6805b3c7c5234bd7f0fdc6355fddbb53152f605865d96deb5ed115b67baff445

max time kernel
331s
max time network
334s
platform
windows10-2004_x64
resource
win10v2004-20251016-en
resource tags

arch:x64arch:x86image:win10v2004-20251016-enlocale:en-usos:windows10-2004-x64system
submitted
22/11/2025, 17:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Malware-1-master/MEMZ-Destructive.exe
Size 14KB
Sample251122-vkblbavldp
SHA256 a3d5715a81f2fbeb5f76c88c9c21eeee87142909716472f911ff6950c790c24d
MD5 19dbec50735b5f2a72d4199c4e184960
SHA1 6fed7732f7cb6f59743795b2ab154a3676f4c822
SHA512 aa8a6bbb1ec516d5d5acf8be6863a4c6c5d754cee12b3d374c3a6acb393376806edc422f0ffb661c210e5b9485da88521e4a0956a4b7b08a5467cfaacd90591d
SSDEEP 192:sIvxdXSQeWSg9JJS/lcIEiwqZKBkDFR43xWTM3LHn8f26gyr6yfFCj3r:sMVSaSEglcIqq3agmLc+6gyWqFCj
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

bootkit discovery persistence

Malware Config

Signatures

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-139171303-3954714288-23435696-1000\Control Panel\International\Geo\Nation	MEMZ-Destructive.exe
Key value queried	\REGISTRY\USER\S-1-5-21-139171303-3954714288-23435696-1000\Control Panel\International\Geo\Nation	MEMZ-Destructive.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	MEMZ-Destructive.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2520_1778333299\_locales\et\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2520_1778333299\offscreendocument_main.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2520_1041833469\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2520_1712958736\Mu\Other	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2520_1712958736\Sigma\Other	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2520_1106902844\manifest.fingerprint	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2520_1778333299\_locales\sv\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2520_1778333299\_locales\no\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2520_1778333299\_metadata\verified_contents.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2520_1712958736\Mu\Entities	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2520_1778333299\_locales\uk\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2520_1778333299\_locales\tr\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2520_1778333299\_locales\mr\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2520_1778333299\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2520_1712958736\Mu\Fingerprinting	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2520_1778333299\_locales\sr\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2520_1778333299\_locales\my\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2520_951021920\manifest.fingerprint	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2520_1778333299\_locales\ms\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2520_1778333299\_locales\en_CA\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2520_1778333299\_locales\ja\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2520_1778333299\service_worker_bin_prod.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2520_1041833469\manifest.fingerprint	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2520_1712958736\manifest.fingerprint	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2520_1778333299\_locales\th\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2520_1778333299\_locales\eu\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2520_1778333299\_locales\ar\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2520_1778333299\_locales\hy\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2520_1778333299\_locales\gl\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2520_1778333299\manifest.fingerprint	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2520_951021920\female_names.txt	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2520_1778333299\_locales\ro\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2520_1712958736\Mu\CompatExceptions	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2520_1778333299\_locales\si\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2520_1778333299\_locales\zh_CN\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2520_1778333299\_locales\zu\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2520_951021920\english_wikipedia.txt	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2520_1778333299\_locales\sw\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2520_1712958736\Mu\TransparentAdvertisers	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2520_951021920\test.txt	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2520_1778333299\_locales\bg\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2520_1041833469\data.txt	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2520_1778333299\_locales\pl\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2520_1778333299\_locales\kk\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2520_1778333299\_locales\km\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2520_1778333299\_locales\ka\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2520_1778333299\_locales\zh_HK\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2520_1778333299\_locales\az\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2520_1106902844\typosquatting_list.pb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2520_1778333299\_locales\hr\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2520_2026957623\manifest.fingerprint	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2520_1712958736\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2520_951021920\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2520_1778333299\_locales\zh_TW\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2520_1778333299\_locales\iw\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2520_1778333299\_locales\cy\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2520_1712958736\Sigma\Advertising	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2520_1106902844\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2520_1778333299\_locales\ur\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2520_1778333299\_locales\pt_BR\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2520_1778333299\_locales\is\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2520_1778333299\_locales\ru\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2520_1778333299\_locales\el\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2520_1778333299\_locales\vi\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MEMZ-Destructive.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MEMZ-Destructive.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wordpad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regedit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wordpad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mmc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134083047385961279"	msedge.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-139171303-3954714288-23435696-1000\{7BC39D35-DC32-4385-93A4-604A46FB57B7}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-139171303-3954714288-23435696-1000_Classes\Local Settings	calc.exe
Key created	\REGISTRY\USER\S-1-5-21-139171303-3954714288-23435696-1000_Classes\Local Settings	calc.exe
Key created	\REGISTRY\USER\S-1-5-21-139171303-3954714288-23435696-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Runs regedit.exe 1 IoCs

