6805b3c7c5234bd7f0fdc6355fddbb53152f605865d96deb5ed115b67baff445

max time kernel
227s
max time network
229s
platform
windows10-2004_x64
resource
win10v2004-20251016-en
resource tags

arch:x64arch:x86image:win10v2004-20251016-enlocale:en-usos:windows10-2004-x64system
submitted
22/11/2025, 17:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Malware-1-master/getr3kt.bat
Size 13KB
Sample251122-vkblbavldp
SHA256 5e2cd213ff47b7657abd9167c38ffd8b53c13261fe22adddea92b5a2d9e320ad
MD5 4e2a7f369378a76d1df4d8c448f712af
SHA1 1192b4d01254a8704e6d6ae17dc2ec28a7ad5a49
SHA512 90e6eedca424e2ee37c78e0c0380db490c049b0378541812734c134510c40c6e4c48c4e213f395339ed99ff337ef087b6056ac5aafb246c1789ca6082dcabd2e
SSDEEP 192:AOyUySl0UaDz2gWsIzlmj+BxZ3yqueWQx0lZicyC8Sh31xcjBzyxwn7AVhllz3:AVODaDSHMql3yqlxy5L1xcjwrlz3
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

bootkit discovery execution persistence

Malware Config

Signatures

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2860684728-3699940733-4015428997-1000\Control Panel\International\Geo\Nation	MEMZ.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2860684728-3699940733-4015428997-1000\Control Panel\International\Geo\Nation	MEMZ.exe

Executes dropped EXE 7 IoCs

pid	Process
3436	MEMZ.exe
2020	MEMZ.exe
4976	MEMZ.exe
1424	MEMZ.exe
2240	MEMZ.exe
4764	MEMZ.exe
2608	MEMZ.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	MEMZ.exe

Drops file in Program Files directory 5 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1144_211386029\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1144_211386029\protocols.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1144_211386029\manifest.fingerprint	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1144_827569389\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1144_827569389\manifest.fingerprint	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MEMZ.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MEMZ.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	Taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	Taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	Taskmgr.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134083047368982328"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2860684728-3699940733-4015428997-1000_Classes\Local Settings	calc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2860684728-3699940733-4015428997-1000\{FDC8E3FB-A3D8-4DBA-97D3-0F1E211929CB}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2860684728-3699940733-4015428997-1000\{86264916-309E-405F-9B92-63656FBEBDF1}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2020	MEMZ.exe
2020	MEMZ.exe
2020	MEMZ.exe
2020	MEMZ.exe
4976	MEMZ.exe
4976	MEMZ.exe
4976	MEMZ.exe
4976	MEMZ.exe
2020	MEMZ.exe
2020	MEMZ.exe
2020	MEMZ.exe
2020	MEMZ.exe
4976	MEMZ.exe
4976	MEMZ.exe
1424	MEMZ.exe
1424	MEMZ.exe
4976	MEMZ.exe
4976	MEMZ.exe
1424	MEMZ.exe
1424	MEMZ.exe
2020	MEMZ.exe
2020	MEMZ.exe
2240	MEMZ.exe
2240	MEMZ.exe
2020	MEMZ.exe
2020	MEMZ.exe
1424	MEMZ.exe
1424	MEMZ.exe
4976	MEMZ.exe
4976	MEMZ.exe
4764	MEMZ.exe
4764	MEMZ.exe
4764	MEMZ.exe
4764	MEMZ.exe
4976	MEMZ.exe
4976	MEMZ.exe
1424	MEMZ.exe
1424	MEMZ.exe
2020	MEMZ.exe
2020	MEMZ.exe
2240	MEMZ.exe
2240	MEMZ.exe
2020	MEMZ.exe
2240	MEMZ.exe
2020	MEMZ.exe
2240	MEMZ.exe
1424	MEMZ.exe
1424	MEMZ.exe
4976	MEMZ.exe
4976	MEMZ.exe
4764	MEMZ.exe
4764	MEMZ.exe
4764	MEMZ.exe
4764	MEMZ.exe
4976	MEMZ.exe
4976	MEMZ.exe
1424	MEMZ.exe
1424	MEMZ.exe
2240	MEMZ.exe
2240	MEMZ.exe
2020	MEMZ.exe
2020	MEMZ.exe
4976	MEMZ.exe
4976	MEMZ.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 18 IoCs

pid	Process
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: 33	1804	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1804	AUDIODG.EXE
Token: SeDebugPrivilege	4396	Taskmgr.exe
Token: SeSystemProfilePrivilege	4396	Taskmgr.exe
Token: SeCreateGlobalPrivilege	4396	Taskmgr.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
1144	msedge.exe
4396	Taskmgr.exe
4396	Taskmgr.exe
4396	Taskmgr.exe
4396	Taskmgr.exe
4396	Taskmgr.exe
4396	Taskmgr.exe
4396	Taskmgr.exe
4396	Taskmgr.exe
4396	Taskmgr.exe
4396	Taskmgr.exe
4396	Taskmgr.exe
4396	Taskmgr.exe
4396	Taskmgr.exe
4396	Taskmgr.exe
4396	Taskmgr.exe
4396	Taskmgr.exe
4396	Taskmgr.exe
4396	Taskmgr.exe
4396	Taskmgr.exe
4396	Taskmgr.exe
4396	Taskmgr.exe
4396	Taskmgr.exe
4396	Taskmgr.exe
4396	Taskmgr.exe
4396	Taskmgr.exe
4396	Taskmgr.exe
4396	Taskmgr.exe
4396	Taskmgr.exe
4396	Taskmgr.exe
4396	Taskmgr.exe
4396	Taskmgr.exe
4396	Taskmgr.exe
4396	Taskmgr.exe
4396	Taskmgr.exe
4396	Taskmgr.exe
4396	Taskmgr.exe
4396	Taskmgr.exe
4396	Taskmgr.exe
4396	Taskmgr.exe
4396	Taskmgr.exe
4396	Taskmgr.exe
4396	Taskmgr.exe
4396	Taskmgr.exe
4396	Taskmgr.exe
4396	Taskmgr.exe
4396	Taskmgr.exe
4396	Taskmgr.exe
4396	Taskmgr.exe
4396	Taskmgr.exe
4396	Taskmgr.exe
4396	Taskmgr.exe
4396	Taskmgr.exe
4396	Taskmgr.exe
4396	Taskmgr.exe
4396	Taskmgr.exe
4396	Taskmgr.exe
4396	Taskmgr.exe
4396	Taskmgr.exe
4396	Taskmgr.exe
4396	Taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
4396	Taskmgr.exe
4396	Taskmgr.exe
4396	Taskmgr.exe
4396	Taskmgr.exe
4396	Taskmgr.exe
4396	Taskmgr.exe
4396	Taskmgr.exe
4396	Taskmgr.exe
4396	Taskmgr.exe
4396	Taskmgr.exe
4396	Taskmgr.exe
4396	Taskmgr.exe
4396	Taskmgr.exe
4396	Taskmgr.exe
4396	Taskmgr.exe
4396	Taskmgr.exe
4396	Taskmgr.exe
4396	Taskmgr.exe
4396	Taskmgr.exe
4396	Taskmgr.exe
4396	Taskmgr.exe
4396	Taskmgr.exe
4396	Taskmgr.exe
4396	Taskmgr.exe
4396	Taskmgr.exe
4396	Taskmgr.exe
4396	Taskmgr.exe
4396	Taskmgr.exe
4396	Taskmgr.exe
4396	Taskmgr.exe
4396	Taskmgr.exe
4396	Taskmgr.exe
4396	Taskmgr.exe
4396	Taskmgr.exe
4396	Taskmgr.exe
4396	Taskmgr.exe
4396	Taskmgr.exe
4396	Taskmgr.exe
4396	Taskmgr.exe
4396	Taskmgr.exe
4396	Taskmgr.exe
4396	Taskmgr.exe
4396	Taskmgr.exe
4396	Taskmgr.exe
4396	Taskmgr.exe
4396	Taskmgr.exe
4396	Taskmgr.exe
4396	Taskmgr.exe
4396	Taskmgr.exe
4396	Taskmgr.exe
4396	Taskmgr.exe
4396	Taskmgr.exe
4396	Taskmgr.exe
4396	Taskmgr.exe
4396	Taskmgr.exe
4396	Taskmgr.exe
4396	Taskmgr.exe
4396	Taskmgr.exe
4396	Taskmgr.exe
4396	Taskmgr.exe
4396	Taskmgr.exe
4396	Taskmgr.exe
4396	Taskmgr.exe
4396	Taskmgr.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2608	MEMZ.exe
2880	OpenWith.exe
2608	MEMZ.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 940 wrote to memory of 464	940	cmd.exe	87
PID 940 wrote to memory of 464	940	cmd.exe	87
PID 940 wrote to memory of 3436	940	cmd.exe	88
PID 940 wrote to memory of 3436	940	cmd.exe	88
PID 940 wrote to memory of 3436	940	cmd.exe	88
PID 3436 wrote to memory of 2020	3436	MEMZ.exe	96
PID 3436 wrote to memory of 2020	3436	MEMZ.exe	96
PID 3436 wrote to memory of 2020	3436	MEMZ.exe	96
PID 3436 wrote to memory of 4976	3436	MEMZ.exe	97
PID 3436 wrote to memory of 4976	3436	MEMZ.exe	97
PID 3436 wrote to memory of 4976	3436	MEMZ.exe	97
PID 3436 wrote to memory of 1424	3436	MEMZ.exe	98
PID 3436 wrote to memory of 1424	3436	MEMZ.exe	98
PID 3436 wrote to memory of 1424	3436	MEMZ.exe	98
PID 3436 wrote to memory of 2240	3436	MEMZ.exe	99
PID 3436 wrote to memory of 2240	3436	MEMZ.exe	99
PID 3436 wrote to memory of 2240	3436	MEMZ.exe	99
PID 3436 wrote to memory of 4764	3436	MEMZ.exe	100
PID 3436 wrote to memory of 4764	3436	MEMZ.exe	100
PID 3436 wrote to memory of 4764	3436	MEMZ.exe	100
PID 3436 wrote to memory of 2608	3436	MEMZ.exe	101
PID 3436 wrote to memory of 2608	3436	MEMZ.exe	101
PID 3436 wrote to memory of 2608	3436	MEMZ.exe	101
PID 2608 wrote to memory of 4988	2608	MEMZ.exe	103
PID 2608 wrote to memory of 4988	2608	MEMZ.exe	103
PID 2608 wrote to memory of 4988	2608	MEMZ.exe	103
PID 2608 wrote to memory of 1476	2608	MEMZ.exe	106
PID 2608 wrote to memory of 1476	2608	MEMZ.exe	106
PID 1476 wrote to memory of 4708	1476	msedge.exe	107
PID 1476 wrote to memory of 4708	1476	msedge.exe	107
PID 4708 wrote to memory of 2188	4708	msedge.exe	108
PID 4708 wrote to memory of 2188	4708	msedge.exe	108
PID 4708 wrote to memory of 2040	4708	msedge.exe	109
PID 4708 wrote to memory of 2040	4708	msedge.exe	109
PID 4708 wrote to memory of 3424	4708	msedge.exe	110
PID 4708 wrote to memory of 3424	4708	msedge.exe	110
PID 4708 wrote to memory of 3424	4708	msedge.exe	110
PID 4708 wrote to memory of 3424	4708	msedge.exe	110
PID 4708 wrote to memory of 3424	4708	msedge.exe	110
PID 4708 wrote to memory of 3424	4708	msedge.exe	110
PID 4708 wrote to memory of 3424	4708	msedge.exe	110
PID 4708 wrote to memory of 3424	4708	msedge.exe	110
PID 4708 wrote to memory of 3424	4708	msedge.exe	110
PID 4708 wrote to memory of 3424	4708	msedge.exe	110
PID 4708 wrote to memory of 3424	4708	msedge.exe	110
PID 4708 wrote to memory of 3424	4708	msedge.exe	110
PID 4708 wrote to memory of 3424	4708	msedge.exe	110
PID 4708 wrote to memory of 3424	4708	msedge.exe	110
PID 4708 wrote to memory of 3424	4708	msedge.exe	110
PID 4708 wrote to memory of 3424	4708	msedge.exe	110
PID 4708 wrote to memory of 3424	4708	msedge.exe	110
PID 4708 wrote to memory of 3424	4708	msedge.exe	110
PID 4708 wrote to memory of 3424	4708	msedge.exe	110
PID 4708 wrote to memory of 3424	4708	msedge.exe	110
PID 4708 wrote to memory of 3424	4708	msedge.exe	110
PID 4708 wrote to memory of 3424	4708	msedge.exe	110
PID 4708 wrote to memory of 3424	4708	msedge.exe	110
PID 4708 wrote to memory of 3424	4708	msedge.exe	110
PID 4708 wrote to memory of 3424	4708	msedge.exe	110
PID 4708 wrote to memory of 3424	4708	msedge.exe	110
PID 4708 wrote to memory of 3424	4708	msedge.exe	110
PID 4708 wrote to memory of 3424	4708	msedge.exe	110
PID 4708 wrote to memory of 3424	4708	msedge.exe	110
PID 4708 wrote to memory of 3424	4708	msedge.exe	110

