Analysis

  • max time kernel
    149s
  • max time network
    145s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10/11/2024, 21:21

General

  • Target

    MEMZ-Clean.bat

  • Size

    9KB

  • MD5

    bbae81b88416d8fba76dd3145a831d19

  • SHA1

    42fa0e1b90ad49f66d4ab96c8cca02f81248da8b

  • SHA256

    5c3fde60c178ed0306dd3e396032acdc9bc55c690e27a926923dd18238bbd64c

  • SHA512

    f03ac63bbb504cb53dc896c2bec8666257034b1c4a5827a4ad75c434af05f1cd631a814cc8689e60210e4ca757e61390db8d222f05bf9f3a0fa7026bdf8c4368

  • SSDEEP

    192:XBOTDzoOgdlf7MAdTyQuHq2b1vXei2SLca5icrLJlz3:ss/tDyQuHZddL5Jlz3

Score
7/10

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Command and Scripting Interpreter: JavaScript 1 TTPs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Enumerates system info in registry 2 TTPs 12 IoCs
  • Suspicious behavior: EnumeratesProcesses 24 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 20 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\MEMZ-Clean.bat"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1956
    • C:\Windows\system32\cscript.exe
      cscript x.js
      2⤵
        PID:2260
      • C:\Users\Admin\AppData\Roaming\MEMZ.exe
        "C:\Users\Admin\AppData\Roaming\MEMZ.exe"
        2⤵
        • Checks computer location settings
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:4644
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=bonzi+buddy+download+free
          3⤵
          • Enumerates system info in registry
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          • Suspicious use of WriteProcessMemory
          PID:2968
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc6df646f8,0x7ffc6df64708,0x7ffc6df64718
            4⤵
              PID:1104
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2012,4679311752478976524,8584687084257026538,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2116 /prefetch:2
              4⤵
                PID:5064
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2012,4679311752478976524,8584687084257026538,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2184 /prefetch:3
                4⤵
                • Suspicious behavior: EnumeratesProcesses
                PID:672
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2012,4679311752478976524,8584687084257026538,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2872 /prefetch:8
                4⤵
                  PID:828
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,4679311752478976524,8584687084257026538,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1
                  4⤵
                    PID:3132
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,4679311752478976524,8584687084257026538,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:1
                    4⤵
                      PID:3196
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,4679311752478976524,8584687084257026538,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4984 /prefetch:1
                      4⤵
                        PID:4160
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,4679311752478976524,8584687084257026538,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4008 /prefetch:1
                        4⤵
                          PID:1152
                        • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2012,4679311752478976524,8584687084257026538,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5508 /prefetch:8
                          4⤵
                            PID:5112
                          • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2012,4679311752478976524,8584687084257026538,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5508 /prefetch:8
                            4⤵
                            • Suspicious behavior: EnumeratesProcesses
                            PID:4800
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=how+to+create+your+own+ransomware
                          3⤵
                          • Enumerates system info in registry
                          • Suspicious behavior: EnumeratesProcesses
                          • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                          • Suspicious use of FindShellTrayWindow
                          • Suspicious use of SendNotifyMessage
                          PID:2460
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc6df646f8,0x7ffc6df64708,0x7ffc6df64718
                            4⤵
                              PID:3184
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2044,13247290998226985603,6219063570839935735,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2124 /prefetch:2
                              4⤵
                                PID:3628
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2044,13247290998226985603,6219063570839935735,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2176 /prefetch:3
                                4⤵
                                • Suspicious behavior: EnumeratesProcesses
                                PID:5008
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2044,13247290998226985603,6219063570839935735,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2912 /prefetch:8
                                4⤵
                                  PID:4912
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,13247290998226985603,6219063570839935735,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3380 /prefetch:1
                                  4⤵
                                    PID:3160
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,13247290998226985603,6219063570839935735,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3408 /prefetch:1
                                    4⤵
                                      PID:2036
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,13247290998226985603,6219063570839935735,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5000 /prefetch:1
                                      4⤵
                                        PID:4220
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,13247290998226985603,6219063570839935735,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5212 /prefetch:1
                                        4⤵
                                          PID:2724
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2044,13247290998226985603,6219063570839935735,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5500 /prefetch:8
                                          4⤵
                                            PID:4584
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2044,13247290998226985603,6219063570839935735,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5500 /prefetch:8
                                            4⤵
                                            • Suspicious behavior: EnumeratesProcesses
                                            PID:4532
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=montage+parody+making+program+2016
                                          3⤵
                                          • Enumerates system info in registry
                                          • Suspicious behavior: EnumeratesProcesses
                                          • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                                          • Suspicious use of FindShellTrayWindow
                                          • Suspicious use of SendNotifyMessage
                                          PID:2288
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc6df646f8,0x7ffc6df64708,0x7ffc6df64718
                                            4⤵
                                              PID:4552
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2196,17499921034922022632,16442053227157566549,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2212 /prefetch:2
                                              4⤵
                                                PID:4688
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2196,17499921034922022632,16442053227157566549,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2280 /prefetch:3
                                                4⤵
                                                • Suspicious behavior: EnumeratesProcesses
                                                PID:1932
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2196,17499921034922022632,16442053227157566549,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2928 /prefetch:8
                                                4⤵
                                                  PID:2564
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,17499921034922022632,16442053227157566549,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3208 /prefetch:1
                                                  4⤵
                                                    PID:2220
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,17499921034922022632,16442053227157566549,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:1
                                                    4⤵
                                                      PID:4300
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,17499921034922022632,16442053227157566549,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4916 /prefetch:1
                                                      4⤵
                                                        PID:4528
                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,17499921034922022632,16442053227157566549,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5092 /prefetch:1
                                                        4⤵
                                                          PID:1516
                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2196,17499921034922022632,16442053227157566549,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5272 /prefetch:8
                                                          4⤵
                                                            PID:1924
                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2196,17499921034922022632,16442053227157566549,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5272 /prefetch:8
                                                            4⤵
                                                            • Suspicious behavior: EnumeratesProcesses
                                                            PID:212
                                                        • C:\Windows\SysWOW64\cmd.exe
                                                          "C:\Windows\System32\cmd.exe"
                                                          3⤵
                                                          • System Location Discovery: System Language Discovery
                                                          PID:1032
                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=internet+explorer+is+the+best+browser
                                                          3⤵
                                                          • Enumerates system info in registry
                                                          • Suspicious behavior: EnumeratesProcesses
                                                          • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                                                          PID:496
                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc6df646f8,0x7ffc6df64708,0x7ffc6df64718
                                                            4⤵
                                                              PID:4664
                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2024,4408325713967284893,1329368566238069885,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2036 /prefetch:2
                                                              4⤵
                                                                PID:436
                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2024,4408325713967284893,1329368566238069885,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2384 /prefetch:3
                                                                4⤵
                                                                • Suspicious behavior: EnumeratesProcesses
                                                                PID:1224
                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2024,4408325713967284893,1329368566238069885,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2692 /prefetch:8
                                                                4⤵
                                                                  PID:4520
                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,4408325713967284893,1329368566238069885,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3392 /prefetch:1
                                                                  4⤵
                                                                    PID:1668
                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,4408325713967284893,1329368566238069885,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3412 /prefetch:1
                                                                    4⤵
                                                                      PID:3108
                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,4408325713967284893,1329368566238069885,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4984 /prefetch:1
                                                                      4⤵
                                                                        PID:3848
                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,4408325713967284893,1329368566238069885,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4988 /prefetch:1
                                                                        4⤵
                                                                          PID:1416
                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2024,4408325713967284893,1329368566238069885,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3644 /prefetch:8
                                                                          4⤵
                                                                            PID:3140
                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2024,4408325713967284893,1329368566238069885,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3644 /prefetch:8
                                                                            4⤵
                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                            PID:4524
                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,4408325713967284893,1329368566238069885,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5272 /prefetch:1
                                                                            4⤵
                                                                              PID:1448
                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,4408325713967284893,1329368566238069885,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5388 /prefetch:1
                                                                              4⤵
                                                                                PID:2480
                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,4408325713967284893,1329368566238069885,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5912 /prefetch:1
                                                                                4⤵
                                                                                  PID:4848
                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,4408325713967284893,1329368566238069885,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5920 /prefetch:1
                                                                                  4⤵
                                                                                    PID:3872
                                                                            • C:\Windows\System32\CompPkgSrv.exe
                                                                              C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                              1⤵
                                                                                PID:4512
                                                                              • C:\Windows\System32\CompPkgSrv.exe
                                                                                C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                                1⤵
                                                                                  PID:4800
                                                                                • C:\Windows\System32\CompPkgSrv.exe
                                                                                  C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                                  1⤵
                                                                                    PID:1284
                                                                                  • C:\Windows\System32\CompPkgSrv.exe
                                                                                    C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                                    1⤵
                                                                                      PID:4560
                                                                                    • C:\Windows\system32\AUDIODG.EXE
                                                                                      C:\Windows\system32\AUDIODG.EXE 0x3f8 0x464
                                                                                      1⤵
                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                      PID:3468
                                                                                    • C:\Windows\System32\CompPkgSrv.exe
                                                                                      C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                                      1⤵
                                                                                        PID:3596
                                                                                      • C:\Windows\System32\CompPkgSrv.exe
                                                                                        C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                                        1⤵
                                                                                          PID:4000
                                                                                        • C:\Windows\System32\CompPkgSrv.exe
                                                                                          C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                                          1⤵
                                                                                            PID:2292
                                                                                          • C:\Windows\System32\CompPkgSrv.exe
                                                                                            C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                                            1⤵
                                                                                              PID:4120

