08f933d7bb8853cdcba4103ee3ec2690fba229f9fec55e2bb62b5123187f19599a5fa70c326bdb34
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 1KB
SHA256 923157a0f6327145992272108045b6808fa6cf2938ac134561fb64a61a3dc858
MD5 1f1e89c88218075ae63bc4ff9a6c1909
SHA1 1866a25448da5b67f035ed28ecf2ded8f9814e6d
SHA512 169f77d0466268c31d5bb96d00e0a470b0a5f18f327cc9e7fb5001ad3db9fc1821a5b8b1afc42a6af49d2ce289610e2911cd55f6dcaab831710ca3e7d0c42791
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 9KB
SHA256 01eae20e6bcac3a592f986f67a4d4cd2a1feb758a964ca136dfec9f564b82cb9
MD5 922dae5ed498974789fd4a26c10abdbb
SHA1 9aa1ba804136d0208a68a2a2e771afe45da55ccd
SHA512 c6728708bb77e162ee67ebcf9a5a808a3c92959724d4b52aaaa176cd53ef92960bf57cb139a0b4fe8924ce80a970b0d105048af1663ae933c72a18a87361d215
SSDEEP 192:796XjcIeaDzfaBZhYeIcGusHV+F0E0k0A4ecJ6eVUPo6yIsnVdgM:796XjcxaHyMcGuYG0Nk0Ac604M
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 9KB
SHA256 49613441a2789d2c7582b976a6731e8fc8a641b6a0cb74e7424783a1e19a1cbe
MD5 bad2c27dad61f70baf96a6d443f9dddf
SHA1 af206c53b75f52095ce0179d6c7feecf6f41394a
SHA512 32197be3757742b33b995905aada1033d4ce618ac875dd5ebca8e45bd2f32fb3997371b1f4b00712d22ec838003a664de51a5e578e3cd6562f61514e1e56bea7
SSDEEP 192:79RXjcIeaDzfaBZhbGBeIcGusHV+F0E0k0U4ecJ6ecUPo6yIsnVdgM:79RXjcxaHybGDcGuYG0Nk0Uc6N4M
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 9KB
SHA256 ce7b709ad41f39cbf5a2c24679043051fbbd24e8e7edcf02e2a2475ea35c4707
MD5 3b5e4c30ffd1719a200f3f48faa46dca
SHA1 2de06444bbf0feb9cfab4c3daebc97eff4e7d7d2
SHA512 482788fc98c38553a68afd7c557a0b9dbc976fb98e3580d9a565a06a1ac02cbe5a0be9649532d92057e4c13ac92336b7462494886113e425bada5124e4c79f43
SSDEEP 192:79RXjcIeaDzfaBZhb8BeIcGusHV+F0E0k0U4ecJ6ecUPo6yIsnVdgM:79RXjcxaHyb8DcGuYG0Nk0Uc6N4M
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 10KB
SHA256 0a6f97714cd877290156ab235940227d8b0def0ab6e899c34b5f6b7f95cc9b19
MD5 81df6abffac5428bd5f3b3d679f36775
SHA1 ca7dc96b00543daa9388a92993dbcd2e2c5ef9e3
SHA512 a595d05043971e2c6be261b58f7bd01291cb9ab3744a27ac1c59a7d25bb4be5e6d0683bf4ad653443b07c152575e01818c0e276bac8d3b1f0445adfb0ace660d
SSDEEP 192:796XjcIeaDzfaBZhb9BeIcGusHV+F0E0k0a4ecJ6emUPo6yIsnVdgM:796XjcxaHyb9DcGuYG0Nk0ac6p4M
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 10KB
SHA256 072e39c8153ea433d30f857d396012971f6dd87b13e291cd4e4dc1829d7cdee0
MD5 2460adfc6c967e2eaf81960497276a5f
SHA1 508a81202051f90d28b30150252d465740904c5e
SHA512 37e23c06215040a0b137bd61263a667f1805600ae400e8a16057ead030106d697579520545072da0499218faab491bcbcfed7d9de1cad24b05996ea262d2a5f6
SSDEEP 192:79RXjcIeaDzfaBZhbLBeIcGusHV+F0E0k0a4ecJ6emUPo6yIsnVdgM:79RXjcxaHybLDcGuYG0Nk0ac6p4M
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 10KB
SHA256 3bfd41942994fb04030d79b4ff8ff627b22a32a25596b23fcece9538a776c08f
MD5 47844be6faa55c0f7d5a74cf55363a32
SHA1 69d96d1d52a5e15efff69326c293f1c0cd30ec6b
SHA512 392b0ea2b1b713bc92bdde25bcfe892bbb46e1a2040d0a9e77d15d1fce98369f04ffce243457d46fd48b046079d5ad061f96477ce4610bbffcd5919cf70f31cc
SSDEEP 192:79RXjcIeaDzfaBZhbiBeIcGusHV+F0E0k0a4ecJ6emUPo6yIsnVdgM:79RXjcxaHybiDcGuYG0Nk0ac6p4M
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 9KB
SHA256 abf2d5d5b5568558e8a18d81561ad6d44be812a5598c36c017d6a17389f6b638
MD5 421885bd8bd7536f87ae8222ed59215c
SHA1 5434961abb63c9b1bc90582bcc9541abce36f604
SHA512 474b771b247791d0d16d7f853ea468b0283469ee40d99a335e9c43d9304f3526fb7ed934c265fa521d50d412b825bf0809fdf50532f4398eb9bb7c05b123f7f7
SSDEEP 192:79RXjcIeaDzfaBZhb7BeIcGusHV+F0E0k0A4ecJ6eVUPo6yIsnVdgM:79RXjcxaHyb7DcGuYG0Nk0Ac604M
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 0cb49e0765139b4b20ac25361681d470ede40aa784fadf25d8022ec8296b9e0e
MD5 9b280e2c6e1f2635870824bde2f698c8
SHA1 0768160bb87cbc452f879b950ded6e0d440b3417
SHA512 2aa4c0439774f0d4973322c49795ce99d2971f4ee4ae6355542450b3586d166310279dbf67049a0f036cd729a4e495aa878d535e556950ba3f8311def5aa7335
SSDEEP 3072:tcZ6UZsu46J8ixse6HWNMk6YILigpcehoroae9:tNUZt46Jlxse6HWNj6YHgta9e9
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 5b2ec8434a282dda05d9e18dca420d3cd1739b90702d4d263fbe24d046146e11
MD5 012824791217434f14150ee28e94736d
SHA1 9dbe1b3d36506611c496984c8f013b8cb909d5a1
SHA512 217a6a208f66a67ebf474887c784ee043bf09097fe572dba1151ff0f432c632d9e31de4dc98da9cc043e0c01f277d869be0aed99be4572c98314132a28f24f7f
SSDEEP 3072:icZ6UZsu46J8ixse6HWNMk6YILigpcehoroae9:iNUZt46Jlxse6HWNj6YHgta9e9
MD5 SHA1 SHA512 SSDEEP