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Malware-1-master\getr3kt.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:940
- C:\Windows\system32\cscript.exe
  cscript x.js
  2⤵
  PID:464
- C:\Users\Admin\AppData\Roaming\MEMZ.exe
  "C:\Users\Admin\AppData\Roaming\MEMZ.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3436
- - C:\Users\Admin\AppData\Roaming\MEMZ.exe
    "C:\Users\Admin\AppData\Roaming\MEMZ.exe" /watchdog
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:2020
- - C:\Users\Admin\AppData\Roaming\MEMZ.exe
    "C:\Users\Admin\AppData\Roaming\MEMZ.exe" /watchdog
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:4976
- - C:\Users\Admin\AppData\Roaming\MEMZ.exe
    "C:\Users\Admin\AppData\Roaming\MEMZ.exe" /watchdog
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:1424
- - C:\Users\Admin\AppData\Roaming\MEMZ.exe
    "C:\Users\Admin\AppData\Roaming\MEMZ.exe" /watchdog
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:2240
- - C:\Users\Admin\AppData\Roaming\MEMZ.exe
    "C:\Users\Admin\AppData\Roaming\MEMZ.exe" /watchdog
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:4764
- - C:\Users\Admin\AppData\Roaming\MEMZ.exe
    "C:\Users\Admin\AppData\Roaming\MEMZ.exe" /main
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Writes to the Master Boot Record (MBR)
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2608
  - - C:\Windows\SysWOW64\notepad.exe
      "C:\Windows\System32\notepad.exe" \note.txt
      4⤵
      System Location Discovery: System Language Discovery
      PID:4988
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=how+2+buy+weed
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1476
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument http://google.co.ck/search?q=how+2+buy+weed
        5⤵
        Checks processor information in registry
        Enumerates system info in registry
        Modifies data under HKEY_USERS
        Modifies registry class
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of FindShellTrayWindow
        Suspicious use of WriteProcessMemory
        
        PID:4708
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x238,0x23c,0x240,0x234,0x274,0x7ffdd29bf208,0x7ffdd29bf214,0x7ffdd29bf220
        6⤵
        
        PID:2188
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1904,i,10440570621883499536,4245760515515356911,262144 --variations-seed-version --mojo-platform-channel-handle=2112 /prefetch:3
        6⤵
        
        PID:2040
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2040,i,10440570621883499536,4245760515515356911,262144 --variations-seed-version --mojo-platform-channel-handle=2024 /prefetch:2
        6⤵
        
        PID:3424
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2012,i,10440570621883499536,4245760515515356911,262144 --variations-seed-version --mojo-platform-channel-handle=2640 /prefetch:8
        6⤵
        
        PID:4208
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3508,i,10440570621883499536,4245760515515356911,262144 --variations-seed-version --mojo-platform-channel-handle=3592 /prefetch:1
        6⤵
        
        PID:4236
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3516,i,10440570621883499536,4245760515515356911,262144 --variations-seed-version --mojo-platform-channel-handle=3600 /prefetch:1
        6⤵
        
        PID:4776
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --field-trial-handle=4240,i,10440570621883499536,4245760515515356911,262144 --variations-seed-version --mojo-platform-channel-handle=4252 /prefetch:1
        6⤵
        
        PID:3180
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --extension-process --renderer-sub-type=extension --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --field-trial-handle=4300,i,10440570621883499536,4245760515515356911,262144 --variations-seed-version --mojo-platform-channel-handle=4312 /prefetch:2
        6⤵
        
        PID:688
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=4256,i,10440570621883499536,4245760515515356911,262144 --variations-seed-version --mojo-platform-channel-handle=4304 /prefetch:8
        6⤵
        
        PID:2524
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=5216,i,10440570621883499536,4245760515515356911,262144 --variations-seed-version --mojo-platform-channel-handle=3724 /prefetch:8
        6⤵
        
        PID:1136
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --field-trial-handle=5404,i,10440570621883499536,4245760515515356911,262144 --variations-seed-version --mojo-platform-channel-handle=5384 /prefetch:1
        6⤵
        
        PID:1016
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --field-trial-handle=5184,i,10440570621883499536,4245760515515356911,262144 --variations-seed-version --mojo-platform-channel-handle=5180 /prefetch:1
        6⤵
        
        PID:4024
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --string-annotations --always-read-main-dll --field-trial-handle=4304,i,10440570621883499536,4245760515515356911,262144 --variations-seed-version --mojo-platform-channel-handle=5116 /prefetch:8
        6⤵
        
        PID:2748
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --string-annotations --always-read-main-dll --field-trial-handle=4280,i,10440570621883499536,4245760515515356911,262144 --variations-seed-version --mojo-platform-channel-handle=4616 /prefetch:8
        6⤵
        
        PID:1040
      - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=6184,i,10440570621883499536,4245760515515356911,262144 --variations-seed-version --mojo-platform-channel-handle=6196 /prefetch:8
        6⤵
        
        PID:2416
      - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=6184,i,10440570621883499536,4245760515515356911,262144 --variations-seed-version --mojo-platform-channel-handle=6196 /prefetch:8
        6⤵
        
        PID:3724
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=6256,i,10440570621883499536,4245760515515356911,262144 --variations-seed-version --mojo-platform-channel-handle=4292 /prefetch:8
        6⤵
        
        PID:1796
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=4232,i,10440570621883499536,4245760515515356911,262144 --variations-seed-version --mojo-platform-channel-handle=5544 /prefetch:8
        6⤵
        
