6805b3c7c5234bd7f0fdc6355fddbb53152f605865d96deb5ed115b67baff445

max time kernel
340s
max time network
341s
platform
windows10-2004_x64
resource
win10v2004-20251016-en
resource tags

arch:x64arch:x86image:win10v2004-20251016-enlocale:en-usos:windows10-2004-x64system
submitted
22/11/2025, 17:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Malware-1-master/MEMZ-Destructive.bat
Size 13KB
Sample251122-vkblbavldp
SHA256 5e2cd213ff47b7657abd9167c38ffd8b53c13261fe22adddea92b5a2d9e320ad
MD5 4e2a7f369378a76d1df4d8c448f712af
SHA1 1192b4d01254a8704e6d6ae17dc2ec28a7ad5a49
SHA512 90e6eedca424e2ee37c78e0c0380db490c049b0378541812734c134510c40c6e4c48c4e213f395339ed99ff337ef087b6056ac5aafb246c1789ca6082dcabd2e
SSDEEP 192:AOyUySl0UaDz2gWsIzlmj+BxZ3yqueWQx0lZicyC8Sh31xcjBzyxwn7AVhllz3:AVODaDSHMql3yqlxy5L1xcjwrlz3
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

bootkit discovery execution persistence

Malware Config

Signatures

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-836202210-2447721123-193472470-1000\Control Panel\International\Geo\Nation	MEMZ.exe
Key value queried	\REGISTRY\USER\S-1-5-21-836202210-2447721123-193472470-1000\Control Panel\International\Geo\Nation	MEMZ.exe

Executes dropped EXE 7 IoCs

pid	Process
3532	MEMZ.exe
4612	MEMZ.exe
1500	MEMZ.exe
3948	MEMZ.exe
1664	MEMZ.exe
1780	MEMZ.exe
4916	MEMZ.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	MEMZ.exe

Drops file in Program Files directory 29 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping760_325100806\manifest.fingerprint	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping760_1474875803\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping760_1474875803\office_endpoints_list.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping760_1532321188\travel-facilitated-booking-kayak.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping760_1532321188\manifest.fingerprint	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping760_149713434\LICENSE	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping760_425209855\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping760_1532321188\extraction.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping760_1532321188\travel-facilitated-booking-bing.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping760_1532321188\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping760_149713434\manifest.fingerprint	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping760_325100806\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping760_891495816\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping760_891495816\manifest.fingerprint	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping760_1474875803\smart_switch_list.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping760_275185906\manifest.fingerprint	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping760_891495816\protocols.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping760_1474875803\manifest.fingerprint	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping760_149713434\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping760_149713434\_metadata\verified_contents.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping760_275185906\LICENSE	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping760_425209855\manifest.fingerprint	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping760_275185906\sets.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping760_275185906\_metadata\verified_contents.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping760_1532321188\automation.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping760_425209855\nav_config.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping760_275185906\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping760_1532321188\classification.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping760_149713434\keys.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MEMZ.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MEMZ.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wordpad.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134083047347034939"	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-836202210-2447721123-193472470-1000\{CB129AD1-AFEC-4939-9D76-B88F453B2686}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4612	MEMZ.exe
4612	MEMZ.exe
4612	MEMZ.exe
4612	MEMZ.exe
1500	MEMZ.exe
1500	MEMZ.exe
1780	MEMZ.exe
1780	MEMZ.exe
1500	MEMZ.exe
1500	MEMZ.exe
4612	MEMZ.exe
4612	MEMZ.exe
1664	MEMZ.exe
1664	MEMZ.exe
3948	MEMZ.exe
3948	MEMZ.exe
1664	MEMZ.exe
1664	MEMZ.exe
4612	MEMZ.exe
4612	MEMZ.exe
1500	MEMZ.exe
1500	MEMZ.exe
1780	MEMZ.exe
1780	MEMZ.exe
1780	MEMZ.exe
1780	MEMZ.exe
1500	MEMZ.exe
1500	MEMZ.exe
4612	MEMZ.exe
4612	MEMZ.exe
1664	MEMZ.exe
1664	MEMZ.exe
3948	MEMZ.exe
3948	MEMZ.exe
1500	MEMZ.exe
1500	MEMZ.exe
1780	MEMZ.exe
1780	MEMZ.exe
3948	MEMZ.exe
3948	MEMZ.exe
1664	MEMZ.exe
1664	MEMZ.exe
4612	MEMZ.exe
4612	MEMZ.exe
1664	MEMZ.exe
1664	MEMZ.exe
3948	MEMZ.exe
3948	MEMZ.exe
1780	MEMZ.exe
1780	MEMZ.exe
1500	MEMZ.exe
1500	MEMZ.exe
1500	MEMZ.exe
1780	MEMZ.exe
1780	MEMZ.exe
1500	MEMZ.exe
1664	MEMZ.exe
3948	MEMZ.exe
1664	MEMZ.exe
3948	MEMZ.exe
4612	MEMZ.exe
4612	MEMZ.exe
4612	MEMZ.exe
3948	MEMZ.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 33 IoCs

pid	Process
760	msedge.exe
760	msedge.exe
760	msedge.exe
760	msedge.exe
760	msedge.exe
760	msedge.exe
760	msedge.exe
760	msedge.exe
760	msedge.exe
760	msedge.exe
760	msedge.exe
760	msedge.exe
760	msedge.exe
760	msedge.exe
760	msedge.exe
760	msedge.exe
760	msedge.exe
760	msedge.exe
760	msedge.exe
760	msedge.exe
760	msedge.exe
760	msedge.exe
760	msedge.exe
760	msedge.exe
760	msedge.exe
760	msedge.exe
760	msedge.exe
760	msedge.exe
760	msedge.exe
760	msedge.exe
760	msedge.exe
760	msedge.exe
760	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	1192	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1192	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
760	msedge.exe
760	msedge.exe

Suspicious use of SetWindowsHookEx 12 IoCs

pid	Process
4916	MEMZ.exe
4916	MEMZ.exe
4916	MEMZ.exe
4916	MEMZ.exe
4916	MEMZ.exe
2196	wordpad.exe
2196	wordpad.exe
2196	wordpad.exe
2196	wordpad.exe
2196	wordpad.exe
2196	wordpad.exe
4916	MEMZ.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 404 wrote to memory of 3296	404	cmd.exe	87
PID 404 wrote to memory of 3296	404	cmd.exe	87
PID 404 wrote to memory of 3532	404	cmd.exe	89
PID 404 wrote to memory of 3532	404	cmd.exe	89
PID 404 wrote to memory of 3532	404	cmd.exe	89
PID 3532 wrote to memory of 4612	3532	MEMZ.exe	97
PID 3532 wrote to memory of 4612	3532	MEMZ.exe	97
PID 3532 wrote to memory of 4612	3532	MEMZ.exe	97
PID 3532 wrote to memory of 1500	3532	MEMZ.exe	98
PID 3532 wrote to memory of 1500	3532	MEMZ.exe	98
PID 3532 wrote to memory of 1500	3532	MEMZ.exe	98
PID 3532 wrote to memory of 3948	3532	MEMZ.exe	99
PID 3532 wrote to memory of 3948	3532	MEMZ.exe	99
PID 3532 wrote to memory of 3948	3532	MEMZ.exe	99
PID 3532 wrote to memory of 1664	3532	MEMZ.exe	100
PID 3532 wrote to memory of 1664	3532	MEMZ.exe	100
PID 3532 wrote to memory of 1664	3532	MEMZ.exe	100
PID 3532 wrote to memory of 1780	3532	MEMZ.exe	101
PID 3532 wrote to memory of 1780	3532	MEMZ.exe	101
PID 3532 wrote to memory of 1780	3532	MEMZ.exe	101
PID 3532 wrote to memory of 4916	3532	MEMZ.exe	102
PID 3532 wrote to memory of 4916	3532	MEMZ.exe	102
PID 3532 wrote to memory of 4916	3532	MEMZ.exe	102
PID 4916 wrote to memory of 2324	4916	MEMZ.exe	104
PID 4916 wrote to memory of 2324	4916	MEMZ.exe	104
PID 4916 wrote to memory of 2324	4916	MEMZ.exe	104
PID 4916 wrote to memory of 4220	4916	MEMZ.exe	107
PID 4916 wrote to memory of 4220	4916	MEMZ.exe	107
PID 4220 wrote to memory of 760	4220	msedge.exe	108
PID 4220 wrote to memory of 760	4220	msedge.exe	108
PID 760 wrote to memory of 672	760	msedge.exe	109
PID 760 wrote to memory of 672	760	msedge.exe	109
PID 760 wrote to memory of 1740	760	msedge.exe	110
PID 760 wrote to memory of 1740	760	msedge.exe	110
PID 760 wrote to memory of 4140	760	msedge.exe	111
PID 760 wrote to memory of 4140	760	msedge.exe	111
PID 760 wrote to memory of 4140	760	msedge.exe	111
PID 760 wrote to memory of 4140	760	msedge.exe	111
PID 760 wrote to memory of 4140	760	msedge.exe	111
PID 760 wrote to memory of 4140	760	msedge.exe	111
PID 760 wrote to memory of 4140	760	msedge.exe	111
PID 760 wrote to memory of 4140	760	msedge.exe	111
PID 760 wrote to memory of 4140	760	msedge.exe	111
PID 760 wrote to memory of 4140	760	msedge.exe	111
PID 760 wrote to memory of 4140	760	msedge.exe	111
PID 760 wrote to memory of 4140	760	msedge.exe	111
PID 760 wrote to memory of 4140	760	msedge.exe	111
PID 760 wrote to memory of 4140	760	msedge.exe	111
PID 760 wrote to memory of 4140	760	msedge.exe	111
PID 760 wrote to memory of 4140	760	msedge.exe	111
PID 760 wrote to memory of 4140	760	msedge.exe	111
PID 760 wrote to memory of 4140	760	msedge.exe	111
PID 760 wrote to memory of 4140	760	msedge.exe	111
PID 760 wrote to memory of 4140	760	msedge.exe	111
PID 760 wrote to memory of 4140	760	msedge.exe	111
PID 760 wrote to memory of 4140	760	msedge.exe	111
PID 760 wrote to memory of 4140	760	msedge.exe	111
PID 760 wrote to memory of 4140	760	msedge.exe	111
PID 760 wrote to memory of 4140	760	msedge.exe	111
PID 760 wrote to memory of 4140	760	msedge.exe	111
PID 760 wrote to memory of 4140	760	msedge.exe	111
PID 760 wrote to memory of 4140	760	msedge.exe	111
PID 760 wrote to memory of 4140	760	msedge.exe	111
PID 760 wrote to memory of 4140	760	msedge.exe	111

