2ca4803498d7d375a61bfab2a3a4cf7e0eec41d116e50a838791a55b164e0f8c

Resubmissions

13/02/2025, 01:26

250213-btppra1pcz 10

17/01/2025, 20:14

17/01/2025, 20:12

17/01/2025, 17:25

17/01/2025, 17:21

17/01/2025, 14:16

17/01/2025, 14:12

16/01/2025, 12:52

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
12/01/2025, 15:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Malware-1-master/MEMZ-Destructive.exe
Size

14KB
MD5

19dbec50735b5f2a72d4199c4e184960
SHA1

6fed7732f7cb6f59743795b2ab154a3676f4c822
SHA256

a3d5715a81f2fbeb5f76c88c9c21eeee87142909716472f911ff6950c790c24d
SHA512

aa8a6bbb1ec516d5d5acf8be6863a4c6c5d754cee12b3d374c3a6acb393376806edc422f0ffb661c210e5b9485da88521e4a0956a4b7b08a5467cfaacd90591d
SSDEEP

192:sIvxdXSQeWSg9JJS/lcIEiwqZKBkDFR43xWTM3LHn8f26gyr6yfFCj3r:sMVSaSEglcIqq3agmLc+6gyWqFCj

Score

7^/10

bootkit discovery persistence

Malware Config

Signatures

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	MEMZ-Destructive.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	MEMZ-Destructive.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	MEMZ-Destructive.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MEMZ-Destructive.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MEMZ-Destructive.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4516	MEMZ-Destructive.exe
4516	MEMZ-Destructive.exe
4516	MEMZ-Destructive.exe
4516	MEMZ-Destructive.exe
2748	MEMZ-Destructive.exe
2748	MEMZ-Destructive.exe
4516	MEMZ-Destructive.exe
4516	MEMZ-Destructive.exe
5064	MEMZ-Destructive.exe
5064	MEMZ-Destructive.exe
5064	MEMZ-Destructive.exe
5064	MEMZ-Destructive.exe
4516	MEMZ-Destructive.exe
4516	MEMZ-Destructive.exe
2748	MEMZ-Destructive.exe
2748	MEMZ-Destructive.exe
3660	MEMZ-Destructive.exe
3660	MEMZ-Destructive.exe
3660	MEMZ-Destructive.exe
2748	MEMZ-Destructive.exe
2748	MEMZ-Destructive.exe
3660	MEMZ-Destructive.exe
4516	MEMZ-Destructive.exe
4516	MEMZ-Destructive.exe
5064	MEMZ-Destructive.exe
5064	MEMZ-Destructive.exe
5104	MEMZ-Destructive.exe
5104	MEMZ-Destructive.exe
5064	MEMZ-Destructive.exe
5104	MEMZ-Destructive.exe
5064	MEMZ-Destructive.exe
5104	MEMZ-Destructive.exe
4516	MEMZ-Destructive.exe
3660	MEMZ-Destructive.exe
4516	MEMZ-Destructive.exe
3660	MEMZ-Destructive.exe
2748	MEMZ-Destructive.exe
2748	MEMZ-Destructive.exe
4516	MEMZ-Destructive.exe
4516	MEMZ-Destructive.exe
3660	MEMZ-Destructive.exe
3660	MEMZ-Destructive.exe
5104	MEMZ-Destructive.exe
5064	MEMZ-Destructive.exe
5104	MEMZ-Destructive.exe
5064	MEMZ-Destructive.exe
5064	MEMZ-Destructive.exe
5064	MEMZ-Destructive.exe
5104	MEMZ-Destructive.exe
5104	MEMZ-Destructive.exe
3660	MEMZ-Destructive.exe
3660	MEMZ-Destructive.exe
4516	MEMZ-Destructive.exe
4516	MEMZ-Destructive.exe
2748	MEMZ-Destructive.exe
2748	MEMZ-Destructive.exe
4516	MEMZ-Destructive.exe
3660	MEMZ-Destructive.exe
4516	MEMZ-Destructive.exe
3660	MEMZ-Destructive.exe
5104	MEMZ-Destructive.exe
5064	MEMZ-Destructive.exe
5104	MEMZ-Destructive.exe
5064	MEMZ-Destructive.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 22 IoCs