        PID:880
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=3624,i,10440570621883499536,4245760515515356911,262144 --variations-seed-version --mojo-platform-channel-handle=4392 /prefetch:8
        6⤵
        
        PID:3980
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=4336,i,10440570621883499536,4245760515515356911,262144 --variations-seed-version --mojo-platform-channel-handle=4368 /prefetch:8
        6⤵
        
        PID:4112
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=4248,i,10440570621883499536,4245760515515356911,262144 --variations-seed-version --mojo-platform-channel-handle=6508 /prefetch:8
        6⤵
        
        PID:4148
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=4376,i,10440570621883499536,4245760515515356911,262144 --variations-seed-version --mojo-platform-channel-handle=6672 /prefetch:8
        6⤵
        
        PID:2308
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=6660,i,10440570621883499536,4245760515515356911,262144 --variations-seed-version --mojo-platform-channel-handle=6828 /prefetch:8
        6⤵
        
        PID:3036
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=6808,i,10440570621883499536,4245760515515356911,262144 --variations-seed-version --mojo-platform-channel-handle=6496 /prefetch:8
        6⤵
        
        PID:3296
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --field-trial-handle=5164,i,10440570621883499536,4245760515515356911,262144 --variations-seed-version --mojo-platform-channel-handle=4492 /prefetch:1
        6⤵
        
        PID:4716
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --field-trial-handle=5160,i,10440570621883499536,4245760515515356911,262144 --variations-seed-version --mojo-platform-channel-handle=4404 /prefetch:1
        6⤵
        
        PID:3652
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --string-annotations --always-read-main-dll --field-trial-handle=4500,i,10440570621883499536,4245760515515356911,262144 --variations-seed-version --mojo-platform-channel-handle=4480 /prefetch:8
        6⤵
        
        PID:3932
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --string-annotations --always-read-main-dll --field-trial-handle=4384,i,10440570621883499536,4245760515515356911,262144 --variations-seed-version --mojo-platform-channel-handle=4452 /prefetch:8
        6⤵
        
        PID:3312
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --string-annotations --always-read-main-dll --field-trial-handle=6396,i,10440570621883499536,4245760515515356911,262144 --variations-seed-version --mojo-platform-channel-handle=5232 /prefetch:8
        6⤵
        
        PID:4196
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=what+happens+if+you+delete+system32
      4⤵
      PID:1860
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument http://google.co.ck/search?q=what+happens+if+you+delete+system32
        5⤵
        
        PID:4636
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://answers.microsoft.com/en-us/protect/forum/protect_other-protect_scanning/memz-malwarevirus-trojan-completely-destroying/268bc1c2-39f4-42f8-90c2-597a673b6b45
      4⤵
      PID:444
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument http://answers.microsoft.com/en-us/protect/forum/protect_other-protect_scanning/memz-malwarevirus-trojan-completely-destroying/268bc1c2-39f4-42f8-90c2-597a673b6b45
        5⤵
        Drops file in Program Files directory
        Checks processor information in registry
        Enumerates system info in registry
        Modifies data under HKEY_USERS
        Modifies registry class
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of FindShellTrayWindow
        
        PID:1144
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x238,0x23c,0x240,0x234,0x248,0x7ffdd29bf208,0x7ffdd29bf214,0x7ffdd29bf220
        6⤵
        
        PID:2424
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2156,i,798437095928971955,7313489658740012180,262144 --variations-seed-version --mojo-platform-channel-handle=2152 /prefetch:2
        6⤵
        
        PID:4796
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1868,i,798437095928971955,7313489658740012180,262144 --variations-seed-version --mojo-platform-channel-handle=2208 /prefetch:3
        6⤵
        
        PID:624
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2464,i,798437095928971955,7313489658740012180,262144 --variations-seed-version --mojo-platform-channel-handle=2480 /prefetch:8
        6⤵
        
        PID:4248
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3448,i,798437095928971955,7313489658740012180,262144 --variations-seed-version --mojo-platform-channel-handle=3468 /prefetch:1
        6⤵
        
        PID:4736
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3456,i,798437095928971955,7313489658740012180,262144 --variations-seed-version --mojo-platform-channel-handle=3724 /prefetch:1
        6⤵
        
        PID:3276
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --field-trial-handle=4852,i,798437095928971955,7313489658740012180,262144 --variations-seed-version --mojo-platform-channel-handle=4848 /prefetch:1
        6⤵
        
        PID:2484
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --string-annotations --always-read-main-dll --field-trial-handle=4980,i,798437095928971955,7313489658740012180,262144 --variations-seed-version --mojo-platform-channel-handle=5028 /prefetch:8
        6⤵
        
        PID:2436
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --string-annotations --always-read-main-dll --field-trial-handle=5000,i,798437095928971955,7313489658740012180,262144 --variations-seed-version --mojo-platform-channel-handle=3884 /prefetch:8
        6⤵
        
        PID:3740
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=5404,i,798437095928971955,7313489658740012180,262144 --variations-seed-version --mojo-platform-channel-handle=5412 /prefetch:8
        6⤵
        
        PID:2748
      - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=5420,i,798437095928971955,7313489658740012180,262144 --variations-seed-version --mojo-platform-channel-handle=5496 /prefetch:8
        6⤵
        
        PID:536
      - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=5420,i,798437095928971955,7313489658740012180,262144 --variations-seed-version --mojo-platform-channel-handle=5496 /prefetch:8
        6⤵
        
        PID:3592
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --field-trial-handle=6104,i,798437095928971955,7313489658740012180,262144 --variations-seed-version --mojo-platform-channel-handle=6024 /prefetch:1
        6⤵
        
        PID:3928
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --string-annotations --always-read-main-dll --field-trial-handle=6108,i,798437095928971955,7313489658740012180,262144 --variations-seed-version --mojo-platform-channel-handle=6212 /prefetch:8
        6⤵
        
        PID:2256
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --string-annotations --always-read-main-dll --field-trial-handle=6240,i,798437095928971955,7313489658740012180,262144 --variations-seed-version --mojo-platform-channel-handle=6200 /prefetch:8
        6⤵
        
        PID:2948
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --string-annotations --always-read-main-dll --field-trial-handle=6232,i,798437095928971955,7313489658740012180,262144 --variations-seed-version --mojo-platform-channel-handle=6284 /prefetch:8
        6⤵
        
        PID:4388
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --field-trial-handle=6172,i,798437095928971955,7313489658740012180,262144 --variations-seed-version --mojo-platform-channel-handle=6176 /prefetch:1
        6⤵
        
        PID:3396
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --string-annotations --always-read-main-dll --field-trial-handle=5108,i,798437095928971955,7313489658740012180,262144 --variations-seed-version --mojo-platform-channel-handle=4744 /prefetch:8
        6⤵
        
        PID:2236
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2728,i,798437095928971955,7313489658740012180,262144 --variations-seed-version --mojo-platform-channel-handle=4868 /prefetch:8
        6⤵
        
        PID:3760
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --field-trial-handle=1216,i,798437095928971955,7313489658740012180,262144 --variations-seed-version --mojo-platform-channel-handle=5132 /prefetch:1
        6⤵
        
        PID:3644
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --field-trial-handle=5160,i,798437095928971955,7313489658740012180,262144 --variations-seed-version --mojo-platform-channel-handle=5224 /prefetch:1
        6⤵
        
        PID:3236
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=6520,i,798437095928971955,7313489658740012180,262144 --variations-seed-version --mojo-platform-channel-handle=6308 /prefetch:8
        6⤵
        
        PID:2940
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --string-annotations --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=6256,i,798437095928971955,7313489658740012180,262144 --variations-seed-version --mojo-platform-channel-handle=6296 /prefetch:8
        6⤵
        
        PID:4800
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --field-trial-handle=6332,i,798437095928971955,7313489658740012180,262144 --variations-seed-version --mojo-platform-channel-handle=6512 /prefetch:1
        6⤵
        
        PID:1704
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --field-trial-handle=6648,i,798437095928971955,7313489658740012180,262144 --variations-seed-version --mojo-platform-channel-handle=6660 /prefetch:1
        6⤵
        
        PID:932
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=bonzi+buddy+download+free
      4⤵
      PID:5016
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument http://google.co.ck/search?q=bonzi+buddy+download+free
        5⤵
        
        PID:3652
  - - C:\Windows\SysWOW64\Taskmgr.exe
      "C:\Windows\System32\Taskmgr.exe"
      4⤵
      System Location Discovery: System Language Discovery
      Checks SCSI registry key(s)
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      PID:4396
  - - C:\Windows\SysWOW64\calc.exe
      "C:\Windows\System32\calc.exe"
      4⤵
      System Location Discovery: System Language Discovery
      Modifies registry class
      PID:916
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=how+to+remove+memz+trojan+virus
      4⤵
      PID:4560
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument http://google.co.ck/search?q=how+to+remove+memz+trojan+virus
        5⤵
        
        PID:2940
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=best+way+to+kill+yourself
      4⤵
      PID:2924
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument http://google.co.ck/search?q=best+way+to+kill+yourself
        5⤵
        
        PID:1880

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:3760

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:2844

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3008

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x308 0x494
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1804

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:2880

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping1144_211386029\manifest.json
Size 135B
SHA256 ba5c9096d20a482aaa1aa9e5f98ad6127d3e97c2f21de84f7c78d9b8073c8e26
MD5 fbebd68ecaa98928909421f66909c054
SHA1 99d787d90f7ed2e5ad924f9c5668eb988b5a6c07
SHA512 749a3b2be47fe28399dc763888654a3e8d397e06e8d3c3af3965bb45846a1336e6ab4ca82c82c3df846b34a2afafa2156f2690e9bf347ab175408dc0171c61cc
MD5 SHA1 SHA512