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Malware-1-master\MEMZ-Destructive.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:404
- C:\Windows\system32\cscript.exe
  cscript x.js
  2⤵
  PID:3296
- C:\Users\Admin\AppData\Roaming\MEMZ.exe
  "C:\Users\Admin\AppData\Roaming\MEMZ.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3532
- - C:\Users\Admin\AppData\Roaming\MEMZ.exe
    "C:\Users\Admin\AppData\Roaming\MEMZ.exe" /watchdog
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:4612
- - C:\Users\Admin\AppData\Roaming\MEMZ.exe
    "C:\Users\Admin\AppData\Roaming\MEMZ.exe" /watchdog
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:1500
- - C:\Users\Admin\AppData\Roaming\MEMZ.exe
    "C:\Users\Admin\AppData\Roaming\MEMZ.exe" /watchdog
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:3948
- - C:\Users\Admin\AppData\Roaming\MEMZ.exe
    "C:\Users\Admin\AppData\Roaming\MEMZ.exe" /watchdog
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:1664
- - C:\Users\Admin\AppData\Roaming\MEMZ.exe
    "C:\Users\Admin\AppData\Roaming\MEMZ.exe" /watchdog
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:1780
- - C:\Users\Admin\AppData\Roaming\MEMZ.exe
    "C:\Users\Admin\AppData\Roaming\MEMZ.exe" /main
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Writes to the Master Boot Record (MBR)
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4916
  - - C:\Windows\SysWOW64\notepad.exe
      "C:\Windows\System32\notepad.exe" \note.txt
      4⤵
      System Location Discovery: System Language Discovery
      PID:2324
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=john+cena+midi+legit+not+converted
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4220
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument http://google.co.ck/search?q=john+cena+midi+legit+not+converted
        5⤵
        Drops file in Program Files directory
        Checks processor information in registry
        Enumerates system info in registry
        Modifies data under HKEY_USERS
        Modifies registry class
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of FindShellTrayWindow
        Suspicious use of WriteProcessMemory
        
        PID:760
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ff972aff208,0x7ff972aff214,0x7ff972aff220
        6⤵
        
        PID:672
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1896,i,9782587223137096796,1777170606611709729,262144 --variations-seed-version --mojo-platform-channel-handle=2260 /prefetch:3
        6⤵
        
        PID:1740
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2236,i,9782587223137096796,1777170606611709729,262144 --variations-seed-version --mojo-platform-channel-handle=2232 /prefetch:2
        6⤵
        
        PID:4140
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2556,i,9782587223137096796,1777170606611709729,262144 --variations-seed-version --mojo-platform-channel-handle=2736 /prefetch:8
        6⤵
        
        PID:3732
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3568,i,9782587223137096796,1777170606611709729,262144 --variations-seed-version --mojo-platform-channel-handle=3576 /prefetch:1
        6⤵
        
        PID:4972
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3584,i,9782587223137096796,1777170606611709729,262144 --variations-seed-version --mojo-platform-channel-handle=3596 /prefetch:1
        6⤵
        
        PID:3556
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --field-trial-handle=4244,i,9782587223137096796,1777170606611709729,262144 --variations-seed-version --mojo-platform-channel-handle=4280 /prefetch:1
        6⤵
        
        PID:736
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --extension-process --renderer-sub-type=extension --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --field-trial-handle=4260,i,9782587223137096796,1777170606611709729,262144 --variations-seed-version --mojo-platform-channel-handle=4292 /prefetch:2
        6⤵
        
        PID:3484
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=5072,i,9782587223137096796,1777170606611709729,262144 --variations-seed-version --mojo-platform-channel-handle=5224 /prefetch:8
        6⤵
        
        PID:2204
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=5124,i,9782587223137096796,1777170606611709729,262144 --variations-seed-version --mojo-platform-channel-handle=5196 /prefetch:8
        6⤵
        
        PID:4124
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --string-annotations --always-read-main-dll --field-trial-handle=5104,i,9782587223137096796,1777170606611709729,262144 --variations-seed-version --mojo-platform-channel-handle=3724 /prefetch:8
        6⤵
        
        PID:884
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --string-annotations --always-read-main-dll --field-trial-handle=4228,i,9782587223137096796,1777170606611709729,262144 --variations-seed-version --mojo-platform-channel-handle=3684 /prefetch:8
        6⤵
        
        PID:4560
      - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=5864,i,9782587223137096796,1777170606611709729,262144 --variations-seed-version --mojo-platform-channel-handle=5916 /prefetch:8
        6⤵
        
        PID:2856
      - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=5864,i,9782587223137096796,1777170606611709729,262144 --variations-seed-version --mojo-platform-channel-handle=5916 /prefetch:8
        6⤵
        
        PID:4676
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=5992,i,9782587223137096796,1777170606611709729,262144 --variations-seed-version --mojo-platform-channel-handle=6036 /prefetch:8
        6⤵
        
        PID:1368
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=6184,i,9782587223137096796,1777170606611709729,262144 --variations-seed-version --mojo-platform-channel-handle=6044 /prefetch:8
        6⤵
        
        PID:5084
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --field-trial-handle=6192,i,9782587223137096796,1777170606611709729,262144 --variations-seed-version --mojo-platform-channel-handle=6204 /prefetch:1
        6⤵
        
        PID:4372
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=6164,i,9782587223137096796,1777170606611709729,262144 --variations-seed-version --mojo-platform-channel-handle=6140 /prefetch:8
        6⤵
        
        PID:2040
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=6476,i,9782587223137096796,1777170606611709729,262144 --variations-seed-version --mojo-platform-channel-handle=6488 /prefetch:8
        6⤵
        
        PID:1208
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=6640,i,9782587223137096796,1777170606611709729,262144 --variations-seed-version --mojo-platform-channel-handle=6636 /prefetch:8
        6⤵
        
        PID:1372
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=6800,i,9782587223137096796,1777170606611709729,262144 --variations-seed-version --mojo-platform-channel-handle=6812 /prefetch:8
        6⤵
        
        PID:1564
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=6972,i,9782587223137096796,1777170606611709729,262144 --variations-seed-version --mojo-platform-channel-handle=6644 /prefetch:8
        6⤵
        
        PID:4248
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=6796,i,9782587223137096796,1777170606611709729,262144 --variations-seed-version --mojo-platform-channel-handle=7116 /prefetch:8
        6⤵
        
        PID:1548
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --field-trial-handle=7140,i,9782587223137096796,1777170606611709729,262144 --variations-seed-version --mojo-platform-channel-handle=7304 /prefetch:1
        6⤵
        
        PID:2700
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --field-trial-handle=4596,i,9782587223137096796,1777170606611709729,262144 --variations-seed-version --mojo-platform-channel-handle=4268 /prefetch:1
        6⤵
        
        PID:4348
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --field-trial-handle=4332,i,9782587223137096796,1777170606611709729,262144 --variations-seed-version --mojo-platform-channel-handle=4560 /prefetch:1
        6⤵
        
        PID:3296
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --string-annotations --always-read-main-dll --field-trial-handle=560,i,9782587223137096796,1777170606611709729,262144 --variations-seed-version --mojo-platform-channel-handle=7400 /prefetch:8
        6⤵
        
        PID:920
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --string-annotations --always-read-main-dll --field-trial-handle=7336,i,9782587223137096796,1777170606611709729,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:8
        6⤵
        