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 4e2510a1d5a50a94fe4ce0f74932ab780758a8cbdc6d176a9ce8ab92309f26f8
MD5 37f660dd4b6ddf23bc37f5c823d1c33a
SHA1 1c35538aa307a3e09d15519df6ace99674ae428b
SHA512 807b8b8dc9109b6f78fc63655450bf12b9a006ff63e8f29ade8899d45fdf4a6c068c5c46a3efbc4232b9e1e35d6494f00ded5cdb3e235c8a25023bfbd823992d
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 38355fd694faf1223518e40bac1996bdceaf44191214b0a23c4334d5fb07d031
MD5 d7cb450b1315c63b1d5d89d98ba22da5
SHA1 694005cd9e1a4c54e0b83d0598a8a0c089df1556
SHA512 df04d4f4b77bae447a940b28aeac345b21b299d8d26e28ecbb3c1c9e9a0e07c551e412d545c7dbb147a92c12bad7ae49ac35af021c34b88e2c6c5f7a0b65f6a8
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 9cca205d6607889e144768d2a1b636e6114ac8f426c83fd24c2608fd8a9271b3
MD5 2ebc63d6410ba324bc0de5fa2e332dbc
SHA1 da746e4917d686972d26c3feb20904da161ff29e
SHA512 d3e9c3620d87772da2f35a5b0e3f7c64db0eba8157f8d092e979162954c853806cd2e7f8ffe488cfefc7c773ed8af621d9002b4800055bccfc268ba77302b235
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 ff687ff74d795ccb4feee07c4c7b004d08f211db0d404f4c91d074c1b11508d4
MD5 9b5746a943ff20919f0d96b877345e45
SHA1 1be5a633887062df1ca4e5b629f5693e6a8f01f7
SHA512 e6ab4224c50350647a0d5b9fa087cebd390ffb63ff1eac9298515e06e2b3e34e6904fe122e76ca4ed8c1124da1b9d99dbb0516ee814bd6f07325279238c7a577
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 4527b55a27023b6429448314fc4e24171a666a0bd9d6557c952337d9307fc44e
MD5 37efbdfe98dcd3a90ca1d9475d6e2cff
SHA1 3cbb86286ad24e3efa0942b673fe065f15fd0ae4
SHA512 345217fb910cd66763d69ee1dfcd9fe8fac00adaf5e9cf0f662156bb22d1806bcce47c0bb847371718e959deca7b98fd5939b8ea218d10d4542b1d6ec74fd845
MD5 SHA1 SHA512

