41f5035bd0070cd9b240d684e1b055d9d76140ab53196cac1a6172b9490a3063

Resubmissions

01-02-2025 20:13

250201-yzt8razpaq 8

01-02-2025 18:19

250201-wymq6svjbs 10

Analysis

max time kernel
341s
max time network
340s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
01-02-2025 20:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

GoDm.zip
Size

7.7MB
MD5

ce486f16b14240fa3c9da7dbf0883e35
SHA1

9b2843811b7cee87138a675dead3d891a48b9be9
SHA256

41f5035bd0070cd9b240d684e1b055d9d76140ab53196cac1a6172b9490a3063
SHA512

fe35664b3fb8c1e4cee9a56b5f2c0963a55ffdfebe4b619c4070c70d6c6a316b08f410b1519cf3774762b28c5d3bd8895e831caedee89fba9ed961c02648e4ff
SSDEEP

196608:EwW+LSbSSxaqah9Qo1bcBtC9cm2PQsZyCveLMRMg1fiH:A+mRwP91aE2PQsYCmMF6H

Score

8^/10

bootkit defense_evasion discovery persistence ransomware

Malware Config

Signatures

Downloads MZ/PE file 2 IoCs

flow	pid	Process
32	3084	msedge.exe
43	3084	msedge.exe

Event Triggered Execution: Image File Execution Options Injection 1 TTPs 14 IoCs

persistence

Image File Execution Options Injection

T1546.012

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mmc.exe\Debugger = "rekt.exe"	MEMZ.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe	MEMZ.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe	MEMZ.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe\Debugger = "rekt.exe"	MEMZ.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe	MEMZ.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\shutdown.exe\Debugger = "rekt.exe"	MEMZ.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mmc.exe	MEMZ.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\logonui.exe	MEMZ.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\logonui.exe\Debugger = "rekt.exe"	MEMZ.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskkill.exe	MEMZ.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\Debugger = "rekt.exe"	MEMZ.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\Debugger = "rekt.exe"	MEMZ.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\shutdown.exe	MEMZ.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskkill.exe\Debugger = "rekt.exe"	MEMZ.exe

Executes dropped EXE 8 IoCs

pid	Process
4648	winrar-x64-710b3.exe
1224	winrar-x64-710b3.exe
2604	VineMEMZ-Original.exe
3584	MEMZ.exe
3376	MEMZ.exe
1372	MEMZ.exe
3380	MEMZ.exe
2436	MEMZ.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	MEMZ.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Roaming\\Data\\Pussy.png"	MEMZ.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 2 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\VineMEMZ-Original.exe:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\winrar-x64-710b3.exe:Zone.Identifier	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VineMEMZ-Original.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	geometry dash auto speedhack.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MEMZ.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MEMZ.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	geometry dash auto speedhack.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MEMZ.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MEMZ.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MEMZ.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 54 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:FMTID = "{B725F130-47EF-101A-A5F1-02608C9EEBAC}"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\Local Settings\MuiCache	MiniSearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\FFlags = "1"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0e000000ffffffff	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\IconSize = "48"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\LogicalViewMode = "1"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\IconSize = "16"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\Local Settings	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\FFlags = "1092616193"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 200000001a00eebbfe23000010009bee837d4422704eb1f55393042af1e400000000	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\LogicalViewMode = "3"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupByDirection = "1"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:PID = "14"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\Local Settings	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\Mode = "1"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a000000a000000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\Local Settings	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f44471a0359723fa74489c55595fe6b30ee0000	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\KnownFolderDerivedFolderType = "{885A186E-A440-4ADA-812B-DB871B942259}"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupByKey:PID = "0"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\Registry\User\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\NotificationData	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Downloads"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByDirection = "4294967295"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupView = "0"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\NodeSlot = "2"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Mode = "4"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupView = "4294967295"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1092616193"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	msedge.exe

NTFS ADS 6 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 75713.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\memz.by.iTzDrK_.rar:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\VineMEMZ-Original.exe:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 39432.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\winrar-x64-710b3.exe:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\memz.by.iTzDrK_.zip:Zone.Identifier	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3084	msedge.exe
3084	msedge.exe
4592	msedge.exe
4592	msedge.exe
3632	msedge.exe
3632	msedge.exe
1196	identity_helper.exe
1196	identity_helper.exe
1680	msedge.exe
1680	msedge.exe
748	msedge.exe
748	msedge.exe
1552	msedge.exe
1552	msedge.exe
2620	msedge.exe
2620	msedge.exe
2620	msedge.exe
2620	msedge.exe
1032	msedge.exe
1032	msedge.exe
3652	msedge.exe
3652	msedge.exe
3380	MEMZ.exe
3380	MEMZ.exe
1372	MEMZ.exe
1372	MEMZ.exe
3376	MEMZ.exe
3376	MEMZ.exe
1372	MEMZ.exe
1372	MEMZ.exe
3380	MEMZ.exe
3380	MEMZ.exe
3376	MEMZ.exe
3376	MEMZ.exe
3376	MEMZ.exe
3376	MEMZ.exe
3380	MEMZ.exe
3380	MEMZ.exe
1372	MEMZ.exe
1372	MEMZ.exe
1372	MEMZ.exe
3380	MEMZ.exe
1372	MEMZ.exe
3380	MEMZ.exe
3376	MEMZ.exe
3376	MEMZ.exe
3376	MEMZ.exe
3376	MEMZ.exe
3380	MEMZ.exe
3380	MEMZ.exe
1372	MEMZ.exe
1372	MEMZ.exe
1372	MEMZ.exe
3380	MEMZ.exe
1372	MEMZ.exe
3380	MEMZ.exe
3376	MEMZ.exe
3376	MEMZ.exe
3376	MEMZ.exe
3376	MEMZ.exe
3380	MEMZ.exe
3380	MEMZ.exe
1372	MEMZ.exe
1372	MEMZ.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 44 IoCs

pid	Process
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: 33	4820	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	4820	AUDIODG.EXE
Token: SeShutdownPrivilege	2884	geometry dash auto speedhack.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe

Suspicious use of SendNotifyMessage 19 IoCs

pid	Process
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
2436	MEMZ.exe

Suspicious use of SetWindowsHookEx 39 IoCs

pid	Process
4844	MiniSearchHost.exe
4648	winrar-x64-710b3.exe
4648	winrar-x64-710b3.exe
4648	winrar-x64-710b3.exe
2228	OpenWith.exe
2228	OpenWith.exe
2228	OpenWith.exe
1224	winrar-x64-710b3.exe
1224	winrar-x64-710b3.exe
1224	winrar-x64-710b3.exe
1032	msedge.exe
2604	VineMEMZ-Original.exe
3004	geometry dash auto speedhack.exe
3584	MEMZ.exe
3376	MEMZ.exe
1372	MEMZ.exe
3380	MEMZ.exe
2436	MEMZ.exe
2884	geometry dash auto speedhack.exe
2884	geometry dash auto speedhack.exe
2884	geometry dash auto speedhack.exe
2884	geometry dash auto speedhack.exe
2884	geometry dash auto speedhack.exe
2884	geometry dash auto speedhack.exe
2884	geometry dash auto speedhack.exe
2884	geometry dash auto speedhack.exe
2884	geometry dash auto speedhack.exe
2884	geometry dash auto speedhack.exe
2884	geometry dash auto speedhack.exe
2884	geometry dash auto speedhack.exe
2884	geometry dash auto speedhack.exe
2884	geometry dash auto speedhack.exe
2884	geometry dash auto speedhack.exe
2884	geometry dash auto speedhack.exe
2884	geometry dash auto speedhack.exe
2884	geometry dash auto speedhack.exe
2884	geometry dash auto speedhack.exe
2884	geometry dash auto speedhack.exe
2884	geometry dash auto speedhack.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4592 wrote to memory of 2232	4592	msedge.exe	80
PID 4592 wrote to memory of 2232	4592	msedge.exe	80
PID 4592 wrote to memory of 2100	4592	msedge.exe	81
PID 4592 wrote to memory of 2100	4592	msedge.exe	81
PID 4592 wrote to memory of 2100	4592	msedge.exe	81
PID 4592 wrote to memory of 2100	4592	msedge.exe	81
PID 4592 wrote to memory of 2100	4592	msedge.exe	81
PID 4592 wrote to memory of 2100	4592	msedge.exe	81
PID 4592 wrote to memory of 2100	4592	msedge.exe	81
PID 4592 wrote to memory of 2100	4592	msedge.exe	81
PID 4592 wrote to memory of 2100	4592	msedge.exe	81
PID 4592 wrote to memory of 2100	4592	msedge.exe	81
PID 4592 wrote to memory of 2100	4592	msedge.exe	81
PID 4592 wrote to memory of 2100	4592	msedge.exe	81
PID 4592 wrote to memory of 2100	4592	msedge.exe	81
PID 4592 wrote to memory of 2100	4592	msedge.exe	81
PID 4592 wrote to memory of 2100	4592	msedge.exe	81
PID 4592 wrote to memory of 2100	4592	msedge.exe	81
PID 4592 wrote to memory of 2100	4592	msedge.exe	81
PID 4592 wrote to memory of 2100	4592	msedge.exe	81
PID 4592 wrote to memory of 2100	4592	msedge.exe	81
PID 4592 wrote to memory of 2100	4592	msedge.exe	81
PID 4592 wrote to memory of 2100	4592	msedge.exe	81
PID 4592 wrote to memory of 2100	4592	msedge.exe	81
PID 4592 wrote to memory of 2100	4592	msedge.exe	81
PID 4592 wrote to memory of 2100	4592	msedge.exe	81
PID 4592 wrote to memory of 2100	4592	msedge.exe	81
PID 4592 wrote to memory of 2100	4592	msedge.exe	81
PID 4592 wrote to memory of 2100	4592	msedge.exe	81
PID 4592 wrote to memory of 2100	4592	msedge.exe	81
PID 4592 wrote to memory of 2100	4592	msedge.exe	81
PID 4592 wrote to memory of 2100	4592	msedge.exe	81
PID 4592 wrote to memory of 2100	4592	msedge.exe	81
PID 4592 wrote to memory of 2100	4592	msedge.exe	81
PID 4592 wrote to memory of 2100	4592	msedge.exe	81
PID 4592 wrote to memory of 2100	4592	msedge.exe	81
PID 4592 wrote to memory of 2100	4592	msedge.exe	81
PID 4592 wrote to memory of 2100	4592	msedge.exe	81
PID 4592 wrote to memory of 2100	4592	msedge.exe	81
PID 4592 wrote to memory of 2100	4592	msedge.exe	81
PID 4592 wrote to memory of 2100	4592	msedge.exe	81
PID 4592 wrote to memory of 2100	4592	msedge.exe	81
PID 4592 wrote to memory of 3084	4592	msedge.exe	82
PID 4592 wrote to memory of 3084	4592	msedge.exe	82
PID 4592 wrote to memory of 4824	4592	msedge.exe	83
PID 4592 wrote to memory of 4824	4592	msedge.exe	83
PID 4592 wrote to memory of 4824	4592	msedge.exe	83
PID 4592 wrote to memory of 4824	4592	msedge.exe	83
PID 4592 wrote to memory of 4824	4592	msedge.exe	83
PID 4592 wrote to memory of 4824	4592	msedge.exe	83
PID 4592 wrote to memory of 4824	4592	msedge.exe	83
PID 4592 wrote to memory of 4824	4592	msedge.exe	83
PID 4592 wrote to memory of 4824	4592	msedge.exe	83
PID 4592 wrote to memory of 4824	4592	msedge.exe	83
PID 4592 wrote to memory of 4824	4592	msedge.exe	83
PID 4592 wrote to memory of 4824	4592	msedge.exe	83
PID 4592 wrote to memory of 4824	4592	msedge.exe	83
PID 4592 wrote to memory of 4824	4592	msedge.exe	83
PID 4592 wrote to memory of 4824	4592	msedge.exe	83
PID 4592 wrote to memory of 4824	4592	msedge.exe	83
PID 4592 wrote to memory of 4824	4592	msedge.exe	83
PID 4592 wrote to memory of 4824	4592	msedge.exe	83
PID 4592 wrote to memory of 4824	4592	msedge.exe	83
PID 4592 wrote to memory of 4824	4592	msedge.exe	83

C:\Windows\Explorer.exe
C:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\GoDm.zip
1⤵
PID:4884