        PID:116
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --string-annotations --always-read-main-dll --field-trial-handle=7352,i,9782587223137096796,1777170606611709729,262144 --variations-seed-version --mojo-platform-channel-handle=5964 /prefetch:8
        6⤵
        
        PID:3144
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --field-trial-handle=3452,i,9782587223137096796,1777170606611709729,262144 --variations-seed-version --mojo-platform-channel-handle=3740 /prefetch:1
        6⤵
        
        PID:2744
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --field-trial-handle=3200,i,9782587223137096796,1777170606611709729,262144 --variations-seed-version --mojo-platform-channel-handle=5960 /prefetch:1
        6⤵
        
        PID:2632
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --string-annotations --always-read-main-dll --field-trial-handle=6692,i,9782587223137096796,1777170606611709729,262144 --variations-seed-version --mojo-platform-channel-handle=3816 /prefetch:8
        6⤵
        
        PID:3784
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --always-read-main-dll --field-trial-handle=5872,i,9782587223137096796,1777170606611709729,262144 --variations-seed-version --mojo-platform-channel-handle=7296 /prefetch:1
        6⤵
        
        PID:3132
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --always-read-main-dll --field-trial-handle=5400,i,9782587223137096796,1777170606611709729,262144 --variations-seed-version --mojo-platform-channel-handle=5452 /prefetch:1
        6⤵
        
        PID:4364
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=7556,i,9782587223137096796,1777170606611709729,262144 --variations-seed-version --mojo-platform-channel-handle=2712 /prefetch:8
        6⤵
        
        PID:2288
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --always-read-main-dll --field-trial-handle=3636,i,9782587223137096796,1777170606611709729,262144 --variations-seed-version --mojo-platform-channel-handle=7244 /prefetch:1
        6⤵
        
        PID:2652
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --always-read-main-dll --field-trial-handle=6812,i,9782587223137096796,1777170606611709729,262144 --variations-seed-version --mojo-platform-channel-handle=6820 /prefetch:1
        6⤵
        
        PID:2004
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --always-read-main-dll --field-trial-handle=6288,i,9782587223137096796,1777170606611709729,262144 --variations-seed-version --mojo-platform-channel-handle=6436 /prefetch:1
        6⤵
        
        PID:2236
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=6228,i,9782587223137096796,1777170606611709729,262144 --variations-seed-version --mojo-platform-channel-handle=6904 /prefetch:8
        6⤵
        
        PID:1652
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --always-read-main-dll --field-trial-handle=3812,i,9782587223137096796,1777170606611709729,262144 --variations-seed-version --mojo-platform-channel-handle=6964 /prefetch:1
        6⤵
        
        PID:64
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --string-annotations --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=5368,i,9782587223137096796,1777170606611709729,262144 --variations-seed-version --mojo-platform-channel-handle=7472 /prefetch:8
        6⤵
        
        PID:2172
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --always-read-main-dll --field-trial-handle=7260,i,9782587223137096796,1777170606611709729,262144 --variations-seed-version --mojo-platform-channel-handle=5308 /prefetch:1
        6⤵
        
        PID:4776
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --always-read-main-dll --field-trial-handle=5820,i,9782587223137096796,1777170606611709729,262144 --variations-seed-version --mojo-platform-channel-handle=7500 /prefetch:1
        6⤵
        
        PID:2520
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=5552,i,9782587223137096796,1777170606611709729,262144 --variations-seed-version --mojo-platform-channel-handle=3440 /prefetch:8
        6⤵
        
        PID:3496
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --always-read-main-dll --field-trial-handle=3352,i,9782587223137096796,1777170606611709729,262144 --variations-seed-version --mojo-platform-channel-handle=6160 /prefetch:1
        6⤵
        
        PID:2128
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --always-read-main-dll --field-trial-handle=7112,i,9782587223137096796,1777170606611709729,262144 --variations-seed-version --mojo-platform-channel-handle=3440 /prefetch:1
        6⤵
        
        PID:3004
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=5892,i,9782587223137096796,1777170606611709729,262144 --variations-seed-version --mojo-platform-channel-handle=5196 /prefetch:8
        6⤵
        
        PID:4364
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --always-read-main-dll --field-trial-handle=6424,i,9782587223137096796,1777170606611709729,262144 --variations-seed-version --mojo-platform-channel-handle=6596 /prefetch:1
        6⤵
        
        PID:3164
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --always-read-main-dll --field-trial-handle=7496,i,9782587223137096796,1777170606611709729,262144 --variations-seed-version --mojo-platform-channel-handle=3732 /prefetch:1
        6⤵
        
        PID:800
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --string-annotations --always-read-main-dll --field-trial-handle=7300,i,9782587223137096796,1777170606611709729,262144 --variations-seed-version --mojo-platform-channel-handle=6128 /prefetch:8
        6⤵
        
        PID:4332
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --always-read-main-dll --field-trial-handle=6740,i,9782587223137096796,1777170606611709729,262144 --variations-seed-version --mojo-platform-channel-handle=6564 /prefetch:1
        6⤵
        
        PID:4816
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --always-read-main-dll --field-trial-handle=6080,i,9782587223137096796,1777170606611709729,262144 --variations-seed-version --mojo-platform-channel-handle=7704 /prefetch:1
        6⤵
        
        PID:3764
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=7216,i,9782587223137096796,1777170606611709729,262144 --variations-seed-version --mojo-platform-channel-handle=7628 /prefetch:8
        6⤵
        
        PID:2848
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --always-read-main-dll --field-trial-handle=3836,i,9782587223137096796,1777170606611709729,262144 --variations-seed-version --mojo-platform-channel-handle=6500 /prefetch:1
        6⤵
        
        PID:4408
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --always-read-main-dll --field-trial-handle=7628,i,9782587223137096796,1777170606611709729,262144 --variations-seed-version --mojo-platform-channel-handle=4240 /prefetch:1
        6⤵
        
        PID:1368
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=55 --always-read-main-dll --field-trial-handle=7728,i,9782587223137096796,1777170606611709729,262144 --variations-seed-version --mojo-platform-channel-handle=6548 /prefetch:1
        6⤵
        
        PID:4272
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=56 --always-read-main-dll --field-trial-handle=7972,i,9782587223137096796,1777170606611709729,262144 --variations-seed-version --mojo-platform-channel-handle=7992 /prefetch:1
        6⤵
        
        PID:992
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=7860,i,9782587223137096796,1777170606611709729,262144 --variations-seed-version --mojo-platform-channel-handle=6420 /prefetch:8
        6⤵
        
        PID:1368
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=58 --always-read-main-dll --field-trial-handle=5304,i,9782587223137096796,1777170606611709729,262144 --variations-seed-version --mojo-platform-channel-handle=6408 /prefetch:1
        6⤵
        
        PID:3776
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=59 --always-read-main-dll --field-trial-handle=8044,i,9782587223137096796,1777170606611709729,262144 --variations-seed-version --mojo-platform-channel-handle=8060 /prefetch:1
        6⤵
        
        PID:3024
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=60 --always-read-main-dll --field-trial-handle=7856,i,9782587223137096796,1777170606611709729,262144 --variations-seed-version --mojo-platform-channel-handle=7292 /prefetch:1
        6⤵
        
        PID:5732
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=61 --always-read-main-dll --field-trial-handle=8176,i,9782587223137096796,1777170606611709729,262144 --variations-seed-version --mojo-platform-channel-handle=8152 /prefetch:1
        6⤵
        
        PID:5756
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=8064,i,9782587223137096796,1777170606611709729,262144 --variations-seed-version --mojo-platform-channel-handle=7840 /prefetch:8
        6⤵
        
        PID:5980
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://softonic.com/
      4⤵
      PID:3504
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument http://softonic.com/
        5⤵
        
        PID:1372
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=minecraft+hax+download+no+virus
      4⤵
      PID:3764
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument http://google.co.ck/search?q=minecraft+hax+download+no+virus
        5⤵
        
        PID:2368
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=how+to+create+your+own+ransomware
      4⤵
      PID:4640
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument http://google.co.ck/search?q=how+to+create+your+own+ransomware
        5⤵
        
        PID:1936
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://play.clubpenguin.com/
      4⤵
      PID:444
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument http://play.clubpenguin.com/
        5⤵
        
        PID:4004
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=montage+parody+making+program+2016
      4⤵
      PID:4976
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument http://google.co.ck/search?q=montage+parody+making+program+2016
        5⤵
        
        PID:4800
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=virus+builder+legit+free+download
      4⤵
      PID:2424
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument http://google.co.ck/search?q=virus+builder+legit+free+download
        5⤵
        
        PID:872
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://softonic.com/
      4⤵
      PID:1652
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument http://softonic.com/
        5⤵
        
        PID:5112
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=montage+parody+making+program+2016
      4⤵
      PID:3116
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument http://google.co.ck/search?q=montage+parody+making+program+2016
        5⤵
        
        PID:920
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=is+illuminati+real
      4⤵
      PID:4912
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument http://google.co.ck/search?q=is+illuminati+real
        5⤵
        
        PID:1648
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=g3t+r3kt
      4⤵
      PID:312
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument http://google.co.ck/search?q=g3t+r3kt
        5⤵
        