pid	Process
2512	regedit.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1924	MEMZ-Destructive.exe
1924	MEMZ-Destructive.exe
1924	MEMZ-Destructive.exe
1924	MEMZ-Destructive.exe
3968	MEMZ-Destructive.exe
3968	MEMZ-Destructive.exe
5272	MEMZ-Destructive.exe
5272	MEMZ-Destructive.exe
5272	MEMZ-Destructive.exe
3968	MEMZ-Destructive.exe
3968	MEMZ-Destructive.exe
5272	MEMZ-Destructive.exe
1924	MEMZ-Destructive.exe
5596	MEMZ-Destructive.exe
1924	MEMZ-Destructive.exe
5596	MEMZ-Destructive.exe
2716	MEMZ-Destructive.exe
2716	MEMZ-Destructive.exe
2716	MEMZ-Destructive.exe
5596	MEMZ-Destructive.exe
5596	MEMZ-Destructive.exe
2716	MEMZ-Destructive.exe
1924	MEMZ-Destructive.exe
3968	MEMZ-Destructive.exe
1924	MEMZ-Destructive.exe
3968	MEMZ-Destructive.exe
5272	MEMZ-Destructive.exe
5272	MEMZ-Destructive.exe
1924	MEMZ-Destructive.exe
1924	MEMZ-Destructive.exe
3968	MEMZ-Destructive.exe
3968	MEMZ-Destructive.exe
5596	MEMZ-Destructive.exe
5596	MEMZ-Destructive.exe
2716	MEMZ-Destructive.exe
2716	MEMZ-Destructive.exe
2716	MEMZ-Destructive.exe
2716	MEMZ-Destructive.exe
5596	MEMZ-Destructive.exe
5596	MEMZ-Destructive.exe
3968	MEMZ-Destructive.exe
3968	MEMZ-Destructive.exe
1924	MEMZ-Destructive.exe
1924	MEMZ-Destructive.exe
5272	MEMZ-Destructive.exe
5272	MEMZ-Destructive.exe
1924	MEMZ-Destructive.exe
1924	MEMZ-Destructive.exe
3968	MEMZ-Destructive.exe
3968	MEMZ-Destructive.exe
5596	MEMZ-Destructive.exe
5596	MEMZ-Destructive.exe
2716	MEMZ-Destructive.exe
2716	MEMZ-Destructive.exe
2716	MEMZ-Destructive.exe
5596	MEMZ-Destructive.exe
5596	MEMZ-Destructive.exe
2716	MEMZ-Destructive.exe
3968	MEMZ-Destructive.exe
1924	MEMZ-Destructive.exe
3968	MEMZ-Destructive.exe
1924	MEMZ-Destructive.exe
5272	MEMZ-Destructive.exe
5272	MEMZ-Destructive.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2140	mmc.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 14 IoCs

pid	Process
2520	msedge.exe
2520	msedge.exe
2520	msedge.exe
2520	msedge.exe
2520	msedge.exe
2520	msedge.exe
2520	msedge.exe
2520	msedge.exe
2520	msedge.exe
2520	msedge.exe
2520	msedge.exe
2520	msedge.exe
2520	msedge.exe
2520	msedge.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: 33	2140	mmc.exe
Token: SeIncBasePriorityPrivilege	2140	mmc.exe
Token: 33	2140	mmc.exe
Token: SeIncBasePriorityPrivilege	2140	mmc.exe
Token: 33	2140	mmc.exe
Token: SeIncBasePriorityPrivilege	2140	mmc.exe
Token: 33	5384	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	5384	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2520	msedge.exe