Submit Download

98954388-dc76-41f6-8b5b-5103175496a6.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\98954388-dc76-41f6-8b5b-5103175496a6.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\data_0
Size 44KB
SHA256 b370b05291c5f0bab28ff8287b795a787d4ac46fe42e58fd0646f2e8e34ede32
MD5 61416ec561ed0a869a64df0e10b9be0f
SHA1 401d5ce6bb8fcd9528a33d1f1585e99f2a139ec9
SHA512 dbea76558cb658a5182735a91c49820d805b0cd639f752ec29fb339aef41e052a3422877239af5e3b8113b21a5ec615746b0c7e1177932159705910ad3575326
SSDEEP 24:d0S+3iyR8IUPvf9dU7NUhck4WtN0+VGDN:sPRI3Ik4dDN
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\data_1
Size 264KB
SHA256 9e912a12d58379377453e5cbe73cc6cd7062c8729606ec53496230106b724828
MD5 9f9d9780ce766dfb0997d063fe604c8e
SHA1 b1d1c625c0e9d6f4373f4681265740d65288f195
SHA512 00c6fa6d87ea95ece0b57bdf14b00010561c4150fbf28bf6be1f4c5c44023c59ed56a4189f13758fe8afdbd72677f88c90e5bac9060d45d79e7923b9bcb8c15d
SSDEEP 96:4Nzn/GdUxNk3ZjYIsTgpl9lnxvUkK7inEkzzjyFKTfXgPEpJIIcd:4Nz/If0Iz/Da7i/jEKT/VfXcd
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\data_2
Size 1.0MB
SHA256 f290f03028d8897ed18c6bcf59699a8d682706ffdcb617c10697872e7282c617
MD5 55c1dd8240457c56907255cd086a7bf3
SHA1 4cec7f24361ac554e8a521bb3b067973c68986f0
SHA512 9c2470a458b8ddd2e04a0ff0626e47dcd1baf3212538f5dcc4d7640d04707fc29f5e9ac91db5bb6622a5c50138930e3a80cfcb3cbd82a703232b603de61eedd1
SSDEEP 96:VSabhtXqMHyCl8m7N0ag66fANA+bTn48LER:VS4xqM8ra4ANAubrLER
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000003

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000003
Size 215KB
SHA256 18a1cfc3b339903a71e6a68791cde83fca626a4c1a22be5cb7755c9f2343e2a5
MD5 1585c4c0ffdb55b2a4fdc0b0f5c317be
SHA1 aac0e0f12332063c75c690458b2cfe5acb800d0a
SHA512 7021ed87f0c97edc3a8ff838202fa444841eafcbfa4e00e722b723393a1ac679279aa744e8edde237a05be6060527a0c7e64a36148bd2d1316d5589d78d08e23
SSDEEP 6144:/Hl6MVIiSyiXJeJNmem3pF+U0jBMSrhhH0z1kXEwYR:/kMVTShSNVETSBPVh0z1kXg
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 144B
SHA256 de9d91534429711d1906af05dcc082a742fa4eaf88c5c158cc73b14b1d0a4d26
MD5 dcefd2e7edd4e64607d853d3e3bba814
SHA1 5156420c65ed6d7f2b3cf04345f1ab0d41f4dbef
SHA512 5486ff3579ec3374437e38acb190fc5a677db5609ba671f053ea8c4eca2bfd33dbe22abfd40f78e00439b75e1cc0cd4b4085ba1177922ec0c0a1e84ba9b95af3
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 168B
SHA256 7e3725a6688ed63a0a1daa1395607078cf4cb68ed356de383b5db53730685155
MD5 a51eccfc888d1798f0dbad5ddb5d9179
SHA1 3f2c829daee1545d82835a49b8c5ffa0c5ea1331
SHA512 156aeffe9130c84b7f379734d6db226118f9346334d65d17840b800f5ce8e179e87af12a6227141b63146f8979803cca7110c044b9fb355c6cebd8d999a76740
MD5 SHA1 SHA512