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
- Modifies registry class
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffdc1a93cb8,0x7ffdc1a93cc8,0x7ffdc1a93cd8
  2⤵
  PID:2232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1900,14385662958180849717,15678119053808087053,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1908 /prefetch:2
  2⤵
  PID:2100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1900,14385662958180849717,15678119053808087053,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2292 /prefetch:3
  2⤵
  - Downloads MZ/PE file
  - Suspicious behavior: EnumeratesProcesses
  PID:3084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1900,14385662958180849717,15678119053808087053,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2556 /prefetch:8
  2⤵
  PID:4824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,14385662958180849717,15678119053808087053,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3192 /prefetch:1
  2⤵
  PID:3168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,14385662958180849717,15678119053808087053,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:1
  2⤵
  PID:2896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,14385662958180849717,15678119053808087053,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4572 /prefetch:1
  2⤵
  PID:1624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,14385662958180849717,15678119053808087053,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4472 /prefetch:1
  2⤵
  PID:1308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1900,14385662958180849717,15678119053808087053,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4452 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,14385662958180849717,15678119053808087053,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3992 /prefetch:1
  2⤵
  PID:2712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,14385662958180849717,15678119053808087053,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3768 /prefetch:1
  2⤵
  PID:3740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,14385662958180849717,15678119053808087053,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5184 /prefetch:1
  2⤵
  PID:688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,14385662958180849717,15678119053808087053,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4824 /prefetch:1
  2⤵
  PID:4892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,14385662958180849717,15678119053808087053,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5380 /prefetch:1
  2⤵
  PID:4668
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1900,14385662958180849717,15678119053808087053,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5264 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,14385662958180849717,15678119053808087053,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5620 /prefetch:1
  2⤵
  PID:2676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,14385662958180849717,15678119053808087053,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5612 /prefetch:1
  2⤵
  PID:4696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,14385662958180849717,15678119053808087053,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6080 /prefetch:1
  2⤵
  PID:3928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1900,14385662958180849717,15678119053808087053,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6232 /prefetch:8
  2⤵
  PID:3180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,14385662958180849717,15678119053808087053,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4500 /prefetch:1
  2⤵
  PID:2764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,14385662958180849717,15678119053808087053,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5884 /prefetch:1
  2⤵
  PID:2376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,14385662958180849717,15678119053808087053,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5924 /prefetch:1
  2⤵
  PID:4508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,14385662958180849717,15678119053808087053,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5620 /prefetch:1
  2⤵
  PID:2660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,14385662958180849717,15678119053808087053,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6372 /prefetch:1
  2⤵
  PID:3944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1900,14385662958180849717,15678119053808087053,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5996 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:1680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,14385662958180849717,15678119053808087053,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4500 /prefetch:1
  2⤵
  PID:1008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1900,14385662958180849717,15678119053808087053,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5856 /prefetch:8
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,14385662958180849717,15678119053808087053,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6000 /prefetch:1
  2⤵
  PID:1680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,14385662958180849717,15678119053808087053,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6356 /prefetch:1
  2⤵
  PID:4312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,14385662958180849717,15678119053808087053,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4736 /prefetch:1
  2⤵
  PID:244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,14385662958180849717,15678119053808087053,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2816 /prefetch:1
  2⤵
  PID:1808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,14385662958180849717,15678119053808087053,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6684 /prefetch:1
  2⤵
  PID:1208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,14385662958180849717,15678119053808087053,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6860 /prefetch:1
  2⤵
  PID:3592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,14385662958180849717,15678119053808087053,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5788 /prefetch:1
  2⤵
  PID:652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1900,14385662958180849717,15678119053808087053,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6920 /prefetch:8
  2⤵
  PID:4648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1900,14385662958180849717,15678119053808087053,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3520 /prefetch:8
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:1552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,14385662958180849717,15678119053808087053,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6016 /prefetch:1
  2⤵
  PID:3704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,14385662958180849717,15678119053808087053,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7280 /prefetch:1
  2⤵
  PID:5032
- C:\Users\Admin\Downloads\winrar-x64-710b3.exe
  "C:\Users\Admin\Downloads\winrar-x64-710b3.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1900,14385662958180849717,15678119053808087053,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=7172 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,14385662958180849717,15678119053808087053,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7544 /prefetch:1
  2⤵
  PID:2332
- C:\Users\Admin\Downloads\winrar-x64-710b3.exe
  "C:\Users\Admin\Downloads\winrar-x64-710b3.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,14385662958180849717,15678119053808087053,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7072 /prefetch:1
  2⤵
  PID:2016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,14385662958180849717,15678119053808087053,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7296 /prefetch:1
  2⤵
  PID:3576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,14385662958180849717,15678119053808087053,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7436 /prefetch:1
  2⤵
  PID:1880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,14385662958180849717,15678119053808087053,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7240 /prefetch:1
  2⤵
  PID:1552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1900,14385662958180849717,15678119053808087053,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7560 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:1032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,14385662958180849717,15678119053808087053,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6440 /prefetch:1
  2⤵
  PID:5040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,14385662958180849717,15678119053808087053,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5136 /prefetch:1
  2⤵
  PID:2860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,14385662958180849717,15678119053808087053,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6432 /prefetch:1
  2⤵
  PID:1636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,14385662958180849717,15678119053808087053,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=55 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7696 /prefetch:1
  2⤵
  PID:3100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,14385662958180849717,15678119053808087053,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=56 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7484 /prefetch:1
  2⤵
  PID:1872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,14385662958180849717,15678119053808087053,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=57 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7876 /prefetch:1
  2⤵
  PID:4212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,14385662958180849717,15678119053808087053,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=59 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7636 /prefetch:1
  2⤵
  PID:4172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1900,14385662958180849717,15678119053808087053,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=8080 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:3652
- C:\Users\Admin\Downloads\VineMEMZ-Original.exe
  "C:\Users\Admin\Downloads\VineMEMZ-Original.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2604
- - C:\Users\Admin\AppData\Roaming\MEMZ.exe
    "C:\Users\Admin\AppData\Roaming\MEMZ.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:3584
  - - C:\Users\Admin\AppData\Roaming\MEMZ.exe
      /watchdog
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of SetWindowsHookEx
      PID:3376
  - - C:\Users\Admin\AppData\Roaming\MEMZ.exe
      /watchdog
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of SetWindowsHookEx
      PID:1372
  - - C:\Users\Admin\AppData\Roaming\MEMZ.exe
      /watchdog
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of SetWindowsHookEx
      PID:3380
  - - C:\Users\Admin\AppData\Roaming\MEMZ.exe
      /main
      4⤵
      Event Triggered Execution: Image File Execution Options Injection
      Executes dropped EXE
      Writes to the Master Boot Record (MBR)
      Sets desktop wallpaper using registry
      System Location Discovery: System Language Discovery
      Suspicious use of SendNotifyMessage
      Suspicious use of SetWindowsHookEx
      PID:2436
    - - C:\Windows\SysWOW64\notepad.exe
        
        "C:\Windows\System32\notepad.exe" \note.txt
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,14385662958180849717,15678119053808087053,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=61 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7064 /prefetch:1
  2⤵
  PID:1424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,14385662958180849717,15678119053808087053,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=62 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3464 /prefetch:1
  2⤵
  PID:1716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,14385662958180849717,15678119053808087053,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=63 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8068 /prefetch:1
  2⤵
  PID:1036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,14385662958180849717,15678119053808087053,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=64 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7668 /prefetch:1
  2⤵
  PID:2044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,14385662958180849717,15678119053808087053,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=65 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7248 /prefetch:1
  2⤵
  PID:4684

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1880

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2928

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4844

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2228

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1076

C:\Users\Admin\AppData\Local\Temp\Temp1_memz.by.iTzDrK_.zip\geometry dash auto speedhack.exe
"C:\Users\Admin\AppData\Local\Temp\Temp1_memz.by.iTzDrK_.zip\geometry dash auto speedhack.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3004
- C:\Users\Admin\AppData\Local\Temp\Temp1_memz.by.iTzDrK_.zip\geometry dash auto speedhack.exe
  "C:\Users\Admin\AppData\Local\Temp\Temp1_memz.by.iTzDrK_.zip\geometry dash auto speedhack.exe" /watchdog
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:2884