        PID:2740
  - - C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe
      "C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2196
    - - C:\Windows\splwow64.exe
        
        C:\Windows\splwow64.exe 12288
        5⤵
        
        PID:4712
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=how+to+get+money
      4⤵
      PID:2428
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument http://google.co.ck/search?q=how+to+get+money
        5⤵
        
        PID:4532
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=g3t+r3kt
      4⤵
      PID:5696
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument http://google.co.ck/search?q=g3t+r3kt
        5⤵
        
        PID:5708

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:4360

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x410 0x3f8
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1192

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc
1⤵
PID:4796

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping760_1474875803\manifest.json
Size 160B
SHA256 2a7fe18a087d8e8be847d9569420b6e8907917ff6ca0fa42be15d4e3653c8747
MD5 a24a1941bbb8d90784f5ef76712002f5
SHA1 5c2b6323c7ed8913b5d0d65a4d21062c96df24eb
SHA512 fd7dfec3d46b2af0bddb5aaeae79467507e0c29bab814007a39ea61231e76123659f18a453ed3feb25f16652a0c63c33545e2a0d419fafea89f563fca6a07ce2
MD5 SHA1 SHA512

Submit Download

LICENSE

Path C:\Program Files\chrome_Unpacker_BeginUnzipping760_149713434\LICENSE
Size 1KB
SHA256 3dbd2c90050b652d63656481c3e5871c52261575292db77d4ea63419f187a55b
MD5 ee002cb9e51bb8dfa89640a406a1090a
SHA1 49ee3ad535947d8821ffdeb67ffc9bc37d1ebbb2
SHA512 d1fdcc436b8ca8c68d4dc7077f84f803a535bf2ce31d9eb5d0c466b62d6567b2c59974995060403ed757e92245db07e70c6bddbf1c3519fed300cc5b9bf9177c
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping760_149713434\manifest.json
Size 79B
SHA256 7c00a941d7a04048f469ffb986ff7e8bf349f149639cc474a463da4a607c0a70
MD5 0726a393d6366788cb47da5897d1af64
SHA1 022ebd4d118261b871d50479868d502b797e6d14
SHA512 adaaf0c40793c606d44fd7112b42040f01dd483a7c4c678e811f824e2fbad722ee3faf50984615731d71425eb3a1e4a9090962249e673fe8e7290713c8f75d9f
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping760_1532321188\manifest.json
Size 135B
SHA256 cb929ae2d466e597ecc4f588ba22faf68f7cfc204b3986819c85ac608d6f82b5
MD5 4055ba4ebd5546fb6306d6a3151a236a
SHA1 609a989f14f8ee9ed9bffbd6ddba3214fd0d0109
SHA512 58d39f7ae0dafd067c6dba34c686506c1718112ad5af8a255eb9a7d6ec0edca318b557565f5914c5140eb9d1b6e2ffbb08c9d596f43e7a79fdb4ef95457bf29a
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping760_275185906\manifest.json
Size 85B
SHA256 2d905d7b28b1afd313753d14f6a916a2e56ec4c1316bfa43046b09214ceb6090
MD5 8ce95626b39ebc2401eee0b34c24fc7c
SHA1 f97a2fefe756f7a03e388e1333573b884730c2b0
SHA512 f04e4f695977918adf6e0603386b6f9c75a4a2202b0fe7215b642f3db491a1db398039cc28633b8e2541749403581622d28c1400f3f8fc66a3daab200e27266d
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping760_325100806\manifest.json
Size 43B
SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
MD5 af3a9104ca46f35bb5f6123d89c25966
SHA1 1ffb1b0aa9f44bdbc57bdf4b98d26d3be0207ee8
SHA512 6a7a543fa2d1ead3574b4897d2fc714bb218c60a04a70a7e92ecfd2ea59d67028f91b6a2094313f606560087336c619093f1d38d66a3c63a1d1d235ca03d36d1
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping760_425209855\manifest.json
Size 160B
SHA256 31952875f8bb2e71f49231c95349945ffc0c1dd975f06309a0d138f002cfd23d
MD5 c3911ceb35539db42e5654bdd60ac956
SHA1 71be0751e5fc583b119730dbceb2c723f2389f6c
SHA512 d8b2c7c5b7105a6f0c4bc9c79c05b1202bc8deb90e60a037fec59429c04fc688a745ee1a0d06a8311466b4d14e2921dfb4476104432178c01df1e99deb48b331
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping760_891495816\manifest.json
Size 135B
SHA256 ba5c9096d20a482aaa1aa9e5f98ad6127d3e97c2f21de84f7c78d9b8073c8e26
MD5 fbebd68ecaa98928909421f66909c054
SHA1 99d787d90f7ed2e5ad924f9c5668eb988b5a6c07
SHA512 749a3b2be47fe28399dc763888654a3e8d397e06e8d3c3af3965bb45846a1336e6ab4ca82c82c3df846b34a2afafa2156f2690e9bf347ab175408dc0171c61cc
MD5 SHA1 SHA512

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 4387fffe30d53483d642a61eedc64f0d7b74a8ed9b252e335a579e083b5745d6
MD5 de9d71b7760178a9a44eaa0466f6e89f
SHA1 326a9d78956a1e7316fa83cd4c207b08f7f3e5a3
SHA512 46c2da2dfa4152c2adfd298f843562e3eba2a38088cb09203a4df55c344f9bf91b955c0f27ce104aa268fa136c98476da20a1e1274279693572f485bd212e44d
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P76:fwUQC5VwBIiElEd2K57P76
MD5 SHA1 SHA512 SSDEEP

Submit Download

protocols.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent\1.0.0.10\protocols.json
Size 3KB
SHA256 4fd800e7b1a5fb24b13fac2e31946d205012b7c28d8c61580b0669b2fa3517cc
MD5 1de85fec2dfcc28011a7c2aaab95eb5f
SHA1 80e8c954bfbe8f7ee5a2335c8d969ae033935dc3
SHA512 9c7dd37eb0c094b6aa05201e7c71a8f33b9db81284223bcfa595a44a6ac95d5a6820ab6f07b7aa8d26bf207454e94277bf35332e9c009ee63f083752b6b51750
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 40115dfe720d3bb8e581a8ccaf95688143f230acd2bf5de2149ae47aa65fd1aa
MD5 cebebd9dbec7d32a38b1cfcb7f9f4d74
SHA1 0437d43ec2dca4ba69c81eb4d456fdbceee67ffe
SHA512 ff7f56ba7f1eb75d079fce92fa17d9dc6f4762ad87ad4620eb1eac33c5ce83ba90f1d911c84f834c8325542b7310c3b2a079094c25e374e0e73f913277cd48cf
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 9ff050d9f35ba5a2135e4789d2ae351f563c8df465371b56cd7fdc3435b02de2
MD5 c1d43c01160489fa39d9ae018b94186e
SHA1 07617b506e973b0c2bdc39915b15117dc9753963
SHA512 aa03c85961f998b4a2f44bd992ff67388e384a45839005665cfe0336f547dcdab544ccfda940553da96729e43d4790c5c33882323c7407878fd79e28463f8ad0
MD5 SHA1 SHA512

Submit Download

f_000089

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000089
Size 346KB
SHA256 b723265edf984e7400a825fa97d834987239c1a64de099abd8699a629ad74239
MD5 3d0af77ac533dfbc4fd2402f7a39df46
SHA1 8ea15d41c2b2d11f21ce56b17a861e748476a7ba
SHA512 a728321915bbcca93468114b695b8a8edcc44809855513de0ada05a824e0635fba46aef49762ff8fbf61ed8a638e021ca17b3a515fecb80838a1e58ab2536234
SSDEEP 6144:VdB+B5F9JzBGjGlTtGDQLkmm2Td4y2UZscV/bdf60QNZKmJhpDH4T1lNzuYm:tS6kTtGDsZ4VKRFbVDOImfpD01lNzuYm
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000097

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000097
Size 51KB
SHA256 57147f08949ababe7deef611435ae418475a693e3823769a25c2a39b6ead9ccc
MD5 f61f0d4d0f968d5bba39a84c76277e1a
SHA1 aa3693ea140eca418b4b2a30f6a68f6f43b4beb2
SHA512 6c3bd90f709bcf9151c9ed9ffea55c4f6883e7fda2a4e26bf018c83fe1cfbe4f4aa0db080d6d024070d53b2257472c399c8ac44eefd38b9445640efa85d5c487
SSDEEP 1536:1rvqtK8DZilXxwJ8mMwAZy7phqsFLdG3B4d:xytBZits8bw4wzbFxG3B4d
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000099

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000099
Size 438KB
SHA256 ae2e57f109c828b6b461e88cbfbca07593f4d141efeb69dcde8d4153e838b6ef
MD5 df92d1ffff9bf107cc5ffa1419f77614
SHA1 b385dbee9b8d0a66c934c9e3eeadee1ddbba3310
SHA512 2b1d3aecba1f21a4b0975922fc8ca33ae9ac71abcd645b26f1de01bd7f37c3dccf742ce76b9e08e817ad3fbbc06824c9aadb29b25a84063b5d250509ab8c2833
SSDEEP 6144:n1m7CgMogujF962NIXJfGxUOJsEy8Vg0zfM5yznh6AP9pENlC7Ux7TNvC8:4796vf8dzk5G6CqNRxVv
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_00009a