pid	Process
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	1832	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1832	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1664	MEMZ-Destructive.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3332 wrote to memory of 4516	3332	MEMZ-Destructive.exe	89
PID 3332 wrote to memory of 4516	3332	MEMZ-Destructive.exe	89
PID 3332 wrote to memory of 4516	3332	MEMZ-Destructive.exe	89
PID 3332 wrote to memory of 5064	3332	MEMZ-Destructive.exe	90
PID 3332 wrote to memory of 5064	3332	MEMZ-Destructive.exe	90
PID 3332 wrote to memory of 5064	3332	MEMZ-Destructive.exe	90
PID 3332 wrote to memory of 2748	3332	MEMZ-Destructive.exe	91
PID 3332 wrote to memory of 2748	3332	MEMZ-Destructive.exe	91
PID 3332 wrote to memory of 2748	3332	MEMZ-Destructive.exe	91
PID 3332 wrote to memory of 3660	3332	MEMZ-Destructive.exe	92
PID 3332 wrote to memory of 3660	3332	MEMZ-Destructive.exe	92
PID 3332 wrote to memory of 3660	3332	MEMZ-Destructive.exe	92
PID 3332 wrote to memory of 5104	3332	MEMZ-Destructive.exe	93
PID 3332 wrote to memory of 5104	3332	MEMZ-Destructive.exe	93
PID 3332 wrote to memory of 5104	3332	MEMZ-Destructive.exe	93
PID 3332 wrote to memory of 1664	3332	MEMZ-Destructive.exe	94
PID 3332 wrote to memory of 1664	3332	MEMZ-Destructive.exe	94
PID 3332 wrote to memory of 1664	3332	MEMZ-Destructive.exe	94
PID 1664 wrote to memory of 2020	1664	MEMZ-Destructive.exe	97
PID 1664 wrote to memory of 2020	1664	MEMZ-Destructive.exe	97
PID 1664 wrote to memory of 2020	1664	MEMZ-Destructive.exe	97
PID 1664 wrote to memory of 2780	1664	MEMZ-Destructive.exe	107
PID 1664 wrote to memory of 2780	1664	MEMZ-Destructive.exe	107
PID 2780 wrote to memory of 3756	2780	msedge.exe	108
PID 2780 wrote to memory of 3756	2780	msedge.exe	108
PID 2780 wrote to memory of 1468	2780	msedge.exe	109
PID 2780 wrote to memory of 1468	2780	msedge.exe	109
PID 2780 wrote to memory of 1468	2780	msedge.exe	109
PID 2780 wrote to memory of 1468	2780	msedge.exe	109
PID 2780 wrote to memory of 1468	2780	msedge.exe	109
PID 2780 wrote to memory of 1468	2780	msedge.exe	109
PID 2780 wrote to memory of 1468	2780	msedge.exe	109
PID 2780 wrote to memory of 1468	2780	msedge.exe	109
PID 2780 wrote to memory of 1468	2780	msedge.exe	109
PID 2780 wrote to memory of 1468	2780	msedge.exe	109
PID 2780 wrote to memory of 1468	2780	msedge.exe	109
PID 2780 wrote to memory of 1468	2780	msedge.exe	109
PID 2780 wrote to memory of 1468	2780	msedge.exe	109
PID 2780 wrote to memory of 1468	2780	msedge.exe	109
PID 2780 wrote to memory of 1468	2780	msedge.exe	109
PID 2780 wrote to memory of 1468	2780	msedge.exe	109
PID 2780 wrote to memory of 1468	2780	msedge.exe	109
PID 2780 wrote to memory of 1468	2780	msedge.exe	109
PID 2780 wrote to memory of 1468	2780	msedge.exe	109
PID 2780 wrote to memory of 1468	2780	msedge.exe	109
PID 2780 wrote to memory of 1468	2780	msedge.exe	109
PID 2780 wrote to memory of 1468	2780	msedge.exe	109
PID 2780 wrote to memory of 1468	2780	msedge.exe	109
PID 2780 wrote to memory of 1468	2780	msedge.exe	109
PID 2780 wrote to memory of 1468	2780	msedge.exe	109
PID 2780 wrote to memory of 1468	2780	msedge.exe	109
PID 2780 wrote to memory of 1468	2780	msedge.exe	109
PID 2780 wrote to memory of 1468	2780	msedge.exe	109
PID 2780 wrote to memory of 1468	2780	msedge.exe	109
PID 2780 wrote to memory of 1468	2780	msedge.exe	109
PID 2780 wrote to memory of 1468	2780	msedge.exe	109
PID 2780 wrote to memory of 1468	2780	msedge.exe	109
PID 2780 wrote to memory of 1468	2780	msedge.exe	109
PID 2780 wrote to memory of 1468	2780	msedge.exe	109
PID 2780 wrote to memory of 1468	2780	msedge.exe	109
PID 2780 wrote to memory of 1468	2780	msedge.exe	109
PID 2780 wrote to memory of 1468	2780	msedge.exe	109
PID 2780 wrote to memory of 1468	2780	msedge.exe	109
PID 2780 wrote to memory of 1468	2780	msedge.exe	109