Submit Download

manifest.fingerprint

Path C:\Program Files\chrome_Unpacker_BeginUnzipping1144_827569389\manifest.fingerprint
Size 66B
SHA256 946f3a9e019b0d80f5671de782f295132341f663f74aebad7628f22e528d6d52
MD5 3fb5233616491df0ec229ba9f42efdb8
SHA1 18a8116e2df9805accd7901d2321c3fa92da1af4
SHA512 e9b17ac626bf6508db9a686825411e90d316a0f1dacbf63dbec5baaaf6b96af4dbc9a7332975b6d5c16c43757d79fddca6b888ea97bc07a8dffb1b3a06366b4d
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping1144_827569389\manifest.json
Size 43B
SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
MD5 af3a9104ca46f35bb5f6123d89c25966
SHA1 1ffb1b0aa9f44bdbc57bdf4b98d26d3be0207ee8
SHA512 6a7a543fa2d1ead3574b4897d2fc714bb218c60a04a70a7e92ecfd2ea59d67028f91b6a2094313f606560087336c619093f1d38d66a3c63a1d1d235ca03d36d1
MD5 SHA1 SHA512

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 5784c6833749b9ac3dd753596be4db5d8f1ab56d3fdb201bba85600619a0c6d6
MD5 3fa1d86f00548427b5dbe798ae69af49
SHA1 3370b12d545ab8dc9f49d7b0637f55fe5f39937b
SHA512 be3eea2b258ff7ed0d58f318f5ff398ed6f8b13501a1665ad0335b2839c2a98ea9eb41baf2ed374ddd7db48cd2e577dcf66afb21befaecee1371bc0750b6409f
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7e:fwUQC5VwBIiElEd2K57P7e
MD5 SHA1 SHA512 SSDEEP

Submit Download

protocols.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent\1.0.0.10\protocols.json
Size 3KB
SHA256 4fd800e7b1a5fb24b13fac2e31946d205012b7c28d8c61580b0669b2fa3517cc
MD5 1de85fec2dfcc28011a7c2aaab95eb5f
SHA1 80e8c954bfbe8f7ee5a2335c8d969ae033935dc3
SHA512 9c7dd37eb0c094b6aa05201e7c71a8f33b9db81284223bcfa595a44a6ac95d5a6820ab6f07b7aa8d26bf207454e94277bf35332e9c009ee63f083752b6b51750
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 841a81dc820cd1f7642d1dc2e0544dff07302344c9f2f8e8dd4e3bcc31326242
MD5 ac2f626dc7e324587c36ffd1b57e8398
SHA1 0c3f42584e91baf59b7fa7951020d0cbee78392e
SHA512 6f88eccc165e38b9d544fbf7476f85d61f9a39bf9107f219aa3ca9a97d1bd106b6f854b51c926e350a4096b717a99c1bd12132c74e8a1f3b5261fc8bf8a871a3
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b5347cc604fbf9e6d036aeee63a204a38efbd41a64d4783c8b7ab5ece16ae0e6
MD5 bf7bb465fe892d888222e417e736e66f
SHA1 9cbf14e29dc322025f4dd441e2edb2bdafa796cf
SHA512 a0e37050592089cb695291df38b580542cb1964fb67563db1f8398dfa9a5ad402f6dd1b56c5f72f040a3f7f4c91010e745871f0aa5c1b01b08cb76aa4b64231c
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 0eaec88a294aafc5e72a63999e54e6abd97c261816533db56ca579d827c05a6b
MD5 adf8f7f6c2368ca925dd8654417632cd
SHA1 8e0f51b321714b2512fc5278f87e1b2471fe00e9
SHA512 d4ef4b5e40b9b598694d092d5cb5aa0fa3a0a9ec067a8ead5d5197d2db5407d6d51db38b6d0cfe675585fb1571b4e7a8d6746c785a228b2ac26adc3da800158f
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f5972a7e3bd3342684a9359afa204e41218d4b4a6674cd9212789c9dbb2c75f6
MD5 e8be8b66a09a326fc6d53d7e13c7805c
SHA1 8d80df524d40c59b5434d4849e463728a4d52a8a
SHA512 c5076603434b399c1174f43c2256712bf4af4f988591a487b5761875b610b47d7f00c73ccc93afca98a012fdb986c4789bc569c589c5e3612063255e3f8ab1c4
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 aa81778c9eef753ede256cfa6368d5d2e5043ecaa0631e5bb17b768b69f48bc5
MD5 71373f48745cfc0ef7532bcf4989dbe5
SHA1 d6f163c7d7e153c4bda21f6990c4c75b1f5f07eb
SHA512 5f671f8e1208da51e91b034a3d7917d29f115469108a12a834f49af171a01b9679b6e3289f2f29693b71fd43f2191c285aba64554c4fd010ab329d16147b29c1
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_0
Size 44KB
SHA256 69bf16ef047a3e108e93e5a2aadd81cf9480a3ee7805bdb28f4a4eb3c0ac59b2
MD5 e576c287dc7213cbf00064f659f43e5e
SHA1 3bab1e422443808dd42ae2558c6aef0e3655b998
SHA512 ca95ed132f13d07f355d98f1c8843d9dd9778a7305532f4fd6c8c6c12fce0b4216c4d8bb43846d35f956c8ed00f7f61bac0ca62bb93cf8b4e2f56a5450f99b7a
SSDEEP 384:KIXYAG2EsEkfeW48sdCz6XCqXiinVNYVOEr9wkXzrvaZ:1XYA1EsoC6XC0iin/rkG
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_1
Size 520KB
SHA256 8086192681c3ff81ed239e08e30d730fe73783e5ffb4d3dc90114749c8fb7ce9
MD5 b3319fbf57d28ab96359771702ae2ad4
SHA1 2d19da2cf50eb4494d6e9a1c9821d57c43334a4d
SHA512 5ace7b47ff52c0f2a504872d0a9cdce76bb886afa3ec986e5868c34742e4729747af6e7ac4e78708987eddcde2b70548132ac5158457a008fb8369bfd4815699
SSDEEP 3072:10q1zT6yFfkSiAohqFq9kX9F3odDcbFls:1CydcqqkIdDM7s
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_2
Size 1.0MB
SHA256 d041f811e629010e714bb9ae84680a09f12b60531865c66d134853831d11c756
MD5 2e27aaa20d66f9c760df62723985d675
SHA1 1661dbcb0ba91ccf7cb7a5a5f895c110dceb4346
SHA512 acd7df654ad7b5c75f3734ca40de2cacf59bd5bf16a3842d0afea1e79891a02359a95181fbb451ac7da5865cd2d94540d8ef5950d234087b548b631a12df9eab
SSDEEP 3072:Yu5mOZCGdLH67Tg+PC0+u/WmNkhavwBMVsKXDkWMmviFCVVMJHSIvj9yrZLM:n5HZCdw+PC0+u/lguzzpCAViSIrUZLM
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_3
Size 8.0MB
SHA256 ba61211a9b33cc3a73e4cca9cac8a5c1d65d1c0b9df7512322d50cb80e140608
MD5 52eca41eb3d77c895cb686ebc8954867
SHA1 8e2fdcc590570567503e775cc0740593e6e02161
SHA512 4f6e475a152165c2fbd46791d3fc5383f42f5e4e550200de24178dfc54873c0cdaf8e133566a902a13f1136cfd61faa25e255ffab4da8c8f4df78ca14ed1997f
SSDEEP 24576:ZEaxcBUhGeXeL8qCaI9cm46Wt069jRagSuqTNoZsw5Tkl4LGT/P4usN7kl1J4So:ZEuGWkI9cm41trVatob5PgwJkH+So
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_00006c

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00006c
Size 40KB
SHA256 8269137b5d9e9fe613e720c7cfb357971710a9ca8e7d3b4dbb41b3709c149747
MD5 46ae74badf5fd746f6fd1fa84ad2e471
SHA1 b754cfc58eee2007b1ac0709f94549e1069e1209
SHA512 db66d6cdf2c2db84ef70bd388874f751b22a26b562f65a8cc1df8adfa740b082c210b50ae325dc7d00620bd106252011d99079993e56f14f60c3627e413cc722
SSDEEP 768:9H67MgpSWLr+C9XuPMqkHte9u/WQs3vhcwj0O+UVCbhIo:90Lr+kOMqL0+DbjTFUbhF
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_00006d

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00006d
Size 346KB
SHA256 b723265edf984e7400a825fa97d834987239c1a64de099abd8699a629ad74239
MD5 3d0af77ac533dfbc4fd2402f7a39df46
SHA1 8ea15d41c2b2d11f21ce56b17a861e748476a7ba
SHA512 a728321915bbcca93468114b695b8a8edcc44809855513de0ada05a824e0635fba46aef49762ff8fbf61ed8a638e021ca17b3a515fecb80838a1e58ab2536234
SSDEEP 6144:VdB+B5F9JzBGjGlTtGDQLkmm2Td4y2UZscV/bdf60QNZKmJhpDH4T1lNzuYm:tS6kTtGDsZ4VKRFbVDOImfpD01lNzuYm
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_00006e