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00009a
Size 77KB
SHA256 a81a49ec43eac2d8e81636e4ad2054fe483197673caddf664b8e261a923e26f9
MD5 6e480bef790dc6fd86b55a4fb87ff461
SHA1 d7db643fc3179bb74f016e2e1615cd32ac16c5e1
SHA512 df4ad5089790bd662956a0fdad4f98c93614f6aec60a0c260783fbd17945238b803e71a82ea0af27753d722965f57e715cda14eb573692a9aa2c5c92bf0da8b8
SSDEEP 1536:988y8AoSl3PgeoNpHiOkpzguJ4XKeqc4tQD8uRnVoL3a8e6GZxM1s:NAog3PDom1zguSK9cH8kng3a8zGis
MD5 SHA1 SHA512 SSDEEP

Submit Download

02626f7a028b854c_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\02626f7a028b854c_0
Size 354B
SHA256 7fb1bd51ef756cb03d24a73b73640b5e115260d690ec9a3d587e7c9c758c6efc
MD5 256275188fca0ceaf9da2deee8133112
SHA1 3446886fc7d99efdc33e34b7488797ee413a1ebe
SHA512 e9fb13c04b138ab41d37a455a393f53e1b6c46565e8af5d4657b70200dae9fae316e05175a7d6fdc2f3d8389f78864006c2329ad84912ae85e7a44489a646687
MD5 SHA1 SHA512

Submit Download

e9c57c9f63a51789_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\e9c57c9f63a51789_0
Size 312KB
SHA256 daa0e44ece090a83853582fef1b159863b75b778aad3bed56a6af1282df1d53f
MD5 70cb83169bfd441ab2be94fda866d1b2
SHA1 2874361746246fde75dd706fa271e84323e8f96a
SHA512 07cdcae19f3ec832c2a1be1f3a97e3053f06beef6b3395b5e0eb22a8fa317677ea072dd6f6579f50d50b7fe881513fc71610816a70ab98028d6a0680b345d29f
SSDEEP 3072:1mWGxWlKRD1aLKpgyV69ztefSJXvtj9QnqXZdlHHzSodwcww1d1XvqqS/MXbYynM:MVgyDgyV6/JgcNocww1d1LXbY0s
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 6adc25ba6cdcb2f7242d8b88c9182c2be116c8b486ca5792690b8641449a8cb2
MD5 163b9d44b31ac9e494162c860f059a13
SHA1 f520947a1c7df984a818ac72efa4199a1f229db3
SHA512 723a5bd6f9a4d94d3a5ff6ae7477a18e5919a918c843bea63c282e09fc5540f434af3f95b996385a6fd6f8d8dc1e265234fe217f67b86bcf05dcc5145d2be8c3
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 82c4c3bedf170a393c4f612306615808272bb5930590e68fd68b3a6814cfb0ab
MD5 dcefc8e2ab02dba54e895e09fcb3ad7c
SHA1 503a4bad4b0a6c64d54d51a3e774f63954cb3c9d
SHA512 43108af93ff6bd796b24321bef8e83b40e516c5163c92bf2799578457458cc18fdbe9ee8c63df13838a98ddefb1555b9bbab5e43cd3ad5dd33ea9f7decb4ddf3
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 e13f39cbcbcb60df90b5d76bda442afb4ac5f6ca920eccdfd57b13ff284d6f26
MD5 6c2713e7e3b055b4633c342336ff3cd2
SHA1 10e37e9d5a6462c4ef78e0ab73a82541e4f4f12d
SHA512 71f365ef4b9f648df1ac967ceefb9e7a457d6188ae36b4da1960f7071ac1d0e6885690db1595babbf5263f68f1a9c52f91f4e9e03303b9eba23b0d686675576c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 7b61ec55535ca9a7814eb2504eea8b2fab6b808eeb15e64578b9fe5d145a3413
MD5 3feaff729d4445e82c48b4726817e552
SHA1 279959a9aaa91cf9ee4ea5cb57677ec20ba16057
SHA512 895ee4f1c736cdd68709b50ab8a828cbb52eb0334151ec2be698973295d8e858b24df5592fdbfc92b0ca841d0067394c9ee2a5b00fde80d4b47b98d9e3e8d789
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 2d43974f839418cdf1fd68ba5351f2260998440c99dadfa4d3ee971c6f3d2394
MD5 8601ab940dbc4c7e04c99722a8032c9d
SHA1 5e90d621b4df5a8a1cda683f1c2baa75bb3a7a78
SHA512 fce85e0b18a593a6426725c8c9ec883c04b155e3017435ac545067597f0d3d36e77ccd3050936749cd10aeae05bbfe66afa45acc7c97546976255b62df9f594e
MD5 SHA1 SHA512

Submit Download

the-real-index~RFe596df3.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe596df3.TMP
Size 3KB
SHA256 97b93e6d34234249e0b71644568f38cb0abe42b09108bdf458e57609997eaea9
MD5 ea1c9c0188ccf029ff90e5fc1b4f27dc
SHA1 2bbd1ce9afac7db1ebf407b44969ba550da73bfc
SHA512 39791ad1b7585e7a8cefafe174d6c621ac053dad3ecbbfc5c8cb00eb19db971814c373df49006e5111cca3ab8565b88df9ae7032d33db77fac8e9cfea6c174fc
MD5 SHA1 SHA512

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 69KB
SHA256 b305e470fb9f8b69a8cd53b5a8ffb88538c9f6a9c7c2c194a226e8f6c9b53c17
MD5 164a788f50529fc93a6077e50675c617
SHA1 c53f6cd0531fd98d6abbd2a9e5fbb4319b221f48
SHA512 ec7d173b55283f3e59a468a0037921dc4e1bf3fab1c693330b9d8e5826273c917b374c4b802f3234bbb5e5e210d55e52351426867e0eb8c9f6fba1a053cb05d4
SSDEEP 1536:hAlMWz7vLDtDSVlXXwpFlorgLUxF+i2IFXaH5EoVDRnaXW:hvuWAUxFhFpoaXW
MD5 SHA1 SHA512 SSDEEP

Submit Download

content.js

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_1\content.js
Size 9KB
SHA256 0d40a5153cb66b5bde64906ca3ae750494098f68ad0b4d091256939eea243643
MD5 3d20584f7f6c8eac79e17cca4207fb79
SHA1 3c16dcc27ae52431c8cdd92fbaab0341524d3092
SHA512 315d1b4cc2e70c72d7eb7d51e0f304f6e64ac13ae301fd2e46d585243a6c936b2ad35a0964745d291ae9b317c316a29760b9b9782c88cc6a68599db531f87d59
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
MD5 SHA1 SHA512 SSDEEP

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 108KB
SHA256 a5f47979e3d9dc7c49694d8e9e4dd8e98b45470f93161940daff0b96bfc84a91
MD5 3692b82273b09514a7212381ba0e0098
SHA1 5abf2cbf0bfd404c62a99944e2653830865eb23b
SHA512 d3611f1b0d1c4740eef4bb7d25dffc69de0afabb5f62164acb0d7e947175822cffdadfd607249028c6c6f9f39486e0e7dec0368f225793245ee820f59dcac4d7
SSDEEP 1536:IJcH74ohBGZqW3iPPDuVvpBI/S8tZsA62UYPq:PHSRiPjU1
MD5 SHA1 SHA512 SSDEEP

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 9KB
SHA256 6af8461c68a7962a1e1ee7cb25c401d66e460e53b62a7a11926886a869096fd5
MD5 60315f00f1a661221c7faaf461bb8c0e
SHA1 d48094acca11e9090946497c770e8ffd8e54d81c
SHA512 b166d633076cf51dbb7235fb4b1119042fafc9ed7aa37ca22e2b2903b4f77c566ca1fbf18dcbf5f86851554883b28ac4fe68616cdfab5dc5c092cb4aa8841bb0
SSDEEP 192:Dsip66CSVpo+epKxpSzl2rDwgjRlXtOuMjk1M+EUAj63oTCOSiwG:Dsip66CSVpo+epKxpSzl2rDwgjRlXtOr
MD5 SHA1 SHA512 SSDEEP

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 9KB
SHA256 9251cb3fde1e6a43dd16361e6dfa8603ba911a4b387cc91effe25631c9365a67
MD5 dd2b6f89f3625fe67c4e5ec67549d716
SHA1 1ccae6c4b77676e7cba4ef483ea952ff87cf107b
SHA512 97eee1f86003c8bf06ef91f325e4f0a364f41a3f69fda436a16afa909a3789f848051e10ea6d506ab545269d6b2930af8d1b7e7f002d0c51dcc3275177f858c4
SSDEEP 192:Dsip66CSVpo+epKxJzl2j6xArDwgAjs3VvzeM+E3lwbVECkmG:Dsip66CSVpo+epKxJzl2GxArDwgAjs33
MD5 SHA1 SHA512 SSDEEP

