2ca4803498d7d375a61bfab2a3a4cf7e0eec41d116e50a838791a55b164e0f8c

max time kernel
855s
max time network
861s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
16/01/2025, 12:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Malware-1-master/MEMZ-Clean.exe
Size 12KB
Sample250116-p2cbaasjam
SHA256 4bbf7589615ebdb6c769d6d2e7bdcb26072bac0cda6e225a4133ba8819e688d5
MD5 9c642c5b111ee85a6bccffc7af896a51
SHA1 eca8571b994fd40e2018f48c214fab6472a98bab
SHA512 23cc74b5a7bdf70ba789d1730a0009414cfb9c780544e3d8d841be58782b9a9a089969c4295a0da25d07285505992386486d6ff0524e75605b96bb99cd3aaa1c
SSDEEP 192:BCMfc/GinpRBueYDw4+kEeN4FRrfMFFp3+f2dvGhT59uay:AMfceinpOeRENYhfOj+eGdKa
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation	MEMZ-Clean.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\devmgmt.msc	mmc.exe
File opened for modification	C:\Windows\System32\devmgmt.msc	mmc.exe

Drops file in Windows directory 58 IoCs

description	ioc	Process
File created	C:\Windows\INF\c_fsundelete.PNF	mmc.exe
File created	C:\Windows\INF\c_sslaccel.PNF	mmc.exe
File created	C:\Windows\INF\c_apo.PNF	mmc.exe
File created	C:\Windows\INF\c_fssecurityenhancer.PNF	mmc.exe
File created	C:\Windows\INF\c_fsinfrastructure.PNF	mmc.exe
File created	C:\Windows\INF\c_firmware.PNF	mmc.exe
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	mspaint.exe
File created	C:\Windows\INF\c_smrdisk.PNF	mmc.exe
File created	C:\Windows\INF\c_scmvolume.PNF	mmc.exe
File created	C:\Windows\INF\wsdprint.PNF	mmc.exe
File created	C:\Windows\INF\c_ucm.PNF	mmc.exe
File created	C:\Windows\INF\c_fsphysicalquotamgmt.PNF	mmc.exe
File created	C:\Windows\INF\c_fscopyprotection.PNF	mmc.exe
File created	C:\Windows\INF\c_fsactivitymonitor.PNF	mmc.exe
File created	C:\Windows\INF\c_fscfsmetadataserver.PNF	mmc.exe
File created	C:\Windows\INF\miradisp.PNF	mmc.exe
File created	C:\Windows\INF\c_fscompression.PNF	mmc.exe
File created	C:\Windows\INF\digitalmediadevice.PNF	mmc.exe
File created	C:\Windows\INF\c_swcomponent.PNF	mmc.exe
File created	C:\Windows\INF\c_cashdrawer.PNF	mmc.exe
File created	C:\Windows\INF\c_barcodescanner.PNF	mmc.exe
File created	C:\Windows\INF\c_fscontentscreener.PNF	mmc.exe
File created	C:\Windows\INF\c_fsreplication.PNF	mmc.exe
File created	C:\Windows\INF\c_display.PNF	mmc.exe
File created	C:\Windows\INF\c_computeaccelerator.PNF	mmc.exe
File created	C:\Windows\INF\rdcameradriver.PNF	mmc.exe
File created	C:\Windows\INF\c_receiptprinter.PNF	mmc.exe
File created	C:\Windows\INF\xusb22.PNF	mmc.exe
File created	C:\Windows\INF\c_magneticstripereader.PNF	mmc.exe
File created	C:\Windows\INF\c_scmdisk.PNF	mmc.exe
File created	C:\Windows\INF\c_fsantivirus.PNF	mmc.exe
File created	C:\Windows\INF\c_fsopenfilebackup.PNF	mmc.exe
File created	C:\Windows\INF\c_fssystemrecovery.PNF	mmc.exe
File created	C:\Windows\INF\c_proximity.PNF	mmc.exe
File created	C:\Windows\INF\remoteposdrv.PNF	mmc.exe
File created	C:\Windows\INF\c_fssystem.PNF	mmc.exe
File created	C:\Windows\INF\c_fsquotamgmt.PNF	mmc.exe
File created	C:\Windows\INF\c_fscontinuousbackup.PNF	mmc.exe
File created	C:\Windows\INF\c_netdriver.PNF	mmc.exe
File created	C:\Windows\INF\dc1-controller.PNF	mmc.exe
File created	C:\Windows\INF\PerceptionSimulationSixDof.PNF	mmc.exe
File created	C:\Windows\INF\c_volume.PNF	mmc.exe
File created	C:\Windows\INF\c_mcx.PNF	mmc.exe
File created	C:\Windows\INF\c_diskdrive.PNF	mmc.exe
File created	C:\Windows\INF\rawsilo.PNF	mmc.exe
File created	C:\Windows\INF\c_extension.PNF	mmc.exe
File created	C:\Windows\INF\c_linedisplay.PNF	mmc.exe
File created	C:\Windows\INF\oposdrv.PNF	mmc.exe
File created	C:\Windows\INF\c_fshsm.PNF	mmc.exe
File created	C:\Windows\INF\c_holographic.PNF	mmc.exe
File created	C:\Windows\INF\c_media.PNF	mmc.exe
File created	C:\Windows\INF\c_smrvolume.PNF	mmc.exe
File created	C:\Windows\INF\c_fsencryption.PNF	mmc.exe
File created	C:\Windows\INF\c_camera.PNF	mmc.exe
File created	C:\Windows\INF\c_fsvirtualization.PNF	mmc.exe
File created	C:\Windows\INF\c_monitor.PNF	mmc.exe
File created	C:\Windows\INF\c_processor.PNF	mmc.exe
File created	C:\Windows\INF\ts_generic.PNF	mmc.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mmc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regedit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mspaint.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MEMZ-Clean.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mmc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wordpad.exe

Checks SCSI registry key(s) 3 TTPs 40 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	mmc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A	mmc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	mmc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	mmc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	mmc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	mmc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	mmc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	mmc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	mmc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	mmc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	mmc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName	mmc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	mmc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A	mmc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	mmc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	mmc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A\	mmc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	mmc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	mmc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	mmc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	mmc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A\	mmc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom	mmc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	mmc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A	mmc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	mmc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	mmc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	mmc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A	mmc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	mmc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	mmc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A\	mmc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	mmc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName	mmc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom	mmc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	mmc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	mmc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A\	mmc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	mmc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	mmc.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings	MEMZ-Clean.exe
Key created	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings	calc.exe

Runs regedit.exe 1 IoCs

pid	Process
2764	regedit.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
1188	msedge.exe
1188	msedge.exe
1328	msedge.exe
1328	msedge.exe
3032	identity_helper.exe
3032	identity_helper.exe
6036	msedge.exe
6036	msedge.exe
6036	msedge.exe
6036	msedge.exe
3492	mspaint.exe
3492	mspaint.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1980	mmc.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 30 IoCs

pid	Process
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe

Suspicious behavior: SetClipboardViewer 1 IoCs

pid	Process
2132	mmc.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: 33	1980	mmc.exe
Token: SeIncBasePriorityPrivilege	1980	mmc.exe
Token: 33	1980	mmc.exe
Token: SeIncBasePriorityPrivilege	1980	mmc.exe
Token: 33	2132	mmc.exe
Token: SeIncBasePriorityPrivilege	2132	mmc.exe
Token: 33	2132	mmc.exe
Token: SeIncBasePriorityPrivilege	2132	mmc.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe

Suspicious use of SetWindowsHookEx 16 IoCs

pid	Process
2860	mmc.exe
1980	mmc.exe
1980	mmc.exe
2336	OpenWith.exe
436	wordpad.exe
436	wordpad.exe
436	wordpad.exe
436	wordpad.exe
436	wordpad.exe
2736	mmc.exe
2132	mmc.exe
2132	mmc.exe
3492	mspaint.exe
3492	mspaint.exe
3492	mspaint.exe
3492	mspaint.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 524 wrote to memory of 1328	524	MEMZ-Clean.exe	89
PID 524 wrote to memory of 1328	524	MEMZ-Clean.exe	89
PID 1328 wrote to memory of 3420	1328	msedge.exe	90
PID 1328 wrote to memory of 3420	1328	msedge.exe	90
PID 1328 wrote to memory of 3200	1328	msedge.exe	91
PID 1328 wrote to memory of 3200	1328	msedge.exe	91
PID 1328 wrote to memory of 3200	1328	msedge.exe	91
PID 1328 wrote to memory of 3200	1328	msedge.exe	91
PID 1328 wrote to memory of 3200	1328	msedge.exe	91
PID 1328 wrote to memory of 3200	1328	msedge.exe	91
PID 1328 wrote to memory of 3200	1328	msedge.exe	91
PID 1328 wrote to memory of 3200	1328	msedge.exe	91
PID 1328 wrote to memory of 3200	1328	msedge.exe	91
PID 1328 wrote to memory of 3200	1328	msedge.exe	91
PID 1328 wrote to memory of 3200	1328	msedge.exe	91
PID 1328 wrote to memory of 3200	1328	msedge.exe	91
PID 1328 wrote to memory of 3200	1328	msedge.exe	91
PID 1328 wrote to memory of 3200	1328	msedge.exe	91
PID 1328 wrote to memory of 3200	1328	msedge.exe	91
PID 1328 wrote to memory of 3200	1328	msedge.exe	91
PID 1328 wrote to memory of 3200	1328	msedge.exe	91
PID 1328 wrote to memory of 3200	1328	msedge.exe	91
PID 1328 wrote to memory of 3200	1328	msedge.exe	91
PID 1328 wrote to memory of 3200	1328	msedge.exe	91
PID 1328 wrote to memory of 3200	1328	msedge.exe	91
PID 1328 wrote to memory of 3200	1328	msedge.exe	91
PID 1328 wrote to memory of 3200	1328	msedge.exe	91
PID 1328 wrote to memory of 3200	1328	msedge.exe	91
PID 1328 wrote to memory of 3200	1328	msedge.exe	91
PID 1328 wrote to memory of 3200	1328	msedge.exe	91
PID 1328 wrote to memory of 3200	1328	msedge.exe	91
PID 1328 wrote to memory of 3200	1328	msedge.exe	91
PID 1328 wrote to memory of 3200	1328	msedge.exe	91
PID 1328 wrote to memory of 3200	1328	msedge.exe	91
PID 1328 wrote to memory of 3200	1328	msedge.exe	91
PID 1328 wrote to memory of 3200	1328	msedge.exe	91
PID 1328 wrote to memory of 3200	1328	msedge.exe	91
PID 1328 wrote to memory of 3200	1328	msedge.exe	91
PID 1328 wrote to memory of 3200	1328	msedge.exe	91
PID 1328 wrote to memory of 3200	1328	msedge.exe	91
PID 1328 wrote to memory of 3200	1328	msedge.exe	91
PID 1328 wrote to memory of 3200	1328	msedge.exe	91
PID 1328 wrote to memory of 3200	1328	msedge.exe	91
PID 1328 wrote to memory of 3200	1328	msedge.exe	91
PID 1328 wrote to memory of 1188	1328	msedge.exe	92
PID 1328 wrote to memory of 1188	1328	msedge.exe	92
PID 1328 wrote to memory of 2248	1328	msedge.exe	93
PID 1328 wrote to memory of 2248	1328	msedge.exe	93
PID 1328 wrote to memory of 2248	1328	msedge.exe	93
PID 1328 wrote to memory of 2248	1328	msedge.exe	93
PID 1328 wrote to memory of 2248	1328	msedge.exe	93
PID 1328 wrote to memory of 2248	1328	msedge.exe	93
PID 1328 wrote to memory of 2248	1328	msedge.exe	93
PID 1328 wrote to memory of 2248	1328	msedge.exe	93
PID 1328 wrote to memory of 2248	1328	msedge.exe	93
PID 1328 wrote to memory of 2248	1328	msedge.exe	93
PID 1328 wrote to memory of 2248	1328	msedge.exe	93
PID 1328 wrote to memory of 2248	1328	msedge.exe	93
PID 1328 wrote to memory of 2248	1328	msedge.exe	93
PID 1328 wrote to memory of 2248	1328	msedge.exe	93
PID 1328 wrote to memory of 2248	1328	msedge.exe	93
PID 1328 wrote to memory of 2248	1328	msedge.exe	93
PID 1328 wrote to memory of 2248	1328	msedge.exe	93
PID 1328 wrote to memory of 2248	1328	msedge.exe	93

C:\Users\Admin\AppData\Local\Temp\Malware-1-master\MEMZ-Clean.exe
"C:\Users\Admin\AppData\Local\Temp\Malware-1-master\MEMZ-Clean.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=how+2+remove+a+virus
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:1328
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffad82e46f8,0x7ffad82e4708,0x7ffad82e4718
    3⤵
    PID:3420
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2164,10243408369955766334,6459576151559617550,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2184 /prefetch:2
    3⤵
    PID:3200
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2164,10243408369955766334,6459576151559617550,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2236 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1188
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2164,10243408369955766334,6459576151559617550,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2852 /prefetch:8
    3⤵
    PID:2248
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,10243408369955766334,6459576151559617550,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
    3⤵
    PID:4428
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,10243408369955766334,6459576151559617550,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
    3⤵
    PID:3888
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,10243408369955766334,6459576151559617550,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4664 /prefetch:1
    3⤵
    PID:4896
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,10243408369955766334,6459576151559617550,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3904 /prefetch:1
    3⤵
    PID:4828
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2164,10243408369955766334,6459576151559617550,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5272 /prefetch:8
    3⤵
    PID:812
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2164,10243408369955766334,6459576151559617550,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5272 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3032
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,10243408369955766334,6459576151559617550,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5420 /prefetch:1
    3⤵
    PID:4204
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,10243408369955766334,6459576151559617550,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5452 /prefetch:1
    3⤵
    PID:3328
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,10243408369955766334,6459576151559617550,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5720 /prefetch:1
    3⤵
    PID:2860
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,10243408369955766334,6459576151559617550,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4800 /prefetch:1
    3⤵
    PID:2392
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,10243408369955766334,6459576151559617550,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5392 /prefetch:1
    3⤵
    PID:3756
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,10243408369955766334,6459576151559617550,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5708 /prefetch:1
    3⤵
    PID:1204
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,10243408369955766334,6459576151559617550,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1292 /prefetch:1
    3⤵
    PID:1016
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,10243408369955766334,6459576151559617550,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5420 /prefetch:1
    3⤵
    PID:2100
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,10243408369955766334,6459576151559617550,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1948 /prefetch:1
    3⤵
    PID:5512
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,10243408369955766334,6459576151559617550,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6276 /prefetch:1
    3⤵
    PID:5612
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2164,10243408369955766334,6459576151559617550,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6176 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:6036
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,10243408369955766334,6459576151559617550,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5292 /prefetch:1
    3⤵
    PID:3780
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,10243408369955766334,6459576151559617550,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5348 /prefetch:1
    3⤵
    PID:5196
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,10243408369955766334,6459576151559617550,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4812 /prefetch:1
    3⤵
    PID:5636
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,10243408369955766334,6459576151559617550,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6372 /prefetch:1
    3⤵
    PID:5736
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,10243408369955766334,6459576151559617550,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6568 /prefetch:1
    3⤵
    PID:880
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,10243408369955766334,6459576151559617550,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5916 /prefetch:1
    3⤵
    PID:6048
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,10243408369955766334,6459576151559617550,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1772 /prefetch:1
    3⤵
    PID:5764
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,10243408369955766334,6459576151559617550,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6544 /prefetch:1
    3⤵
    PID:5228
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,10243408369955766334,6459576151559617550,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7144 /prefetch:1
    3⤵
    PID:3092
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,10243408369955766334,6459576151559617550,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6936 /prefetch:1
    3⤵
    PID:2336
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,10243408369955766334,6459576151559617550,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7412 /prefetch:1
    3⤵
    PID:6036
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,10243408369955766334,6459576151559617550,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6460 /prefetch:1
    3⤵
    PID:6060
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,10243408369955766334,6459576151559617550,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7192 /prefetch:1
    3⤵
    PID:1244
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,10243408369955766334,6459576151559617550,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6936 /prefetch:1
    3⤵
    PID:1692
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,10243408369955766334,6459576151559617550,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6900 /prefetch:1
    3⤵
    PID:5136
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,10243408369955766334,6459576151559617550,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5932 /prefetch:1
    3⤵
    PID:5984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=bonzi+buddy+download+free
  2⤵
  PID:2872
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffad82e46f8,0x7ffad82e4708,0x7ffad82e4718
    3⤵
    PID:2468
- C:\Windows\SysWOW64\mmc.exe
  "C:\Windows\system32\mmc.exe" "C:\Windows\System32\devmgmt.msc"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2860
- - C:\Windows\system32\mmc.exe
    "C:\Windows\System32\devmgmt.msc" "C:\Windows\System32\devmgmt.msc"
    3⤵
    - Drops file in System32 directory
    - Drops file in Windows directory
    - Checks SCSI registry key(s)
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:1980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=bonzi+buddy+download+free
  2⤵
  PID:1464
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffad82e46f8,0x7ffad82e4708,0x7ffad82e4718
    3⤵
    PID:3680
- C:\Windows\SysWOW64\calc.exe
  "C:\Windows\System32\calc.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  PID:1508
- C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe
  "C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:436
- - C:\Windows\splwow64.exe
    C:\Windows\splwow64.exe 12288
    3⤵
    PID:2860
- C:\Windows\SysWOW64\mmc.exe
  "C:\Windows\system32\mmc.exe" "C:\Windows\System32\devmgmt.msc"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2736
- - C:\Windows\system32\mmc.exe
    "C:\Windows\System32\devmgmt.msc" "C:\Windows\System32\devmgmt.msc"
    3⤵
    - Drops file in System32 directory
    - Checks SCSI registry key(s)
    - Suspicious behavior: SetClipboardViewer
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:2132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=john+cena+midi+legit+not+converted
  2⤵
  PID:5436
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffad82e46f8,0x7ffad82e4708,0x7ffad82e4718
    3⤵
    PID:5452
- C:\Windows\SysWOW64\regedit.exe
  "C:\Windows\System32\regedit.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Runs regedit.exe
  PID:2764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=how+to+create+your+own+ransomware
  2⤵
  PID:3184
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffad82e46f8,0x7ffad82e4708,0x7ffad82e4718
    3⤵
    PID:2316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=how+to+code+a+virus+in+visual+basic
  2⤵
  PID:5372
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffad82e46f8,0x7ffad82e4708,0x7ffad82e4718
    3⤵
    PID:5412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=the+memz+are+real
  2⤵
  PID:3988
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffad82e46f8,0x7ffad82e4708,0x7ffad82e4718
    3⤵
    PID:644
- C:\Windows\SysWOW64\mspaint.exe
  "C:\Windows\System32\mspaint.exe"
  2⤵
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:3492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=mcafee+vs+norton
  2⤵
  PID:5348
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffad82e46f8,0x7ffad82e4708,0x7ffad82e4718
    3⤵
    PID:5396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=minecraft+hax+download+no+virus
  2⤵
  PID:6116
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffad82e46f8,0x7ffad82e4708,0x7ffad82e4718
    3⤵
    PID:6132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=bonzi+buddy+download+free
  2⤵
  PID:5728
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffad82e46f8,0x7ffad82e4708,0x7ffad82e4718
    3⤵
    PID:5380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=how+to+remove+memz+trojan+virus
  2⤵
  PID:6088
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffad82e46f8,0x7ffad82e4708,0x7ffad82e4718
    3⤵
    PID:4432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=facebook+hacking+tool+free+download+no+virus+working+2016
  2⤵
  PID:5376
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffad82e46f8,0x7ffad82e4708,0x7ffad82e4718
    3⤵
    PID:6052