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00006e
Size 41KB
SHA256 dec20d9c0ad2b2ecd2e79ff6c3ac9af5fc1ce35f384d5b043e7efca976ec2516
MD5 d7ad3bf0e06872b9c7c88f8a1b2d1689
SHA1 d8f2d3662a4326e67788cdad741850ab73f59169
SHA512 81e5f92b083920ba0c8b3a856d9ec59fdd6391de52cbe2da500146a712503aeaae82d070019b9530770f8f29df2e790487c1cd9edc8d7a9c2c142b57ed144601
SSDEEP 768:r5/2EUqaPn8XoeSnXXmie9HSBHwlBYslVGPne/VENu5EV:JVlN4LnnWRsHqQne/SNu8
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_00006f

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00006f
Size 41KB
SHA256 a51b59a8037913830b91fafa285ec0d896f71980464c815f9d1118fc3c9b2a83
MD5 378a8fcb5f97b54c9dd0424895569a31
SHA1 2cb7131123a87c2ce11bbc881620596f746f74e9
SHA512 39da85a3f2b7274b4d7bc3d68b1c061d58aa367b6b556376bfe462789e9929914a6ad3f63c33519c1cb1cebcaef5d819fd9109da8c778b64a1f170a3a8276679
SSDEEP 768:7ehywKqhr4EKbqlOdvfDy+254dAkQK24d0x9ZMaFvnzOY7Zy/H9/DvPsiU4qVKpZ:7ecwP0EQqWC5kQ34CxbjBnij/H9/DMRM
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000070

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000070
Size 51KB
SHA256 57147f08949ababe7deef611435ae418475a693e3823769a25c2a39b6ead9ccc
MD5 f61f0d4d0f968d5bba39a84c76277e1a
SHA1 aa3693ea140eca418b4b2a30f6a68f6f43b4beb2
SHA512 6c3bd90f709bcf9151c9ed9ffea55c4f6883e7fda2a4e26bf018c83fe1cfbe4f4aa0db080d6d024070d53b2257472c399c8ac44eefd38b9445640efa85d5c487
SSDEEP 1536:1rvqtK8DZilXxwJ8mMwAZy7phqsFLdG3B4d:xytBZits8bw4wzbFxG3B4d
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000071

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000071
Size 142KB
SHA256 5378969916af9522fbf23b0d4af956029bfc1d5564a3ddc0ece0aa138b4b7b83
MD5 a3138cdaaab2658c3cf974bdfed893c2
SHA1 4e329b84dc42930a9a0ad245465afad2a6fdb1de
SHA512 54f4d5aaaba92daba51c581be252dfea9303b10233041e67e642a9285f2b62bc3ff9fbb0a18f808280d011a497c473a6ea5f0490db4b572ac61327ff15d4e59d
SSDEEP 3072:ESLKMpy9HHCSV+xFyfEg2ZBLaiHbp4KUfimUWLja:ESWzHHlgTyfEg2XR/mXG
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000072

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000072
Size 434KB
SHA256 7d0e4aa42d583e98f232fcf4e967bc540a63a72e0458e4b86c275d04c975aa82
MD5 7c1c84099ac6d707c3721aafb7494116
SHA1 0147428539d3416ba923174aa3328ba61eb07673
SHA512 e75b534169a0ae3eee7d231f5349f6acbe9dafcc7d3fb2abafc77d789e6a835af7746411681fd4cf606f4485504fbaab08ca6fdc157aad0e060147b60b5ba870
SSDEEP 12288:VSF335/WG0EaGgiMneKYQhDKCW/eV6DdXUP:VSl370fG9/QhG/pX0
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000073

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000073
Size 77KB
SHA256 a81a49ec43eac2d8e81636e4ad2054fe483197673caddf664b8e261a923e26f9
MD5 6e480bef790dc6fd86b55a4fb87ff461
SHA1 d7db643fc3179bb74f016e2e1615cd32ac16c5e1
SHA512 df4ad5089790bd662956a0fdad4f98c93614f6aec60a0c260783fbd17945238b803e71a82ea0af27753d722965f57e715cda14eb573692a9aa2c5c92bf0da8b8
SSDEEP 1536:988y8AoSl3PgeoNpHiOkpzguJ4XKeqc4tQD8uRnVoL3a8e6GZxM1s:NAog3PDom1zguSK9cH8kng3a8zGis
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 278e107662578ff238b7e146df0c71bd22fb0b84b1beaa744a74f3e69e11b536
MD5 99a8600c68bf6aff5a34e262d324c0f4
SHA1 b22b6d4cb310b4f4d6ebb3b7b67f474b6db9e6b9
SHA512 a6274317c9f6767082a7c3f9fb04c54fe1f25222dab373e525e160ca00ec0e3e4f6708f83f62196aacb2fc75c32ecab9cc7e2940587f938a5b162c58d5d00475
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 12db89524cba60bfe6c3ba5777169de0d8b98a030de851de73bfc0a430048951
MD5 3efb8d009189cd8e61c2bdd04a62bcea
SHA1 2cc0f73a5e875343dfaa67c0fd307e14016b42c7
SHA512 267a665764b9a1c2b36ec138083c3ce526c979d1e53c8ebb9f28fde463bb3144d158485222b174bb15e0b686257fde574e146c843170014abf8cf95344efe36b
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 f7a54b7827ea5b976dc840c3a884ca75b67482311aee71ae3719ea6ef61c4fa5
MD5 fb6577e5d5f536929165cfaa037b084b
SHA1 a7886fff9fb71e48afec5589fa3717838d4a85fb
SHA512 d7d99ab9636691fed53a2f35f50598816dbaec45f6548ec9356bb7a1375054b1fba21f703068f9549f151e37d4f446a27d841425ff16dca19131457ee3e9c235
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 9d6c91fd95bd6794c62d404acbb2b41d4cd3305ba4e0126a6c56e18e416b59bb
MD5 e490b5a4b34a2a8f998d3e44bdf1b3e0
SHA1 6e99f7f9eb1c0a3041bd1b28bec4f8e9788e5f7c
SHA512 3cc74250569f0710f02b774da63447328a735e16b1edf9826a3d7c05e5c8db536d9f073d84ad876fd8d3e54b76a128d002d0c7e74c8c17c362ebdbe47591aeef
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 2d1c1e09e5806505e3693cb1bf7089faa8d995c3eda5e618d384538d7c051841
MD5 6d2827b1b5aea0f89771b89d107c045b
SHA1 504120c2b8e9f7851afaffa402ac68344144feee
SHA512 390b1f08ee72a06956fedfffe74ae9fd8c4d71334c705487848fc9906cc476e0437892897e11c1ebd73d8c15fa9ecc2be7e24375a8b55f6b71671237850a2f16
MD5 SHA1 SHA512

Submit Download

the-real-index~RFe58a718.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58a718.TMP
Size 3KB
SHA256 64b5264cd1befa4f5465232e443d849b8a3937f1b3e7059a8d11e1b8fc716686
MD5 47b54e587dc304a65a1674376847e074
SHA1 3b0f4273199e28655534b51009be9b8922021ea5
SHA512 4bb5b58e468e6cc62a4f43cbafe1bfd49e795df0ddb96066e894649746d2dda70cadcb7e47aa9a5ed0555c49cabfd727d69a776b4dfac78a9bcc97252d13545a
MD5 SHA1 SHA512

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 a2afd9b3b4a5ae5774412b243f575f53c85a5bf04ffcf6cd54ba43e904109181
MD5 21c55591750e8cc7a8ba2030e3b9e2e9
SHA1 8d453371d8b9a6570a8c7ccf3d0064638cf10b38
SHA512 85ac4b553aa65fc39ed9a6c659c605c47d75ea1f5e31d4e7d9b09f97128642ff7d13a2700d8e8a823f1ad147c8e57d87c0fe16644b26e99fde757b9875634d91
SSDEEP 3:MsEllllkEthXllkl2zEklXu:/M/xT02znXu
MD5 SHA1 SHA512 SSDEEP

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 69KB
SHA256 b305e470fb9f8b69a8cd53b5a8ffb88538c9f6a9c7c2c194a226e8f6c9b53c17
MD5 164a788f50529fc93a6077e50675c617
SHA1 c53f6cd0531fd98d6abbd2a9e5fbb4319b221f48
SHA512 ec7d173b55283f3e59a468a0037921dc4e1bf3fab1c693330b9d8e5826273c917b374c4b802f3234bbb5e5e210d55e52351426867e0eb8c9f6fba1a053cb05d4
SSDEEP 1536:hAlMWz7vLDtDSVlXXwpFlorgLUxF+i2IFXaH5EoVDRnaXW:hvuWAUxFhFpoaXW
MD5 SHA1 SHA512 SSDEEP

Submit Download

content.js

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_2\content.js
Size 9KB
SHA256 0d40a5153cb66b5bde64906ca3ae750494098f68ad0b4d091256939eea243643
MD5 3d20584f7f6c8eac79e17cca4207fb79
SHA1 3c16dcc27ae52431c8cdd92fbaab0341524d3092
SHA512 315d1b4cc2e70c72d7eb7d51e0f304f6e64ac13ae301fd2e46d585243a6c936b2ad35a0964745d291ae9b317c316a29760b9b9782c88cc6a68599db531f87d59
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
MD5 SHA1 SHA512 SSDEEP