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 9KB
SHA256 f4d28b666c34c4099bee38d8ca65519e835bf816490b1ac4516dd068d6ba6913
MD5 b865b1c19dc12d8fb4957d6924e45d50
SHA1 c72eb82a765a2a4d5cbb8d3f4a1b39670dc57feb
SHA512 89cc7077fe783b1900cf33d735e1dd8be6aa005fc49fa106f02c1f70ca6a3d191080d430fd519a630d8fefef36a85689572b44b4d629c7edc07fb445dda53511
SSDEEP 192:Dsip66CSVpo+epKxJzl2j6xrDwgjs3VvzeM+E3D/8XIo4MIao1zG:Dsip66CSVpo+epKxJzl2GxrDwgjs3Vva
MD5 SHA1 SHA512 SSDEEP

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 9422ddee2bd7278e59587fc06d16882d141b89cca52d0f2b8ae813bdfe5bf51d
MD5 1650e321f1df1c70aea15ba8403c5558
SHA1 e3ac9ccab814edc04f8550dc284f80cea998e139
SHA512 90522ed9ec0c3a886e48b8d43439b7de0a65fb41156539ce7a33b12124eabbe9ce2a365280d5391d6f9d32a4b566589abd12946d850155cacba12da3db5f7b92
SSDEEP 192:sVMR9yMh/K1Ml8MgisQWvd5pjjUNGruYwDIZ8pTMECHY+WNfLECVtywYVeHFdrIh:sVMRIisQWl5p/r2DCHSfACOwyCEh
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 0e75f3652e122238fe08e89666937f5ac56450a8c1df9abaa95b2c556017e257
MD5 8adcbbc306440110745ab6422503d458
SHA1 ec2ea8dce0e8c05b2ee21b4c117649bfedb30c91
SHA512 a431f7576ea256fe2264d2c77ed7960c10e0b9201d822563a59e2eb5a924ccf8aea75e648b6834d43a9ef44ef74b2a5742f5618e3bfa9bef1914fe948b13fdd0
SSDEEP 192:sVjR9yMh/K1Ml8MgisQWvd5DjjUNGruVwDIZ8pTME65HY+WNfLECXS+Ztyw30ALv:sVjRIisQWl5D/r3DIHSfACHyw5bEC
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 5e9b854465167c6e436a890b30db197ce980865c025eef256faa638865a9c56d
MD5 c2b0752aaf4f397804f694792975c52b
SHA1 444cfc4303725e30f727fbdca5f71107489c4046
SHA512 db95340ad4ac256e7e10449366bce40add844d6d1c32cb3cc79a60a93becfefd982ce7c27f26bc60f129d9d4ce7393ecc46bc91f239b8d5551edd18d0bb0a302
SSDEEP 384:sVjRqCisQWl5D/rINDhHofACR43ohJDEa6:sB4ChD/krHofACT56
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 55d234ae24de4d5ef8c6a8eb8dc9649b893f8b94ee4b53b74e9d052f0f677a05
MD5 d90d7c238fe41a1f3b822960dd246fc9
SHA1 27cb83642d0aaa4833ffe1de3b3145e8360ec7a4
SHA512 d0e1fef882ef46ecfeba3c0232893c2c506b6d8bfffb363d06a14e23563112009f317f77a9052e8cf3f61fe22e88b6e1f8f3517f57a82269497eebba3e158ea1
SSDEEP 384:sVMRqCisQWl5D/rIPDeHofACRo728JQEa6:si4ChD/kKHofACTX6
MD5 SHA1 SHA512 SSDEEP

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 35KB
SHA256 9a34915ff8890a3450e8d9732a2f4c226f309d7a0185bf64c357405d76c83c73
MD5 7bb05ed8211d3b24648c8d921fff235b
SHA1 8d4fc37b2603e31c404996c52e06257df3ceaf5a
SHA512 37ceda136e4810750ed68ee8896a1a843a9074ca24191cc0f37659999d0398b0ec81cd9d2c976414de88dcf2e8464c76415a29a8037fdb99972c89a6ab4af8eb
SSDEEP 768:AoRKEIwv7pLuLZfFWFlj1z8F1+UoAYDCx9Tuqh0VfUC9xbog/OVxauuYLlmg9aj8:AoRKEIwpEZfFWFlj1zu1ja+auuYL4saI
MD5 SHA1 SHA512 SSDEEP

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 4e65434e0c25b4870d3cea2f5a4d0717913583017d85486bd7357832a0561f21
MD5 19ed747d109caf99b4be69688cac2be1
SHA1 eccf4cba3c32b091d5a0e8b714c3686f21d48b0b
SHA512 554417487dc5b0fd6bbd7c4e873ec709c68e802fe364d43b6e0eca113017468f770d58c4ba151494251f503fae64bbd7b651e610abe391bf90317dd1ba4b7629
SSDEEP 48:ddK8iyd2Kt0fKuoyxlKkhemeLe6e2e8eH:ddKz22KCfK/SlKy
MD5 SHA1 SHA512 SSDEEP

Submit Download

CloudConfigLog

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog
Size 24KB
SHA256 cb0d1e5dabcfe82e06f5365288f216fe1e6c0b8d65fc23e29e32824481015b33
MD5 7faf3483acff70d1170bab15eaa89d43
SHA1 775fb3df055dddc07a84df956049401d05dbb8ba
SHA512 41229c384b841591b7a327e6cf33cdc3bfdba352fe741021f3a9a154ec2006b571e8f7d222cd7662735bc4259aae3540707eb10a1fa4ded0d69ea550582cb890
SSDEEP 768:OJOk/FY7/2lagbCtCkQ7wDlH/h+umbA6BQpGMgSVlkium1z4tfLTvq/uIvqpgRv/:OJOk/iSlagbCtCkQ8DlH/jmbA6BQpGM7
MD5 SHA1 SHA512 SSDEEP

Submit Download

CloudConfigLog

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog
Size 880B
SHA256 d5f127135a9baecee9748b6861384233b4d367abd3b06b0aa6d95908e0291c90
MD5 5993956a3cdf37ca9995ba2a1715c6d6
SHA1 418c1ce705ea0c019108fa3c62f4386290ee3d4e
SHA512 8ac17c9bd13897b97fb858fcbdc550d8236e01a679e65be0ed7524b2c9e90887f9964496765963c6636fbea1b77bc3d6fa6d4a22f9eacf6f5a036c344d7d3847
MD5 SHA1 SHA512

Submit Download

CloudConfigLog~RFe598b6d.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog~RFe598b6d.TMP
Size 469B
SHA256 3b6a226586052ead225e08d49ef8cde46dc739e91183bd6cb033d5c25120f16e
MD5 219d9c2d506530938adeebf48be28dee
SHA1 ae80b666a05acc75d28f7aaf4db3ef7906ce712d
SHA512 d006cf62053692031d8bd6101b30a7e3b1ebde18128ac943c871bd6101270d8d352170d77a8b8d5c6ef70ea8430773ca5b3bfea297a64626c51e238ca4598407
MD5 SHA1 SHA512

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

OperationConfig~RFe598c19.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe598c19.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
MD5 SHA1 SHA512