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004E4 0x0000000000000480
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4820

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Defense Evasion

Modify Registry

T1112

Pre-OS Boot

T1542

Bootkit

T1542.003

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d7145ec3fa29a4f2df900d1418974538

SHA1
1368d579635ba1a53d7af0ed89bf0b001f149f9d

SHA256
efc56eb46cf3352bf706c0309d5d740bca6ac06142f9bdc5e8344b81d4d83d59

SHA512
5bb663ede88f8b7c96b09c1214aac68eda99bc09525ac383baa96914ff7d553ea1aed09e3c9d16893d791c81ddb164c682dfbb4759ac0bc751221f3e36558a91

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d91478312beae099b8ed57e547611ba2

SHA1
4b927559aedbde267a6193e3e480fb18e75c43d7

SHA256
df43cd7779d9fc91fd0416155d6771bc81565e98be38689cb17caece256bf043

SHA512
4086c4ebe410a37d0124fc8bd00c58775e70ab2b7b5a39b4e49b332ce5b4866c6775707436395467aff9596507c96fb4896f3bf0249c5b9c99a927f31dcc1a96

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000002

Filesize
48KB

MD5
df1d27ed34798e62c1b48fb4d5aa4904

SHA1
2e1052b9d649a404cbf8152c47b85c6bc5edc0c9

SHA256
c344508bd16c376f827cf568ef936ad2517174d72bf7154f8b781a621250cc86

SHA512
411311be9bfdf7a890adc15fe89e6f363bc083a186bb9bcb02be13afb60df7ebb545d484c597b5eecdbfb2f86cd246c21678209aa61be3631f983c60e5d5ca94

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000003

Filesize
64KB

MD5
d6b36c7d4b06f140f860ddc91a4c659c

SHA1
ccf16571637b8d3e4c9423688c5bd06167bfb9e9

SHA256
34013d7f3f0186a612bef84f2984e2767b32c9e1940df54b01d5bd6789f59e92

SHA512
2a9dd9352298ec7d1b439033b57ee9a390c373eeb8502f7f36d6826e6dd3e447b8ffd4be4f275d51481ef9a6ac2c2d97ef98f3f9d36a5a971275bf6cee48e487

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000004

Filesize
67KB

MD5
69df804d05f8b29a88278b7d582dd279

SHA1
d9560905612cf656d5dd0e741172fb4cd9c60688

SHA256
b885987a52236f56ce7a5ca18b18533e64f62ab64eb14050ede93c93b5bd5608

SHA512
0ef49eeeeb463da832f7d5b11f6418baa65963de62c00e71d847183e0035be03e63c097103d30329582fe806d246e3c0e3ecab8b2498799abbb21d8b7febdc0e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000005

Filesize
19KB

MD5
1bd4ae71ef8e69ad4b5ffd8dc7d2dcb5

SHA1
6dd8803e59949c985d6a9df2f26c833041a5178c

SHA256
af18b3681e8e2a1e8dc34c2aa60530dc8d8a9258c4d562cbe20c898d5de98725

SHA512
b3ff083b669aca75549396250e05344ba2f1c021468589f2bd6f1b977b7f11df00f958bbbd22f07708b5d30d0260f39d8de57e75382b3ab8e78a2c41ef428863

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000006

Filesize
63KB

MD5
226541550a51911c375216f718493f65

SHA1
f6e608468401f9384cabdef45ca19e2afacc84bd

SHA256
caecff4179910ce0ff470f9fa9eb4349e8fb717fa1432cf19987450a4e1ef4a5

SHA512
2947b309f15e0e321beb9506861883fde8391c6f6140178c7e6ee7750d6418266360c335477cae0b067a6a6d86935ec5f7acdfdacc9edffa8b04ec71be210516

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000007

Filesize
25KB

MD5
e580283a2015072bac6b880355fe117e

SHA1
0c0f3ca89e1a9da80cd5f536130ce5da3ad64bfe

SHA256
be8b1b612f207b673b1b031a7c67f8e2421d57a305bebf11d94f1c6e47d569ee

SHA512
65903ba8657d145cc3bbe37f5688b803ee03dd8ff8da23b587f64acaa793eaea52fcb6e8c0ec5032e0e3a2faacc917406ada179706182ce757d1c02979986dd6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001c

Filesize
40KB

MD5
3051c1e179d84292d3f84a1a0a112c80

SHA1
c11a63236373abfe574f2935a0e7024688b71ccb

SHA256
992cbdc768319cbd64c1ec740134deccbb990d29d7dccd5ecd5c49672fa98ea3

SHA512
df64e0f8c59b50bcffb523b6eab8fabf5f0c5c3d1abbfc6aa4831b4f6ce008320c66121dcedd124533867a9d5de83c424c5e9390bf0a95c8e641af6de74dabff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001d

Filesize
53KB

MD5
68f0a51fa86985999964ee43de12cdd5

SHA1
bbfc7666be00c560b7394fa0b82b864237a99d8c

SHA256
f230c691e1525fac0191e2f4a1db36046306eb7d19808b7bf8227b7ed75e5a0f

SHA512
3049b9bd4160bfa702f2e2b6c1714c960d2c422e3481d3b6dd7006e65aa5075eed1dc9b8a2337e0501e9a7780a38718d298b2415cf30ec9e115a9360df5fa2a7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\25c90b4fb1c6ef85_0

Filesize
1KB

MD5
c1de64d8b4fc39b7319c2c51f0dc4634

SHA1
65b0ca993323fc35278d17ba6bd7cd1b5dea75f6

SHA256
142e1b5e89f7175c9cffd56bb1c775100648508558a00b543a251d79a1d3c005

SHA512
bfda5f0e29ab6cb952e765862840c7ddecb7cad996a81e5cbd69b7ae3d91690f0c4d72c884dd8ae6043d29999346f2699dbb3306ed9b52bf6f02757bd3efb48f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\2692617678c042d9_0

Filesize
10KB

MD5
29bfcf8a119f86992a525113710d37c5

SHA1
b929af6a3b20528040a18e5ba3f8b90f922ea326

SHA256
75f5897d3cf2343d6bbaa07558b0651c598ca078187546c18313489590122b6d

SHA512
cbe2bae9a30593c2066fdbbd6423ce39c9957457ef63beb758e3ed51a9315e39a1ab280358b1cd7c2c715dc2f4f7d3fc67259de68a1ab7f81d719067f84b08df

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\2f4680e8f8f8a14f_0

Filesize
13KB

MD5
d1b9b5759fabb67c59ef811d2bd6d352

SHA1
a6865d76376aed9b8447d5eca0fb67b8133133bb

SHA256
6ce24b903578a5c7f4c8978f5ff8f0ea3fe93b479de2899d066758fee6415a0a

SHA512
ff0a4895043edaabf51f8892dbcecbb6c5c834275d4b707eb8d98c98c169770e69ae7905a7029d37978075c1a1d29875351838aba168e1d8891043abd1329a08