                                                                                            Network

                                                                                                  MITRE ATT&CK Enterprise v15

                                                                                                  Replay Monitor

                                                                                                  Loading Replay Monitor...

                                                                                                  Downloads

                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                                                                    Filesize

                                                                                                    152B

                                                                                                    MD5

                                                                                                    34d2c4f40f47672ecdf6f66fea242f4a

                                                                                                    SHA1

                                                                                                    4bcad62542aeb44cae38a907d8b5a8604115ada2

                                                                                                    SHA256

                                                                                                    b214e3affb02a2ea4469a8bbdfa8a179e7cc57cababd83b4bafae9cdbe23fa33

                                                                                                    SHA512

                                                                                                    50fba54ec95d694211a005d0e3e6cf5b5677efa16989cbf854207a1a67e3a139f32b757c6f2ce824a48f621440b93fde60ad1dc790fcec4b76edddd0d92a75d6

                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                                                                    Filesize

                                                                                                    152B

                                                                                                    MD5

                                                                                                    8749e21d9d0a17dac32d5aa2027f7a75

                                                                                                    SHA1

                                                                                                    a5d555f8b035c7938a4a864e89218c0402ab7cde

                                                                                                    SHA256

                                                                                                    915193bd331ee9ea7c750398a37fbb552b8c5a1d90edec6293688296bda6f304

                                                                                                    SHA512

                                                                                                    c645a41180ed01e854f197868283f9b40620dbbc813a1c122f6870db574ebc1c4917da4d320bdfd1cc67f23303a2c6d74e4f36dd9d3ffcfa92d3dfca3b7ca31a

                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                                                                    Filesize

                                                                                                    152B

                                                                                                    MD5

                                                                                                    f7efc6992499d246d2a5aeec7fd72d0d

                                                                                                    SHA1

                                                                                                    7f5cfb0fdf9a6842002fd99c180fd89037f6909c

                                                                                                    SHA256

                                                                                                    49878b6da135f7e56923f9df275b0caa9b90dc8af6118137db403f416103bcca

                                                                                                    SHA512

                                                                                                    aeb70df17783d3a5bdbae1cc479f36b9059534cf5ede571fea614bcea832a984b417af065e60e3d886dcf16a2c593acc148d259a08dd5750df2a8046b6d1c2ce

                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                                                                    Filesize

                                                                                                    152B

                                                                                                    MD5

                                                                                                    0bdd16dc65203c1a3ba78272624f5ec9

                                                                                                    SHA1

                                                                                                    ab97922b9b11bb6c135220cc6f25268ad4df5e98

                                                                                                    SHA256

                                                                                                    bf3ce938badde45eef6bfa33dd35e767dc53748f47e53679ab3c0872928bd6bd

                                                                                                    SHA512

                                                                                                    d639e62a5a8465f75bea180eb28643372bf4e1dcda4a23a52ae9babc008c4a44f5a7338716535471bd0485a19b49a63a385d07ed0d067c750c73b93e1c76034d

                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                                                                    Filesize

                                                                                                    152B

                                                                                                    MD5

                                                                                                    c01c08bc7678c5bbf194e33d70fe72fa

                                                                                                    SHA1

                                                                                                    23b5641400fdf43536c6840812e6ded70622b27e

                                                                                                    SHA256

                                                                                                    b21363a6c12ee2d31f64691d0f50fa6d1e1a98fddc3605fd3c73e8316eeac4fc

                                                                                                    SHA512

                                                                                                    c5b1e5e0462272d53d7ccfb60b7c61628f85add4e6b9df681ebf50f8e8ad377bc7093361cd8213664249419a8c56a7ae6cffc7b3d434231756209e33fe9d8b36

                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\07a42ab3-27e1-4b52-936f-fcd06ea958e5.tmp

                                                                                                    Filesize

                                                                                                    1B

                                                                                                    MD5

                                                                                                    5058f1af8388633f609cadb75a75dc9d

                                                                                                    SHA1

                                                                                                    3a52ce780950d4d969792a2559cd519d7ee8c727

                                                                                                    SHA256

                                                                                                    cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8

                                                                                                    SHA512

                                                                                                    0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21

                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\data_0

                                                                                                    Filesize

                                                                                                    44KB

                                                                                                    MD5

                                                                                                    c528a081318207cb69789b529bed853b

                                                                                                    SHA1

                                                                                                    e5ef2fbe78dc05718c6539c4ed2374ff35fec2aa

                                                                                                    SHA256

                                                                                                    f78fe16e4655c4e0791485673052b333b1faf2919a0b0773dec9b8ff4f37205d

                                                                                                    SHA512

                                                                                                    ca54d0be92515a1408162172516006f6d7ac496787c2b4c1aedf2f362de06edce212b9274770a47cf8b9908d34daefe82363d43fd6cd5a101e14dcd72b425c26

                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\data_1

                                                                                                    Filesize

                                                                                                    264KB

                                                                                                    MD5

                                                                                                    5a89bdbefbf39caaf58abf9c835e546d

                                                                                                    SHA1

                                                                                                    05fe80e8da9dade8828413d10ea6f5d56a20be7d

                                                                                                    SHA256

                                                                                                    ecb55fc6744a0ce4f0d94d6286655f9706d2364cc6fd2eef1aeff8ed79825ca6

                                                                                                    SHA512

                                                                                                    d795dd0a8991e902fadb573274f57669286548c80d04c60243e2afdb94c18afceff3c2ab70b831c918c19e6116c0e5229b13dec8d7313ce3c3258d9a93e99033