Suspicious use of SetWindowsHookEx 23 IoCs

pid	Process
3200	MEMZ-Destructive.exe
216	mmc.exe
2140	mmc.exe
2140	mmc.exe
764	wordpad.exe
764	wordpad.exe
764	wordpad.exe
764	wordpad.exe
764	wordpad.exe
764	wordpad.exe
3200	MEMZ-Destructive.exe
3208	OpenWith.exe
3200	MEMZ-Destructive.exe
4448	wordpad.exe
4448	wordpad.exe
4448	wordpad.exe
4448	wordpad.exe
4448	wordpad.exe
4448	wordpad.exe
3200	MEMZ-Destructive.exe
404	OpenWith.exe
3200	MEMZ-Destructive.exe
3200	MEMZ-Destructive.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4440 wrote to memory of 1924	4440	MEMZ-Destructive.exe	94
PID 4440 wrote to memory of 1924	4440	MEMZ-Destructive.exe	94
PID 4440 wrote to memory of 1924	4440	MEMZ-Destructive.exe	94
PID 4440 wrote to memory of 5272	4440	MEMZ-Destructive.exe	95
PID 4440 wrote to memory of 5272	4440	MEMZ-Destructive.exe	95
PID 4440 wrote to memory of 5272	4440	MEMZ-Destructive.exe	95
PID 4440 wrote to memory of 3968	4440	MEMZ-Destructive.exe	96
PID 4440 wrote to memory of 3968	4440	MEMZ-Destructive.exe	96
PID 4440 wrote to memory of 3968	4440	MEMZ-Destructive.exe	96
PID 4440 wrote to memory of 2716	4440	MEMZ-Destructive.exe	97
PID 4440 wrote to memory of 2716	4440	MEMZ-Destructive.exe	97
PID 4440 wrote to memory of 2716	4440	MEMZ-Destructive.exe	97
PID 4440 wrote to memory of 5596	4440	MEMZ-Destructive.exe	98
PID 4440 wrote to memory of 5596	4440	MEMZ-Destructive.exe	98
PID 4440 wrote to memory of 5596	4440	MEMZ-Destructive.exe	98
PID 4440 wrote to memory of 3200	4440	MEMZ-Destructive.exe	99
PID 4440 wrote to memory of 3200	4440	MEMZ-Destructive.exe	99
PID 4440 wrote to memory of 3200	4440	MEMZ-Destructive.exe	99
PID 3200 wrote to memory of 2216	3200	MEMZ-Destructive.exe	101
PID 3200 wrote to memory of 2216	3200	MEMZ-Destructive.exe	101
PID 3200 wrote to memory of 2216	3200	MEMZ-Destructive.exe	101
PID 3200 wrote to memory of 1296	3200	MEMZ-Destructive.exe	104
PID 3200 wrote to memory of 1296	3200	MEMZ-Destructive.exe	104
PID 1296 wrote to memory of 2520	1296	msedge.exe	105
PID 1296 wrote to memory of 2520	1296	msedge.exe	105
PID 2520 wrote to memory of 1124	2520	msedge.exe	106
PID 2520 wrote to memory of 1124	2520	msedge.exe	106
PID 2520 wrote to memory of 2060	2520	msedge.exe	107
PID 2520 wrote to memory of 2060	2520	msedge.exe	107
PID 2520 wrote to memory of 6092	2520	msedge.exe	108
PID 2520 wrote to memory of 6092	2520	msedge.exe	108
PID 2520 wrote to memory of 6092	2520	msedge.exe	108
PID 2520 wrote to memory of 6092	2520	msedge.exe	108
PID 2520 wrote to memory of 6092	2520	msedge.exe	108
PID 2520 wrote to memory of 6092	2520	msedge.exe	108
PID 2520 wrote to memory of 6092	2520	msedge.exe	108
PID 2520 wrote to memory of 6092	2520	msedge.exe	108
PID 2520 wrote to memory of 6092	2520	msedge.exe	108
PID 2520 wrote to memory of 6092	2520	msedge.exe	108
PID 2520 wrote to memory of 6092	2520	msedge.exe	108
PID 2520 wrote to memory of 6092	2520	msedge.exe	108
PID 2520 wrote to memory of 6092	2520	msedge.exe	108
PID 2520 wrote to memory of 6092	2520	msedge.exe	108
PID 2520 wrote to memory of 6092	2520	msedge.exe	108
PID 2520 wrote to memory of 6092	2520	msedge.exe	108
PID 2520 wrote to memory of 6092	2520	msedge.exe	108
PID 2520 wrote to memory of 6092	2520	msedge.exe	108
PID 2520 wrote to memory of 6092	2520	msedge.exe	108
PID 2520 wrote to memory of 6092	2520	msedge.exe	108
PID 2520 wrote to memory of 6092	2520	msedge.exe	108
PID 2520 wrote to memory of 6092	2520	msedge.exe	108
PID 2520 wrote to memory of 6092	2520	msedge.exe	108
PID 2520 wrote to memory of 6092	2520	msedge.exe	108
PID 2520 wrote to memory of 6092	2520	msedge.exe	108
PID 2520 wrote to memory of 6092	2520	msedge.exe	108
PID 2520 wrote to memory of 6092	2520	msedge.exe	108
PID 2520 wrote to memory of 6092	2520	msedge.exe	108
PID 2520 wrote to memory of 6092	2520	msedge.exe	108
PID 2520 wrote to memory of 6092	2520	msedge.exe	108
PID 2520 wrote to memory of 6092	2520	msedge.exe	108
PID 2520 wrote to memory of 6092	2520	msedge.exe	108
PID 2520 wrote to memory of 6092	2520	msedge.exe	108
PID 2520 wrote to memory of 6092	2520	msedge.exe	108
PID 2520 wrote to memory of 6092	2520	msedge.exe	108