C:\Users\Admin\AppData\Local\Temp\Malware-1-master\MEMZ-Destructive.exe
"C:\Users\Admin\AppData\Local\Temp\Malware-1-master\MEMZ-Destructive.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3332
- C:\Users\Admin\AppData\Local\Temp\Malware-1-master\MEMZ-Destructive.exe
  "C:\Users\Admin\AppData\Local\Temp\Malware-1-master\MEMZ-Destructive.exe" /watchdog
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4516
- C:\Users\Admin\AppData\Local\Temp\Malware-1-master\MEMZ-Destructive.exe
  "C:\Users\Admin\AppData\Local\Temp\Malware-1-master\MEMZ-Destructive.exe" /watchdog
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5064
- C:\Users\Admin\AppData\Local\Temp\Malware-1-master\MEMZ-Destructive.exe
  "C:\Users\Admin\AppData\Local\Temp\Malware-1-master\MEMZ-Destructive.exe" /watchdog
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2748
- C:\Users\Admin\AppData\Local\Temp\Malware-1-master\MEMZ-Destructive.exe
  "C:\Users\Admin\AppData\Local\Temp\Malware-1-master\MEMZ-Destructive.exe" /watchdog
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3660
- C:\Users\Admin\AppData\Local\Temp\Malware-1-master\MEMZ-Destructive.exe
  "C:\Users\Admin\AppData\Local\Temp\Malware-1-master\MEMZ-Destructive.exe" /watchdog
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5104
- C:\Users\Admin\AppData\Local\Temp\Malware-1-master\MEMZ-Destructive.exe
  "C:\Users\Admin\AppData\Local\Temp\Malware-1-master\MEMZ-Destructive.exe" /main
  2⤵
  - Checks computer location settings
  - Writes to the Master Boot Record (MBR)
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1664
- - C:\Windows\SysWOW64\notepad.exe
    "C:\Windows\System32\notepad.exe" \note.txt
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2020
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=mcafee+vs+norton
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:2780
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7fffc0fe46f8,0x7fffc0fe4708,0x7fffc0fe4718
      4⤵
      PID:3756
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1972,11603088949168416121,9384983990533445892,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1968 /prefetch:2
      4⤵
      PID:1468
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1972,11603088949168416121,9384983990533445892,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2428 /prefetch:3
      4⤵
      PID:3792
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1972,11603088949168416121,9384983990533445892,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2708 /prefetch:8
      4⤵
      PID:4668
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1972,11603088949168416121,9384983990533445892,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1
      4⤵
      PID:2472
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1972,11603088949168416121,9384983990533445892,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
      4⤵
      PID:3848
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1972,11603088949168416121,9384983990533445892,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4080 /prefetch:1
      4⤵
      PID:4320
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1972,11603088949168416121,9384983990533445892,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
      4⤵
      PID:1020
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1972,11603088949168416121,9384983990533445892,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5468 /prefetch:8
      4⤵
      PID:4140
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1972,11603088949168416121,9384983990533445892,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5468 /prefetch:8
      4⤵
      PID:216
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1972,11603088949168416121,9384983990533445892,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5532 /prefetch:1
      4⤵
      PID:3820
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1972,11603088949168416121,9384983990533445892,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5552 /prefetch:1
      4⤵
      PID:4900