                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\data_2

                                                                                                    Filesize

                                                                                                    1.0MB

                                                                                                    MD5

                                                                                                    55c1dd8240457c56907255cd086a7bf3

                                                                                                    SHA1

                                                                                                    4cec7f24361ac554e8a521bb3b067973c68986f0

                                                                                                    SHA256

                                                                                                    f290f03028d8897ed18c6bcf59699a8d682706ffdcb617c10697872e7282c617

                                                                                                    SHA512

                                                                                                    9c2470a458b8ddd2e04a0ff0626e47dcd1baf3212538f5dcc4d7640d04707fc29f5e9ac91db5bb6622a5c50138930e3a80cfcb3cbd82a703232b603de61eedd1

                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\data_3

                                                                                                    Filesize

                                                                                                    4.0MB

                                                                                                    MD5

                                                                                                    155c584840c9fb5dfc5c057afb6b2eea

                                                                                                    SHA1

                                                                                                    b3bf1f1e1876d4b3c13f7890acd95bba6b7d7072

                                                                                                    SHA256

                                                                                                    761642f088db076495b94a86b921658682c18889d3f3ccb1b0b6bbd3570609bb

                                                                                                    SHA512

                                                                                                    7b82aea2e5d5ea2fd526d8f263290cab3560a4e4b1e101fcb51a76769757bf4936f2e99b284196fd94dba06d7db37cf0e0369219ecd3aa838b6d39ba834b5751

                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000002

                                                                                                    Filesize

                                                                                                    41KB

                                                                                                    MD5

                                                                                                    503766d5e5838b4fcadf8c3f72e43605

                                                                                                    SHA1

                                                                                                    6c8b2fa17150d77929b7dc183d8363f12ff81f59

                                                                                                    SHA256

                                                                                                    c53b8a39416067f4d70c21be02ca9c84724b1c525d34e7910482b64d8e301cf9

                                                                                                    SHA512

                                                                                                    5ead599ae1410a5c0e09ee73d0fdf8e8a75864ab6ce12f0777b2938fd54df62993767249f5121af97aa629d8f7c5eae182214b6f67117476e1e2b9a72f34e0b4

                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000003

                                                                                                    Filesize

                                                                                                    215KB

                                                                                                    MD5

                                                                                                    e579aca9a74ae76669750d8879e16bf3

                                                                                                    SHA1

                                                                                                    0b8f462b46ec2b2dbaa728bea79d611411bae752

                                                                                                    SHA256

                                                                                                    6e51c7866705bf0098febfaf05cf4652f96e69ac806c837bfb1199b6e21e6aaf

                                                                                                    SHA512

                                                                                                    df22f1dff74631bc14433499d1f61609de71e425410067fd08ec193d100b70d98672228906081c309a06bcba03c097ace885240a3ce71e0da4fdb8a022fc9640

                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\29ae35ae15b4ded6_0

                                                                                                    Filesize

                                                                                                    232B

                                                                                                    MD5

                                                                                                    1b9695d487debf7e771115be1e30472f

                                                                                                    SHA1

                                                                                                    91bc9c1a94fa3451847321708c858ea47095405e

                                                                                                    SHA256

                                                                                                    a9393909d5a84f738adbd146d4368d2e148c30d34af5a7be10d04ca35c11219c

                                                                                                    SHA512

                                                                                                    a8663eb7be4304ed4efc0c46ccc5c001627faa2861fb5564007bcfe6735c7ee8e0af59a33f994812f9f9f040b94b125a7abfce5e7aa2169d9e7444b6007a667e

                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\47939f49e4ecfd5c_0

                                                                                                    Filesize

                                                                                                    637KB

                                                                                                    MD5

                                                                                                    06371ea217199a668e9930b03b05c0a8

                                                                                                    SHA1

                                                                                                    93bc2be85c21938d48cad253d706f4338e397182

                                                                                                    SHA256

                                                                                                    9e63fba74d9701be782e2166844eba69ec9461be4bece9e73da9272207938598

                                                                                                    SHA512

                                                                                                    d9ef5fed89a1068ea1dd9e0611aafe6f6fcdc338e4a0bca39c4f57dc202c22abadf8e6612e786d1423d638042a9ede41572a501ed6c5a883947827054c29e022

                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\4b4bfcdbca80cfd9_0

                                                                                                    Filesize

                                                                                                    289B

                                                                                                    MD5

                                                                                                    e066b9823616052b9b86a24791c59837

                                                                                                    SHA1

                                                                                                    c0cab462078755afd177a7b629c451be4a20b4db

                                                                                                    SHA256

                                                                                                    55a2b5c43125de541d6a5f7b793c0a50b102b8d16929fb6e0041a55078b23a8d

                                                                                                    SHA512

                                                                                                    dd3bf53597d0dcc3644573d5de977958fbbe1f16de2b550f4d2095c701229a33e48b6c16af51004dd3e831f4779be2ddd8e12742e357422e63f8235b5cd5e485

                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\5a3ee6758c6e4d1c_0

                                                                                                    Filesize

                                                                                                    240B

                                                                                                    MD5

                                                                                                    d48a7449289cf77a827cbefd915eb474

                                                                                                    SHA1

                                                                                                    fbf0640bd82e06f6713b6e9dd7af4e45062ef7b0

                                                                                                    SHA256

                                                                                                    3cd5b66767ed96ee83ee89781bbc355b370e205a83c751cd6d0093311e1e25e4

                                                                                                    SHA512

                                                                                                    3c83e1b5baffd53ee9d2e3a93eb7e06d47696f5d5dc87a2e1bb58bb855ea00ea31ca80926635b5e40b29bcfe56abbbb71a50377119e498a42d1523ead571e483

                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                                                                                    Filesize

                                                                                                    168B

                                                                                                    MD5

                                                                                                    6c490f9d1b63719a994de82ee0a0e6c1

                                                                                                    SHA1

                                                                                                    7fe472e33d37050d05a0f546d3022f47ca677811

                                                                                                    SHA256

                                                                                                    f8415a86b04cd7eab8e48d53a5908506ab98754e916c38e8c1ea984ac79eb85c

                                                                                                    SHA512

                                                                                                    4001df77b1f3f60794f25c73fd3d8b23d1bcced19811136dbafb15396747de3f113c7e241a0acf03fde5de870b62c41b1bfa02869bea68d70d56961f02b0b448

                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                                                                                    Filesize

                                                                                                    144B

                                                                                                    MD5

                                                                                                    1e7872814a4e32425a235cefcfdbe3ad

                                                                                                    SHA1

                                                                                                    26eaecbbe75040cf9eaa53d2242279ed3b3619bc

                                                                                                    SHA256

                                                                                                    e3f15c121d098353b166cda8409ab8bd35348656b17fe77c64e7b6a8aeda8f66

                                                                                                    SHA512

                                                                                                    ee6c8e5a96318aaf68229ab11fb5c9d2105b083dc46c4aee57143b8ee0d3f0d786bad855fa28c1e31dfb5185fbd54ae275e727a74b2942194a66f17719f656c9

                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                                                                                    Filesize