C:\Users\Admin\AppData\Local\Temp\Malware-1-master\MEMZ-Destructive.exe
"C:\Users\Admin\AppData\Local\Temp\Malware-1-master\MEMZ-Destructive.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4440
- C:\Users\Admin\AppData\Local\Temp\Malware-1-master\MEMZ-Destructive.exe
  "C:\Users\Admin\AppData\Local\Temp\Malware-1-master\MEMZ-Destructive.exe" /watchdog
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1924
- C:\Users\Admin\AppData\Local\Temp\Malware-1-master\MEMZ-Destructive.exe
  "C:\Users\Admin\AppData\Local\Temp\Malware-1-master\MEMZ-Destructive.exe" /watchdog
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5272
- C:\Users\Admin\AppData\Local\Temp\Malware-1-master\MEMZ-Destructive.exe
  "C:\Users\Admin\AppData\Local\Temp\Malware-1-master\MEMZ-Destructive.exe" /watchdog
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3968
- C:\Users\Admin\AppData\Local\Temp\Malware-1-master\MEMZ-Destructive.exe
  "C:\Users\Admin\AppData\Local\Temp\Malware-1-master\MEMZ-Destructive.exe" /watchdog
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2716
- C:\Users\Admin\AppData\Local\Temp\Malware-1-master\MEMZ-Destructive.exe
  "C:\Users\Admin\AppData\Local\Temp\Malware-1-master\MEMZ-Destructive.exe" /watchdog
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5596
- C:\Users\Admin\AppData\Local\Temp\Malware-1-master\MEMZ-Destructive.exe
  "C:\Users\Admin\AppData\Local\Temp\Malware-1-master\MEMZ-Destructive.exe" /main
  2⤵
  - Checks computer location settings
  - Writes to the Master Boot Record (MBR)
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3200
- - C:\Windows\SysWOW64\notepad.exe
    "C:\Windows\System32\notepad.exe" \note.txt
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2216
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=minecraft+hax+download+no+virus
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1296
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument http://google.co.ck/search?q=minecraft+hax+download+no+virus
      4⤵
      Drops file in Program Files directory
      Checks processor information in registry
      Enumerates system info in registry
      Modifies data under HKEY_USERS
      Modifies registry class
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:2520
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffe2fd5f208,0x7ffe2fd5f214,0x7ffe2fd5f220
        5⤵
        