Submit Download

office_endpoints_list.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Data Protection Lists\2.0.0.0\office_endpoints_list.json
Size 3KB
SHA256 8480f3d58faa017896ba8239f3395e3551325d7a6466497a9a69bf182647b25e
MD5 94406cdd51b55c0f006cfea05745effb
SHA1 a15dc50ca0fd54d6f54fbc6e0788f6dcfc876cc9
SHA512 d4e621f57454fea7049cffc9cc3adfb0d8016360912e6a580f6fe16677e7dd7aa2ee0671cb3c5092a9435708a817f497c3b2cc7aba237d32dbdaae82f10591c3
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 1628419ff8edc1a4723bf161974ec1129cb818ac5fd4645190d1e7350ffc0295
MD5 b17ad8a8e177eef7be52f515e9eb8a59
SHA1 eae53cc21ee6c6e2d61413c57c8105e19936cbdc
SHA512 aafefc9b05e282b10daf9f677ade34bc7e61b8d2315db15efd216957979f3cad1c01dba6796c0124fe6e1134f5e79e578a99268280e7e25461973bb96caefe9c
SSDEEP 384:n8feJzfbqZkSJLdjqiFDwdWqANsNbVXhRDJsyJgeQJvBGEVp16wka:4YfJSJLdOuDwLANGNJ/JgrJvBB0wx
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 f9206cd9c700dd5d1f6a773ef61d56e04cba4330dc132a006ca77f7ab1e5b0ce
MD5 f174f5f63ebe52ee6de7918e9c1f3096
SHA1 113c5500484b27c02c9241e988c2eb5863a233a6
SHA512 1457a849888e5b573b1399e0c188c56ac5486b14c0587783c84a677bf476b425aec93fb122d72c75ecaa2b92f3bf9aa99afdc81dad3e6bd0f2d812aa376ca6ca
SSDEEP 768:TFOYfJSJLdOuDwLArnCgcObJ/JgrJYBB0wx:QYfEhOuPXxagT
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 b2dd6cb18b6ef29a68e325bb08e32e1ee5823137d7dcd122314086ed9c0d712b
MD5 0d0b1727a01361aac4223dadcb372b9d
SHA1 f0b0c5d9af8b38a94903c0978d7f8f73cf187660
SHA512 57368a11d061b9c0d459439dcc027e56d833645201670df18498931ae845f0606513ca372efbe0424fdd42b06b76b1ebabfd00a152a40ad4e610446548993ac3
SSDEEP 768:TFXYfJSJLdOuDwLAMnCgbdbJ/JgrJYBB0wx:NYfEhOuArxagT
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 af064b64b84a33dd1b54718f811e25b53d6d4e0d0d3b92ce5c0845aa0f3bb998
MD5 6622be446cccaa3b046f2783688d811d
SHA1 b45317ebffe063068bc5513797c0b2743113d45f
SHA512 c9af92e095e3341b10fd2a50fbcb597967c0e1604cadca9ee9fb1fbb09cd39d07f1202030c8f850805661d0b06f8bdeab7bf52a3a11ed457fea9fb32d0d3fb17
SSDEEP 768:TFlYfJSJLdOuDwLAenCgznbJ/JgrJYBB0wx:jYfEhOuKFxagT
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 cf0fcb0a42a4d1ac4031f540c2aac267fc3fccf11981ee73dbf90b6574bb10d4
MD5 b13e7bd759ce3130d1288e8ca99c8ca4
SHA1 1cd629814aaa142d47ddc7d0136e41db3c95c335
SHA512 c58915902201036c1c62c3ab6be6f8b35d0fa930d319dadc9c0dd046d268701d6152de18b9a2f4c0c393199668900fad312557ed18abf0608fb3db2a1fd1dcde
SSDEEP 768:TFaYfJSJLdOuDwLAHnCgKCbJ/JgrJYBB0wx:cYfEhOubpxagT
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 95e5bcf96c50b5ccc51ffa35177aff14bae2161f1de754d7884d41fc952529df
MD5 8de9717ac307a629eac559a365eddf71
SHA1 bda59fc91b44633b091256e4cadd1318a34a9250
SHA512 3838fc405ea9cefc0749cad2ef5458a81690743ac25343f45e8e8bf2e6a0be990c46bc213c1176cb65de1722cefe88b6c206cd11fce6c121dd73c63563e35603
SSDEEP 384:nSfeJzfbqZkSJLdjqiFDwdWqANsNbqyka2DJsyJgeQJvBGEVp16wka:uYfJSJLdOuDwLANHaGJ/JgrJvBB0wx
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 ce131e1db78c98a8241b197a526d75b8642cd27a9bd344abed4d74237b06b702
MD5 aaaffab89808230f117849b800df8cde
SHA1 7545dcea73c9526aa77a15a479b73d13725db421
SHA512 1d6e98a8f8b0e6b53c86250eb033411b3d386c6d1008156408003f8f2f10957597f7fad5d2d9afc6052dbd71776a8e2018e27b28e214e2a9584b4753402338a0
SSDEEP 192:5ONbyoPWiRUy2Pj43JsTuJgeQJbmozfpGnOUO:5ONbyaMjOJsyJgeQJPBUO
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 7KB
SHA256 43fdd7e1283819eaba71ce9b10a931ec3711f4d684e54c9ba606e625ad7bee2d
MD5 ce88ff37c1ab8d9fda78ebd05dce54b3
SHA1 38adf22daacb38e0010271a6816faab2ba604bba
SHA512 4eb9e62d6b984401ebc94e8b35d498ec06dbbbfe2716714567c9a2a61fee24b3ea24d7874823d7f91f893efdc444feaaf565f6a0ddc1f8e7ced93363462e78a2
SSDEEP 192:UONbyo9WiRUy/PD43JsTuJgewHkpgQSUO:UONbysBDOJsyJgehDSUO
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 29KB
SHA256 b0e4edd53170cbbe3435918cb5d0c9f45cc0c59373d29a938c7a63d2f43ba13f
MD5 5d20617de3c27696d71a493fb437a056
SHA1 74735238780f02559b5a8854058fca459b987816
SHA512 4c9fbf581f4309d455ef2aad76342cf9791b97a46ebeed585a3cdb3b5df916026a27a744dc4b2332d29c0fcd2ff748a0d7e96eb18c520ea5d832fe7d5e821b11
SSDEEP 768:TFhYfJSJLdOuDwLA/CCgJcbJ/JgrJYBB0wx:DYfEhOurTxagT
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 335887c1b6d39bd8eba0416d247a4e220c4f44847521f51603637b73f150f6f0
MD5 72f28ca9f78915e47dd38971dac808ea
SHA1 6f61b1a2d14878ad0bd019ac7d19c264d8a7949d
SHA512 d4bf764b2fa57b7e039f62a4054095399634f16f8f37d74d78af1183dfb80f6ca2728de225b4a9a579ad99ed837005ecab5e9a4be4a20b0bcacf0bb1fbbfe3ae
SSDEEP 768:TF/YfJSJLdOuDwLAjnCgZtbJ/JgrJYBB0wx:1YfEhOu3NxagT
MD5 SHA1 SHA512 SSDEEP

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 1c6193e949d3a055352e08eea1855f534ceaae064ec1785668a7fc07b827a06a
MD5 79e77bb724e3ae3d89c188e89462bfde
SHA1 521bf308e791781d73a487b8df20769639d9c45e
SHA512 067f3cf42b3aea9e81bb02a4e76d5de8baf975768dbde93cd8220fb12e4231927e12902c22ed55a4fe8e151eeef17e9d84e4ad19dd3f9334c3d8f23fe0e643a3
MD5 SHA1 SHA512

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 90163ec822adb6861214ed53f41a848c0d0f76b34680adbf15b47826c9622fbb
MD5 073ba9d55a75a73ca4ccd660f135e490
SHA1 dbab5eaa8c3e4a15e4f109fff8c3fc48fbe62cc2
SHA512 5fd2c8791bc41c4a4a469866ae48128fe9068cb15fe2533d9aaca361f1acf29bffd4992621ecfb82e4c4daf596976a90ca8ddb1f72a8867e455585e00a2f4f97
MD5 SHA1 SHA512

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 d530157633f0fdfa549c6f852cd82daeaf1375a2bb5b9ab4d6b5289cad07fa60
MD5 4521bb28c7a657b2e32697c8f4cd6429
SHA1 3ac0ae283310369b92f8d80923490810c74dab4d
SHA512 6cce4609e1f5c4c21695a774d1b44f301717c3823fc1bc3816a2ef8a8148759cd767921562018ed37bc852128656d48eabd814a8dc86655a43593e11c5ed84ba
MD5 SHA1 SHA512

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 1d17bec3958a9458a52f6083105f4bfe60d22130885280b3adb8a556260b6521
MD5 2136170b7d0e33fe990d183d8a1bb4fc
SHA1 b924eb13143fd22639537c357d556d8159d3c545
SHA512 9ec0d9a5c1bbda7c6b5e92ad05c75a0f13c32530307c2418271fd5b760eca462f39b63f8b585f885323aebb229414757483a2d35645e117038635ba75f8c895a
MD5 SHA1 SHA512

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 8fc37a9e9e534fd72248dd70e6a236b3c8d6dbccbf9a90225b025dfb671266b7
MD5 5b94470b6002110a63b2e336fe020f2e
SHA1 729862e7e2158ef3cdb373fc875188e26a1879f3
SHA512 93578e87bf7c2072293b4c66acb7ba2909106c160bc07539a5f8b77f731fa99292619bd7067d5baf558fa14dcadb4e671ce0745974982e569d2f79493cff3b9f
MD5 SHA1 SHA512

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 23a2592c91403d01e846aa5bfa80cb28e2126083f10c3aae8f3cdab7da7d2d2d
MD5 8a830d537e94c6110b9e9343741335f7
SHA1 6f6ffffac8bd8535398d7a0d66c03fb5d7cfbdc4
SHA512 4385855cdbb0b2e8f8033f93b07a905b49f58378d220edcea6d73a6d9a64b07decad1abd144e2096599c24f8d471dd1a5938ff63e81f2fba7272b19832db03e4
MD5 SHA1 SHA512

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 f09d9a50c12bb8415bfa117aed8b269cb6e42b10ce78286cad1cef32f7a29a72
MD5 13229ae2ff0c1d6d5a010d134ecbc40a
SHA1 65f262c2e9c5ad36711c30e4cd828915f432f4cd
SHA512 6c3c8a7cb11cd1dfda3bf2cd69c754a8959e1ef7123474356e1dd21a16404d34e81eb78bc1dc59f16e28a50afd88523190bbc676b15f3058be8c6934a8029304
MD5 SHA1 SHA512