Submit Download

History

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History
Size 192KB
SHA256 46727eed57e479a04265614fba36bdd09ea823eb98dad82138c748062cea09e8
MD5 5819dd69d64e3a86020cf0f19c4c840d
SHA1 f8622db4729f7eb592b17217c59b5587b9cd3c32
SHA512 d078fa868a158aa13b1e5d86e9d53fb5b0a6a5ea40b2935c25c2124aaf945a53a8fa32988af92f15a7d72bfdf7fd0b2a170baa028d61bf22a371b9e7a950ffbf
SSDEEP 192:c3xd+GmBE3upbIXJlPtwVjMmjnZ4LHrDo/A8j:wxdmBE3u1kJFtDhrDo/A8j
MD5 SHA1 SHA512 SSDEEP

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 108KB
SHA256 a5f47979e3d9dc7c49694d8e9e4dd8e98b45470f93161940daff0b96bfc84a91
MD5 3692b82273b09514a7212381ba0e0098
SHA1 5abf2cbf0bfd404c62a99944e2653830865eb23b
SHA512 d3611f1b0d1c4740eef4bb7d25dffc69de0afabb5f62164acb0d7e947175822cffdadfd607249028c6c6f9f39486e0e7dec0368f225793245ee820f59dcac4d7
SSDEEP 1536:IJcH74ohBGZqW3iPPDuVvpBI/S8tZsA62UYPq:PHSRiPjU1
MD5 SHA1 SHA512 SSDEEP

Submit Download

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
Size 20KB
SHA256 a9a0938b4ec8de7b4c2a8362d2746fc463e7f0c827a83513072d968836b4af06
MD5 cae3920e6be917511e90c67493a58584
SHA1 cf7f216cd6f7b53216785132212e43bef4c0b512
SHA512 227a8f45df8da798a917dd45ef668b45b8d464abb0c68ad5c503381e29a15db201a08e80229015a0ff8fcfa12c89f025eb499bfa831b51ce00f56ed66b9b86dd
SSDEEP 48:T9LopFMatSaw/auUOt8ByoMwBZBv6HNHngxlmCGGmlP0mhHNcnpueOwLmp:NeMatUaAKMMknWxlU/Im
MD5 SHA1 SHA512 SSDEEP

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 5KB
SHA256 e9f14272dc9f003a9d28edcb6308306e608bd01e6222d2443f68e3dd4d0296dd
MD5 0df2aebd789fa95bacf9424a3857f581
SHA1 274088a168d6dc0d9b99da07ffe1280a0c19fce3
SHA512 0664071a7cac362ceb236854b8133e265eb8fa4cc2dd2b7db2a6b6d328c569f0de8cca4173aa10b02d2464bbfc20a45fb47fb93cf7cbd763348638f60d8a0949
SSDEEP 96:DIOHmWaWdfBAyQ1xj6xkdNyaTzI+vL91G:DzHmWaWdJ7Q1xj6x0NyaTzI+vLLG
MD5 SHA1 SHA512 SSDEEP

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 7KB
SHA256 d0b7b79012a3b1bdb1cd8dd792e3df015498c01d3b6661488f4798242fb30179
MD5 1b2b1d82d17cd3d4d730f65f66c30139
SHA1 597212225280647216bca3db4155ffca67691114
SHA512 e90f8d5f2308f3eaa7ab25cb07b899315aa233d088958ab99e7175c2fe0af022870d2d011a46dccfbc0f37d6f3fb19ae9b91c3d1bb86dc1829dc3d4489ad7754
SSDEEP 192:Ds415ZsOBPFWdJ7Q1xj6uukPFnnei4L+W4IaFG:Ds415ZsOBPFWdJ7Q1xGuukPFnnei4L+k
MD5 SHA1 SHA512 SSDEEP

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
MD5 SHA1 SHA512

Submit Download

Reporting and NEL

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Reporting and NEL
Size 36KB
SHA256 b1fb5315528ac5dc363a5342e8a72f93f4f5f8741a21bf68eb97e8a07418e2a3
MD5 e59c3bf36df3dc8b33b2e269ada8f5cc
SHA1 b5b9be7a77c8567744eb551df21ea96cd7dfd2b7
SHA512 ac25c6ee82453cf5fc45cfc869c550be7e044e7da9e610e22a9d4e6851e8dabe548b58020f6e7aefc0f98d086ae08bcf04e3eeafc6532f53539ff83f021e2557
SSDEEP 96:eIEumQv8m1ccnvS6dA1nJ5h6Q8RRMIDjqTQta2oEUIA5nZuggXL040:eIEumQv8m1ccnvS6dA28Ca2zesLa
MD5 SHA1 SHA512 SSDEEP

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

cd1830b6-92f8-43ae-a8c3-232514035424.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\cd1830b6-92f8-43ae-a8c3-232514035424.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 a74e896988f48abbd1a9e9de4cb1b5c4e3bd29c280e41567275c815319075613
MD5 0ffb34f795777d4fb39f245041c35391
SHA1 0e46448b24d9bc4b8459285fcf8569bc4fd276ed
SHA512 1d1fe8755163d21bf6342c24108edd1465e896bab914add2d788f543dfdd1913daa96a7b18fffe118cab00a1cdd012d88aa529a13d36a00581f590da66eceecf
SSDEEP 192:sVTRayMh/K1Ml87gZsdWc+vmELRjSIT3XLIgVIZ8pdjd5HY+WNu7YaDQYMv+PdC6:sVTiBZsdWc++ELR20nLIgx1HS6QXrmWQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 fecc57652ca1622ac6f4910e831a11f89b7b422cfcfb0493510a9f1a8053412d
MD5 4cbc7ef1520168a4198722516206fdf1
SHA1 54b233a4435abac292097146bdc5a92e8d677687
SHA512 74fdf1b1e724832ddb8848b602ea9e8dfa1902f51bef8b0edb01383157c95c9f48d0f220c69849dc92011a612fd906e092d99afca43f40fd952211989b14685d
SSDEEP 384:sVTLBZsxWcY+Ege0nLI/J0HSO4WQAidWQ:sptgzkge8HSdl
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 e86b1feb49119768183f769985e4b5d7f2e57ca208800e247fb46b8da08b9150
MD5 0742489889b846ce714e1b382ce0afab
SHA1 9daff7bdd8909892318e5df553ebaded08c8f6b4
SHA512 a174d5929dfc17f5605ceeab1352726a868e5f9ce42dc8f187fc6ebff9dd9f960c3584146c08b8e8e1fb17d88a5a59a418e7d54cbe79cae5a70815858ff43a48
SSDEEP 192:sVTRayMh/K1Ml8MgZsrvmELVjSIT3XLIzVIZ8pdhj5HY+WNbbZPwYCP3CbkS2eIA:sVTiIZsr+ELV20nLIzxxHSNwSOWh
MD5 SHA1 SHA512 SSDEEP

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 35KB
SHA256 3a8a3ae78b3470eb9c818e402b2082933efb562a86b88405619382ec815d55f1
MD5 5691adf4a739bb36ddccf652bda5308b
SHA1 e31e254d17cad7855b6ded696bc3d74f71c3eb77
SHA512 21a9bc927d4fe2177bb84b4e921a166f32503b86342c8f827ff62ce962641b1cfb2b5a1fa5d0348d585319176e1083c5a908b34ca3e671f20236bb9eaddfa58e
SSDEEP 768:91ti8XT7pLuLZTNWFh7xr8F1+UoAYDCx9Tuqh0VfUC9xbog/OV9j5ALlBT5Ccroi:91ti8XFEZTNWFh7xru1jaij5ALz1CHex
MD5 SHA1 SHA512 SSDEEP

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG
Size 326B
SHA256 3e688a2b5b14ce91fff43db29a23f1854e85f27b904f669594cf5d0b7203c9a6
MD5 683b973004481bf36866c33ba1ff41c7
SHA1 0c24a9728d66863ffdc7321b7aa80b3a03e03b2b
SHA512 8bf991caf710c838f02492357b1ffd1b4c44765dcdbf2f5a39e66f2d0f0777f9cc0e0d71b72642e5d2e94a6696de7317fb0bf9e0d743709b3c60c574e2cbc1e4
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 2d5c07318a98b3dfd3a25ed5058d908d44d8d3d012be06d8a13591baaef1ced1
MD5 d748925b28e47f6c2f0cd8fec853df43
SHA1 09cfd4aa48ee9a0509803ca6b0114dafa460bc23
SHA512 4b55e93541a225aa32103e9a33f5a25fc2f5ddd22a2bc178b8c96f2d8a1f106b68a2c039c05df051bd5c1d91b2c0b281988c51ca07051ea082cca73939285252
SSDEEP 48:0cKjkeK93ydqKNcHKWIy5bKuZgCgngegSggg0gP:0cKYeKV+qKqHK3KbKNFgRVjnP
MD5 SHA1 SHA512 SSDEEP

Submit Download

CloudConfigLog

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog
Size 24KB
SHA256 35e81659f4f897762191c11f128a1ca61705cbb6d32e492f716a40d22c920632
MD5 2f12e332cfb8379bcd4be52efd9e9e91
SHA1 b8edc15c0f476b3abcfc307c0f3dd3e705e49401
SHA512 e6de185ad756e064d1179ac088d010396cff3cc0a7849dc0c90d7e6a2bf9b341c8c611e4a23707e05e3ed0d4d0e6ac5da2ae55c0c876f80c3c16cf2450509e89
SSDEEP 768:OJOk/FY7/2lagbCtCkQ7wDlH/h+umbA6BQpGMgSVlkium1z4tfLTvq/uIvqpgRvk:OJOk/iSlagbCtCkQ8DlH/jmbA6BQpGMA
MD5 SHA1 SHA512 SSDEEP