Submit Download

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies
Size 20KB
SHA256 eb1b7f1356780707d938a4033a46ee3f77c7b2e8119279563e3d75c58154cce5
MD5 ae3fa524e39de3bb6d95f1b2c3bbe648
SHA1 6aa94de9a6f3599e23671d8cc326158e3b497a28
SHA512 1cdd9522bd26f54f110d61e75b6d3603d1cb14731f49521d6bc6c0e35d4b8eb55c3f37278e2a3af440acdd35e2fcf8a1785fde2443c20144ecdaa115c22012de
SSDEEP 24:TLgbXaFpEO5bNmISHnCWmoqv6UwpQ9YH5RZ6HfBr+RlsoajSk3:TkLOpEO5J/KnvmopUOZD8BrHT3
MD5 SHA1 SHA512 SSDEEP

Submit Download

Favicons

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Favicons
Size 20KB
SHA256 1e8676f61dcfb8d51982846961a3de968b49d3d8b0bf6ded6b1213e8da72dc2f
MD5 bbda39e5e0d9c580e02f356ebf8d7ba4
SHA1 76d3b1f95fc4240b073750471e992e24e3bfd7d0
SHA512 9b515db3d072c581ca773faa6e84f51c9a527d572a9577b3c9a6dd01a209958d58c3d3b2ef057225e47faee4251b2eb9f67cb9d1e9cc48de9d7672e01ccf6972
SSDEEP 48:KBmw6fU1zBnRn0uYbrz1LMpbp+2gjGCHkJ/AztYZIHfSlhlBI8HvU7eLLmXFcwJG:KBCyRn0uelS9nsH4/AztcJuuoKwUnF
MD5 SHA1 SHA512 SSDEEP

Submit Download

History

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History
Size 124KB
SHA256 8040ad61347c774b7a41bc4a3dbdbcb71f0f86185214581fcd9aad5e953b2045
MD5 8e89efef0b69c246752a1486487920eb
SHA1 98a49c95a897b153edcf0e4414c71bae0bc07cf1
SHA512 66e3ffc8b9f95e84433690f8bce8d968cf4b0d0bc029111c7be5d5ac9c953b1eeb620491a2f1d5529a676b1f57cdf2794bfe85ba8e61309b1259d3fd57701fd1
SSDEEP 96:xXnC72MrU+bDoYysX0uhnyTpvVjN9DLjGQLBE3uP2nM:xXC72Mg+bDo3irhnyTpvVj3XBBE3ueM
MD5 SHA1 SHA512 SSDEEP

Submit Download

History Provider Cache

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History Provider Cache
Size 6B
SHA256 e708be5e34097c8b4b6ecb50ead7705843d0dc4b0779b95ef57073d80f36c191
MD5 a9851aa4c3c8af2d1bd8834201b2ba51
SHA1 fa95986f7ebfac4aab3b261d3ed0a21b142e91fc
SHA512 41a1b4d650ff55b164f3db02c8440f044c4ec31d8ddbbbf56195d4e27473c6b1379dfad3581e16429650e2364791f5c19aae723efc11986bb986ef262538b818
MD5 SHA1 SHA512