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1972,11603088949168416121,9384983990533445892,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5780 /prefetch:1
      4⤵
      PID:2228
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1972,11603088949168416121,9384983990533445892,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5788 /prefetch:1
      4⤵
      PID:1100
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1972,11603088949168416121,9384983990533445892,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5592 /prefetch:1
      4⤵
      PID:5052
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1972,11603088949168416121,9384983990533445892,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5032 /prefetch:1
      4⤵
      PID:1272
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1972,11603088949168416121,9384983990533445892,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1868 /prefetch:1
      4⤵
      PID:3664
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1972,11603088949168416121,9384983990533445892,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1748 /prefetch:1
      4⤵
      PID:5088
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1972,11603088949168416121,9384983990533445892,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5152 /prefetch:1
      4⤵
      PID:4416
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1972,11603088949168416121,9384983990533445892,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6380 /prefetch:1
      4⤵
      PID:2456
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1972,11603088949168416121,9384983990533445892,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3576 /prefetch:1
      4⤵
      PID:4480
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1972,11603088949168416121,9384983990533445892,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3600 /prefetch:1
      4⤵
      PID:3992
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1972,11603088949168416121,9384983990533445892,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6136 /prefetch:1
      4⤵
      PID:3896
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1972,11603088949168416121,9384983990533445892,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6452 /prefetch:1
      4⤵
      PID:4416
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1972,11603088949168416121,9384983990533445892,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6204 /prefetch:1
      4⤵
      PID:3980
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1972,11603088949168416121,9384983990533445892,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6560 /prefetch:1
      4⤵
      PID:4328
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1972,11603088949168416121,9384983990533445892,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6608 /prefetch:1
      4⤵
      PID:1304
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1972,11603088949168416121,9384983990533445892,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6372 /prefetch:1
      4⤵
      PID:4640
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=batch+virus+download
    3⤵
    PID:4260
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7fffc0fe46f8,0x7fffc0fe4708,0x7fffc0fe4718
      4⤵
      PID:3584
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://pcoptimizerpro.com/
    3⤵
    PID:2288
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x120,0x124,0x128,0xfc,0x12c,0x7fffc0fe46f8,0x7fffc0fe4708,0x7fffc0fe4718
      4⤵
      PID:2656
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://answers.microsoft.com/en-us/protect/forum/protect_other-protect_scanning/memz-malwarevirus-trojan-completely-destroying/268bc1c2-39f4-42f8-90c2-597a673b6b45
    3⤵
    PID:3036
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7fffc0fe46f8,0x7fffc0fe4708,0x7fffc0fe4718
      4⤵
      PID:4372
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=best+way+to+kill+yourself
    3⤵
    PID:3668
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0x100,0x128,0x7fffc0fe46f8,0x7fffc0fe4708,0x7fffc0fe4718
      4⤵
      PID:3804