                                                                                                    168B

                                                                                                    MD5

                                                                                                    57974d6c97f89bfb625e27a6971f01a8

                                                                                                    SHA1

                                                                                                    03ece331c406d4084f9a8ad3a42cac1ca8e4d9dc

                                                                                                    SHA256

                                                                                                    ef8053f15354ceb0c6b498d15391dc2dfe6b647936af29ebfd87be2aef1150d0

                                                                                                    SHA512

                                                                                                    74e22222b1c00e4afc83c2609a2751624f25f7956a3f5cf01a609b0a11f3fcb0411cd9bd0bd8224f2fca7a9270c867694a3981b04a981dbf18e670359e0e80b3

                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                                                                                    Filesize

                                                                                                    168B

                                                                                                    MD5

                                                                                                    4d55ca0473246094c005f78dac587adf

                                                                                                    SHA1

                                                                                                    2e652513819f80d816723fe3af8792a675cc2d41

                                                                                                    SHA256

                                                                                                    c9e338eaced43963427bb55e1a2a5fa81af4c42ad8f25ed03b469b6d7d06f6e2

                                                                                                    SHA512

                                                                                                    e121270d58f986f9e379fd20a14b1519e712fa6a5dff9ecc9c397c7bececb62cfca4d8bbc57cd8b7e81f99acd0ece7695e89be52cb54667b878fee68e073ec4b

                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG

                                                                                                    Filesize

                                                                                                    322B

                                                                                                    MD5

                                                                                                    a4b56b59060a86acc553a4bd84ad7e3b

                                                                                                    SHA1

                                                                                                    063ce072eb68b065f768732655ef84af3feb9dea

                                                                                                    SHA256

                                                                                                    1d08639bed5e45aca6147c02806791a4e80ffd266b8ce17761c927f67fba52ac

                                                                                                    SHA512

                                                                                                    7a497bb5f194f5f45ab7e8a411a8fb1cd7f6a900647e648211daf0bd61e999bda088fd7282258256f764fa6f031e914327f58d21ebdfb75beb4c6d2f6dca923b

                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Favicons

                                                                                                    Filesize

                                                                                                    20KB

                                                                                                    MD5

                                                                                                    5a24b106054cb2a3430cea0821a3d6ee

                                                                                                    SHA1

                                                                                                    ea0947ec533efc4966157002f2623e17ecf9579c

                                                                                                    SHA256

                                                                                                    cda4d5a9238164eb681060d73631a04f4bc2e6e194808140d0e2abdab15a258a

                                                                                                    SHA512

                                                                                                    3510402c46a9f4e231f146fbf41624a7cb64ffc26300ab8dbe213f5eedc13ca5d61fc28231e720be7c7c274e5e93b682da2fb397b91533a0c3b64a3b1162016b

                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Favicons-journal

                                                                                                    Filesize

                                                                                                    6KB

                                                                                                    MD5

                                                                                                    0d973c57a4035d9c37dffc41e2a1526c

                                                                                                    SHA1

                                                                                                    6efeaa9be8284502ac42408992e511913cdacca4

                                                                                                    SHA256

                                                                                                    b285c5af3a58d2ab9822d3370053aad37bf428b18f73f82823aa5d7bbcedd30a

                                                                                                    SHA512

                                                                                                    8d768add7db3f06d9cd6295310b19f05a6661cac06f0f085c5bd13008fb609f1eccc79e60053a2a6bfe311ae33ae026a14c5c04bcb458b690ac1d5f35d50c8b3

                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History

                                                                                                    Filesize

                                                                                                    124KB

                                                                                                    MD5

                                                                                                    85f4a86eebd0f0a8b2b57d8e681749cc

                                                                                                    SHA1

                                                                                                    d48149557315a3d92a12f01a3199b26aa1502b1b

                                                                                                    SHA256

                                                                                                    6973ba75c0a3f7ee4d1a0f1a290ee77cb1e56e2f82d9914cad9162b28f45ae93

                                                                                                    SHA512

                                                                                                    f7998a73fdb5ac759e588d8b690e83508a943a44422acad7ceea684ec0195d10cba7385ad805dedf10a88d632013a54735c34b46db090ec08d4f96b6b131c574

                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History Provider Cache

                                                                                                    Filesize

                                                                                                    6B

                                                                                                    MD5

                                                                                                    a9851aa4c3c8af2d1bd8834201b2ba51

                                                                                                    SHA1

                                                                                                    fa95986f7ebfac4aab3b261d3ed0a21b142e91fc

                                                                                                    SHA256

                                                                                                    e708be5e34097c8b4b6ecb50ead7705843d0dc4b0779b95ef57073d80f36c191

                                                                                                    SHA512

                                                                                                    41a1b4d650ff55b164f3db02c8440f044c4ec31d8ddbbbf56195d4e27473c6b1379dfad3581e16429650e2364791f5c19aae723efc11986bb986ef262538b818

                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History-journal

                                                                                                    Filesize

                                                                                                    28KB

                                                                                                    MD5

                                                                                                    2e05ee68fffda9f8df8db56570e65048

                                                                                                    SHA1

                                                                                                    b9d5b5ca3ade1c888fff96e420db609d0bb2141d

                                                                                                    SHA256

                                                                                                    f1d9843ab88bf21d2eab8530949d488c033427cd6c149b58f33a47e8140c5d40

                                                                                                    SHA512

                                                                                                    24d7c4ddcdc2df215edc05c83dc2892ed79eef415e650c99519a86e6a2aa0c85899ad94a928fd972452d8a79a08ed673a4de74af744b4e9383f81f8c05574b2b

                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log

                                                                                                    Filesize

                                                                                                    121B

                                                                                                    MD5

                                                                                                    aad869228523ed1f10662141ffe6db89

                                                                                                    SHA1

                                                                                                    f1f8553d4576d33d4127eb3ddba0ee16a37c78c9

                                                                                                    SHA256

                                                                                                    b96016b6726fd04325f0186a6234e8c168f44ab5b306a02533858f4cc6a27799

                                                                                                    SHA512

                                                                                                    246b258812825a7d8e2173b88124446093084b27924016dc2e4029499a10a361b78739bb78d9dc32b9835cbc5df65a1d6e53839149c6b62cf50a7cc39190a642

                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG

                                                                                                    Filesize

                                                                                                    334B

                                                                                                    MD5

                                                                                                    f0cfe05a9c686922a437824091a00345

                                                                                                    SHA1

                                                                                                    84c20c358918fe84b27cfed40a19ae4e5799b9c0

                                                                                                    SHA256

                                                                                                    eeefd34125224e5b9c574edbb036773ef559b62f4ecafb3031bc0385ea318c20

                                                                                                    SHA512

                                                                                                    a013b5442689c7d147e3aa59a4a140b20dd47d10803c3203b016f2d9ceeac95255ebd17b59e364ab42006250e4f93110bb5a5970765322e31b3076faa9426190

                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                                                                                    Filesize

                                                                                                    814B

                                                                                                    MD5

                                                                                                    b000cdfb4d12e4b7ada39f8f78118a73

                                                                                                    SHA1

                                                                                                    2aec39363fc9080ab22bc895bdb828264ab6c21e

                                                                                                    SHA256

                                                                                                    4766974012159d4f3f0ed8a6b2f383baff9a864560c9827c91df213f7e33ac1d

                                                                                                    SHA512

                                                                                                    a905b6063af97b45301ece03e0be7128c8464e28019002dff41544f5ebec5293eb02ccc9d9f5212f0982f06b96e4ff0e9c169fc3d511e8045f664374777742bd

                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                                                                                    Filesize