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log
Size 338B
SHA256 b2b60cf7408de7105bbafa6146ae1915729cb523068ecaf189623ce72865a052
MD5 de522154e4c97fc5d64cf4980474b9ef
SHA1 1a018e3ebce74c27d8216fd2cb68cc078c4f87bf
SHA512 64f00f90363c75e1b2ad7eae1f33f884c942d9a84d12b189340be222bcd5e040433af9607a06bb6918df511a8e52ca2c7b21cc04d7c5b7fe521bc10f39809905
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG
Size 331B
SHA256 47c7ea4b85b26efcff32549a80b54f6008b85e003315d98eb54dcfcfe0ea46c1
MD5 9de5dc4bcb284a38f95a1022f05aa4b2
SHA1 7da147a78ddaab8e085877e39e122fdab7aefe7a
SHA512 27cb857969b41516a85a0c5c26ed42c80418cac05674deae7bef62deeb6e1963cd9effb5aff4f612d5c8833b78acf0ac1cc4db9ad7edcc8638e86ddb18f85fd6
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 846B
SHA256 dd2549399a33951f9e4368b5c56f07b8edb8174f418ae451c54065c15ab1b9da
MD5 cccbb6d94d0e925f9553cecd0018ac2c
SHA1 ea73f8240d86f7256469a5c8b821e55255931cde
SHA512 64fdbe1622ccdd12e77f1d017a3d6b221af5cde4ab2626801d54dae17e55e607d3d46c62ec6d693b9a40a41b6cbba10ee9debd184d00797fbf604b11c8fd1887
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 940B
SHA256 03030c2f393b04747cd7a1e25fdc0982e4db2fdff74c56daf906531627953678
MD5 f166c4d5a099f1300975d87c3ebb642c
SHA1 2ab1f64ebd9e0ff179751bcc39ca2e1c4742d036
SHA512 94a7c9d98695ddeedf96d8ea7d3a8073f9058d34094a6ecbbd3b369c11f516f52cbcd656b9b6ef462523efff8939b6e188acc21ccd09beb04870796b2fa73ebd
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 ab61763ac811436f5d589f40ab36b74c97a5d9da48f48056760a9f2fe713f744
MD5 9766b3c48b6de6bdfbf6464670378c90
SHA1 2e5bdf98a61f4f1f83e56b8f263b05c5d41a33de
SHA512 574320dff1cbb463f1f5b8b8c1a948baabe894f6f4d382b83dd96caeae4b34af677947b8b586d9707cd2f5a473912ac315a8ff6bade8c24a3601d8c7f9dbeb43
SSDEEP 96:n9+kcYSNf1TlwpvWMoiHGR5mde/JwjjaAqqIir4Wmjf0wyWQyV+VD7AiEwb:n9+kcYsfFlGWMHGNJwj+AqZm4Bjf0wlg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 a4c2a4d584172a7877e4bec1e0ab600033dce563163c007f0a830a55270d7704
MD5 4c84cb1ce7aeda8099f11fc3b9a99e14
SHA1 d2c456c7354844e0326ad7868e34fa144718dd61
SHA512 5b07d75f6290a4904bd0846cff7f85ba6507eba006df31bce9464e85be75b82d28c09da59e7ec3379008771e73059c41e6244a7573731370fa30e9c4bbe8c030
SSDEEP 192:n9+kc0lfhVQGWMHBIR4t8oQxrR4YQRB4Bjf0w4xlg:n9+SfjtWeODo2VQb4Bjf0w4I
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 c4b0b5588e77f0340b2bc0ee237bdda13d299da966aab237a9e4056b620fd248
MD5 b11743315906c965e0060988214ad4a4
SHA1 06f9f2786974488de21f0612722b6473092037df
SHA512 a16e8893c17af95e3d1ac21268920f2e86edeffc684428912f9d5ca01f138e80433f8ce991874effa0cf6e98c181c19edbae222ca048d72d0f62f98d40e3e65e
SSDEEP 192:n9+kcYpfhVwGWMHGNR4t8oQxrR4YXRb4Bjf0wVrg:n9++fjNWeGDo2VXB4Bjf0we
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 f7e9ad413a7c51c203cd90e8a7e44e660f7102cfeccb8a5cf0c72739b897e479
MD5 d156bee81d1866528f8323be55c3c544
SHA1 c6f63a3587773813e0501d039e5fd6a171ec7540
SHA512 1105d76b8751bf3ac422cd89d8a6e537f123d4e4f39710961fb23def1ee6095e4038e3854d4728a04be4a31785606487abccc31514e0a656895589dcbb4abc4a
SSDEEP 96:n9+krNf1TxwpvWMoiVmde/1uT1MAqqPGw4WmjKUWQyV+VD7AiEwb:n9+kZfFxGWMP1uTGAqAn4BjKrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 f4367a1ab48aed71c40ac41f1e36d74e8126d068bc81a96b57641e3e7382f6fc
MD5 345e4a5b6deee1f38e52a3586471bcb6
SHA1 32dd15890e6324af3ea25e23e066571a371591b1
SHA512 99a0443812b07e8f2550cff748ebe52d661e99012c519e8250c7e31d4822a5922ef93946a9cfa7b66ce6dafe4ccd536cbf0560e51ca675437f977751d7463004
SSDEEP 96:n9+k+Nf1ThwpvWMoiVmdeHqZw4WmjKUWQyV+VDCziEwb:n9+kAfFhGWMXb4BjKro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 02bb99b8da76e25b4768a7d23f8ad6b5628358f621124156c3919e83943c329e
MD5 8d0bca6dfd47f282054e8a483219cd2e
SHA1 6a5981ee0a0d4618f997849021a023a1b338fc57
SHA512 9f671b481c04f84c953fb691ebeb6e042213409bded354d3275d1869cc01fbcad8c6f7a00faff8ad112b3c5143b0476121b5059d8c37a409e22f3d8f4afb41ff
SSDEEP 192:n9+kcYsfhVlGWMHGNJwj+AqAm4Bjf0wVrt:n9+/fj4WeGi+8m4Bjf0wj
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 d205f8151d6cae0b25fc1ded1bbf2b8c289f356c2c3185c7cbd5cf443e5b70ac
MD5 d62f49b7fed1c141bd1491f090c1ac27
SHA1 79627b0a092e2b6b349846c4c640d4404ccfbf73
SHA512 c21bb9b6ce31aea4d71da284ea5e008ec4aa329dccc6ee70ab611ed2da1a0d3d750c012581308de4f25ec81b3fe67d83f109cd84272e6ce2aded3cb78df775a7
SSDEEP 192:n9+kc0Cf0IPGWMHBIXdUINgrR4YXC4Bjf0w4VWrg:n9+1f0IOWeOOIEVXC4Bjf0w4Vn
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 ec045576abbb5d67fecf83e4d8cc83e62760318c58489802b93069fd596e87b2
MD5 f9e340c236a0a2932ea99486c3f86ff4
SHA1 89297e83b65268afb2eb4b8667dbe8f9d687c480
SHA512 fa191d662c00c794997c09c58f9b2d1c8a1526a34d3ea6de4dad867c4e188d4d877f89a4e67b2e59bf1d8165926ecf6546e29c5b471edfcd910b7a6eb92b1210
SSDEEP 192:n9+kc0lf0IQGWMHBIR4t8oQxrR4YXRB4Bjf0w4VWrt:n9+Sf0ItWeODo2VXb4Bjf0w4Vi
MD5 SHA1 SHA512 SSDEEP