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2448

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2876

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:2336

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc
1⤵
PID:2644

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService
1⤵
PID:5200

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 915193bd331ee9ea7c750398a37fbb552b8c5a1d90edec6293688296bda6f304
MD5 8749e21d9d0a17dac32d5aa2027f7a75
SHA1 a5d555f8b035c7938a4a864e89218c0402ab7cde
SHA512 c645a41180ed01e854f197868283f9b40620dbbc813a1c122f6870db574ebc1c4917da4d320bdfd1cc67f23303a2c6d74e4f36dd9d3ffcfa92d3dfca3b7ca31a
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 b214e3affb02a2ea4469a8bbdfa8a179e7cc57cababd83b4bafae9cdbe23fa33
MD5 34d2c4f40f47672ecdf6f66fea242f4a
SHA1 4bcad62542aeb44cae38a907d8b5a8604115ada2
SHA512 50fba54ec95d694211a005d0e3e6cf5b5677efa16989cbf854207a1a67e3a139f32b757c6f2ce824a48f621440b93fde60ad1dc790fcec4b76edddd0d92a75d6
MD5 SHA1 SHA512

Submit Download

f_000003

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000003
Size 215KB
SHA256 553a19b6f44f125d9594c02231e4217e9d74d92b7065dc996d92f1e53f6bcb69
MD5 d474ec7f8d58a66420b6daa0893a4874
SHA1 4314642571493ba983748556d0e76ec6704da211
SHA512 344062d1be40db095abb7392b047b16f33ea3043158690cf66a2fa554aa2db79c4aa68de1308f1eddf6b9140b9ac5de70aad960b4e8e8b91f105213c4aace348
SSDEEP 6144:ZBsvW+9HsqVaDofPlLFsVcAAdxQQFKdFTWjz:ZiOsgqEQszTu
MD5 SHA1 SHA512 SSDEEP

Submit Download

4a503da9f239e4ac_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\4a503da9f239e4ac_0
Size 415KB
SHA256 9565a5bc8bf6b096b0ff50d235154a478048a0b25f11beed423341a76be579f2
MD5 0fe4637691330e7feb657dd3ea7212a3
SHA1 6e02fc8f5df2dc2b72c4220dce07d3a87e65e193
SHA512 0f99b350c0f2791be3ec91f2646d9fd000462daaea04815935f6d166802ed67e0372d03154a096809b3914a48cbc85cf210f2c89059535543913597e0afa7a93
SSDEEP 6144:AId1+CyN7xF+VtRnh1yxRlFckjoT4h7xajB5yG29nQh5:A4+RNlFEzh1yxR7ks70B5yG29nQh5
MD5 SHA1 SHA512 SSDEEP

Submit Download

73a9896da2e8f016_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\73a9896da2e8f016_0
Size 19KB
SHA256 a7d0775eeaf38df05f8b70c12c7996c1a04b77615ade16d0687166e46005013a
MD5 849f0ea1f185ce614f32e1c97a8f67d0
SHA1 22e8aa5583f1106e526e6241a2120e11c0697d8b
SHA512 15e271e162ef1076c7a7f6e7e7bc04ad60b5c4316a593ac45727a6114000164e1bb80d5b2eecfa141c29a1ab2a6740d872d5b491d7bec673d4cedf081929c2ac
SSDEEP 384:6Bz32gzafZO9pXJYu9Ne3w0MF6b8mzvJqIbFWzYXOxnae3zinHT:azjzahO9pX39AA0gATMzlaeDgT
MD5 SHA1 SHA512 SSDEEP