                                                                                                    908B

                                                                                                    MD5

                                                                                                    1337f64171284be5c3745351e85083eb

                                                                                                    SHA1

                                                                                                    4457eb86baa61cd8d1aace140377ac514853bb0e

                                                                                                    SHA256

                                                                                                    3be4854a77bbfc3e7ac3bac646ae2ee94f2513463dc09bbae3405b69eb805966

                                                                                                    SHA512

                                                                                                    0550a2a2a6d5b02700dce3873ea3ce0f358c39b3e524cce819f64ef2a367ad70baa688bcb07cec9ffcd2ebd36df63c46d82deb2c3e8fba1f6c36dfa275db9260

                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                                                                                    Filesize

                                                                                                    908B

                                                                                                    MD5

                                                                                                    49bd7a8dec4cbd59027618f9e8f0679a

                                                                                                    SHA1

                                                                                                    b8089ebc352c480368bdf11d1b0e5939ccc4a4a3

                                                                                                    SHA256

                                                                                                    7bb67061777dfb68ab31449620506a11c8e05d1916c778b191b775a785c5188e

                                                                                                    SHA512

                                                                                                    f93d05721c80047452d8e407e76f729d173b5b330f20ed4d5faeacddc0947758bbce85edacaa2225d4f52d1da13e8fabe492ae5b23d1b13b2ce0bf0f6e158350

                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                                    Filesize

                                                                                                    7KB

                                                                                                    MD5

                                                                                                    b9eff21228adf28bd15c90199220f056

                                                                                                    SHA1

                                                                                                    26da63f19a58aa87fa209b17d3223c036a30d326

                                                                                                    SHA256

                                                                                                    879e8a4f990a48af444f5863e168a18266d19904f7ee13ccefc89831762f07b0

                                                                                                    SHA512

                                                                                                    8fd117a46a72b6d93e79501543713ea030d7d6677895e6c78ab2e20f32412e0dd4f8b230204c94bf3ef53fdb2f12d1c3b417b2c3b988045d3dfbd874d403e80f

                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                                    Filesize

                                                                                                    5KB

                                                                                                    MD5

                                                                                                    3eb419745ff4f124dd3e9d7e16c29a16

                                                                                                    SHA1

                                                                                                    6ba6eb198a37527363bfaaa41c7d8277274a247a

                                                                                                    SHA256

                                                                                                    63cff540a2819687d06ac91b9821aa4e261373f516efce6950e949881732de67

                                                                                                    SHA512

                                                                                                    1f30ce03f156ac401dbc74d5905358b8001252922e65f64a5e55b3975727c2d243e7c3d205c25a8ef8865863ee61daeef2d66afbd6c36a9209119a249d2ee7a7

                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                                    Filesize

                                                                                                    7KB

                                                                                                    MD5

                                                                                                    acb7f365304d64c4ab4e8ec48a4ca7e5

                                                                                                    SHA1

                                                                                                    93af99ce4b79aed59b07448be8926ac4e770964c

                                                                                                    SHA256

                                                                                                    06e7b37f61d0397ec3b4f6f3e4132af0eb4bf2a5494c55cabee5852303ca3ade

                                                                                                    SHA512

                                                                                                    6d45f2bc3dd517ab388e316dc0356aa10bc029fabbfbebb0d61aea21ccc36c3bc3efd8b70fdf405ce4407bdc21d4443bf212f77b3f5829eaae535f59569b9084

                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                                    Filesize

                                                                                                    7KB

                                                                                                    MD5

                                                                                                    fcb7d7f3c6b4f0f1e4120333b801f9d0

                                                                                                    SHA1

                                                                                                    e7aad8a38206cb86273ed15cd5be3b07068f97dc

                                                                                                    SHA256

                                                                                                    9512a0ff6d3c41570e535e0490bda9ed435dbaa160c93fc046a7537a3961eda8

                                                                                                    SHA512

                                                                                                    234754ef399b25023a4daa0c353ee75f82666f270b74c92113bc6f658e45c2b25c7f0cc4186c034d6f765d1172ee07533ad3980d746c800e18f9a4258acc6c64

                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                                    Filesize

                                                                                                    6KB

                                                                                                    MD5

                                                                                                    d667547268cc587fc005bd6a7434fd8f

                                                                                                    SHA1

                                                                                                    3e240c2a503e869e0900d5f97cfb7e0c16e10e2a

                                                                                                    SHA256

                                                                                                    0dfe492e1f3c69f6d5c88a8203eb1987f274669594851c98930f001b17ab33f5

                                                                                                    SHA512

                                                                                                    d9ed999ea4cef6b219d2e1da4c0b2cfef20afd29542b326566223eda96050b0a81e6aa3ee0d56c17a7d0d47f34f44343645bb5348b767f2bb5c77087c1ab1003

                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                                    Filesize

                                                                                                    6KB

                                                                                                    MD5

                                                                                                    b9823aa5a6ec2d598ea085302d391423

                                                                                                    SHA1

                                                                                                    534bc389bb95b94db343ee05d04aedc8bd71ca8c

                                                                                                    SHA256

                                                                                                    1cb4cfc50a793bc40339e3a8fbbe35b11f49b1bdee1465ea22956176c8dde565

                                                                                                    SHA512

                                                                                                    4de6d9c50b9a8b4820c18953fb135016b0f9a8ff602c6703844023fc3fe1b4b643e1b1bc814f3e3fa60ee2eee36d0932915ffa1fd893ddb06bda10c52c0761a4

                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                                    Filesize

                                                                                                    7KB

                                                                                                    MD5

                                                                                                    2391834fcb3ae0b262d6f8d71b1c4fa5

                                                                                                    SHA1

                                                                                                    3489cf74601d0beddf645597334def69235b9be1

                                                                                                    SHA256

                                                                                                    3daa2cdd195de1b60b62784f1594b24022c1835529f1f48b25c27243d939e857

                                                                                                    SHA512

                                                                                                    f3ed04d8b3d26e6c26683d7ad855be3a272a2faba149aacd2435cba1a44cbbbbce4d2410998eb0d55aa88add48289e2f3d059a9e8a9ba3663052400227d16053

                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                                    Filesize

                                                                                                    7KB

                                                                                                    MD5

                                                                                                    9a6c071bc05a2098b1ba14ded40f191d

                                                                                                    SHA1

                                                                                                    03fc0285947fbf4e788643945814c6df6ea76676

                                                                                                    SHA256

                                                                                                    48395be0da321defe3a99ef96eb4efa5902d48a39a8f29b37a0e313f937076fa

                                                                                                    SHA512

                                                                                                    3aab43c123089512ce4b0eeaf5d1af6ee4a0cfd7860cda70822bcddbb571849e77b402e6cd4d70b512628137ba06911c8a6b1faa0af07fd56d075e24e2b053fe

                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Reporting and NEL

                                                                                                    Filesize

                                                                                                    36KB

                                                                                                    MD5

                                                                                                    124d3fdc675fef197771d159fb445cdc

                                                                                                    SHA1

                                                                                                    5fa6a655588b779bb491e8fb853e1f7b6d211dbc

                                                                                                    SHA256

                                                                                                    2f5f4468f9cd09f393272eb8b05b69d1fbeefecaa34940d4c4441bab7cbb7ed1

                                                                                                    SHA512

                                                                                                    db482dee661159dacb3c6b66ed028661f4711c17e6fcd73bbbbd008b42c544de5aaa12057650dffe5f7b0f6c4670e15639ea82a0c6f4aed846da8231db0a6bae