Submit Download

CloudConfigLog

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog
Size 880B
SHA256 9d4aaaa0a8cdad274deceb97f8424f29a87c30040d9f68653dbba280f151a63f
MD5 4a1afb6da32f82d1e45930bfb17b48e5
SHA1 c27f0ad52d60ba0832c40a5c5f755fee83bd4b77
SHA512 c637d8b46d7013897aecfc54ff45c1bd0be610cb7ab654d1e56379a11b650aafc2b915eafda3d2a34b0be11e771874991f7c982aa3b0d08054b621a539873640
MD5 SHA1 SHA512

Submit Download

CloudConfigLog~RFe59f41a.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog~RFe59f41a.TMP
Size 469B
SHA256 bf98c10b70802f299e98de4311ec4d7cc12d98f9ec7c4d26400f5caa1f2a65f1
MD5 5ce2696e24091730b4e418b3fa8ff113
SHA1 4542eef086e240a21d299e0b204447f6b1298446
SHA512 a783bdad6e9d6aeb58d90a5cd7c9979ffa55f277484b642f41c1458129e6f12e4011381f00e086c9797044439cc16141d47c578f6565ac2d51322035fec76dda
MD5 SHA1 SHA512

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

OperationConfig~RFe59f4a7.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe59f4a7.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
MD5 SHA1 SHA512

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Size 13B
SHA256 01a3e5d854762d8fdd01b235ce536fde31bf9a6be0596c295e3cea9aaf40f3dd
MD5 3e45022839c8def44fd96e24f29a9f4b
SHA1 c798352b5a0860f8edfd5c1589cf6e5842c5c226
SHA512 2888982860091421f89f3d7444cacccb1938ef70fc084d3028d8a29021e6e1d83eaef62108eace2f0d590ed41ece0e443d8b564e9c9a860fc48d766edb1dc3d9
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 4da94e11e559f8a6cdba37ca97a49b9e69327875e3f1581432c4af0c2bf0ae29
MD5 c71d5a3adaf5b6189bbd783fc983fe7a
SHA1 feed8d64fb6adf5a2a383a9952644ddf1866641f
SHA512 386da64b8237eb6f2e7737b9cef1884d38645dd2317770d9b670fb21efa1520da5bbcc07bae4fcce2fbd53986d0c1dce292cf4866bd00713151fc7d24bd0419d
SSDEEP 768:dYfJSJLdOuDwLAfcBjFWR92nowgg7IXB/bw/:dYfEhOujcy2ow1Cs
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 31KB
SHA256 c61e0e0c1cbba5d6f4118766fa370002feeeff1888b4440bbe44a0eabd0d5ded
MD5 55c114b0627b4a9ff6612a0d177149aa
SHA1 51bd61af012be7a4b37e229e93d2d1c43db997fd
SHA512 c7e5fd7c868d5fae10478b0ed23de5b281b12199bf57233c139f5563370e3427ac3f211961363c045933a13b1c4fce40ee05a42b2639376ee272e5aa587d9dde
SSDEEP 768:UYfJSJLdOuDwLAtuB1BWJz92nowgg7IISVNKAf9/0jB/bw/:UYfEhOupuk2ow1NSVNKQ4s
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 3e1937c1f8fd94dae0376e7958d3b1e929be029eec6396cc66fb0e3e24f88c4c
MD5 15069272632cd2d1270ff129cd50c0bc
SHA1 bd2b0b4fe81c0a52767f68bae5dbe43a2dd3bc7c
SHA512 d20f1f76e246bfe18a9691a372006ad4afa0a30ba43b0a0696550e6837c8ffa2a80b68eea9616f28b6f075bb82ccc03a0d8658c95e0dbbe72fb302df415ef958
SSDEEP 768:lYfJSJLdOuDwLAVHBkrWJz92nowgg7GUB/bw/:lYfEhOupH52ow1zG
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 31KB
SHA256 59ed410c1dd141799e79694057c2cbd7b2ca10bd081ce17e4219d31b006b27fe
MD5 c8be0933ff4f8db6bda340558b0e46f5
SHA1 106033ce769bf435fb864ec8b14b2b41af4691d8
SHA512 f9618d69ee978f40dbb9a14ddf685dd17edd5e6f4ae0f029009836620d8bd2e81361a0670676b9e6ed3620bdd62277440fe88f2f5a87036f6fe1a9e6220d80ed
SSDEEP 768:UYfJSJLdOuDwLAtuBoBWJz92nowgg7IISVNKAf9/0jB/bw/:UYfEhOupuB2ow1NSVNKQ4s
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 36KB
SHA256 a59a6ce220d1643313da007f9bee610f571e9fc3e1b1a75aedd2085420cd82ed
MD5 7af9defcd89c58500e2f9aecb01267fa
SHA1 091b1e79b6c1871a6d0ec6bc45fd666746d28eba
SHA512 26301b1af54147903b0fb4e0cade842e719a4359fc661c57eec281b8162be911487806b2baf078ae1af8cada982ab314e2f30cb857c1ec78ba4cca7b556cff9d
SSDEEP 768:hFhYfJSJLdOuDwLAsiCgfBYslWpzzT92nowgg7/UB/bw/:BYfEhOuoOit2ow1sG
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 bbcde37d23a6ff3da1950e08a4a5127880b630a65cc756232439d843e50fca42
MD5 cd5113f6e63c0f7c977cb9e5a2f918fd
SHA1 cc7422928af830b7b2491eef64d428b79f3ac29b
SHA512 9667f3da84e1efea2ae4e5bce311b14e113d10300e013ad85c4596f67e8548117b30716ac7905ddfb846c615c1e24baa5adee96963ad75d38c778186a411baaa
SSDEEP 768:WYfJSJLdOuDwLAVHBprWJz92nowgg7GUB/bw/:WYfEhOupHO2ow1zG
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 5d4c4de8f14ce01f4402095524bc373c477671295a7ea017cdeb53e82fc14d2b
MD5 f9915df30d29ff239e741db6a900db38
SHA1 fdbead2e4c4dad27df3da16ab2feb93db8397cc7
SHA512 fee89f3342efc147edd652b608f3e21831a571226064053d56263534f1b42359e880507beca450c50af3e79a0d11c2e0b346ac0adc92fc7ea2b75ca5d89375cd
SSDEEP 768:hFOYfJSJLdOuDwLAsnCgfBCcWJ5z2T92nowgg7lUB/bw/:uYfEhOuoLJ2ow1qG
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 7KB
SHA256 67ad6b7f2ac3c778fc1dfa2f8497c7027a1f83a050389be7668ac2fe4ad31bbc
MD5 0a1e035d415700204501b18078a72ddd
SHA1 fe5cc7d0792d148eae966a2faaf7c52f3014622f
SHA512 540769f8d8a6894caae0e3857d51295da120bb9e0606cf09275d142b885bbc9a11c74f6069b52113bcc34ee56962e2af48b29e2aa06bb8abd114cc6b58eb0fca
SSDEEP 192:FONbyB1BCWiRUyPkA1SM92C0oP4VG5QabuVgLHNUZ:FONby3k5r1SM92C0oP4VG5QpwtUZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 f7814c7750a8eaf84691e1cbb22b83548a0c67f4111e5ca1d7b9bced038d0932
MD5 425b45caaae37e27168057d2d5d477e5
SHA1 0b4b30b77ed4925e9c9b5e6c82c2c38384c63749
SHA512 1ba6477cfd6f5e962ecb5517c4b80b134c054a564d5127588d32808b32d5f9cfd8fb5346d8eb9375d7bdbe601a6219e4844f42f404a8e430ab79c7da6a8421f1
SSDEEP 768:SYfJSJLdOuDwLAfHBkcWJz92nowgg7GUB/bw/:SYfEhOu7He2ow1zG
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 059aec922168f7fa0ddf91fc724cd90362c56f5039fb958981d126d228d510d7
MD5 0711feac7ef7b8e9e3f0c57540acef3f
SHA1 25e5c2dbc5aa626a08b41c9ee5fbe4cd0553a325
SHA512 66c777fcfd9f665034e19b06d7c775b372cb29cffe6dc62e5ec8b578a8a95cbcef7d889e070e45f37b0ce7f6ebd51c8d82cc0102e6e879562a5fbd074257b7ce
SSDEEP 192:cONbyB1BaWiRUyV1ANSM92C0oP4VG5WRq8ny131VlwhQUZ:cONby3IfaNSM92C0oP4VG5WRqc4XUZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 58862b0b60eff3b0f67b339450eb7221b5a7a22c74402efb2b4be137e0fbc835
MD5 881ac66a8751c5c50447a5f464c91ca7
SHA1 e0df7efe33a78f7f9d7997347f349e51b1f9e7ae
SHA512 3788774aad0ef78b39065ae6be7e64283c951e596fd6e193f0c11d1af9a88e4c37886b0498599adb0e71bc87dba7f91a1052e7d2935e42d64bb80031bb4043f0
MD5 SHA1 SHA512