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\000003.log
Size 1KB
SHA256 2e510a8a7e19fc701a37e71bb3c2b045aa27c7a2a57e8ae1d0cc5c745d701ead
MD5 f49be5cd36e7886ebcdcd45a57502ebd
SHA1 40bdd442c03ee75e324e996d5a6177e4670c3e00
SHA512 5506ca2c4e0345421b1f4dfcc736454593b020bf418907dad5ac0b77c8a05b7e45a894c222f7f8f3090478ab405b52de40140f1ce9ec8bbea1d944cc404cc9d1
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG
Size 319B
SHA256 f87ac4a69a8f8476acb59688c6e5429c5694d1fabb1a3fe0ce5f23000ff63fcc
MD5 96ab25616b2ac80f44f2b506b9df6684
SHA1 1bfb7ecd8e87733260c96fdf47a4b316f73e31ee
SHA512 493f6e87e5b528c06c0a2f99fae0a7ee5f666f6b54f38862ca11669ca2ae6d3c617f0eb5aa3160f56c0df7feb7f933719bb746400ddd8e7701cd1029a7527124
MD5 SHA1 SHA512

Submit Download

Tabs_13373612075744289

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sessions\Tabs_13373612075744289
Size 2KB
SHA256 600383b56513d6c37a1baf979c86937a74f9eed9e907b29dff8c2cef61303121
MD5 1bb80fb2bf984c77871f88e500f7b9c2
SHA1 b042ec25246450f4180f89aa0265c6dd2b3fbafa
SHA512 95c68b0b15f40621bb5c4216472428c528bd8f4defe47d7b70d4967cc78dd1d25e17168c6dda2b01878929e85a38a8112bf695aa80643c177aa9f43093ffc738
MD5 SHA1 SHA512