        PID:1124
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1936,i,1646943133888452022,5597855862939396508,262144 --variations-seed-version --mojo-platform-channel-handle=2264 /prefetch:3
        5⤵
        
        PID:2060
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2232,i,1646943133888452022,5597855862939396508,262144 --variations-seed-version --mojo-platform-channel-handle=2228 /prefetch:2
        5⤵
        
        PID:6092
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2580,i,1646943133888452022,5597855862939396508,262144 --variations-seed-version --mojo-platform-channel-handle=2596 /prefetch:8
        5⤵
        
        PID:5652
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3488,i,1646943133888452022,5597855862939396508,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:1
        5⤵
        
        PID:2464
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3500,i,1646943133888452022,5597855862939396508,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:1
        5⤵
        
        PID:3296
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --field-trial-handle=4916,i,1646943133888452022,5597855862939396508,262144 --variations-seed-version --mojo-platform-channel-handle=4908 /prefetch:1
        5⤵
        
        PID:2540
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --string-annotations --always-read-main-dll --field-trial-handle=5096,i,1646943133888452022,5597855862939396508,262144 --variations-seed-version --mojo-platform-channel-handle=4824 /prefetch:8
        5⤵
        
        PID:1664
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --string-annotations --always-read-main-dll --field-trial-handle=3524,i,1646943133888452022,5597855862939396508,262144 --variations-seed-version --mojo-platform-channel-handle=3752 /prefetch:8
        5⤵
        
        PID:1736
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=5644,i,1646943133888452022,5597855862939396508,262144 --variations-seed-version --mojo-platform-channel-handle=5660 /prefetch:8
        5⤵
        
        PID:5616
    - - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=5808,i,1646943133888452022,5597855862939396508,262144 --variations-seed-version --mojo-platform-channel-handle=5840 /prefetch:8
        5⤵
        
        PID:4208
    - - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=5808,i,1646943133888452022,5597855862939396508,262144 --variations-seed-version --mojo-platform-channel-handle=5840 /prefetch:8
        5⤵
        
        PID:3964
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=5972,i,1646943133888452022,5597855862939396508,262144 --variations-seed-version --mojo-platform-channel-handle=5968 /prefetch:8
        5⤵
        
        PID:4364
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=5968,i,1646943133888452022,5597855862939396508,262144 --variations-seed-version --mojo-platform-channel-handle=5976 /prefetch:8
        5⤵
        
        PID:2092
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --field-trial-handle=5864,i,1646943133888452022,5597855862939396508,262144 --variations-seed-version --mojo-platform-channel-handle=5852 /prefetch:1
        5⤵
        
        PID:5456
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --field-trial-handle=5956,i,1646943133888452022,5597855862939396508,262144 --variations-seed-version --mojo-platform-channel-handle=6188 /prefetch:1
        5⤵
        
        PID:628
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --string-annotations --always-read-main-dll --field-trial-handle=4936,i,1646943133888452022,5597855862939396508,262144 --variations-seed-version --mojo-platform-channel-handle=4992 /prefetch:8
        5⤵
        
        PID:4404
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --string-annotations --always-read-main-dll --field-trial-handle=4784,i,1646943133888452022,5597855862939396508,262144 --variations-seed-version --mojo-platform-channel-handle=4940 /prefetch:8
        5⤵
        
        PID:4416
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --string-annotations --always-read-main-dll --field-trial-handle=6080,i,1646943133888452022,5597855862939396508,262144 --variations-seed-version --mojo-platform-channel-handle=4868 /prefetch:8
        5⤵
        
        PID:4408
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --field-trial-handle=3432,i,1646943133888452022,5597855862939396508,262144 --variations-seed-version --mojo-platform-channel-handle=5180 /prefetch:1
        5⤵
        