                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\000003.log

                                                                                                    Filesize

                                                                                                    538B

                                                                                                    MD5

                                                                                                    df9693d8e9a9b2f91a9be5749c409660

                                                                                                    SHA1

                                                                                                    be254e8b3c910359335e557c161b470002a90026

                                                                                                    SHA256

                                                                                                    f79d57c29ffbefbe3539e6535563e9e2f0596575627f1e3bc7c5c62607d31393

                                                                                                    SHA512

                                                                                                    ac5d2c38ab0b3672a31d1797a8cca2ef1a91faf5d09a42b2615b8293c33f7f9d146370cbd2d54deaeab8e7f2302f8e9822edb38f371bd17b06bb0a7d82fbb0fb

                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG

                                                                                                    Filesize

                                                                                                    322B

                                                                                                    MD5

                                                                                                    2ae6b1b518915013bd61b6b2b3746e9a

                                                                                                    SHA1

                                                                                                    820b4f625dd13adf9fd4f09f26cb381eb9362130

                                                                                                    SHA256

                                                                                                    91369f08e64465c349525cfdef8db5a2e7306260856e3ecd74b4143c0f2903d3

                                                                                                    SHA512

                                                                                                    a1de35a689d5a79ca5ff406e2529920250692c220347904cc428f57ede4b66c3e4eb5a3dd454e566e1350d8df15050b37075165ca0c06f67b2711feb97297b6c

                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sessions\Tabs_13375747315063986

                                                                                                    Filesize

                                                                                                    2KB

                                                                                                    MD5

                                                                                                    9c6c1bff318c09b0102487747ba5d6b5

                                                                                                    SHA1

                                                                                                    1eb8e4f3f4c6ed8eb4d273d7751afe3e15c7276d

                                                                                                    SHA256

                                                                                                    d3692cae05722a42fb7c3f7811f85b461f35df49032360ed66bd5abd689aefab

                                                                                                    SHA512

                                                                                                    26a112217206b95dc6d148e5ea3b598b5153174a04ce119e7cd6160353d6e8dceca1081c0c5c28ea2fe218db0e98135085ce90c7ad4e6b43079832724a3e6a45

                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\000003.log

                                                                                                    Filesize

                                                                                                    112B

                                                                                                    MD5

                                                                                                    4b04ee510adc7a0e13b98d7dd097ddbd

                                                                                                    SHA1

                                                                                                    a56999a5777239c90bdf4e95701609cc1e2b33aa

                                                                                                    SHA256

                                                                                                    1a4f5206329bfcb7b5ea681827dd0fbba2587c0315fb82e25ec88da84f149f35

                                                                                                    SHA512

                                                                                                    6fb92565c75b5eae1128de97e7d5670d4cbbb03305ce7374c60f5cc7cc234fe77d325f249d415ab63e6fc9c6ab6dbee99cafb5f282f4cddfca1c4b3cd13e58c5

                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG

                                                                                                    Filesize

                                                                                                    347B

                                                                                                    MD5

                                                                                                    c13d129c573ab1967b904b09e12ed58b

                                                                                                    SHA1

                                                                                                    a1446c22adbadab49f44ab4194ff3dd5b728a51e

                                                                                                    SHA256

                                                                                                    2cd31fd9a1c6833c3595bec70e0596d792deda86d0397723c6d8e198b71eef19

                                                                                                    SHA512

                                                                                                    9d856f32da267b9a40b98c04be160ea6bca73a8c68bbecdb30ff5a8f21131e449a793986feb0ed6545ebbb9e084c810f76910337095479c62b984afffdba0cf8

                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG

                                                                                                    Filesize

                                                                                                    323B

                                                                                                    MD5

                                                                                                    63d4d6caf3d6da6f3bbd26234785997f

                                                                                                    SHA1

                                                                                                    b4f91c09f8566f008edacb0bfadc8646182bb27a

                                                                                                    SHA256

                                                                                                    cee6c5db768523076719dcc8145495ad8c918872e85cac6ad09ddd1a565fa5ba

                                                                                                    SHA512

                                                                                                    b507c763e0bbcb953f5124b59077aa3424999feb8146fe8809e7f3c4b0c5d52af36faac7137a48e2475ba1933132a3b4dc71db1a10f76caa93fc4fcc979bf44e

                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Visited Links

                                                                                                    Filesize

                                                                                                    128KB

                                                                                                    MD5

                                                                                                    8c6407186ce35fcf229fd88545ace798

                                                                                                    SHA1

                                                                                                    0ca03ddc4a6dbc5c97534bea0e1951b807e1ba7f

                                                                                                    SHA256

                                                                                                    46729f3a89730a019a2232801491ec7dd5cf4fddcfd68415dae8491d1d606d1f

                                                                                                    SHA512

                                                                                                    2233daa2b179beae157d798ab9354a21fad5d6265456724f8d64f9248cb2dca08e046cad05e9f77e23581727837fe0c33038eb4be3498770299d59e7c4272ca8

                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                                                                                    Filesize

                                                                                                    16B

                                                                                                    MD5

                                                                                                    60e3f691077715586b918375dd23c6b0

                                                                                                    SHA1

                                                                                                    476d3eab15649c40c6aebfb6ac2366db50283d1b

                                                                                                    SHA256

                                                                                                    e91d13722e31f9b06c5df3582cad1ea5b73547ce3dc08b12ed461f095aad48ee

                                                                                                    SHA512

                                                                                                    d1c146d27bbf19362d6571e2865bb472ce4fe43dc535305615d92d6a2366f98533747a8a70a578d1f00199f716a61ce39fac5cab9dd67e9c044bc49e7343130e

                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                                                                                    Filesize

                                                                                                    16B

                                                                                                    MD5

                                                                                                    aefd77f47fb84fae5ea194496b44c67a

                                                                                                    SHA1

                                                                                                    dcfbb6a5b8d05662c4858664f81693bb7f803b82

                                                                                                    SHA256

                                                                                                    4166bf17b2da789b0d0cc5c74203041d98005f5d4ef88c27e8281e00148cd611

                                                                                                    SHA512

                                                                                                    b733d502138821948267a8b27401d7c0751e590e1298fda1428e663ccd02f55d0d2446ff4bc265bdcdc61f952d13c01524a5341bc86afc3c2cde1d8589b2e1c3

                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                                                                                    Filesize

                                                                                                    16B

                                                                                                    MD5

                                                                                                    6752a1d65b201c13b62ea44016eb221f

                                                                                                    SHA1

                                                                                                    58ecf154d01a62233ed7fb494ace3c3d4ffce08b

                                                                                                    SHA256

                                                                                                    0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

                                                                                                    SHA512

                                                                                                    9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                                                                                    Filesize

                                                                                                    16B

                                                                                                    MD5

                                                                                                    589c49f8a8e18ec6998a7a30b4958ebc

                                                                                                    SHA1

                                                                                                    cd4e0e2a5cb1fd5099ff88daf4f48bdba566332e

                                                                                                    SHA256

                                                                                                    26d067dbb5e448b16f93a1bb22a2541beb7134b1b3e39903346d10b96022b6b8

                                                                                                    SHA512

                                                                                                    e73566a037838d1f7db7e9b728eba07db08e079de471baca7c8f863c7af7beb36221e9ff77e0a898ce86d4ef4c36f83fb3af9c35e342061b7a5442ca3b9024d2