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\3a4259a0181983ba_0

Filesize
23KB

MD5
db2921ee2a3dde976ad05e7542e0f552

SHA1
0123fb0921db037fc75c92c5fc8b23ad9389abda

SHA256
f7fa92c02f9610ffc9b27d49d79b8fc753de92feed804f4dfe98c93f69b174c3

SHA512
b72b49947bed34408d4612ee4c865759618346883353d61f6075a74fe95e99a60542812ddd040df26cc950d8b46315f1123a14e8f6729803ff4eda779a4f9012

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\45a16ff6d0d9ab5f_0

Filesize
1KB

MD5
dddfd793664c5cd5f320b2bb01497e9e

SHA1
c7b05badd4fa59b2f37e2708524bcfe818a1bc69

SHA256
4519224f54203e5bc04d9045f53f056b3609767faf2d7568e82518ffca82ec96

SHA512
bf5c2d44310d53dd91bc26c5a48e6763d6ad97ac881a09921436b3b1d59a078d129678d95559b03f1ccb3eec31f008e60ea6fae0937561bc0b9f953a0c007a01

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\53ac5abc87e80789_0

Filesize
3KB

MD5
3a62808d1801a16f3f096e57c93079b8

SHA1
00459efa6e4a20edbc9eb9d2e780a3c11b58d3c9

SHA256
ab71d1648d688cc1c1ad0a8a5bf969c887359f19fe44c537583d177042c2ad95

SHA512
e1ed63c36fcca2b11f593e8b85ea86554dfc9e40cbae22b277a3a06872f3b6f630888a59d1220a1cd51218b286b2f24a5f910366e6d3fb57b90c7d9466fd8147

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\5dd1e579c9681f95_0

Filesize
2KB

MD5
502af19153f919ef2ac619937c1534da

SHA1
23208d2d95af8a64cdfe90f1a4b50769ce04f7cc

SHA256
7c12a09dc58536281b157c6940bb512676a72f0f8f91372ecc5d31f95b1a67bf

SHA512
1b1eff477c8d1b0d9ace86f582c055eb0aa6f65339e5c0e07c969abe03de170f5beb47762974cc8259b3d927a97ae98a6ed7545443b058dbd152f8f66fa4bb6c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\61a0b4d20ae0e222_0

Filesize
15KB

MD5
0a4bd8879f3d8f8ae84631578edc7d1e

SHA1
2285451304c26104e6dcd6c361dac2558610592c

SHA256
5b2fb2737a2ef858168cfc437a86ab2bd7c3796526abe01cfc2685942c1a2c39

SHA512
c4ef5996ce7d8ab5e89cdcf4660ed6be320686e4742e33fb90d25e6219241e53f6768c93dc5931bdb63b0431bf39651763498206492d2ea352a6d3d995e02f85

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\71d68e68ea4089fe_0

Filesize
6KB

MD5
409b9a7a801aef11d06acd37e688b571

SHA1
25d20d4394e5a86f66d523ca18e5835fbeed8f3c

SHA256
f28ea12c3357dc03e0b72f202f567f08912bc17dd59de92ccdc7e9c6afa68135

SHA512
6fe0260c7b7d0c6cab350ad831407337877829d95b0f1b9f40e787842be57c80fba1d040e9e2ee1d9b3c67e5415eaa6485d1804b4c09f155934bdf3472deac48

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\74b88724f60b0383_0

Filesize
2KB

MD5
a75671c44cd3b42d353e3bab34398235

SHA1
6dea651f0f541ef68cf3924c31d279b0ab1473b5

SHA256
6cd0e8cbe3341f04819fd4535685dd9a0ec993ba020a3e6bccc5a1f310341814

SHA512
61c85983f12354ffdd6fb35c2f0b91123b1798250f42bfe12c6d475bb33956e578bbd59afad1bf169557d3b5df3cbc09096ff3807f53d2d5c5428cc0d5e943f5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\be6d12311ce2b399_0

Filesize
2KB

MD5
2b70d036df22f7aea823a55a5a3a18c1

SHA1
35977a29ff30551806dba1ecb6a723f38398ebe1

SHA256
e696dc575050f586cee42c23d88087d249eb4814d214b63f2f24049befc8bac8

SHA512
558bb5f39005f93eee57b0c7a16abf1527f4d0199770c82d9db5e4b49433099bd98338a07dc69055671c2a88939bcc23f1be2b27ae934134722e009e98e4e23d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\c0d1825e36e4f904_0

Filesize
43KB

MD5
ea1a0c564eac5140be23d329bcb2a7cc

SHA1
43f9790e3bdfb0c7e71c6818bd32557cae724ede

SHA256
dfe292cb05a162c90a38a0843f819e0d34be6818bcbabc98d622d9c9c36bec74

SHA512
63aa6540b748440401787e2d2166797ae74d64daadc1fd9ac069dc24b37dd8f01c46e3df16cc3456488b6664fe9d03c8807749d174be95db612d1cdbedb4aa66

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\d2f9a2fc02c20de3_0

Filesize
5KB

MD5
604f32cfc025e02a9ba6a9408a7e54b8

SHA1
5bcc5c1abda22229f10d44f2c6364bf6cc313254

SHA256
348c9c8d065b6bcedca7ba7a70ad89f9bf97f7e4435dfc3a78991cccdf8416ce

SHA512
8b8bb6acd701dabf748413aa7d94e388c8682515336112d01b8c650342bc3a0068c8d376c73ca840ea38af69cf6cd5e91f722f74a2a0b16f8734d4365c0866c6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\e18532de58fe3a53_0

Filesize
22KB

MD5
8628464d1b677841053b3b87ced35783

SHA1
3deebc3d733f573b452e7e71d4450ebc56d455c3

SHA256
28474053af514eb863e2b5ff996d00baf72c0e8cc4a1151ec2447923af9e6688

SHA512
2ac68d7b26a4adf62bf9168a5e9f3db8e6653d3b479099765f428544277cab229329ddcc2aacbb2fe8a5a7d16c9a74676142414f72588bb123b2f034d6c513fc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\f2e4bbad99a372cc_0

Filesize
2KB

MD5
5738b123c13e0ebb005d71f51aeaef29

SHA1
2086088bc1b3a20283d7d92d867634595d4635ac

SHA256
1fe9ebe07de60a4e0485df7a6cd2b9e9ca66773239cd9f6c53a2f2c2215f18c3

SHA512
68357da265dab55919b9abdf54d70c5b13044bb678fa43e0c12bc3af050b7a9cead0a3a925ed7ccd5fa1bfdfe13ba904094d5468b701be570053c0224bf075ad