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\000003.log
Size 112B
SHA256 2b75f7190bca0a0ea21c997538043dc21a1f1abb4f9f8dbf55d324242112f056
MD5 9e1513683576def201f3ffc3d248a4c9
SHA1 a605d51544fca52975bc4cef5b287a3db0e93b6d
SHA512 9a5d7d16e405144ca10a15c39c38e81d103754cca4da45588937250bcb528e73d5b7eae88eda3991791cfebad563951defe6d73849cb47264ce001cf085b803c
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG
Size 347B
SHA256 1dad378a871d6e6cae2689c5027ffde40816f52d84f4627147f8bb3b7889fbfe
MD5 74242be539739b4635d03b8c41549350
SHA1 db0f83a139dc1b39303136e227b3c205a6c52a71
SHA512 ae16e1074c301ecf56ceb0d3193b241428fb4cf96c41fd96edf6a1890ed9fd75650884ab7dc78b96a3df5bbe12a34be98f513987ab57abbc7a9f459e42262eb5
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG
Size 323B
SHA256 0bb8b72a0ae1a2acdbbe520d113ca3967d8486a76ebe627e891e34c9313e452d
MD5 68f4a2745df3e80523ab965740c2ca2c
SHA1 27e47034b44121941c2c71ddfb09ef508b2fbad2
SHA512 9089d605843877934323999eaa7074ac858445bd8b59a606e12b4d56e627fba7ebd424fa1ef13d2c964426cec3cb704fd38ca5bef9dc61a6d376696100c48efa
MD5 SHA1 SHA512

Submit Download

Visited Links

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Visited Links
Size 128KB
SHA256 0d26656ab67e0b2c8617c37f77a9ac46dec310ab0ff905b174bcbcc2bce4da54
MD5 55a53209c600a828d25349f0bf7878b6
SHA1 973100c6693e5f3f51265935244421ea111f4763
SHA512 ee4c323ab7e17a0b893c0fadd249e40a944ab520de3cc5e1cac76acc8b0234bf36aaf99144ecbf06d588a90d11934aed0eee11bc66bfc98d14b072d683d667f2
SSDEEP 3:ImtVfzZXlJiBlll:IiVtlA
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 4166bf17b2da789b0d0cc5c74203041d98005f5d4ef88c27e8281e00148cd611
MD5 aefd77f47fb84fae5ea194496b44c67a
SHA1 dcfbb6a5b8d05662c4858664f81693bb7f803b82
SHA512 b733d502138821948267a8b27401d7c0751e590e1298fda1428e663ccd02f55d0d2446ff4bc265bdcdc61f952d13c01524a5341bc86afc3c2cde1d8589b2e1c3
MD5 SHA1 SHA512

Submit Download

load_statistics.db

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db
Size 44KB
SHA256 23d922a8c716a94c4ee707e9c700a3e252af6d25696c66029b3ef22387ce07b6
MD5 c9920d54a62dacf82c4e4a54700f273d
SHA1 62bc9d110b70ddcf7514e0a710347c62f9f90c31
SHA512 c91d5f83fd552dfddef298b753a583bc5d479813b7d6ce1c32057950bb5d29fbe63f95a14179059fb6a9dd1493ef597fdaf12e5ee0a2a78d611ecefa999fb22c
SSDEEP 96:4NsDc0yRdHRMUNBBlyN1HIGesy624/8pWOpsb:bDc0GdxMGBBl2JvesDN/8pWOpsb
MD5 SHA1 SHA512 SSDEEP

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log
Size 187B
SHA256 f8cda18ffbb9f2b8d41838bfb39aa2fbdc5eddf21c9185b32fc57f4ddc22b0e9
MD5 7b49695cbc3c62d30c92cedbd4110ab2
SHA1 d6ce1f7b3d5a8aa492ae5033e493c352f1602e3b
SHA512 f7ff8ce7f3a7ba34c32791fd2234b935fc7e8062f9b2128d6f276ba10b65e8b17d925bd9db98b873e2179436ce8a8883f4a9c9764d9732c840d4f5b2d5ed6953
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG
Size 319B
SHA256 4e10a936f70a09ddb23fd4767dd42e09b372e62e7ea518e2d70b221ae5d6222c
MD5 76d34e5724de74abb46886ad30ede9e3
SHA1 1d6674f8729e19754e092e72469604fda3ef460e
SHA512 9aa0b48e9f8cbfb26c3393ebd04639dc81ce654cf7dab12f9710d450812bbe32b4348c9b7197d63ccd694d6bae23dacb83ef69c853a02771ff4430fe1d7e4276
MD5 SHA1 SHA512