                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db

                                                                                                    Filesize

                                                                                                    44KB

                                                                                                    MD5

                                                                                                    abf8b69f2fa3b95a14d09425a734c3e1

                                                                                                    SHA1

                                                                                                    3cd3e4569b7ca050563d044dd5b53c82abce8411

                                                                                                    SHA256

                                                                                                    d5dcd746dea884e984844f662dc4c8302d619e6c02f57a47e8114c2af6c9d8b6

                                                                                                    SHA512

                                                                                                    6bbafad83d7ea4dc6a7e0ede1d9e386981b641c515e917bdef75a367ef8779e0db0a8a21dd9c83c47ba88803e95c266d8b8edb564e55d23b6f38db0de728a0ba

                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log

                                                                                                    Filesize

                                                                                                    187B

                                                                                                    MD5

                                                                                                    6450eec35c0cb934fc740b5a15e170d6

                                                                                                    SHA1

                                                                                                    0d60bfe754da345fe1dae3ebd652447f93ce36d2

                                                                                                    SHA256

                                                                                                    ac9daf4c057d1bc63d8a6cd1571d353dbb19b1bfb77d5066dccb64c2ee89cef3

                                                                                                    SHA512

                                                                                                    23fc0c75841330fbe5f1bfa938d5a4051a9ddda9ea3d4e8c8c3468eb3be789c1386c52546b00598808d9eb01e9ab64c70db1616d093c80b5b4725337debf5faf

                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG

                                                                                                    Filesize

                                                                                                    322B

                                                                                                    MD5

                                                                                                    f24f842b6457a8a38317b896329a7c42

                                                                                                    SHA1

                                                                                                    242287d5134610c607cd4f24d9852acdd305d8ab

                                                                                                    SHA256

                                                                                                    61daf950e038f4d15be9cef8ff61c2557e2b6e0baf8844ef834860732e9e1826

                                                                                                    SHA512

                                                                                                    e575ca9692833ba9a7add44e031065980b1a309a266eadc2255bb347df2980040679741c2cd08e6ad0e2ae603f2f0f9da010783c5fd9a47f23a76b1b96afc9c9

                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log

                                                                                                    Filesize

                                                                                                    594B

                                                                                                    MD5

                                                                                                    dc7002c5f44315b4c21e99f61a5706b9

                                                                                                    SHA1

                                                                                                    aad85a217ad637fdb0d02cf203d992df72802bc3

                                                                                                    SHA256

                                                                                                    2c62e8ed03fb2c530ae95fb6f54aa977653ebc025929c7a400b36a572d4cdf9b

                                                                                                    SHA512

                                                                                                    dce8aa4370de6c20a2756033f1fa37f16d9e0f02735d95b453dbe791c5604f1d72815e2183f9377fcf427cc177fd0e5a04e4b718fc63a716631ddd4540d46e3d

                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG

                                                                                                    Filesize

                                                                                                    340B

                                                                                                    MD5

                                                                                                    94e555d191e00eb0b53eada8b5181689

                                                                                                    SHA1

                                                                                                    a72d0cd6a8a2346a07cc036e7fa873246f71f0ba

                                                                                                    SHA256

                                                                                                    b6e64ed87aab24e0c0297c97df236b00e2dc137a15907a6db356a38a88122a05

                                                                                                    SHA512

                                                                                                    114efcb91a7278bba10c731e6ea9bfe8577bd2840330efd34312fe56d4c0c9f4236682a090c7b76b629bd4141d5d5656c3e84b7c1efae5df55ba8b9ed44abb5e

                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\data_0

                                                                                                    Filesize

                                                                                                    44KB

                                                                                                    MD5

                                                                                                    b8e80a98412d45a1a5cacc66c8461228

                                                                                                    SHA1

                                                                                                    6f7fd5f26268f991cd745acca57811533c6bb769

                                                                                                    SHA256

                                                                                                    661d0bff90c04cd3475b128585194c03ceb67af579f314f4671bf78dd125ee88

                                                                                                    SHA512

                                                                                                    b2a28f6391817256a2d58bc58a46870ca0f729cbf3db6cc13875874dee68a9d064388baad89b11e6943186d994811cc2cc6e02f9f1ea58d4f53ffb5f7f66a7d2

                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\data_1

                                                                                                    Filesize

                                                                                                    264KB

                                                                                                    MD5

                                                                                                    639afffe77850d090959e0ddacbcae67

                                                                                                    SHA1

                                                                                                    7f5c0cd0a339ac4be57f6c867552692fe40bde28

                                                                                                    SHA256

                                                                                                    c19d79ab23c8a5d8f4c722ffa503e0ecc64563c5b9c034212ea443a556020f10

                                                                                                    SHA512

                                                                                                    6a82558ecef63d00180687990b7591de8ec3668bc92e9f920b2999d5354174639e3661fb4ebcb8495ffeb3f3e34a1184cc2cf69ec34c6c37dcb86d911489705b

                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\data_1

                                                                                                    Filesize

                                                                                                    264KB

                                                                                                    MD5

                                                                                                    9441685a8711303e478939320357f20f

                                                                                                    SHA1

                                                                                                    85d36dc420b4950dde0869998955aa11958d1e95

                                                                                                    SHA256

                                                                                                    b94c505f875b895acb5d1f05b12b776079e10a38d32c27d09bb40a07eb213c38

                                                                                                    SHA512

                                                                                                    6735578e68f8f4902deb85edba8aba7dfb07cd53884bc545cb96ceac27b3ea5d0faafcfdd03068c582b739f450fd400bbfbb5837840e25e06d6744bb9b72f49e

                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\data_3

                                                                                                    Filesize

                                                                                                    4.0MB

                                                                                                    MD5

                                                                                                    bdbe9e376e983f66a494804c6809e4ec

                                                                                                    SHA1

                                                                                                    d45d0d7a9e1e0c3929e7c9d47cf7cba965a88654

                                                                                                    SHA256

                                                                                                    46e64c8824dcd34859dedf4dd4eb1bd54596a10a782c4b1ac52ac5c02db251dc

                                                                                                    SHA512

                                                                                                    5ff4f973e1b0e06856e47434a25991be0ebb3b424c0959943d29e54ba31c503d8b28100639d3a1c5b0d2e67d1cfb3dbd2a9699e05887e9e713bf95736a6d0f52

                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version

                                                                                                    Filesize

                                                                                                    11B

                                                                                                    MD5

                                                                                                    838a7b32aefb618130392bc7d006aa2e

                                                                                                    SHA1

                                                                                                    5159e0f18c9e68f0e75e2239875aa994847b8290

                                                                                                    SHA256

                                                                                                    ac3dd2221d90b09b795f1f72e72e4860342a4508fe336c4b822476eb25a55eaa

                                                                                                    SHA512

                                                                                                    9e350f0565cc726f66146838f9cebaaa38dd01892ffab9a45fe4f72e5be5459c0442e99107293a7c6f2412c71f668242c5e5a502124bc57cbf3b6ad8940cb3e9

                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                                                    Filesize

                                                                                                    10KB

                                                                                                    MD5

                                                                                                    8b1f44eb5f19ab5b948b5064ef724df5

                                                                                                    SHA1

                                                                                                    9fd3b380da21612cef1232c794c60f282c4df985

                                                                                                    SHA256

                                                                                                    4c9fee3099f9978b9369aab01aeac140fcad496190a67ba15114e728898fc4c2

                                                                                                    SHA512

                                                                                                    61025f5fe1f8b404c399db390dae94bc7ae7c7c028eadd06c9f1f76a7d9c8d5ce5b7a39ba48bce52ed3658b27e2895d00c7abb76e3343bb3badc0fd833273b63

                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                                                    Filesize