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
51a012839a4781ceee18efc47695777c

SHA1
598801db6189e09ee9a3b82878f9e2b35b544c6f

SHA256
19a096d094a4e93ab38603a420096c92ceee6aa45cec0ad013484c9fb97dc125

SHA512
7459504f56e31a0ad8a5351e6f5dfaca475a1523fa4c00af34e426a720c9340425e93d7c3cb45e1d4f4a83eb105e3f5ab6b7c7ebf2e6d8bbe10157bb175c2ec7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
5KB

MD5
6ccd4a5da72ac7c591a05a702a8fa0e5

SHA1
8675699548f4218b674607652787129bde1483f4

SHA256
073a11b4000a4eac78535e426196940e96479241c6f3e5201c9520d93e409678

SHA512
40194fc359ca375d73b30886b7ff86690731c93406a3860624965e3c07a034f9f77c97c0182cb61c60d9f08ac672b66380b9c1872c2e25b3fe2bfd500ee5a4ba

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
b70f643af15647ee3bd19a1dee04a093

SHA1
7d2ea2e023681eb54746e27407b6973b085c8c39

SHA256
361f1e92e9222938141f9dfed0bd3bbd90d096a6eba05972d753e7a0aaee5a17

SHA512
7f6a1b8646de94a661664091a7984290ca12760be5a7c57dee96a5594ae10bd31d9933a73ac2c25ef523e7fa3981b9428d3d83af9e3c6b975a86e39826a2c244

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
860B

MD5
e2cfd7b34a5aa0cb527992ef3ff58886

SHA1
e709589b97749ac3de67e4b9c7300b813ed20773

SHA256
b12b4ffd9c063a2e98d35745e34f4bb0736905fa65e231c3a05bc0571c9b3a14

SHA512
6b00370936420f9897618ba68baa081e7ffd090d47ae4eeecaa8bb65e4cffe25a3b59a03f05d8a40c192e2550467d47225519f82ddc331c347e2b8ed6efc23cd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
fe53991fb7222655bd232f2381de3234

SHA1
28dfb5d4765c80b5d75cbaa897221e98a1eaf725

SHA256
1d925a55af00a341899518b283a97905c940251c9e16a09964196d4db6ce943a

SHA512
16c7cb904d1e97b40e6b04c45d4d6148ac3d72ae22598f1dcae42a3f0b029a0e7131ee5468140ba093360e8a4d12fabc6833c13499991170c7c5c852460c9c70

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
86a4ecda8b39a81a63f415b00d4a2cad

SHA1
b5603218f06947b59e63d8157fb7654d9a54e6f0

SHA256
cb66f754ebd843390138f611e750701e3238680b8f76371b7f9acc40eea6404e

SHA512
a2c54ee7c9500905a4de08abfc2c9b1344b718a668c62e6b27785627af4d611698ed270d72c0b0264b5d26266dc4b9b7179e353e8726f92c075d1eca21a2a05b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
3c9dbaaf2a06f191e0eeefc64152ee8c

SHA1
c347b173925228d4a05b74e0c46baa30ca46ffb2

SHA256
3b7307a002e39f119ef9aa86a226780749ee068cc27123815642b41b0eb8df41

SHA512
8f1a424eff601f951750f17abf795b9d129c1df6c743067b3ebc528aa5c5dcac611a11fd8a54103dafe75287ea9127e28d6329a54f9ea193de6e9335b6673440

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
5799f2c3f5070931faf0711c882a2ce6

SHA1
fe9377c21817c560a292142b85e7711458b25043

SHA256
34bf95771f2f164087f948fd6c9a6a6f1aa3f7b678efc4dbbe53e326fcbfcd25

SHA512
959696583912948439f7f6dd83e2582ad2d202d20255592ae900c284a56bcd378e46fc1aaee8278cdf29233695cc29b07e34054ab842d115e55cfb9d6dcc2f9b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
f0fa1424d134297dc1fdf2ce35456a8f

SHA1
b3b9549246406460f5191fae652155ad50620176

SHA256
479125a3afef1a1f395581e346a2be34039bb780a8c4b6664079f3f7e9dae985

SHA512
7f19693805e5cdc0601a4b3b1864ea024df81019cf2e1ba7ca6ba4eb50244a0682bc8f3c8fc84d189059ba9f76dc1d90f20a45d042496766f989e381025bf5e7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
256d7285e6f92d896ff374950bb63950

SHA1
aa71f9087b635bc32be8ee79661066fe50a06a1c

SHA256
673710b04dd737eb6b2b8a2dca005360b76f4e72340212c6b78403aac277a463

SHA512
5003fd38cfd3e165281e70ff285ee29965d8814399997ec1a5b2ed349593cc9b5be80d6c8f05a7e7956228327c09ed57e70854e5217ee6b1e1a8d8bb3eb44cbe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
97858e5fc27a9edd005d78272616ca04

SHA1
21db2182ab827247bf7159057d45ebce59376f26

SHA256
f793d604c37168465bfa3755184acaa8080f72121d9fe14109ed2eaec30a7c65

SHA512
4e1dc918bbbd9434e4c851764313ff098706a400048fa46cbdc461103dbf05e9083a1a99df5715e5fdd97e5b7d13411c1ac0ea5f73e02e3f4b8cde3bc97887e7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
ead1cefcb4bc128941d4e756010a4f8a

SHA1
f6107883e1e61967aeff54cd8a195cfa679fc041

SHA256
19f8ac94c3c555dd379b53bf471343f939a239c3658004a2f4273e1dabb027d3

SHA512
ed2b0c1ca66c545128ae0866b8aad5b9ea150f72328e1c01d56d0c8e21922abd9ce711639b203276d37821e42ca6b82c366d9ddb3e33d3313bb9431eab485b9b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
956a07e9254d3d132cde6de1cd4f765e

SHA1
44cc8289336ebde3ee93376404c3a6f1c2e6cb7c

SHA256
da093715a134e23b056ab0c283b215e0cd508eb1b1d7b3fa772dbf7e82556241

SHA512
725301301bb081b8f7289139c5a8e5dfa8a8e1a08b2c09e97d3b29f95f5fdec17e40e4e1c738e1ed72df29f71d19999719a307c7774c477e74031039297fc722

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
953cd9cc040258f44244d713fb77d5cd

SHA1
2f56277a1f7a6a4c3a4112159b1c07ba4d32b83b

SHA256
0706682b7c8cc8bc6547063235d9dbb7936f489226325f5b6b8b28e11493c5cd

SHA512
e10209277b19122545755d50de36e66672c275772cdf5d2eb7c0231c2132a7bd8052afdb40e9fc6cb3d1b73f7e654b61d0f40ada3708fdc1f67979455e441a88

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
40a85531b49fc02189ac497775a70b6f