Submit Download

f96c4e370537b4dd_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\f96c4e370537b4dd_0
Size 288B
SHA256 dffc79576c6ae06532411fd47e896d57c6ed84460af86ee985f2c7fd7daff0be
MD5 ed95ae7356a87e88d4280f2280c09653
SHA1 d0bca6ec737df89d8c9a2fd1b948f6467f40421f
SHA512 8b0a5b082fa7e76d886854dd57c5ec4a24876baa62fbdfa9caf926b3578412a085305130da28fdda601ecc4c0c47726ebfbcd98f3705cebd2c67aa632d3a3c47
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 168B
SHA256 5baea85d863ac1b1ad536aeeb75f87fbc7d43e55fcf3436e6a63fce508144448
MD5 e8bbbad24d2478f16cd092503d239850
SHA1 285d3d36dea3103a2ae1c15cf36b3d4cdd015c51
SHA512 796cb0d06991ec35f6f644ce503800320874b1f169c7a24e0720b7f2f8d9175e8d319c19de9d9aa5ea37858b0e0769aa79376a4984acb1dcddcc1b9473d10764
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 168B
SHA256 fd59e1da453e9ba968be75c0fc42afda5fe8698e483bcead0ab3f82725c86f9c
MD5 bf014aed1da2231b9f0ce1d3c715353c
SHA1 d26343199c14829aad437084ecadd593768fe6be
SHA512 1b6e3812703bc394226f381c98f3ffb3a7f57497399718cb9389ad9c980d6f1ecfd1ce11db1ec4fbea99433eb1156f073b768324c1668dc32886a380393dacfd
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 168B
SHA256 277e59959bc0ab900034382f5e42179c6c0fa4f5bff762b30837c6af0bc57266
MD5 ff7059e8b3339a231ec937bdc56686f3
SHA1 349357576d4cdd9c11170e788df2211a674e63c9
SHA512 37e972638738d49d2b3f4277004685fc4649048a60e65bc82c0ddf5231653e0530b00aace5301c3070c40a6e62e37f616b9d9412586af9982c6c8a9ba51b0de4
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 168B
SHA256 fac6c7ff43488996f7b809dfe2238960dc7feb741c086696546218dc09f0d542
MD5 6c4b652928d561b03471874605588cce
SHA1 42a92cbc141056ebe62a54ffb403b5ec1595f44b
SHA512 b9bdd79dc868b2c195c2eac369a171d0e30b3862ca930c67329063c9f6c3d5aca23f0643933ef14c82fb07044ea9cd8def7e539b28cf12ec32b928224ce0da14
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 168B
SHA256 d8382d565023f80ec43a86034c749250f83c3d9225a33fd39d5cd956344830d9
MD5 9afad207ed0299620177b34f05c17996
SHA1 3d1494d7509f1997c572ad3674dfff418af386b8
SHA512 37bf90265ca0b696a66c5f23093ee92c4df02c0a81bfe508ada22c6ba080c2fd0ba5adca50979321e4345cfe70aab916d9b93aaa2f70dfdc7ffae574aea6d492
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 1011B
SHA256 3cfa3df32326b299e6c0eb0a5b7d6c98b6121922cd11f6eb69a50e5f2d732142
MD5 ff26625e35b961a79c5a7b89773a7f57
SHA1 4b9ff6517483e271fc49194483cb8c1d87baffe3
SHA512 32ff1fccd79135a15b936268d22b8cfb2c50721e4cf6b19d32c3d895e34c58f4df930b0f32260b89ff5fed267d0d621aad3dbd52781df14488b8f3751ecc9a90
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 814B
SHA256 f807c50244c43eb74fbcea46084514fcb4accc31ec7e025bebec03289ad84577
MD5 f8c80f34ac988ff010c749a282eafcd0
SHA1 77a4a848a075a75afe0f067df5673f9d7ce667c7
SHA512 2b8e2bac329203ebaabe05eede04dc74c7f815a22790ee03609ac77b2d89e8ad2555e51e1e6010063ee374ac63402d1fbcccb84f82fe64d21b1d3149adf1c9e3
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 1011B
SHA256 0b0645a6e81eca497465fab4841b5170222380ae5a83f7d4c1b31e35d338865a
MD5 445fb81dc1676d84dc5550369db61321
SHA1 770d0652a465432a59c5b5adc2e2a94ece8a13f3
SHA512 9d31f179820414510e1ce74cf596dbe1f4b8e04e00ca6b2425e8130b764d4b961937e43513e9bffa4ef885ad48410dd150482cff3bba997e8f41184a11f2ea49
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 814B
SHA256 c933cee520b825cec15ea54f70884b493bbfd47e74853831648c02016e452c68
MD5 98c945efd19bd8dda8ceaaa61d4c7b72
SHA1 0d9157c4612984d8454de8bfb158d70f2f04bbbc
SHA512 906aba548a88342b4cc364506266883a34aad0dfc3ca53a7cc72019078ac00925b5d67504d02851d52b844a7453f4419a1724070aef33233c3dfafcee0b25880
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 ccb62b1ee86a4e1b03c10c93ac80d3de38905502249f130cfcf7fc564f958aad
MD5 7faf37790a0380259c8bef5185fb1165
SHA1 3354e4511ef3b52ec43f28a45a14e732eef10bc2
SHA512 da461d6b22088a939094d74178f87888808769b6d4dd69f31f3065e019d08f5d0451ba7b4d563918ea4d3c7f4ea0894961933c1e40270419c17d00bd940fece9
SSDEEP 96:nlk0c1kNZQwpvWMoiVmde7LgulHKtY8O2W5UWQyV+VD7AiEwb:nlkxSLQGWMrLgaHKtYnvrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 42bfd004f6086ccbf4adb653fe09627738ba30373df6e21352d31a6b123cffed
MD5 90865962b5554b0f52c7acabf37c4972
SHA1 9f4dc9e2bfe9a84cd02788a1580be93c0796e8c1
SHA512 6c1af60fcfb8edac9b77b0c89c512e96cb38018246d3bc14685c1dfe503feb8bd0e708944d0e19044d863282ff67c51d52599117e79440fd997e74e9ac82f31b
SSDEEP 96:nlk0c1kNZDwpvWMoiVmdekyY2TyKtY8OVDnwUWQyV+VD7AiEwb:nlkxSLDGWMUyYSyKtYnZwrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 1f039added8366e785473d572d768344ffd9ac6265d5e0d476662e735d13a609
MD5 36e12999ef62e091e200baf789609c06
SHA1 1cf7362d94de7131c13008b0cfefb926aa7b4f44
SHA512 1f89025c8eaacc889c941e0d4ff25ca657742d87927060de4a58f842ba2084919a39df1ae8f0344e685357ec3cb37360e8fa3d720a0c8d602cdca2caaa062906
SSDEEP 96:nlk0c1kNZmwpvWMoiVmdekxXK29KtY8OhWn5UWQyV+VD7AiEwb:nlkxSLmGWMUxXP9KtYnq5rg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 1148a8470050d0333f20b66988c8ca62ec4176f65a901aacca1e829e348c82dc
MD5 a97d3b33dcfc9e2a60af8a4a1fba649c
SHA1 35e8529d7377e934242c170918a223cb58d55335
SHA512 b7ebd85bf34e61f2dc1eaf883fe3008950c0ed68712b5399982669bf850e7002de1a01037d2ee3dc3aaf839de7b42d8d9e730a7de7e5e709aab62371e5018225
SSDEEP 96:nlk0c1kNZtwpvWMoiVmdeNS+XrMKtY8OwWnkUWQyV+VD7AiEwb:nlkxSLtGWM9S+7MKtYnzkrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 670e692c2b27eb9ceed5b8fd2be69f19bd6ea15536421b786c8fccba4fc0039b
MD5 f7983412024887052e0937ce1b91f366
SHA1 b41ae923a391bfc3f95ac804b2f41cc8b917835d
SHA512 cbb368bee067e2af39f3b26c3bad01418313e25b79ad70cf114cae4697e4a161df11aa87f0ddecbc690e80795e809118783e1ce70e5f90e0e3f04c95efb730c2
SSDEEP 96:nlk0c1kNZfwpvWMoiVmdeBczSrrd2KtY8OoWn+UWQyV+VD7AiEwb:nlkxSLfGWMxc2rR2KtYn7+rg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 d9ce04978d728710ef74eb6c180cc48f3e95ac58d537d371bd51aed15f8af76f
MD5 dd1a693e10e56ffb145223fbc80eb8dc
SHA1 32a11eb0530400b6bb96cb66e719f88ffba6147a
SHA512 437f21694189ccbded67b528f24585a071e222db3482e746855004c1eccf30138c517caeefb81188b30f411e78c2ddf75120685daace1c0d5a1354fc2234b758
SSDEEP 96:nlk0c1kNZUwpvWMoiVmdeUyxvXDKtY8ORrnmUWQyV+VD7AiEwb:nlkxSLUGWMEyxPDKtYnNmrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 f9535f47ad9ed4de24a37241a718df70bac3778596c678847dd40c8e0f8afc34
MD5 55ed36bff3a030b316009455749492d2
SHA1 aa1ff09ec62d86d6ce713472956f911a34855e70
SHA512 9da41dbeca82180d9b0c08bc2cd3c04ab8b3e6854a82bc25126e82b1b3c5e9f16e5c6cb37c274fb762b25dc77e085b0dd4e8f215fb981a864f151ae4e418bc2b
SSDEEP 96:nlk0c1kNZswpvWMoiVmdeRyK2sTKtY8OgbniWtUWQyV+VD7AiEwb:nlkxSLsGWMByKxTKtYnqiWtrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 4124b6673cfac75172db1775445f258b004a649b5ccbfaba11c03257323bc06b
MD5 ffe6ffd3685a511b9cea00c2e8f7a877
SHA1 0fea3848a11cacf3fca8aac72507b97877f48b66
SHA512 f4d0406c414fbbc18d540a3457ec83b7fc1355eb02412e9f50579c0ed14d999adb5259d0eeb6d0a709022c1853dfafdbea4fef1f9c0b97d21a6e2327520d5df6
SSDEEP 96:nlk0c1kNZLwpvWMoiVmdeEug16qhOIhUWQyV+VD7AiEwb:nlkxSLLGWM0ugEqcErg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 753ef7bc1e17283706650ecda8bf8a439ff7513ade40d95645f2c2ea30891d97
MD5 cd6ae81d4dacaa22c3b2fc89eeb3d46c
SHA1 1aea90e1c259134bc7ab1624a5287180bc6e2205
SHA512 fe2852c423e4ce9228e453bad03d85ac945c2d646595ae2430ce9725fa9ebf10cb190ed346d202801b4078b8c29a953eadfda1a5c477c4fa6e62322dc55d59d8
SSDEEP 96:nlk0c1kNZSwpvWMoiVmdeutYcpMk0xKtY8OZuhUWQyV+VD7AiEwb:nlkxSLSGWM+tYcpYxKtYnZKrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 d5c6b42a20c51e8fbc493b081105c68e21e80c2983260907d95bed5287445c38
MD5 1eb3a62f750756d00190f0edb554f906
SHA1 bc9b8458925262203c4d969b2b7d3d6b751eb30a
SHA512 381c6016f6f458eb594afdedcdba4bba4dedc2a96fca74437e0708a7457cd2440fcc2b97bbba23526fe3a321ec4e53ca9fa0b80b49dfb4081d66348805b6a702
SSDEEP 96:nlk0c1kNZbwpvWMoiVmdeNyA42YCKtY8Oo1nicUWQyV+VD7AiEwb:nlkxSLbGWM9yTVCKtYn6icrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 d895c9783b52568d1594db1cb5e9294c99ea36331e43dedeb72c3f1abf4f91a9
MD5 58cb6be81733b7142ac8e85b4db62289
SHA1 12897747dfb4c4565efb06343e821835c147f377
SHA512 c2b64b7965661e0feceb18df2f8266906ce181138aa5c59f1eb9f044a633ed369cf496b76484e62c26dbfba6695e743b47f6d4627446764ce7d1f0e5f06c59ca
SSDEEP 96:nlkTc1kNJDwpvWMoiVmdeHhOM8UWQyV+VDCziEwb:nlkASHDGWMXcFro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 e44591d60ce3de5e7f3ffb726bdb9efc33aaf8d34ca4e8d96bf3019ce6ae9531
MD5 0f87c9fe9c45e774144e8d0ee91b8f0b
SHA1 ad373f8dfe2cfc2b6f30bb779eeb1b5dd6c68fff
SHA512 233898150661aa73463e9ed13dee237152be86d0616aecc5f00e50bd83f342e9d6aecd0b18e9158c578892cd1bf49ece3cbb7a131e2d21f55cc07b0fef069c94
SSDEEP 96:nlk0c1kNZpwpvWMoiVmdeFriO1gKtY8O3FBFUWQyV+VD7AiEwb:nlkxSLpGWM1riegKtYnNrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 3d86ae3b5929933a36f2e44ec5aa073580e1dc9c44696ecb48b8cb7428a2b13f
MD5 a35dc3bf8c808a7b76974c5e53747efa
SHA1 23c306322724c517562b068cbd70ceca5c97b083
SHA512 021b828e33bd2fafe0d615e4775a980a39a04ed94b43c0d6dafa1ac91039e3162d1b472ca951b7888009fad85ca2bd5b2ca8d77a5f62a887b1dd73e58fdbd691
SSDEEP 96:nlk0c1kNZ5wpvWMoiVmdeayM2k4KtY8OrEniWYUWQyV+VD7AiEwb:nlkxSL5GWMKyM94KtYnOiWYrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
MD5 206702161f94c5cd39fadd03f4014d98
SHA1 bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA512 0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 05a3ae6b57b24da32dc6af6a1e78fe69af24df3838f933fd94a645b423969ff1
MD5 c5e85248c536d02c86d69d0ecf285e55
SHA1 3e1d42777e97e8165e4763b70aff2baca481403e
SHA512 109d38aaed482aa1bb6da27c1d9c646e36baf2d76807e34a9fd12ec44bc2aa90c870b77357f310caacc7421e3d6a12456601ff53c7fe11939dce6d96dfb9cecc
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexup08ae2RUSp/IsMAi8wU8ep/:A9iIxuERzA83h09RZxY0vRJFiPU8Nu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 c90fcb9b19604eb56918168e54997d4f99e5b521950f1c39cd4a35720620e9b0
MD5 d486475f904ea85e5a8d1c1b665be651
SHA1 d8bfcdd73a13be0b742d9f9350d8d6fe79f34ef0
SHA512 19a8132783f9cdeb0b07601d1f308849b5e276eaf305b4b801882195c7cf199b917784809f540934d52fbbad61534c00277d58458376e5f62c53aab4cefc443c
SSDEEP 192:uoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexup08ae2RUSpPSzsiAi8wU8eh:69iIxuERzA83h09RZxY0vRPF/iPU8Nu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 04a13569088f1a6459193d8120a42226fe5dab905e568eb2f538b6d5b0db0a08
MD5 b9cd253a78a52d7c53f1d53585bad84b
SHA1 31629408b63c9e9e73a63ba221c3602d461b4f14
SHA512 2ea64da1ff1723ad9e5740954a9ea2f456a2467d2983653009090b35f5f70106ad05c2690aad0d975e75a3124b79e316b5bf8c2c3380369de3dcdc40ceb50740
SSDEEP 192:BoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexup08Une2RUSptMA5PIp3s0Ab:99iIxuERzA83h09RZxY09PR2IIp89iPI
MD5 SHA1 SHA512 SSDEEP