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 eb229c9b15849a8f7c9ba79c48ccf633cbc7d8cf179b688f9bdd242bdb354897
MD5 0e021978cfd53b8d8b216c3b0e496609
SHA1 b83b621e0b4e00ef4145b1e7cfcc5bbfdca230a8
SHA512 11e2b0dd9c082415632174fd9d2534cf51e5721a24b5bd210b4612bb09bcfecf2dcd9ee26b1f99738e11fa3d295f66b3c48016e4c51a6f9c84de0f371266d090
MD5 SHA1 SHA512

Submit Download

RevisitationBloomfilter~RFe597d64.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe597d64.TMP
Size 392B
SHA256 daf7b83d9f559b1e4bda2507c231639d30377b24aa424a8e2296f89c65114655
MD5 ec45f482da21769e68e76ab9fc205d8a
SHA1 8c80979c4597cb6fff4c2a8fb57ba926fd4bfd9f
SHA512 1f98a7263fa6c0713f214e7bc07b6aa449c7232fa6cd408fd8299e622d1e4aa221f3402f5d87bafc204844b5ff0120f4e101df162b9a583b27f34161eab6100c
MD5 SHA1 SHA512

Submit Download

keys.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\TrustTokenKeyCommitments\2025.9.29.1\keys.json
Size 8KB
SHA256 e5b57a8978e405e9487c43e6b0b3685c4c71cdaa2e74e25d7fbed75ffaea01b2
MD5 80068ae175438916aff814972b76e6f6
SHA1 39336911d02ae3c5b038aa31c73c4757dcfadab6
SHA512 7cd55dc8c37fbaf9675d08fd2346ee45721338e1e70cf6aa351e54b45630ada5ada1243d738742cbda258c830e25ee8e09f57fc3cf21948e62c3c552ba9cd18d
SSDEEP 192:uNtGbRmmhGfHPJyR9Pm4lOvMwkoR9PuGMXcy:Ohm+0KjA
MD5 SHA1 SHA512 SSDEEP

Submit Download

nav_config.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\WorkspacesNavigationComponent\1.0.0.5\nav_config.json
Size 2KB
SHA256 98252dc9f9e81167e893f2c32f08ee60e9a6c43fadb454400ed3bff3a68fbf0d
MD5 499d9e568b96e759959dc69635470211
SHA1 2462a315342e0c09fd6c5fbd7f1e7ff6914c17e6
SHA512 3a5922697b5356fd29ccf8dcc2e5e0e8c1fd955046a5bacf11b8ac5b7c147625d31ade6ff17be86e79c2c613104b2d2aebb11557399084d422e304f287d8b905
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 4d9770cca71af2603e0eb6a86b9e550da57a07521f3e28abca675338a0ad135c
MD5 8f796bc7117de71614a017cab1729ba9
SHA1 ac3b5cd68f6dcf45e3103b89f44e94cc5d882fd7
SHA512 89f5926e72f6ffe8bf70a6a26a3c3e7774491feee4583f7fcf9c9294d4b341a1b8c2e23c4e4343c9c06995609e96a9b0db88baa63207a31bd43f5603452949d9
MD5 SHA1 SHA512

Submit Download

32f01ff4-5a3d-4df0-8ac7-e93fdf298672.tmp

Path C:\Users\Admin\AppData\Local\Temp\32f01ff4-5a3d-4df0-8ac7-e93fdf298672.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

4a1f040d-fceb-49a3-98a7-db90ed7af890.tmp

Path C:\Users\Admin\AppData\Local\Temp\4a1f040d-fceb-49a3-98a7-db90ed7af890.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
MD5 SHA1 SHA512 SSDEEP

Submit Download

Path C:\Users\Admin\AppData\Local\Temp\Malware-1-master\x
Size 11KB
SHA256 3c8cea1a86f07b018e637a1ea2649d907573f78c7e4025ef7e514362d09ff6c0
MD5 1882f3dd051e401349f1af58d55b0a37
SHA1 6b0875f9e3164f3a9f21c1ec36748a7243515b47
SHA512 fec96d873997b5c6c82a94f8796c88fc2dd38739277c517b8129277dcbda02576851f1e27bdb2fbb7255281077d5b9ba867f6dfe66bedfc859c59fdd3bbffacf
SSDEEP 192:Ljafl1gt6iUq/l0ZQjGNxYoanyJfjvB0BXmqqTZhXBnaRL9znQ32z8h0:L29mtJUui1any9Bn/RaRL06
MD5 SHA1 SHA512 SSDEEP

Submit Download

Path C:\Users\Admin\AppData\Local\Temp\Malware-1-master\x
Size 4KB
SHA256 45f18ccd8df88c127304a7855a608661b52b0ca813e87e06d87da15259c45037
MD5 214f98cb6a54654a4ca5c456f16aed0a
SHA1 2229090d2f6a1814ba648e5b5a5ae26389cba5a0
SHA512 5f058b05f166e2688df7b3960e135ada25bbcdfbb62a11da3cf9e70c08c51e5589a1e6ca2250318a694d27197f2c5ba1028c443831c43fba2171ca8e072e9873
SSDEEP 96:2OfjuOV4dI3CMQYGtWJQsRmWZu2Ik6iUqLplsQuK0sIF2jGM:Ljafl1gt6iUq/l0ZQjGM
MD5 SHA1 SHA512 SSDEEP

Submit Download

x.js

Path C:\Users\Admin\AppData\Local\Temp\Malware-1-master\x.js
Size 448B
SHA256 aa01b8864b43e92077a106ed3d4656a511f3ba1910fba40c78a32ee6a621d596
MD5 8eec8704d2a7bc80b95b7460c06f4854
SHA1 1b34585c1fa7ec0bd0505478ac9dbb8b8d19f326
SHA512 e274b92810e9a30627a65f87448d784967a2fcfbf49858cbe6ccb841f09e0f53fde253ecc1ea0c7de491d8cc56a6cf8c79d1b7c657e72928cfb0479d11035210
MD5 SHA1 SHA512

Submit Download

z.zip

Path C:\Users\Admin\AppData\Local\Temp\Malware-1-master\z.zip
Size 8KB
SHA256 44c1857b1c4894b3dfbaccbe04905652e634283dcf6b06c25a74b17021e2a268
MD5 63ee4412b95d7ad64c54b4ba673470a7
SHA1 1cf423c6c2c6299e68e1927305a3057af9b3ce06
SHA512 7ff153826bd5fed0a410f6d15a54787b79eba927d5b573c8a7f23f4ecef7bb223d79fd29fe8c2754fbf5b4c77ab7c41598f2989b6f4c7b2aa2f579ef4af06ee7
SSDEEP 192:egFudZs7gU52m4qi2hvimtucysYSM3lRNm5wy2k89QPaNmCpCfAKgW:SdZs7n52mbFimtuckPXEKyuGSXCfAKx
MD5 SHA1 SHA512 SSDEEP

Submit Download

df1dc36e-0739-41ae-a97a-b9c85541656c.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir760_815354975\df1dc36e-0739-41ae-a97a-b9c85541656c.tmp
Size 161KB
SHA256 8db781cdf6d05cbf452dfaf7eaec6c4818e2c979fbe876c2178a449681374b09
MD5 f4e4a2ec27084ae8e2d291b22cfba16a
SHA1 75ef323d2573847b366647019ac6486362fc40b5
SHA512 606ff1219382c3e4367ec8e929928b21031a3c9340c9e2064e1297a879f22ccc4f9289b59db7c35cf78c5b97d8827a3a2c37c62ed40aceea29d1c59bd0d90692
SSDEEP 3072:SBBV1VTKa0F/TnqOK7CcvlUsUc7/3fDN4UKzCGLr8Xqjj6iI+onWr+SZuTF8YB:S/V3mbZrqOUpUgPbN4UXGLqqjGiIXWGB
MD5 SHA1 SHA512 SSDEEP

Submit Download

MEMZ.exe

Path C:\Users\Admin\AppData\Roaming\MEMZ.exe
Size 14KB
SHA256 a3d5715a81f2fbeb5f76c88c9c21eeee87142909716472f911ff6950c790c24d
MD5 19dbec50735b5f2a72d4199c4e184960
SHA1 6fed7732f7cb6f59743795b2ab154a3676f4c822
SHA512 aa8a6bbb1ec516d5d5acf8be6863a4c6c5d754cee12b3d374c3a6acb393376806edc422f0ffb661c210e5b9485da88521e4a0956a4b7b08a5467cfaacd90591d
SSDEEP 192:sIvxdXSQeWSg9JJS/lcIEiwqZKBkDFR43xWTM3LHn8f26gyr6yfFCj3r:sMVSaSEglcIqq3agmLc+6gyWqFCj
MD5 SHA1 SHA512 SSDEEP

Submit Download

note.txt

Path C:\note.txt
Size 218B
SHA256 8e9f20f6864c66576536c0b866c6ffdcf11397db67fe120e972e244c3c022270
MD5 afa6955439b8d516721231029fb9ca1b
SHA1 087a043cc123c0c0df2ffadcf8e71e3ac86bbae9
SHA512 5da21a31fbc4e8250dffed30f66b896bdf007ac91948140334fe36a3f010e1bac3e70a07e9f3eb9da8633189091fd5cadcabbaacd3e01da0fe7ae28a11b3dddf
MD5 SHA1 SHA512

Submit Download