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 fc614ac2972572d79a0e965508f70f5865d819a61c29b2b2e558720edf75028d
MD5 d2442df9e146dfeb98b7ed3e50d4ea3f
SHA1 731ca4bc01797818557d56d4d94f75c9c77fbc2f
SHA512 c0033885a4e4ca7f68744d51d1a7446a13e9d024c2ddef6d8314efd255d15a55624ca12930495427932972b03a5c103a9d3d46095082e83aca52cc6a1b7e0c33
MD5 SHA1 SHA512

Submit Download

RevisitationBloomfilter~RFe5aa152.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe5aa152.TMP
Size 392B
SHA256 dd0d7ad1e1adc54015a906c48a32e4accc96c77af76febbe578a9aa7d2492989
MD5 884d0b9dbe6807ef52ff6ff2be5d8780
SHA1 7c1562999b311256e16baa99f1f16720602184f1
SHA512 18e8324b9721cea7956cac4424b2fc07d87ab8753a556f7c23eee910434ec91d88e2d0bf5a53bbd7f89aa578faf83eb3c6c5c3dbfffd534702a19d04a7a112e2
MD5 SHA1 SHA512

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 2096b0f9b293bffc1a85531064e1a281d0c78f2a9e5f683c42aa6ed1374e86dc
MD5 9e6a42e904d769028b85cfa5e4622e17
SHA1 7413c37873b7917b9f0672dada94d9d51431a66d
SHA512 78fd61a75e5e731d32ccd631e921aa984feea012abf283ecd3e8d5a9536af4aa8a069eae3c460c141b28becf952a615ed4f1cf16c7783c2f46fc959a1c47028a
SSDEEP 3:MsEllllkEthXllkl2zEkl1tH+/:/M/xT02zn1tHu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations
Size 86B
SHA256 f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed
MD5 961e3604f228b0d10541ebf921500c86
SHA1 6e00570d9f78d9cfebe67d4da5efe546543949a7
SHA512 535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 6fa583506cc5faa4ed3ac920d6add1f873d962bab0d3b495979d24a95e295a28
MD5 01c7532f5a533c94c64489df0ed2a565
SHA1 65ecee549d23428665d54e62c52bbc809a18e76b
SHA512 c1718053535e2130bf458e2576d6866bb34865e9682c198b7fbd421fba41d0d4a43698f3776c964733e6de2dff082b1462a09fb6dd9555a8e31903e954812a92
MD5 SHA1 SHA512

Submit Download

02b2a736-7b38-44db-9e5a-30e64b31ebbb.tmp

Path C:\Users\Admin\AppData\Local\Temp\02b2a736-7b38-44db-9e5a-30e64b31ebbb.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

5862eb78-53b1-4078-8025-319edc013115.tmp

Path C:\Users\Admin\AppData\Local\Temp\5862eb78-53b1-4078-8025-319edc013115.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
MD5 SHA1 SHA512 SSDEEP

Submit Download

Path C:\Users\Admin\AppData\Local\Temp\Malware-1-master\x
Size 11KB
SHA256 3c8cea1a86f07b018e637a1ea2649d907573f78c7e4025ef7e514362d09ff6c0
MD5 1882f3dd051e401349f1af58d55b0a37
SHA1 6b0875f9e3164f3a9f21c1ec36748a7243515b47
SHA512 fec96d873997b5c6c82a94f8796c88fc2dd38739277c517b8129277dcbda02576851f1e27bdb2fbb7255281077d5b9ba867f6dfe66bedfc859c59fdd3bbffacf
SSDEEP 192:Ljafl1gt6iUq/l0ZQjGNxYoanyJfjvB0BXmqqTZhXBnaRL9znQ32z8h0:L29mtJUui1any9Bn/RaRL06
MD5 SHA1 SHA512 SSDEEP

Submit Download

Path C:\Users\Admin\AppData\Local\Temp\Malware-1-master\x
Size 4KB
SHA256 45f18ccd8df88c127304a7855a608661b52b0ca813e87e06d87da15259c45037
MD5 214f98cb6a54654a4ca5c456f16aed0a
SHA1 2229090d2f6a1814ba648e5b5a5ae26389cba5a0
SHA512 5f058b05f166e2688df7b3960e135ada25bbcdfbb62a11da3cf9e70c08c51e5589a1e6ca2250318a694d27197f2c5ba1028c443831c43fba2171ca8e072e9873
SSDEEP 96:2OfjuOV4dI3CMQYGtWJQsRmWZu2Ik6iUqLplsQuK0sIF2jGM:Ljafl1gt6iUq/l0ZQjGM
MD5 SHA1 SHA512 SSDEEP

Submit Download

x.js

Path C:\Users\Admin\AppData\Local\Temp\Malware-1-master\x.js
Size 448B
SHA256 aa01b8864b43e92077a106ed3d4656a511f3ba1910fba40c78a32ee6a621d596
MD5 8eec8704d2a7bc80b95b7460c06f4854
SHA1 1b34585c1fa7ec0bd0505478ac9dbb8b8d19f326
SHA512 e274b92810e9a30627a65f87448d784967a2fcfbf49858cbe6ccb841f09e0f53fde253ecc1ea0c7de491d8cc56a6cf8c79d1b7c657e72928cfb0479d11035210
MD5 SHA1 SHA512

Submit Download

z.zip

Path C:\Users\Admin\AppData\Local\Temp\Malware-1-master\z.zip
Size 8KB
SHA256 44c1857b1c4894b3dfbaccbe04905652e634283dcf6b06c25a74b17021e2a268
MD5 63ee4412b95d7ad64c54b4ba673470a7
SHA1 1cf423c6c2c6299e68e1927305a3057af9b3ce06
SHA512 7ff153826bd5fed0a410f6d15a54787b79eba927d5b573c8a7f23f4ecef7bb223d79fd29fe8c2754fbf5b4c77ab7c41598f2989b6f4c7b2aa2f579ef4af06ee7
SSDEEP 192:egFudZs7gU52m4qi2hvimtucysYSM3lRNm5wy2k89QPaNmCpCfAKgW:SdZs7n52mbFimtuckPXEKyuGSXCfAKx
MD5 SHA1 SHA512 SSDEEP

Submit Download

d0872b38-690d-4c12-abb0-63b9816642b6.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4708_711505696\d0872b38-690d-4c12-abb0-63b9816642b6.tmp
Size 161KB
SHA256 8db781cdf6d05cbf452dfaf7eaec6c4818e2c979fbe876c2178a449681374b09
MD5 f4e4a2ec27084ae8e2d291b22cfba16a
SHA1 75ef323d2573847b366647019ac6486362fc40b5
SHA512 606ff1219382c3e4367ec8e929928b21031a3c9340c9e2064e1297a879f22ccc4f9289b59db7c35cf78c5b97d8827a3a2c37c62ed40aceea29d1c59bd0d90692
SSDEEP 3072:SBBV1VTKa0F/TnqOK7CcvlUsUc7/3fDN4UKzCGLr8Xqjj6iI+onWr+SZuTF8YB:S/V3mbZrqOUpUgPbN4UXGLqqjGiIXWGB
MD5 SHA1 SHA512 SSDEEP

Submit Download

MEMZ.exe

Path C:\Users\Admin\AppData\Roaming\MEMZ.exe
Size 14KB
SHA256 a3d5715a81f2fbeb5f76c88c9c21eeee87142909716472f911ff6950c790c24d
MD5 19dbec50735b5f2a72d4199c4e184960
SHA1 6fed7732f7cb6f59743795b2ab154a3676f4c822
SHA512 aa8a6bbb1ec516d5d5acf8be6863a4c6c5d754cee12b3d374c3a6acb393376806edc422f0ffb661c210e5b9485da88521e4a0956a4b7b08a5467cfaacd90591d
SSDEEP 192:sIvxdXSQeWSg9JJS/lcIEiwqZKBkDFR43xWTM3LHn8f26gyr6yfFCj3r:sMVSaSEglcIqq3agmLc+6gyWqFCj
MD5 SHA1 SHA512 SSDEEP

Submit Download

note.txt

Path C:\note.txt
Size 218B
SHA256 8e9f20f6864c66576536c0b866c6ffdcf11397db67fe120e972e244c3c022270
MD5 afa6955439b8d516721231029fb9ca1b
SHA1 087a043cc123c0c0df2ffadcf8e71e3ac86bbae9
SHA512 5da21a31fbc4e8250dffed30f66b896bdf007ac91948140334fe36a3f010e1bac3e70a07e9f3eb9da8633189091fd5cadcabbaacd3e01da0fe7ae28a11b3dddf
MD5 SHA1 SHA512

Submit Download

memory/4396-1013-0x00000000063A0000-0x00000000063A1000-memory.dmp

Download

memory/4396-1004-0x00000000063A0000-0x00000000063A1000-memory.dmp

Download

memory/4396-1003-0x00000000063A0000-0x00000000063A1000-memory.dmp

Download

memory/4396-1002-0x00000000063A0000-0x00000000063A1000-memory.dmp

Download

memory/4396-1014-0x00000000063A0000-0x00000000063A1000-memory.dmp

Download

memory/4396-1010-0x00000000063A0000-0x00000000063A1000-memory.dmp

Download

memory/4396-1012-0x00000000063A0000-0x00000000063A1000-memory.dmp

Download

memory/4396-1011-0x00000000063A0000-0x00000000063A1000-memory.dmp

Download

memory/4396-1008-0x00000000063A0000-0x00000000063A1000-memory.dmp

Download

memory/4396-1009-0x00000000063A0000-0x00000000063A1000-memory.dmp

Download