Submit Download

PerceptionSimulationSixDof.PNF

Path C:\Windows\INF\PerceptionSimulationSixDof.PNF
Size 10KB
SHA256 0d39822906f00f876beec95a498ae548ed811cc93d1e05d6988de95ae37ac330
MD5 b1098f9ca6412ace5d9b6bcca5e5e3ec
SHA1 f3383b68929d323f7fd1924e2f10f4993068facf
SHA512 5bccdf675edec553d3f31f402d033583914864b5611d41d6dbc319bdcff03e3cfa1f5e596b2c9a69f52e905b34e2e9a793467dc9069cbcec1970d8035ee40d3b
SSDEEP 96:pSDBok/wkM/cUzQ32XPScs4eFRr6C1VbmGSECJkK1rGHq9ZcG0bp3QbWxK7HI7aj:E6MpMEHUEkQUkK1ruq9AJMn/31j
MD5 SHA1 SHA512 SSDEEP

Submit Download

c_apo.PNF

Path C:\Windows\INF\c_apo.PNF
Size 6KB
SHA256 23087bcb7d7bad0ce03e7abdc275fd6e903ec4059afa8161a53ee0796d18c63b
MD5 d86fe32538e566744be07ef24e10b8e7
SHA1 674b152c247a32ce59414e04cb3a41875eba7069
SHA512 b337219c8274e82786bd0c0aefaa7bf0e27444eea7990e5b36e026d0fae095899fdc553aac68f42d1277c74b29b81a05bb7cc50906a69ee03b063239c051cfda
SSDEEP 96:knKL502juqOfW2x4DA29L9PVPId0krZRRdtoD0HbzmXPB3Pn0880v:PLeffx4DAALNwrDd2D0HbzmfBcm
MD5 SHA1 SHA512 SSDEEP

Submit Download

c_barcodescanner.PNF

Path C:\Windows\INF\c_barcodescanner.PNF
Size 3KB
SHA256 25565d343bd1d66169a78a1f724b8c7a802a5a270507fc6e44f9e7f81e133af8
MD5 1612bf196a6d9f603f06e5285788039b
SHA1 439fa54bacb5741e11e6545ee359f2170856a18d
SHA512 95dc29d6dcc12b7e821c0fb5df7b5c9b81d5d5b88a1ac28a8ee9b2f5037baf7bdce76e2f90530a511a691724bc7cb3b536ecdeb27d837f703599dbffcf264aec
MD5 SHA1 SHA512

Submit Download

c_camera.PNF

Path C:\Windows\INF\c_camera.PNF
Size 8KB
SHA256 70f4cf234497cb95582ad34b83584fd51112d770a67b1ab3f309370a4ab5b5b2
MD5 4b016800a2dd884050582c00845bf672
SHA1 1607d5af69caee776afc624ca7437a96cb2b3d7c
SHA512 5974d6db31c79f95aca920bf6715dbd4a009f6b55764d83f68f3be108a4b241d329e91fc24fc9fdfc2c873325c4b35749af7f89e1e00c21ff6fcce59604fa37f
SSDEEP 96:hkjCisKeUCBQfWpFRsyzHUCe2+v02SBXz6aCU+lb8BVATMG5q8xJw5W/39rdeTNM:VQfORsUupa2rq5WxZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

c_cashdrawer.PNF

Path C:\Windows\INF\c_cashdrawer.PNF
Size 3KB
SHA256 33f9b32cf7af8b738c17ac973fd14c531e16cef06fb432d2bd99f7dcc44b3e05
MD5 8210253c127ede2cfca6d6af865840e2
SHA1 0191aa53ab958cb798d19d7263120c618e530842
SHA512 520341c2e2e00f5437f570ea2ea390536372cb7a0a8b97d93d0686ab625fef04fb60a5fda90f1ce841622ae270eac0ea01011251cb94baa6970d51d2439b69ed
MD5 SHA1 SHA512

Submit Download

c_diskdrive.PNF

Path C:\Windows\INF\c_diskdrive.PNF
Size 6KB
SHA256 7e0014355ac7cdc7c692c90018e75c36850f6758ff84b81d46735ddc61640af9
MD5 0048a8665cb1a972107f859fa64e9126
SHA1 100853cdb84af84743aeca1ae4df00e0cbc9424e
SHA512 85c884c8b15e2f1deab21584b477f93bd23465f1977aec9518af401e585d77c8350a265c518fce6afb6867378a06205703c37d8230bca237c608f078d250f4eb
SSDEEP 48:s6j4xIiupQ/sHBTflBeqnL0474QiT5isYwEwGJcIDbCRbga6JMxN6xQ4SVZHIEl7:xj4xFuKeBTfPeqw1YDwuCNf6U5NcqJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

c_display.PNF

Path C:\Windows\INF\c_display.PNF
Size 8KB
SHA256 3dc32b30f729bfb42a47cda94f18a8ecfcfaa0a5914921baebb769ce25714963
MD5 555927cd58cd6a437fcee6b24d4aa9c9
SHA1 927f8d23c04bff765df737966353fe12a47a5dc1
SHA512 c4da647351cdd204f0e778c99d0b0ad7bced330e8830093c5b30902a8f8aa47bab339d3dbf28d123e2dee0af949b33f60d8db98cabf14a09e5694abb3d6dbdac
SSDEEP 96:q/cw3dCMNyLiDW4VlZU4VfOrtlBARvFLi+XT7+uZt/Y0BnuOTITd47VGpR2b8jN:VwEMYODNrZ4BATLjXvZ1NnuH6i
MD5 SHA1 SHA512 SSDEEP

Submit Download

c_fsactivitymonitor.PNF

Path C:\Windows\INF\c_fsactivitymonitor.PNF
Size 4KB
SHA256 01a7d237141b4b4b41b0ad0ac0f4ce554ec62c567cf368406889d84288988a59
MD5 275aceecafd32ae82dd8ee2e448096ad
SHA1 1ce03b1ff957eaef5f2af9177c175cf7384b6242
SHA512 bb8728d2a34050e79cd58cd46502c1e8f8f8c60912eed1bd7e271d01da7b6bc20ff2cc39f05ac5d4d985ddd65e6cd0ed24f8a73e9c75ffe2a9fea67c0f566334
SSDEEP 48:UoPNpH84VgfW1zF5CboZRlDt+hqOCIn79KZRlmwp7fSg8fMT:UoVV84VgfW1QcN+mo5KKwp7G4
MD5 SHA1 SHA512 SSDEEP

Submit Download

c_fsantivirus.PNF

Path C:\Windows\INF\c_fsantivirus.PNF
Size 4KB
SHA256 d26f373639b2492bb19b1fe49cb4a15468fa82d33a5edee783085ea930ea548f
MD5 b93d641489836820549a799c8e0adeb4
SHA1 cb8c8a23ec4af9db35ee5a8b7ba05dc45a88c407
SHA512 50971c7eeb11d71c709d973d02095195d402a9ab841d209b7768915799b0efea44149c2295271d370e8ece6bb7e61f2a710743f235d3dac2c01b504bea8b22d3
SSDEEP 48:OIiOaT5SVfWvc5eTbJIeaIXzpQp7fg0PlaChB:OIiZQfW/84+p7g0tJhB
MD5 SHA1 SHA512 SSDEEP

Submit Download

c_fscfsmetadataserver.PNF

Path C:\Windows\INF\c_fscfsmetadataserver.PNF
Size 4KB
SHA256 97a3f8a9d97880813af2b6828c4e3b69e317a93a4dfda7cbd8f9190e9ae9e94d
MD5 cf2965bf656d2d5dcad311fc68547f18
SHA1 0a24210c5b2330a0e799bd2334b52c1c0743a2d6
SHA512 357f6b6db00aa439c2ebea4917b820cfdde0c91164e4c481f5712d617ecf84a4bb11d16ca6c69d68c3c8d05eb9a978c7bfb3c2c5d2c79ef5707a3ae276d137ef
SSDEEP 48:lmXkr5jZIMr5qG5ygsiibj/IYftGg7ap7fMUHn6h:lmXkr5lIFiiH3Tap7MUHnE
MD5 SHA1 SHA512 SSDEEP

Submit Download

c_fscontentscreener.PNF

Path C:\Windows\INF\c_fscontentscreener.PNF
Size 4KB
SHA256 13693f1a0f5576cb44fef76ff6ef372f51d0ea15a2efd42dbe42240852b0aa9c
MD5 b1da17ebe8e0c8100d8fa1a987946885
SHA1 5007072091938ea7300aa1b83d4456487af6904c
SHA512 e8545736385e9f908a4c19f4103563a238f07caa53616833b2d9b74116cceef71140da9d356f4633dc8eaad7bc3858c2e78be3f05eb02a3833e79ea6207e1d6e
SSDEEP 48:GzoPPspxzVPgz3r5CejBLUFRpGrIVAwj9L+wp7fSg8fMT:aos/zVPgzVjBL066Pj9L+wp7G4
MD5 SHA1 SHA512 SSDEEP

Submit Download

c_fscontinuousbackup.PNF

Path C:\Windows\INF\c_fscontinuousbackup.PNF
Size 4KB
SHA256 adee1e8a3d9f06faa8336a7e5a4718e23cc2b3afcb88d2d8e0cdbd4f41a7418f
MD5 84f9a2f0aac1bcdedac267dabaec69c6
SHA1 5089876525aeaa99b198edc4f4d54eaf1d6ca108
SHA512 2cd605402ea80534fbeb4ac17ff943a3f9b263c5a5fac80f4d0fca4aa579ab8f541eb3f2db5f811293db0233cae990385b7deda4d7cd45076c880a03f7b8fdb7
SSDEEP 48:czoG4ogrxIfWgQmzy35OmRQernlHW4IDbBRbwwQeup7f5FSSnLGCDNpzdr:woGCrxIfWgHwR3DruBNf3up750Shfr
MD5 SHA1 SHA512 SSDEEP