        PID:5700
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --field-trial-handle=6396,i,1646943133888452022,5597855862939396508,262144 --variations-seed-version --mojo-platform-channel-handle=6412 /prefetch:1
        5⤵
        
        PID:3812
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --string-annotations --always-read-main-dll --field-trial-handle=3728,i,1646943133888452022,5597855862939396508,262144 --variations-seed-version --mojo-platform-channel-handle=6324 /prefetch:8
        5⤵
        
        PID:5048
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=5604,i,1646943133888452022,5597855862939396508,262144 --variations-seed-version --mojo-platform-channel-handle=6644 /prefetch:8
        5⤵
        
        PID:5632
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --string-annotations --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=6620,i,1646943133888452022,5597855862939396508,262144 --variations-seed-version --mojo-platform-channel-handle=6596 /prefetch:8
        5⤵
        
        PID:3168
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=5608,i,1646943133888452022,5597855862939396508,262144 --variations-seed-version --mojo-platform-channel-handle=6624 /prefetch:8
        5⤵
        
        PID:2708
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --field-trial-handle=6576,i,1646943133888452022,5597855862939396508,262144 --variations-seed-version --mojo-platform-channel-handle=6528 /prefetch:1
        5⤵
        
        PID:6016
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --field-trial-handle=5260,i,1646943133888452022,5597855862939396508,262144 --variations-seed-version --mojo-platform-channel-handle=5224 /prefetch:1
        5⤵
        
        PID:5420
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --field-trial-handle=1012,i,1646943133888452022,5597855862939396508,262144 --variations-seed-version --mojo-platform-channel-handle=3204 /prefetch:1
        5⤵
        
        PID:4424
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --field-trial-handle=4000,i,1646943133888452022,5597855862939396508,262144 --variations-seed-version --mojo-platform-channel-handle=6332 /prefetch:1
        5⤵
        
        PID:3572
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=6652,i,1646943133888452022,5597855862939396508,262144 --variations-seed-version --mojo-platform-channel-handle=3720 /prefetch:8
        5⤵
        
        PID:2208
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --string-annotations --always-read-main-dll --field-trial-handle=6444,i,1646943133888452022,5597855862939396508,262144 --variations-seed-version --mojo-platform-channel-handle=6764 /prefetch:8
        5⤵
        
        PID:3840
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=6696,i,1646943133888452022,5597855862939396508,262144 --variations-seed-version --mojo-platform-channel-handle=6580 /prefetch:8
        5⤵
        
        PID:868
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=6584,i,1646943133888452022,5597855862939396508,262144 --variations-seed-version --mojo-platform-channel-handle=6680 /prefetch:8
        5⤵
        
        PID:2492
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --always-read-main-dll --field-trial-handle=6656,i,1646943133888452022,5597855862939396508,262144 --variations-seed-version --mojo-platform-channel-handle=5044 /prefetch:1
        5⤵
        
        PID:1644
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --always-read-main-dll --field-trial-handle=6868,i,1646943133888452022,5597855862939396508,262144 --variations-seed-version --mojo-platform-channel-handle=6832 /prefetch:1
        5⤵
        
        PID:3872
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=batch+virus+download
    3⤵
    PID:1512
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument http://google.co.ck/search?q=batch+virus+download
      4⤵
      PID:5616
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=facebook+hacking+tool+free+download+no+virus+working+2016
    3⤵
    PID:4748
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument http://google.co.ck/search?q=facebook+hacking+tool+free+download+no+virus+working+2016
      4⤵
      PID:4848
- - C:\Windows\SysWOW64\mmc.exe
    "C:\Windows\System32\mmc.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:216
  - - C:\Windows\system32\mmc.exe
      "C:\Windows\system32\mmc.exe"
      4⤵
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      PID:2140
- - C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe
    "C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:764
  - - C:\Windows\splwow64.exe
      C:\Windows\splwow64.exe 12288
      4⤵
      PID:4608
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=bonzi+buddy+download+free
    3⤵
    PID:2420
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument http://google.co.ck/search?q=bonzi+buddy+download+free
      4⤵
      PID:720
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=bonzi+buddy+download+free
    3⤵
    PID:3332
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument http://google.co.ck/search?q=bonzi+buddy+download+free
      4⤵
      PID:1060
- - C:\Windows\SysWOW64\calc.exe
    "C:\Windows\System32\calc.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:452
- - C:\Windows\SysWOW64\regedit.exe
    "C:\Windows\System32\regedit.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Runs regedit.exe
    PID:2512
- - C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe
    "C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:4448
- - C:\Windows\SysWOW64\calc.exe
    "C:\Windows\System32\calc.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:5436
- - C:\Windows\SysWOW64\explorer.exe
    "C:\Windows\System32\explorer.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:6024
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=g3t+r3kt
    3⤵
    PID:3412
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument http://google.co.ck/search?q=g3t+r3kt
      4⤵
      PID:3776