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4196

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3664

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x41c 0x49c
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1832

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
85ba073d7015b6ce7da19235a275f6da

SHA1
a23c8c2125e45a0788bac14423ae1f3eab92cf00

SHA256
5ad04b8c19bf43b550ad725202f79086168ecccabe791100fba203d9aa27e617

SHA512
eb4fd72d7030ea1a25af2b59769b671a5760735fb95d18145f036a8d9e6f42c903b34a7e606046c740c644fab0bb9f5b7335c1869b098f121579e71f10f5a9c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
7de1bbdc1f9cf1a58ae1de4951ce8cb9

SHA1
010da169e15457c25bd80ef02d76a940c1210301

SHA256
6e390bbc0d03a652516705775e8e9a7b7936312a8a5bea407f9d7d9fa99d957e

SHA512
e4a33f2128883e71ab41e803e8b55d0ac17cbc51be3bde42bed157df24f10f34ad264f74ef3254dbe30d253aca03158fde21518c2b78aaa05dae8308b1c5f30c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000003

Filesize
215KB

MD5
d79b35ccf8e6af6714eb612714349097

SHA1
eb3ccc9ed29830df42f3fd129951cb8b791aaf98

SHA256
c8459799169b81fdab64d028a9ebb058ea2d0ad5feb33a11f6a45a54a5ccc365

SHA512
f4be1c1e192a700139d7cff5059af81c0234ed5f032796036a1a4879b032ce4eedd16a121bbf776f17bc84a0012846f467ad48b46db4008841c25b779c7d8f5a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
168B

MD5
6f54ac97f5a7c10486a728a03585412d

SHA1
a9575dcde1ef9fb9ec03a6bb446534a12c33439f

SHA256
c50eecb5678a68adb6ad4e424ee1239a3398cd647e61bd66ffdbb5d0d4c410ac

SHA512
9946fce32ce2c7f97efdc360b5c929ab52f000d1fa67004cacb686b0865e1cd943e0da4beb1723ed686fbee3b6771d02ff705721de96cc42b078487412636375

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
960B

MD5
bf1a8bba3de3fbf0b799d622fb8f585a

SHA1
400e6ed1a768a5549a6c00092b2edcfc67b2a919

SHA256
7caf98ba6ab23b77bcc0ba544f8f376552003c77fad1bfebd9be580089c992d7

SHA512
77fbfcfd9a82d09ec42dfaf74fa7650f1366c880fc7dec85d4788c5cf251b64b20c0c107a61822c012316f2e2ed1a5b5912b581725491e2f9d9201947fc7138a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
504B

MD5
7d784b3b2e1baa439c9194560ddb77e3

SHA1
47cab12aca469290e76368e27eba4fd30084bc15

SHA256
251341e367a08ba8ecb23434416f6a956b41e28602dd9237d53c9f862fdb2d0e

SHA512
fa725b7c6740bbb45c259a5f9e7ccd125b266f73f19ba469003bd03c0f43fbd897b0ababc03b0700b61289551cfe9b5a719debf554f89395fd76b8d6d70e3136

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
144B

MD5
4fbd3d48c6311aa8de4f12d713cc370b

SHA1
52830285ce3a3200148559f10ca3283b6a2b0041

SHA256
ae7ca82546c7d92c980df9ec9be21ed2b4a4c960a5095ad64f856d26290cfce5

SHA512
b14256a8ae4a7f35b4aa2788a41aa2856d0413ffb5d5313844aa299cca9b2aae02e0320a40316e2cc5210c42c43c9448581adabc84676283b8ebb4440e0d819d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
151141004ad7c999d4e03a53526f910c

SHA1
27dc7069a02a0256417d40f1462811cbd97c9cbd

SHA256
fb7e553ec20388bdb6dd8b83cbf9d358e3b757a7b4dc3d634f4911d9316c068e

SHA512
b70790454383358694caafb147bee5658a123fae79edc611335197db3487a80cc64970eb19a7dec0f65b8754cf333fc5ccc5195b6a8750cb9f3500caaaa7777b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
1f14de7ec6cdd5f156b063941ca64ab9

SHA1
59b66d26fa568b82add705b7ea12d44571972900

SHA256
5bc35ac44485a12b0498d2fc7cdabe1c566ed58622e6d260a381d5d096021253

SHA512
b395c5231396e2d133bbf0ca6891d90722ba140d2261337538ba118dbe7d08cfdda1541b98508afd9703ce19b755520a3b5f5022e231328548cc8393ef47f24b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
44f2120d96102e3222e2ac12db6cc4aa

SHA1
b546cc067a3fdd5238d8b56023a67608875b823b

SHA256
756bb297c96e94ee98b3e1cd0f910bbae771c08789f1aeb15a866c6e41bd85a8

SHA512
42b3c7126cf7af8cca68c66e3c0332cdb92baed0e62d4763c6691c0091dc85f726a8ae7f9c1628bd11c0ba534df987810ba45f995a0bd223730d30695c335b0f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
6e9cac58ac7ac9488869c81acb137512