Submit Download

c_fscopyprotection.PNF

Path C:\Windows\INF\c_fscopyprotection.PNF
Size 4KB
SHA256 c7b8af67c4834563713eea646af508d357e4bef96269cb144b268f6161fb5533
MD5 394748e30ed2293ab8848f7590f13d27
SHA1 377bf53bc971ed3dcb7565788463ba3f13ee87f7
SHA512 5d3085a0d5c5e1a3a8e9b6d7801bfe2d506d481218a44fb8e73bc800e89552ed4dc028f7a81b68a4318900976a8a4907766224d0ed80847cba29c3c8159dc32b
SSDEEP 48:4zo3VhRjs9PfW1W5C60mcPid0BIKNTJk0Qwp7fSg8fMT:MolHjs9PfWez2xFNTW5wp7G4
MD5 SHA1 SHA512 SSDEEP

Submit Download

c_fsencryption.PNF

Path C:\Windows\INF\c_fsencryption.PNF
Size 4KB
SHA256 f4fa61365921ec8e825062c0d43230aed1cf1e6b0d1c7b4037b300658ae967a9
MD5 b6d4bc452fd6a18e6c8740e3af413ba2
SHA1 d2942c6360207ccdd3fd9321ed4a00a2c108c16a
SHA512 be7298742dff91648e8df9cf9fe5b6a91af570f2c7dbac8711cf612b1c30b2941ffbe06e8d9f75e6da08daa956afd26e3c99003a1495deea54a711ec19b06d12
SSDEEP 48:YYd00HkbJhfWif5epcewvpCddA3I50UDZrc5p7f/3V:r9HYhfW3ssotUh2p7/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

c_fshsm.PNF

Path C:\Windows\INF\c_fshsm.PNF
Size 4KB
SHA256 55d99af205bd9dd85dad77d3159ab8c720b309adaaf5538428a8a2f53a7a8810
MD5 c062e91e8f62f9f78912ca9344270637
SHA1 c94f67913ad48c126c15b8d77ce7667328bd238c
SHA512 79ccede585f009a8ff41b5ac54fbc0dbc7c40e4d438282f202854958f4c112814c74ec62b2aa3ef8deba6f928ad4f75f8eb23691c4cd4286a5d7a63f49eefcef
SSDEEP 48:U416mYPAdk5fW4c5Kz34W3TrbIi3y4Yp7fqrL:bM5PAS5fWcoIjt7Yp7S
MD5 SHA1 SHA512 SSDEEP

Submit Download

c_fsphysicalquotamgmt.PNF

Path C:\Windows\INF\c_fsphysicalquotamgmt.PNF
Size 4KB
SHA256 250447e56fff3c2b1675c5eee8ea7c2d4cdf667058d4c53cc8d2163379f860d4
MD5 b03950c7202906e928bced8484dd2777
SHA1 7a64d8d68b5e0e308e463a4fa618db05096651e8
SHA512 f9b8a93afc6210b145c89d49895579a1253faba1ab2cfd2476f6b1f6e674deeefd230a9adbc222510fc12a37a1d9f77c85c1d8a890fa992eeb5c4af0eb297a34
SSDEEP 48:38I2im1E+gEfWWWn1c5+NdwXijpc1keaISyAaGwpijYp7fkapR:38Iq1AEfWxnnKXYWMdyAqpYYp77R
MD5 SHA1 SHA512 SSDEEP

Submit Download

c_fsquotamgmt.PNF

Path C:\Windows\INF\c_fsquotamgmt.PNF
Size 4KB
SHA256 fb2ee1308ec24b3df1288469d1d348c5282c45fee47ac1c22a49b3bfab9df924
MD5 3f89a0dd90abf143239cb4e87f197a25
SHA1 2f76223b8c2b82cf591b85ba2da86fd0136ee25f
SHA512 db214e2b8a896e9dd67006e4bfba24ef005105beddf0939ff263fd78411940810fea264aa24ef2c5fd6f00c09eff98fb4fdcbbb8f9675faa0363094b87c53bce
SSDEEP 48:F4W3Rkp9czVgfWMSc5C7uINWEdG2ISyA68MWop7fSg8fMf:FjBkroVgfWMo3kydyA3xop7Gs
MD5 SHA1 SHA512 SSDEEP

Submit Download

c_fsreplication.PNF

Path C:\Windows\INF\c_fsreplication.PNF
Size 4KB
SHA256 05abfc20f02e1b045d8815dedbf066c41e8e8084816883f599d78925d89b7fcb
MD5 e419a5d5a0a4ce625ea8bed60bfe49d1
SHA1 834661c85aa343c863d0870ade91dc1c5cd13775
SHA512 75155d2995f71cae4eb94efd7776fb01c1015b78f531c727f761cfc67a11db18a1d8a4f188c66f93ffc8026e28c815e9c89d88ad38f1d65c8b709e07549cdc5a
SSDEEP 48:DHrVZ/8hIGsfns566YI1xCpddY3IDbcRbciOp7fl4G51LF:DLV2I93CopA3ucNjOp79
MD5 SHA1 SHA512 SSDEEP

Submit Download

c_fssecurityenhancer.PNF

Path C:\Windows\INF\c_fssecurityenhancer.PNF
Size 4KB
SHA256 2d1b6ccbd91b8a4d90a2043d58f6b2976b7a81580f2fa39968661ac29425e087
MD5 d33fb400c473d002277078f03a6d66fc
SHA1 959920ca0c867a2ad0a2d0ecfbf675df3b6c913c
SHA512 fe3755a1545737c6d6d3ce8c4e4dc6ddee1d1795a1500b3a516de5811506a7e97cfc57fff5dda760b5207c44e317e929e1e6108a347204eda69fe5eaba38256b
SSDEEP 48:FzG4Hoc9B6fWk6c5O3KspoeaINR0Yp7f5FSSnLGCDNpzdDD:9GKr9B6fWkyb8S+Yp750Shf3
MD5 SHA1 SHA512 SSDEEP

Submit Download

c_fssystem.PNF

Path C:\Windows\INF\c_fssystem.PNF
Size 4KB
SHA256 655fe8302f85fdbcb13ba8714a8d45aca56ecc9ca46ade3ca6eff8e63161513e
MD5 2ac38f764eccaf526b9cd0afe32d1d6a
SHA1 68614e768e8cb992d106d8241af4f03028b821f9
SHA512 7740bdaaa69fd525cf564704601e40c7c1b76c6c5696beec38a61f8c0e5304f7dc6ed4cc1eeba0bd2ab56b955d6fac5aced440fa518aa85f010d4ed8568b8f1d
SSDEEP 48:tT0YcAVcbJgGOP352zyaSKLi94Y3Is/ByaJp7fHXB:tT/cAVQNOU5vLiN3jp5Jp7HR
MD5 SHA1 SHA512 SSDEEP

Submit Download

c_fssystemrecovery.PNF

Path C:\Windows\INF\c_fssystemrecovery.PNF
Size 4KB
SHA256 0b7ae76c8fa13d5f40189b9161337c6fecd635603b1fb43d01b7e5dbba8118a1
MD5 2deecd98bc5bc95c4052026b9c4b7e69
SHA1 2756c14878a6f17032e0ba52217c920847d46074
SHA512 f729beb29bbd73f7f16ec6deb35ec8c45500271e1551a47b3d5f175cc40d6b989ac8c03a77630d2e87263d20d94a8359d9f407fbb44e3223d95106cadbc26408
SSDEEP 48:+oBP5thBjVgDWe5C4Av2qR23eaIz/6Avawp7fSg8fMT:+oJf3jVgDEvlMMjvawp7G4
MD5 SHA1 SHA512 SSDEEP

Submit Download

c_holographic.PNF

Path C:\Windows\INF\c_holographic.PNF
Size 6KB
SHA256 b6eb1ca1b567c4015a3688b390f893075d5ca61c178963921056d7a3c38f9d6d
MD5 aa3e4c509d54843eae8eea2f62b014c5
SHA1 3741dd5b1e804e9210af0c13b36fceeb8102686f
SHA512 12ef529740672b855082056d0843b868c1f2946ec810cc041117e2941d4f153496b76797370f904fa892536bac993636949c0d2ea920783aea1ef26967689b1b
SSDEEP 96:sUHwQZUC8DQflugaCviAIWa2L5+8XXZhS2z:sCHfcmai3XXZp
MD5 SHA1 SHA512 SSDEEP

Submit Download

c_linedisplay.PNF

Path C:\Windows\INF\c_linedisplay.PNF
Size 3KB
SHA256 ccf334064e49d49a444c6534f182a1ea08087dfc42d6c3241cfe3bfaca5109a0
MD5 e1c7f2f39f5d72f8a9bf176c988e7acd
SHA1 adbb86fbf82f4d0676e11949ee65e25df2a63131
SHA512 ac13d949ffac013f6cbb5dffb7716c4260cc8c1532750fe87d162d5f137f40fd4bf41372ca0985f3bcc211404119d5643535ee388891e8ef5653e8b8523de462
MD5 SHA1 SHA512