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:4860

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:924

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x3d4 0x3dc
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5384

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc
1⤵
PID:5312

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:3208

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:404

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping2520_1041833469\manifest.json
Size 53B
SHA256 d1768a411f8308d2e53bda32bfb0d9c293b7d18c3d8c1c266febd6bb8d2a2ae6
MD5 5e2b168d39a2c48bcfdfceac3cdada96
SHA1 e60397bd2e1f55bd5e8c62e415f7908db0fd32a6
SHA512 8f06183c9444f1ae3a11c2b63926a35147587e33b137f18bd1f88d06817fc033f46ba69b2392ef3dfb6d6d06e1b6f1aecd8e7e83b53440f73881e1445b531769
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping2520_1106902844\manifest.json
Size 119B
SHA256 1f18892bc153b41fc9e1ce95d417d0ea0dc7676ec2f17e01de8931fed1cae670
MD5 7a3c8e2b8b70bdfdcc1db549b5b0a4bc
SHA1 28a7308a6ad5843219018855b51e49bcb4853b17
SHA512 15d67d22808482a9ce23b3fed2856b9917aeef01007f5b476740550f7c504f39203bc1a811c7309416af0438fee5ef0749f5c9696f42ae740c7f35405977f9f6
MD5 SHA1 SHA512

Submit Download

deny_domains.list

Path C:\Program Files\chrome_Unpacker_BeginUnzipping2520_2026957623\deny_domains.list
Size 12B
SHA256 f51a7acfffec56d6751561966d947d3fd199b74528c07dabdcf5fcb33d5b2e85
MD5 085a334bdb7c8e27b7d925a596bfc19a
SHA1 1e4ad53dc335af5c6a8da2e4b4a175f37fafe2f2
SHA512 c883cb43c97a136825c6fd143f539210c234c66f9b76dfd8431f6ff014094e20b9410d7462aadee2344df8ca158def6b9a807e7cadbdfa947f6f8592e7283e34
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping2520_2026957623\manifest.json
Size 176B
SHA256 3e4c1b4b8dda29ed41f066d52ed35694e70f4b8a583efcbce12f661a49b57ba3
MD5 43c5775bc9bc99578d9a96958edc8864
SHA1 580dcf0609fb7931c7b5b7f8b787279bc1f6ec13
SHA512 0ab77a360635d032eb96b5d107626d24504e42522c0fb6f5bdabcddbc80129d05ac240b0ddcf21718308340676836d14feb677f8c0f3ed9d721bb0f623eef940
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping2520_951021920\manifest.json
Size 69B
SHA256 dc6a19395ad3a24ee3805f6e90c6b16fdc141a51ac7fbb99fb784e423f8962f3
MD5 b721bdf2924d658186ac8868dbd2c008
SHA1 914aacc65bb7933bd73aa06f8bd2ca0b04de3858
SHA512 4c1c16f714a2e2436697bc801f7e2f684010c833e3d5fe6ed68d6f3e630afa495412ea5a1b46f4bbbb1102feede84e72f32686910492510cbce71888a85b5fda
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 cc21b4591b2ea6c7594cdf520051f4daaa374b81d7d231837a5fcd68f4f71a77
MD5 6d402ade60cdb5a64c06a0be7df93c82
SHA1 2d9a78fbe34e84029b5cf974f7a17c1b751d80c9
SHA512 7e6d351eac513e8a8aeb8616a785bf250a6944e9544ebd7cb4de063e9bd3a32077184fce72c38dc07a0ebad8c6f74629caff0f3b573b593dcfdfb9e23bb68e6e
MD5 SHA1 SHA512