SHA1
761f41e7967704c4484accf9daedb6a6fbed5e98

SHA256
3bcd5b5c2da939822a9459f258b954a1987785281848f3c1a3b63bf01f2698f7

SHA512
6af6dd10da9db92df782c576e7af5ec666fb4b0194dfdf10177aa95345cb013efff8ab37e90fdd5aa06e82f71040fbc4e81ab90d49d3ed9bebcc947877ac57e9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
5d23ec4825e76706f1e497d047b73e2e

SHA1
16174b9c1e624b09644dbbc7937c38326aa022f6

SHA256
1d7e30f710f02a5ea47ef6a9089de3d76df00672321f6d15218e8e03e05e7808

SHA512
205e6c9bbf3de02bff945c6d7030f1a3107a116c52fe21e2a142b9461317a02bb4bae1ebe19c9c528f64ad321b4111accabece7303d01e66b5eb45b24c4220b3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
4beb74ab32c3bc1e19154fcd2cfc4199

SHA1
c67ce6c39f40e1836514f1cb7c019228a5d10d15

SHA256
9ea7804b92302d757376ad51a3a88011b7b0c018dc0d7888856d4895d63811d3

SHA512
a4130d2f83da680b4477ead251e66cb10fa521f26b4d4775e6a29b9bdad752678648786c64bcf11b4c63d460ad0fb94ab38bc16ba3f2cc8ef476e3f94f95dceb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
187c5e3c201792bc1d549e22d1024e11

SHA1
868dfee625e7806614fdafebf7d036e7b2b466cb

SHA256
88ca8746f4e014d3606e0da4ad4ce50350d6807f264e79f4f6d206c246f7be24

SHA512
16df5d7631d02098588ed2e6934604dc0bc91319a8bb00527389ea5fa59b9f4d028bca387bc95f68799e24e8ed416da31887fdba7003a8b860ffedcd217a0483

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
921088985f24648dcbebbb22470535b8

SHA1
e5c7d92d8ae001b5bf35eb83e1f39d5d73fa7e80

SHA256
b5cf2f9e7213da2ee69750eac03e97d89c470eeb67c55385c997a30081db0dd7

SHA512
1594d69e3a8238bed6b2252da1f3aed15257034ccfa106b0adc01491e980e03bb9469f9e1eac5b4821c868ef73f5006c7d6f74fe3831ab549e69a9aeca0abd7b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
5a3d76bc0e47ae064db043937f68f09c

SHA1
fcdc23f6802e5d4b5b2d21210259a4ce407c3fc2

SHA256
e31135b1f52dde89316fee3f4708ff604d8bcbd7413b82b3d9ba82182ce9e39b

SHA512
26de8e4c8aff031764ba793deaae8215e54b0e38241fc430ccda55523d441c8feb03c35fa164ffe0c926fb8c8aad28aaace70238b1c2ad7367b218c3e2640ab7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
7dd9f926344aa161b3008254fae1fd10

SHA1
2e9aecb8abceac0ec3781523b771975c86083335

SHA256
c727e07ad4e1e684ad5c393b3f6c9dde03ff26359b32baf981a177eea1cc1a41

SHA512
fa9885be07c33446a9e8bcb004f5a22ced7419154c935df107b4ceb2849f82bca552c6539c291ce7dec60e6f5b297583bc56e3f64da564a2277726c4685dff9d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
485d055b6f4d0df4194346d4beb61098

SHA1
512554c3a313d2573a1b8535446dca122e33509f

SHA256
5152453df6106cad5d3f4221f8255daad3e771b5d2cb73c1c37deab89f0562d1

SHA512
95711598e57eb000c0117ac6c8d9393f77920582d7510b80da9efa670ce35a97d99edb23eb063dc57522463eb00986d2ec0ee9bfe53174be10f2994203571fca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
5d2674cf5298365c6a48a0b59c6716aa

SHA1
b2fa17d063b9bf594f68a1834cffd0382f9c8269

SHA256
99d64bcf9a9ed2a887b8747483edbe87a195d00fce18a26ff27f9ee81db6a814

SHA512
359bbf8754caa5024a4df583e2aa0cd5832b59e8bbd9458cfcbb8530bff5d9d121fd2173453ecfacd77abc145b7f15e452fe3e4b0ec5542e609bf3aa7f0c1ec4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58506d.TMP

Filesize
1KB

MD5
a10bfd284d70dfea845d3e3ae9ea4b9d

SHA1
772fe4112eab6bac96de0f32282381f6381ee528

SHA256
db163f3c96b80dbb56ba3475b2f962fde929db1c93da228532cef715fed2bc33

SHA512
80b14191e37afeb35e09724f85376899ad800517f8b6b9b838c598da892d4a5f87703e629c020e1dd51ed2e7dee68ff8ce2d6cc406e6f2872a309217f22be1aa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
89372014c41e062464951c91b93e240e

SHA1
2c39e555c9eea45390ec831faf96d6ecfdef940f

SHA256
7491d64502c20559c10dd3c059bf8a677036dfe8429c3c9f5f4e840c5ab4b94d

SHA512
29aeae8ece22eef2bf3dd2dfc099ada83077ab78db41901b4fd1b729b6deaa817a2b08726af5530b8adbf6a8f6ec724684686dbf94862f808bf917abb0f05fe0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
9c572379dd837b849d8221a6a2a1cc13

SHA1
db24242ea8c7c9ed76b08d83786082abd032fa6a

SHA256
1338cbcfa3b85717eb34a5b52116c515bcecb28a24c6e46a3cccde98c4224c8d

SHA512
a85398c15fdd347466d546047f7e916787bcc61bbe394ff03221a48fbaca033b1f4fb8abeaf412db2ce3fba6609ab2b5376c2321253ffe26e1c8f9c87cf895eb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
24a6e788edc3abe6f61054a66ef1fd6a

SHA1
97e44b6c133a1b0a761078ce5ff377392b4a1241

SHA256
ed244b0e4c2d583ac0fa58c68139e74152f12d03cee0d114b9a3d6256b518de3

SHA512
e3584327f33894d8bd6167e23113af4ed60370a6e1fb03c70af39ecb157fc9a76311b013c9d79d1c8209a8d2d0303c422e552c6e4be57c2cba22be0bcbff80bd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
020a715e29c6a79a15d25f96802e0b44

SHA1
a6b6632f6046f2131169f216480b9d5299c14675

SHA256
37c7830f135c30bd1c12e07666e154638a39139ca015270b6f29f7d0c1358403

SHA512
fed10e8a2bc6481e3909fb5e37793b9391175c5e0f0d87d02103f93504e69c5d12bbd24758063778949fdf60b4e63c5b547d7fe29f77e40e6650fc58e2967a01

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
22cb0824411283450b97953ba80f698c