Submit Download

c_magneticstripereader.PNF

Path C:\Windows\INF\c_magneticstripereader.PNF
Size 3KB
SHA256 a1bc54e853d96acf8279a0a7f98de870e6d217d281b1119aad865816659b1eff
MD5 b19015e21e1bc2886b0b674d2f450bd1
SHA1 540de50a0d3b98b6abbc084178ba05e4704321be
SHA512 cfe69151364ff1227b2eae37420ae70f34760150ca78b2e5dad9a83cd0538f6e1ce2798b4f31ee6fd9b9e17e020d738c7ec3805796e8d40bad1cbaa3914350b6
MD5 SHA1 SHA512

Submit Download

c_mcx.PNF

Path C:\Windows\INF\c_mcx.PNF
Size 4KB
SHA256 6d6976794973379f38d6354e17b3c4b8db4286fc8211900830b61030bdf69725
MD5 b90c7e18533b2ca5e9cf2dbcde972733
SHA1 c9886802e07dfeb05a390c9e2d21d75d1481ee7f
SHA512 bf4cd43edd93b918532ff390b27bb02a5254d9703b8d30ce001bf98b028b4a4e509dad367f9afbf505cb00b5ac7ed947232f14515eb3f1465df50e6efa0123de
SSDEEP 48:R5twxkIOLVs566nEJmcERebfrbIXqllX6JxYp7h:R5ukIOJJmInVyJxYp1
MD5 SHA1 SHA512 SSDEEP

Submit Download

c_media.PNF

Path C:\Windows\INF\c_media.PNF
Size 12KB
SHA256 ffccaaf44398b5c696cf99b398e65c24f36b4deacd65c10b17e880a223aace19
MD5 d682ff7089c1f95a6da20228d1f9389f
SHA1 586c2072a38e089b7d39335ddbcc6122f85d31bb
SHA512 fd5ad02f6240d60cd48770c366c3a1a28965565544ce972cfff78da3338e07501c5927b90d44caca7d6fddcfc9490a43b3195349d9606c93e51ea68eab2806a0
SSDEEP 96:QyOzh59keikEccAXWa99u7VPaQlio0dSly1/HC3T6gYq2hwyvVATCG5qylmqB9cT:oxuAXD99usQMqogE3lJSZmXx7p
MD5 SHA1 SHA512 SSDEEP

Submit Download

c_monitor.PNF

Path C:\Windows\INF\c_monitor.PNF
Size 6KB
SHA256 d5fc4200abda6ff1ebcdda2189340f6f5f830bdb0d8980a51944e8a0651cba41
MD5 c35bc030c5750794e239ceec761f9a63
SHA1 e1cb59fb1810bc7348bb0cb4b1cc523a0a1ca740
SHA512 0308d475ec7e49c575d56a86da8f183bf84f8860b02c50b1d356f373880b0e1da39a8551f422c2925baf965b8b5172c4ac18b33223ec55f558847d13d175951f
SSDEEP 96:K3P2tl44AX7cvOMnV13lMGUoT/ms2L1YO/tWHOfJ3VfANNWuyfJ:Ofe13lxUo7LwqCqNWus
MD5 SHA1 SHA512 SSDEEP

Submit Download

c_netdriver.PNF

Path C:\Windows\INF\c_netdriver.PNF
Size 4KB
SHA256 7ae12586e00113234cdb39741ada6312dc5abc5e8fdbdaab73464dab4f296d7c
MD5 5c27ad0bcfdb97c82023615170e6fdbf
SHA1 bde09afbe5ec6218a0463789a88b54e35964dc62
SHA512 2689730c5c0e2bdb8b5fb4e5fcf50c53c7f0dbcfb681fd7e8969a2c9578bdafb7514cff2aa9a952e658a2a386a53870e0619ec03f39aa483c3c968a1104b6ec4
SSDEEP 48:DoutNpfWdm/s5mxRdugoDboXxboJ7zEp7l4GZ:DoGfWd4DOoXtoFEpV
MD5 SHA1 SHA512 SSDEEP

Submit Download

c_processor.PNF

Path C:\Windows\INF\c_processor.PNF
Size 5KB
SHA256 620125da65ba6d7edd53d1de066f1c170039b076bc0c94d19e1eb6c7ecdf25a7
MD5 b8dd882cd6e6e96692fac23395f87de7
SHA1 9da3931e18964091d3ddf618b333e680e42715b6
SHA512 f8ded846c91873b7a81729928365ad5b8e03a29f3256f3a8b221753623ad3c335e6fead066b6402a69283021f11d6fa1597a3180221a2f2f8ae8fea1b86fa27a
SSDEEP 96:VF7RG+gmXfWA3eSLbPiOwthgmyDc8Vze8SWtpJO1:zXXfJ3zL4g7Dc8ReBWlc
MD5 SHA1 SHA512 SSDEEP

Submit Download

c_proximity.PNF

Path C:\Windows\INF\c_proximity.PNF
Size 5KB
SHA256 b24cadbdeaa14c68277ca7443b171074c36e2b28f2e2b476d055c4ad317e9c28
MD5 557e6c5ee5f30ee177fe90bd396327ce
SHA1 47da2b91f66ed53e2643c8fbed2de2c521849bb7
SHA512 06f724657a29605805bd8913ed6801cffa42ba7b641212b32be226a530c855166310ae0987f8446c186f252a592b6aab6ebb80c23e16c9bc7532fcc7cf4dad99
SSDEEP 48:VeRg1oogEfH5S5Om5kx3E8owqOC86QVfVHVM3gQTVyzYJwm9C4l2Q:Vea1oafH6503f/NC8c3geczYJf1
MD5 SHA1 SHA512 SSDEEP

Submit Download

c_receiptprinter.PNF

Path C:\Windows\INF\c_receiptprinter.PNF
Size 3KB
SHA256 8f8a0508ffbab5287084acd50da86abebe5b7c2ae62a6a321cfc5f6194ea98bb
MD5 0b4ed36ac65a4451211d6304620e7f87
SHA1 42da4edf4836d395dc7276700fce799ae86aa77e
SHA512 a13e482b27057dfd58c38b0c6369091126a21b7f73c9b9f0e84504e2e452c4bba2466c5a5258314f5f4e7a6bd178fddd9fd5a3b62df9cc84df49c7f0c8530929
MD5 SHA1 SHA512

Submit Download

c_scmdisk.PNF

Path C:\Windows\INF\c_scmdisk.PNF
Size 6KB
SHA256 7c0a5430e7ddf37ac601603bff865ffec1db51d745bd4ad18c11ea3ea7711201
MD5 e7b570f07874776e4cef2f9c08191001
SHA1 f85095870f4f1bb349a3daac6bece51b3a5c2031
SHA512 33d1968d54d9dac5c88e91312a54556be1fec2e192a7d3813e3e0635083b9daf93c51c7acc47596fd8d381015995e04d68fcd4009bab14f77c5ff8eaf57d2935
SSDEEP 96:5x/0VX7+8BhzO/WuHSuivqSY8aouaNdBEU/v87mW3aD://C6/qXURQBFX8N4
MD5 SHA1 SHA512 SSDEEP

Submit Download

c_scmvolume.PNF

Path C:\Windows\INF\c_scmvolume.PNF
Size 4KB
SHA256 4f57bfc496d88106f21875c2304e3a8854cfd02fb93ae106828fc420c5303580
MD5 946e35ab7a9d8cf86d5c6cb83dd8636a
SHA1 3455614b00b7de00a3c3d5c2bdb87cbc8c5ebb04
SHA512 c727e7014545520c8a8d4d08662d6cdde8e88fec7dbf5c3a282331f9654c96a5ff67c2cd37eb0a73f6702c077206d02355470a7b8fe157bf192083ec3a7b1a58
SSDEEP 48:aApfPlcFU9/Wy4f5O0A2iYx8IDbvRb/KV2p7sXQ:aAxlz/WyIA2iYyuvN/s2pQg
MD5 SHA1 SHA512 SSDEEP

Submit Download

c_smrdisk.PNF

Path C:\Windows\INF\c_smrdisk.PNF
Size 6KB
SHA256 e1c5ad9beab120ab8f12d305ae60b2ef3817ca20c9057d083cd19aa88f2d9fb1
MD5 dd62484074e4b6820726f9acf76a3f57
SHA1 8efdef5893dec4e4cbb3784a52cf7b7b4bfdc030
SHA512 e9d3e2d9070f1bc2f94bf1ec6662427cfb278eb8487a4dc10f2fcc873b319cb03a2983e23cc4244f040a53813d32922003919fdf4a95de9f755fbac519b9dcc9
SSDEEP 96:R6pqYcYiw6J4/WX2/HYUF3umNz6gcX4J7AC:94///4Q6TX4JL
MD5 SHA1 SHA512 SSDEEP

Submit Download

c_smrvolume.PNF

Path C:\Windows\INF\c_smrvolume.PNF
Size 4KB
SHA256 715edaceb7ab7cdd1d7954679c3bd61a35b2fe072717704c58eb84c25d4f9895
MD5 b5111085825780c9db8bc417678f8149
SHA1 efeb256a99fd73ce0fccb48ac01647f5fff1b277
SHA512 39167e3fc6e79163a680cc0941ea98c23dd76ec917dcc9bd5259e46d9215977b60454bbcd95f2bbeb53ee2fa203367e706089619e94bfdab8bdff8e66e35ad51
SSDEEP 48:y0hiez6bhQ/Wmr5yIymY3R3BIDbwRbBqyoyEp7SBTK:y0hlKhQ/WGymY3RRuwNB/oyEpWe
MD5 SHA1 SHA512 SSDEEP