                                                                                                    10KB

                                                                                                    MD5

                                                                                                    abad955dcfd160449e3e1b325f788d80

                                                                                                    SHA1

                                                                                                    51e034e447f30aaf58789b3e84234570149d808e

                                                                                                    SHA256

                                                                                                    6c8f9e3389c65e1dbdda792ee3bc0dd52ece28551721480b95cf87470da51267

                                                                                                    SHA512

                                                                                                    13dc9187168b6a28843f1257ddfdbcabb3eba1352904a12a9b30fa1266bad64bf240bee6c18e8ac53fdc84617f0bd6508c94816d2fe03a09883590989e29ac58

                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                                                    Filesize

                                                                                                    10KB

                                                                                                    MD5

                                                                                                    87f47db02465faa03fd916792e141e29

                                                                                                    SHA1

                                                                                                    fb2d5b41fcc7c2c5cef06256d6e8d3b05531cc0d

                                                                                                    SHA256

                                                                                                    c1ef0abca722a98519d4de5af65e4e336a6beda6577a1510386703a9e029e2a6

                                                                                                    SHA512

                                                                                                    7557bce1376403ab4fd265702d2e55c78c7fc835242726c66aa6035ab292b16697acf6b5879f62081b8dc447186bd72b315ef683682abada8e5709ae1baa7e93

                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                                                    Filesize

                                                                                                    10KB

                                                                                                    MD5

                                                                                                    bd5d1e8ce08802f91cea0ef4c5f306f9

                                                                                                    SHA1

                                                                                                    c82ab1ad43247cfed8f239b5358ada37f5e940b5

                                                                                                    SHA256

                                                                                                    75af1ef07393dd2a945d5591b48b8232f75b4a66e4d23a52d2252f250df16901

                                                                                                    SHA512

                                                                                                    53247c5128d1ce764a16f78bdccf74af90b0cfc4764dfcb557712bdbd0c3086c7a6db2ef7f192872f0f5dff16c398079400fece488df7aad9ac71f39902abdd5

                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                                                    Filesize

                                                                                                    10KB

                                                                                                    MD5

                                                                                                    b270cb8a13057c00cdc3c92d19dce08f

                                                                                                    SHA1

                                                                                                    1e2d620f3376ae132d45354bdc6c602e3f781fd2

                                                                                                    SHA256

                                                                                                    39a2e605abb79c556d5538b3fc5331912739fe976cd1b7ea3df328177a5a0e5b

                                                                                                    SHA512

                                                                                                    611933297deda73c68fcd78e2a6c7e3069452f8d262b336e46c0d7ecae67b99f38e8e73f2415851d57e9bedcb036e864c3768e29e07f93ebec3ee6d42067dcbe

                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\GPUCache\data_1

                                                                                                    Filesize

                                                                                                    264KB

                                                                                                    MD5

                                                                                                    f50f89a0a91564d0b8a211f8921aa7de

                                                                                                    SHA1

                                                                                                    112403a17dd69d5b9018b8cede023cb3b54eab7d

                                                                                                    SHA256

                                                                                                    b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

                                                                                                    SHA512

                                                                                                    bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\9cd93bc6dcf544bae69531052e64647ec02f2bb4.tbres

                                                                                                    Filesize

                                                                                                    4KB

                                                                                                    MD5

                                                                                                    446695216dc8938598442a2820303919

                                                                                                    SHA1

                                                                                                    44d9356dbae0e6b491ff3fa2c3d423a1267dbee0

                                                                                                    SHA256

                                                                                                    b44d5ad2715ba9080bb35afbe7103dc70e298e198f2ae8a3b77a385022a2788d

                                                                                                    SHA512

                                                                                                    7da7508f0f906e78ede9a2e2a120b4ea2954917f746da63930294120a25bea7bb42b4b5aeead6f7f6053943a3852873598cb63fc2b230a576505cb7274933056

                                                                                                  • C:\Users\Admin\AppData\Local\Temp\x

                                                                                                    Filesize

                                                                                                    8KB

                                                                                                    MD5

                                                                                                    5ce1a2162bf5e16485f5e263b3cc5cf5

                                                                                                    SHA1

                                                                                                    e9ec3e06bef08fcf29be35c6a4b2217a8328133c

                                                                                                    SHA256

                                                                                                    0557ea4c5e309b16458ca32ac617b76d1a55f5f0103e368d05c0f0386b7a0a43

                                                                                                    SHA512

                                                                                                    ceb5e270bdbcab5be645e50705e3111a5c4751a7a865580d53fa86580025201264a49dd0ea9135b10cff28d7bb21b767ac5d4aff40e880a866ab35df273b5de1

                                                                                                  • C:\Users\Admin\AppData\Local\Temp\x

                                                                                                    Filesize

                                                                                                    4KB

                                                                                                    MD5

                                                                                                    20e335859ff991575cf1ddf538e5817c

                                                                                                    SHA1

                                                                                                    1e81b804d67d6c0e22c0cef7e1cb9f86ce0ef5ee

                                                                                                    SHA256

                                                                                                    88339750431112ed60cdf9bdb7697434ba9b38e2d15ad604c4462705bc1bdfcf

                                                                                                    SHA512

                                                                                                    012251b342722cf35ebec2c7d071db505a992d81fc4b3492cd87640b5c955dc084825fc5e72edc821f4c481867183f21d26cd904fe7f0373d1156332f87b031d

                                                                                                  • C:\Users\Admin\AppData\Local\Temp\x.js

                                                                                                    Filesize

                                                                                                    448B

                                                                                                    MD5

                                                                                                    8eec8704d2a7bc80b95b7460c06f4854

                                                                                                    SHA1

                                                                                                    1b34585c1fa7ec0bd0505478ac9dbb8b8d19f326

                                                                                                    SHA256

                                                                                                    aa01b8864b43e92077a106ed3d4656a511f3ba1910fba40c78a32ee6a621d596

                                                                                                    SHA512

                                                                                                    e274b92810e9a30627a65f87448d784967a2fcfbf49858cbe6ccb841f09e0f53fde253ecc1ea0c7de491d8cc56a6cf8c79d1b7c657e72928cfb0479d11035210

                                                                                                  • C:\Users\Admin\AppData\Local\Temp\z.zip

                                                                                                    Filesize

                                                                                                    5KB

                                                                                                    MD5

                                                                                                    d2ea024b943caa1361833885b832d20b

                                                                                                    SHA1

                                                                                                    1e17c27a3260862645bdaff5cf82c44172d4df9a

                                                                                                    SHA256

                                                                                                    39df3364a3af6f7d360aa7e1345e27befc4be960e0e7e7e060b20f3389b80e76

                                                                                                    SHA512

                                                                                                    7b7cfb5e689feed6a52eedf36b89a7b5cc411191571c0af5e5d704b5f24bfa04afa62d1daab159a7e5702d80e56f3946bf32db0551d256419ca12cd3c57dcecb

                                                                                                  • C:\Users\Admin\AppData\Roaming\MEMZ.exe

                                                                                                    Filesize

                                                                                                    12KB

                                                                                                    MD5

                                                                                                    9c642c5b111ee85a6bccffc7af896a51

                                                                                                    SHA1

                                                                                                    eca8571b994fd40e2018f48c214fab6472a98bab

                                                                                                    SHA256

                                                                                                    4bbf7589615ebdb6c769d6d2e7bdcb26072bac0cda6e225a4133ba8819e688d5

                                                                                                    SHA512

                                                                                                    23cc74b5a7bdf70ba789d1730a0009414cfb9c780544e3d8d841be58782b9a9a089969c4295a0da25d07285505992386486d6ff0524e75605b96bb99cd3aaa1c