SHA1
a1ab02582108e4c8e2752502377f2b5696bae3dd

SHA256
8b4b147eca9a1d33a788283b00216779974127068c3daa9e85987b756137bf9a

SHA512
ec4902f6e48c4adf2554e2e4ebc5609c32fd4521cb682c057f55989e24e1217354928c9905a7dd3d294ddde6cb284cbecbd851665cf82506143a159fe290471d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
f30abe31c68d1cbf7a34b04ee184b2db

SHA1
46b550a48479323a4f7883e4d84d1970084cf6db

SHA256
c31c1ac3c8da960c67471d6a8da05bb26d589565bd3b028166c43f6e650fc7b7

SHA512
31813bf0c161daf75b04daa5f511dd52fba7d718b5d5928def17135d7cd11c36369963f9b027382f81c2b7ba56d458466d0b3386f92ad7f7d097dd021317ab09

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
595218d7206d00107fef060b4f2a36ac

SHA1
3ae6f749b3804b6a282b1d4e738e726a493e0b1d

SHA256
2f649ccf1e6b4dfbf100b39d231d7eefd5bc02b22ca1930237cc1fc3eebdc5b5

SHA512
e9b665080bf7d13f86becf2ac640512f9562f18922e6a515e2fc4f58c66ceab872d2819d14e41091e8367439a8a5dd358f29a80651b1de2020960ea8ac51e1c5

Download Submit
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchHoverUnifiedTileModelCache.dat

Filesize
10KB

MD5
96329c73cc49cd960e2485210d01c4d2

SHA1
a496b98ad2f2bbf26687b5b7794a26aa4470148e

SHA256
4c159cab6c9ef5ff39e6141b0ccb5b8c6251a3d637520609dfbdd852fa94d466

SHA512
e98736a879cad24c693d6c5939654b2fd25bf9d348f738668624214f22d541a9b781c967201ab2d43cbac9207946824a0299d482485f4b63c48d5d2a839e5baf

Download Submit
C:\Users\Admin\AppData\Roaming\MEMZ.exe

Filesize
21KB

MD5
5761ae6b5665092c45fc8e9292627f88

SHA1
a7f18d7cf5438ee7dcb4e644163f495d3fa9c0ef

SHA256
7acabca3631db2a73a5e20abd050097e44390ead1d74717aed936601904b73c2

SHA512
1d743b407663e00a296c2ae45cb5a05a0866657afafbc9e8220e4c1839cbab2c09bf2a3510ec8016f902ccb7254edddf2a3412e7f5a4cafcabbeb5724a67b46e

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 75713.crdownload

Filesize
39.6MB

MD5
b949ba30eb82cc79eeb7c2d64f483bcb

SHA1
8361089264726bb6cff752b3c137fde6d01f4d80

SHA256
5f6a8f0e85704eb30340a872eec136623e57ab014b4dd165c68dd8cd76143923

SHA512
e2acd4fe7627e55be3e019540269033f65d4954831a732d7a4bd50607260cd2a238832f604fa344f04be9f70e8757a9f2d797de37b440159a16bf3a6359a759b

Download Submit
C:\Users\Admin\Downloads\memz.by.iTzDrK_.rar

Filesize
17KB

MD5
352c9d71fa5ab9e8771ce9e1937d88e9

SHA1
7ef6ee09896dd5867cff056c58b889bb33706913

SHA256
3d5d9bc94be3d1b7566a652155b0b37006583868311f20ef00283c30314b5c61

SHA512
6c133aa0c0834bf3dbb3a4fb7ff163e3b17ae2500782d6bba72812b4e703fb3a4f939a799eeb17436ea24f225386479d3aa3b81fdf35975c4f104914f895ff23

Download Submit
C:\Users\Admin\Downloads\memz.by.iTzDrK_.rar:Zone.Identifier

Filesize
26B

MD5
fbccf14d504b7b2dbcb5a5bda75bd93b

SHA1
d59fc84cdd5217c6cf74785703655f78da6b582b

SHA256
eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913

SHA512
aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98

Download Submit
C:\Users\Admin\Downloads\memz.by.iTzDrK_.zip

Filesize
17KB

MD5
2b20beaeb742c259178fb37c5814edde

SHA1
50e7b029d1d66b74ed0f5a8fdc58258e0cb00cb0

SHA256
b1cbceb11fe2002a8948ce8432f97f76bb8c1c98be2c31f591232a4157cf45e1

SHA512
49032c5aa037dbe7bc704a5edeba6c5b01dd3afc3a03f7eaed5617dfc87bc5620f5515d751f89b245fb18bf46cbafdbf51eefd3abf6ce21f339caf08c27af0e3

Download Submit
C:\Users\Admin\Downloads\memz.by.iTzDrK_.zip:Zone.Identifier

Filesize
179B

MD5
b56379dc66eafa21fd1c845e3d0af9f0

SHA1
c8ba4e25bc89ef2fcdea82324b6cc293d3d9c9c4

SHA256
117f8f2f30649ee295c697ed862c132059af6b6a58408c2951182b43d606fa7e

SHA512
504d513a0b31bca0f6746d2647a8cd044d45f5bfcf276ff9d708a372b66ddf50010c982cbaabde9483bf997e7992af5be649d8997fca70b8473c9f7b6114332c

Download Submit
C:\Users\Admin\Downloads\winrar-x64-710b3.exe

Filesize
3.6MB

MD5
aa8ed98840d02742fb21fbabd0301d6e

SHA1
0ffb54914d12ed9f6523ff413f230c91e5c17b28

SHA256
3d48b547f94d18e521d23d47ef98c90caf6b94eff404a75131975ee1bdc9cc75

SHA512
8adbb9b8054c2da0eb970e854e2a5bf081a560758f5fde01fdb866ce8f8437c7969a62b603702976b9afde819bbc1dcd8603479fe34ff885f13e7465c0709235

Download Submit
C:\Users\Admin\Downloads\winrar-x64-710b3.exe:Zone.Identifier

Filesize
132B

MD5
22871eab4b0ae6977fe566430b95b854

SHA1
d3739803d5b924d5bfbc6ac0052d6ba2d49c782d

SHA256
c9a1898f4fc7668198a02eed776af0becaad8131d089b33b741d3c075103eebe

SHA512
5ac9125abb2ee1b753569add8efd7e1a3edfa398300c1f02041c905e1bd2ab42c94c03a1ada8cace2191db7caefc9bfb12e315cacfd2e910ef35df496c6f409b

Download Submit
memory/2436-1562-0x0000000003A90000-0x0000000003AA0000-memory.dmp

Filesize
64KB

Download
memory/2436-1563-0x0000000003A90000-0x0000000003AA0000-memory.dmp

Filesize
64KB

Download
memory/2436-1565-0x0000000003A90000-0x0000000003AA0000-memory.dmp

Filesize
64KB

Download
memory/2436-1564-0x0000000003A90000-0x0000000003AA0000-memory.dmp

Filesize
64KB

Download
memory/2436-1566-0x0000000003A90000-0x0000000003AA0000-memory.dmp

Filesize
64KB

Download