Submit Download

c_sslaccel.PNF

Path C:\Windows\INF\c_sslaccel.PNF
Size 4KB
SHA256 024d245e7af8409c38f53bd91cf4ede6c11dad6a192a27351ce027db7fdcbb03
MD5 a5b60198ed9c83074babfa86f60c1e4b
SHA1 2f3e922d885fec14b965d9138ec90a1571125e8a
SHA512 47571c1995d026e90114bea355d67842e8e77ab003e906f7f5b247c1fe50743609165b944368f7b92759082c78f5b0ef020023c45bb712ede8e408979a7bbd00
SSDEEP 48:ugTFSZt4CNJkc5eTHlhNLeaoDb+9xb+yuHlqp79G1hX:ugA4+8l5OctQlqpc
MD5 SHA1 SHA512 SSDEEP

Submit Download

c_swcomponent.PNF

Path C:\Windows\INF\c_swcomponent.PNF
Size 7KB
SHA256 f46763a9b7072706927e582e3cbae297627738a5031d03b60dfa860888aa6712
MD5 b097dc99f5d4e4924505d26aad418060
SHA1 56c03dcfd0de0e0248c9087d278736e1c047ee98
SHA512 436d54a5912128459972bcb5cefae0fa9e878f8c0b142df76a4fa7060f2f08f5bc4fcffdee437c355f52450c1354c7128be72d1e32a7bb012aec02b7394cdcfb
SSDEEP 96:b9cYjojOtecSdcfshuFNFYkbR64VqIqI4EHNA3RF:bZASe/cUyMNIrrA37
MD5 SHA1 SHA512 SSDEEP

Submit Download

c_volume.PNF

Path C:\Windows\INF\c_volume.PNF
Size 4KB
SHA256 727a44c3c690ca8e5a2f75a4fa5be134313e6f860416ff4a05e97c2420cd6187
MD5 556ce96ae35a7473106caedd5bcc406f
SHA1 97204f7efc016a0146a5947829154e4087bd5f6c
SHA512 cf9ba4a767ce9e7f7584b6f36f4365769b5a633d45d8726250de43e0e85272d79a4844338efdaf6530235aebadf63029777050690ea3028bcb53b417b5af8072
SSDEEP 48:+j5CyGz7ElZd/Wycb5KQMRrYOmIDbXRbyKVMRGGLp7tVCCHr6mv7C:Y5RGzY/WyZYvuXNyDLpxV3r6mvG
MD5 SHA1 SHA512 SSDEEP

Submit Download

dc1-controller.PNF

Path C:\Windows\INF\dc1-controller.PNF
Size 14KB
SHA256 3ad263dfd598b6ae3ca367f343cff023d59c0934ae4cad559d7a305b3bc59e19
MD5 e7a58b5321b18b389f9d14e92914f83c
SHA1 a30de372f19497c990ec222afe214de11afc7c97
SHA512 31cf30abe22672d99ae81ff41e44e452b9f38e55b8b27519349a0984cc448db62c7f6b0baedca28a636d6f2d3cd260697b5c9e4fcbf8c8dc31073dd1e47078e1
SSDEEP 192:0EsfPZUVSQMJOJCr0V7/RWpfysyGPrUoSZM6OzCi0C7aRYeHocidbE5yhF8Ar/CA:0lDyku29D8m
MD5 SHA1 SHA512 SSDEEP

Submit Download

digitalmediadevice.PNF

Path C:\Windows\INF\digitalmediadevice.PNF
Size 7KB
SHA256 337795db957b3fa3c0e02253f934226fd3aa19158656ccebf21d84965a74cb4d
MD5 db96bfbf5ff25ea12d7d4a2d442c8a8d
SHA1 8a1bc2ffee841bce857159bfa0d40b729239661a
SHA512 ca9d56f06e1aa26e71856d834eabcddc1015640c2db2effc610e8769139efdcfa10fb1767c118fcff56755cca98604e890dd63b79abafb0bf28eb1a4a6fa6252
SSDEEP 96:XvrBaJIfj45QiO4ED6F4rLwY+i50fRAfSOgGyOpt05:iQii2FcH+i5OAUGtva
MD5 SHA1 SHA512 SSDEEP

Submit Download

miradisp.PNF

Path C:\Windows\INF\miradisp.PNF
Size 11KB
SHA256 519c5d140e5fa8aae6506e14dce399e1e7d44798989227962ef51733cca03227
MD5 a29c26407bbcd347209ef1b6ee0da34f
SHA1 e1f4ce5ff4619a4414aa1e0ed3ac520a83919584
SHA512 1760e5112b9e4723d51be0f07986649b3b524ec3a994b3035b6239850c449279cbbef40533dab1cc08c1bae3ec5957148ce6f66504d0c9cfd52109ef09cb53d7
SSDEEP 192:hJQ+yRrzWzo5Om8Mgcs+aEjWwdzmjsqk2lhqvuiaWWwg2T28q6:hJ+F8MgcfagWwdzmjsqtlDi+jQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

oposdrv.PNF

Path C:\Windows\INF\oposdrv.PNF
Size 8KB
SHA256 36b729ee28e68d90c3fde4a3a1633b59339045657fee03218742276768b8c980
MD5 70d8944bc2132b99510043f162b00088
SHA1 ea0208a032bb15c441f849f936ed85d5f672b820
SHA512 426b116dfc2b859dc485d862013eed27273ec7bc14f317eb37be032d09347a9208a8e3aa55324cf368cad0a2d91facbe417a3a041c8c7d868ca9d23dce95385b
SSDEEP 96:ZM2mz1wjUw/6F4rSmOhovI+5/v1bIRd2RGaA0TrwLi1WIGNudUZKMF3+p/:ZFP6F4r7j5K/2JWIGAUZK1B
MD5 SHA1 SHA512 SSDEEP

Submit Download

rawsilo.PNF

Path C:\Windows\INF\rawsilo.PNF
Size 8KB
SHA256 9676f340750cac105df46f894750ef8b1fb634217811da49858c5c82846f7e28
MD5 7dda8349d792874973914b6402fb6d3c
SHA1 c28ecf26eb4b21dbeb6ffcad8535c0804c41b0e4
SHA512 57e7548ebb734ec8a6b2935059052971965caff9972eb57cf543f08ed0ee4d69de14806445b3ce0dc45f884f5b7ae7decc2d49fde5d8ee8076ffcf429ae3c1e2
SSDEEP 96:A59+ZOOiYPZksQR1PRg2QqB6eiSllBNNRx5Rn4ORQzhLg+RzRqRlbX2k6PeDOQML:ADZvQ2ftFFKzhLDtkk9
MD5 SHA1 SHA512 SSDEEP

Submit Download

rdcameradriver.PNF

Path C:\Windows\INF\rdcameradriver.PNF
Size 13KB
SHA256 ab0cb0aa7c4b85d6209fdfc916c5426cdf92fa8bc63c3fe15cda9485bc39f7a6
MD5 1c5d8d8648b79b79d2ddda9d78fa637c
SHA1 5de477696fdaf88c626717f8a3a5c06c7135eb02
SHA512 e0a1d6d35578edc27783a22e40ae533477fdf0ff315d119d4fa460faba1653b23104976b1e0f685d0201f7cb9c06a304481337b567c3b2aa57ee72d31bf743e0
SSDEEP 96:YXE2OCMVZbnAne6Sip7k8hp0/1VWlyjkoskBQulsqZ+eTY6T0qrHkj6g2s78MIkn:lPbAne6SizhSCSkAlsmT1WqzGmb/dmH
MD5 SHA1 SHA512 SSDEEP

Submit Download

remoteposdrv.PNF

Path C:\Windows\INF\remoteposdrv.PNF
Size 8KB
SHA256 235cad285998c2926a74a8c710c3ccc32c3165d408c43ac236952f6772b49704
MD5 cfd404fb925e1b3988fad13846b65a90
SHA1 2a493f3fb68c9f89e70058b2ae06322337b46701
SHA512 5bfd9fe8ffc584317b02e2926b5abd1942bdacd66688a372e410d6d800fa4fc1c5cd56fa7cd92c648ed5f8ffd792a63f25b189451e77b0b2eb6b8ff73fa87087
SSDEEP 96:mJgKFK7Lpmu+lfyY0qaO+1g7U1O6bgrV0krlLgvgNW0h//9:UIr+ZJwK7UFb1sTr
MD5 SHA1 SHA512 SSDEEP

Submit Download

ts_generic.PNF

Path C:\Windows\INF\ts_generic.PNF
Size 8KB
SHA256 e3ff203d71dc37a6e4df5844fefe3dcf720dbcf305f40fbbc5fca2b6ea396f15
MD5 36b9e9735af92ece917fc6e528660fc1
SHA1 80b78e0ad48329c657d261dc30c46de199f0ee4d
SHA512 0f3153d634a49341454b2974248a0bed739e75e10a2a6026dfb322092170fb65e7252283456ed5ee9d9c65b0826dcc2724461bc4d3d83495dc9f463204eccf3c
SSDEEP 96:zrzyuYJhZ476vMdEL5PjYv4fhuONi93+TwmA2YZ0AiF3SzxogsNraMK07hpGpi:vhB76vMd+VjYv1kT/A24xogsNwg
MD5 SHA1 SHA512 SSDEEP

Submit Download

wsdprint.PNF

Path C:\Windows\INF\wsdprint.PNF
Size 7KB
SHA256 2e4a7afab81f605c4b994bb71ddab299e7f1f7ce96140fb930110c3aa5d1167d
MD5 1671a9ea5066b2b30ad0b59fbcd67992
SHA1 eb44dfe3216ded035bdc4b891a06763e2a0584ca
SHA512 610c718048e2243f6a46bb02f9921fdf0bff26306cd58114002ca7269b68db27ed37e5c7be45e62dd328dae24f634496d78a08263d708f27868536a98a4d4b38
SSDEEP 96:LlfjHcmpFCGsrtH1AQGRV6ltzjbZLNAzfaa03cPtKT/pudJsB:FMGsYLL6TIIpudm
MD5 SHA1 SHA512 SSDEEP

Submit Download