SHA1
ab480023cf956ad1bccc40c5bcb1f027a11c8147

SHA256
4f2111e28adb4d47a9fc1e349c99f0da1923467048679fdbcda1ab53bc580e1e

SHA512
55c989178f5fd0cf9d56b2cb5db0120d01960815843150b9370817d4e208d51075e620f952033a5bff6a9249bae9b25a8edce860f9d429c608a1245aa35c205a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
3ae8b7fd0f366b6ca56f21919b911403

SHA1
cc266881c28f97e0c2d2778f3d6e1b5d96fb948c

SHA256
b29ae7db8e54fda0c81ddb24f91fe6db823ab07a7b575a1cf3d830783c39e32e

SHA512
f8b1cc9ff2b514d02a5798bb26e98b6316d6a59e02e849fae2113828472eb38d2c3823360c32966f9b49905ec5559849768257c9c338217b523840bd18f9c20c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
81670c77a6e1fb349038c8798b319b93

SHA1
f979d8cfdd2674d248bb805549fb1e38b8255820

SHA256
095af9bb22bb1303792b96cabd2f3c714f9ff43d221fd877b7393480eb32792e

SHA512
9d0c5b51d786e0c17efa80d1a69a845ea1f5de063d5fb38636f57f40d5fdc990c32c537455da23e34c313089293c74804ab16f615fb738fe76d16588d837a279

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
099345ae093545e501fc25a98f60b100

SHA1
b1d585707d859af2b560e9dd9546ac0c6dc6a160

SHA256
edbb6ba6bcbe1aa9ac78127398c2fed7be884d94377d2c45df2adfe18cea0b3c

SHA512
b7ed32c0d5e13550ab02edf14ddca78433d3a00c21dac01da03188e9e1bba279c405f0849fe84b24861b5fd209e01605c9c578ad74bbb967fe4ac472ad1b5433

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
9f4afe2a5f3ff17cf06fc5b566f805ee

SHA1
84350a6037742daa17678fb358e34f987f6309ba

SHA256
bfe43630700752daad2a9e0624cc5d8f7a66decac556c0b8cd0196cee0c3eef3

SHA512
a19a7757b0b016b44bec00078e853d2a0522024bd56c02bba16c6e5932c4fce94651c08b701b3413d921537624077e8e62c40d98d7e352cf087dbc3c2d318f44

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe59c133.TMP

Filesize
1KB

MD5
92f7d41f8be07029633715c7371c7542

SHA1
6b472b7bd17012892e36e5d1ddda228e3f75ae59

SHA256
85905fcde0e8a4dcac1524b68131fedb7369480a02b11f3d7f98c0a8ee18cb55

SHA512
9d8ea0fd8bedc8334ee09f28a641e55804d62b7a9e8735f44c384b7bc8828f6a89e35442c925a7e39b9de73def546e393e90e517cf47d2e3904219c423a7ada6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
29e30d4acea1054227950cf928c84d6c

SHA1
69c41392e2cbb4f069f2f653bce559d20a616b81

SHA256
29e1ffebc9fdab2015a6a41adc19cff1efd0505ce5a8bec75a5c87128c87aacc

SHA512
b2afe6cb33fc5bc973981c895c2851e369dafa76825ed16cce6b7d1d4f7afe5243ead2eef080ed85b815da73e2faae7cd389048984e15dc5938f919295678537

Download Submit
C:\note.txt

Filesize
218B

MD5
afa6955439b8d516721231029fb9ca1b

SHA1
087a043cc123c0c0df2ffadcf8e71e3ac86bbae9

SHA256
8e9f20f6864c66576536c0b866c6ffdcf11397db67fe120e972e244c3c022270

SHA512
5da21a31fbc4e8250dffed30f66b896bdf007ac91948140334fe36a3f010e1bac3e70a07e9f3eb9da8633189091fd5cadcabbaacd3e01da0fe7ae28a11b3dddf

Download Submit