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log
Size 594B
SHA256 7e52fcf2f92b1fe166e3ce7e7124e6ea1e2689fc390f41052c3bfd3bc2340963
MD5 189d27c151240f6887cc9687845c5d3f
SHA1 30abdcce6ccaa86954497e3eeeccef38e93ae99c
SHA512 31de7e2de16eb3eac98a2dfb4d81bcb840f0d76362f2d8e8f6d08b45ec40a6e30d2901c6c0ddac7f42e504329c814a7fd7813f2acca44ac253841722a6de7270
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG
Size 337B
SHA256 445416095913646d7d245b69cf7a57751958723026c348e8cfe535a350b53d9c
MD5 5eb83b1d67643097371f7c54e75e68d9
SHA1 6a95caee7a5c8e9400dee385d6ce710798794f7e
SHA512 9007171d734681cf1e7d2c7e7346e0d3ae3744a03730a92813950dadefe48683fffa830755835b8b64ea805909182749e09d19686378bcf5601f3b410da17d81
MD5 SHA1 SHA512

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Size 11B
SHA256 ac3dd2221d90b09b795f1f72e72e4860342a4508fe336c4b822476eb25a55eaa
MD5 838a7b32aefb618130392bc7d006aa2e
SHA1 5159e0f18c9e68f0e75e2239875aa994847b8290
SHA512 9e350f0565cc726f66146838f9cebaaa38dd01892ffab9a45fe4f72e5be5459c0442e99107293a7c6f2412c71f668242c5e5a502124bc57cbf3b6ad8940cb3e9
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 7fe2535db1c658a650a8801e9db113d40f268a529c771749da91474411f68a7d
MD5 b81bdbb89b9c7b6dcbb0cb31618f5862
SHA1 230eb1d8f5796dc58c7817254bd11cb7083d9881
SHA512 1f2f944ffae13f678e90e408964706248d5065855829998c0aebff1ec03a767efb3ac526224905879bbb28b40d0d81048cf8f475b4b19a7b86c61fb6b04789e1
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexup5OWWwae2RUTaLy/emSU81R:A9iIxuERzA83h09RZxY5OWd0+aLy2pU6
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 741c3990f4da58d40bf70dedfa4347539b92a7b2d4f15e9c4424f8f030904439
MD5 16afcd15b5fbab6923fcea693f1c4666
SHA1 1b5c60cf467a982a33db16d222b93cd5e5b4da97
SHA512 2f62fe48d2719249e4f1d6978250fd983b355b57ffd5f4a8a33deeb8ed9065794e4e57ab86431bf06dbb702ae7173e446cfdc4dd4d1927f5651446572395d981
SSDEEP 192:QoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexup5OWWwae2RUAJLy/emSU31R:I9iIxuERzA83h09RZxY5OWd0fJLy2pUX
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 4387cf5fdec58badd32d057263992e1178890f198d232ea6be7d1a0597463efa
MD5 b7eafd175bf450b08c13c754ba1609fd
SHA1 7951633f618e00db2cf7c3bab0f3289791ab7b9b
SHA512 5e64fa344fd26a45fee98d8484e5b0ed418cc4fdf3ece18b68fd6c1fafd5d8b54cb4fd04a5dd3a39531d9b497d54f47b35c778a96b02c8db021d5f6630f9b4c9
SSDEEP 192:VoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupckWWwae2RUAJLy/emDUMPb:Z9iIxuERzA83h09RZxYckWd0fJLy24Uo
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\GPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

MEMZ.exe

Path C:\Users\Admin\Downloads\MEMZ.exe
Size 16KB
SHA256 3872c12d31fc9825e8661ac01ecee2572460677afbc7093f920a8436a42e28ff
MD5 1d5ad9c8d3fee874d0feb8bfac220a11
SHA1 ca6d3f7e6c784155f664a9179ca64e4034df9595
SHA512 c8246f4137416be33b6d1ac89f2428b7c44d9376ac8489a9fbf65ef128a6c53fb50479e1e400c8e201c8611992ab1d6c1bd3d6cece89013edb4d35cdd22305b1
SSDEEP 192:M2WgyvSW8gRc6olcIEiwqZKBkDFR43xWTM3LHf26gFrcx3sNq:JWgnSmFlcIqq3agmLH+6gF23sN
MD5 SHA1 SHA512 SSDEEP

Submit Download

note.txt

Path C:\note.txt
Size 218B
SHA256 8e9f20f6864c66576536c0b866c6ffdcf11397db67fe120e972e244c3c022270
MD5 afa6955439b8d516721231029fb9ca1b
SHA1 087a043cc123c0c0df2ffadcf8e71e3ac86bbae9
SHA512 5da21a31fbc4e8250dffed30f66b896bdf007ac91948140334fe36a3f010e1bac3e70a07e9f3eb9da8633189091fd5cadcabbaacd3e01da0fe7ae28a11b3dddf
MD5 SHA1 SHA512

Submit Download