Submit Download

f_000072

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000072
Size 51KB
SHA256 57147f08949ababe7deef611435ae418475a693e3823769a25c2a39b6ead9ccc
MD5 f61f0d4d0f968d5bba39a84c76277e1a
SHA1 aa3693ea140eca418b4b2a30f6a68f6f43b4beb2
SHA512 6c3bd90f709bcf9151c9ed9ffea55c4f6883e7fda2a4e26bf018c83fe1cfbe4f4aa0db080d6d024070d53b2257472c399c8ac44eefd38b9445640efa85d5c487
SSDEEP 1536:1rvqtK8DZilXxwJ8mMwAZy7phqsFLdG3B4d:xytBZits8bw4wzbFxG3B4d
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000075

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000075
Size 77KB
SHA256 a81a49ec43eac2d8e81636e4ad2054fe483197673caddf664b8e261a923e26f9
MD5 6e480bef790dc6fd86b55a4fb87ff461
SHA1 d7db643fc3179bb74f016e2e1615cd32ac16c5e1
SHA512 df4ad5089790bd662956a0fdad4f98c93614f6aec60a0c260783fbd17945238b803e71a82ea0af27753d722965f57e715cda14eb573692a9aa2c5c92bf0da8b8
SSDEEP 1536:988y8AoSl3PgeoNpHiOkpzguJ4XKeqc4tQD8uRnVoL3a8e6GZxM1s:NAog3PDom1zguSK9cH8kng3a8zGis
MD5 SHA1 SHA512 SSDEEP

Submit Download

02626f7a028b854c_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\02626f7a028b854c_0
Size 354B
SHA256 19c36a1b14fb8b40adb7bd1c50e30c673bbc72fbb96a61ed749e6ad11a3e4db9
MD5 c59c3743bc6ab956886ac5c985fbf3eb
SHA1 3dd22c9945534c9e549413358325414ccc75cd63
SHA512 1676b4c446aff9bdbd2a75c614c0d3f2b4e8377e4b15831bf704161391d4b4d806e2812e56789f27050f07a29b0cdfdef8d8e935c4ecd66707feef9c60d6cf9c
MD5 SHA1 SHA512

Submit Download

75d6cb6670a63a12_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\75d6cb6670a63a12_0
Size 310KB
SHA256 e15729611e023f33eb8da64e91af13d0cbf9c7abf180d22b6f80e02333216d1d
MD5 7728a7d4e6c9192bb9a482e621442b7e
SHA1 9f00ec44b5b6149d86e2680dad04219ec5d1a5e9
SHA512 a4eb2445a844b71e847115ee620d198c8ca30c0c285d2c183f6a2a4839e04087c0cdbf2e814872386f7c6c6a48f08236eab76d3a576e40d5dfa14793e49149bf
SSDEEP 3072:UmWGxWiClDpKrSlgnMFBGIcebZSXx1OMzkwiyGd5/FLMIlYElu6IIrXbYynHs:xV7+7gnM0ebZUzk9BLMIlY+XbY0s
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 a85ecc16979944cadb629d124f5a67981fc629392d6a3db42426910c0a7191dc
MD5 309adea20778d8526fa1a2c59e8313f0
SHA1 c085e4cb95d1e23d48ae648964abc4a607fe5ccb
SHA512 8ed8daf7ed7748e5789bdc98eb062a2baaeb97c305f90d40f3f04ff2cd10aaaa67bb09e3e519f279b899258a3547849a65271a29a855e4f0818aa069850d72df
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 6b697b86aa9fceb9ff72c455f421d87804269edec821a3633e572da3a81f47fe
MD5 fb7d83ca8ae17d48cb9cbc64ef2fc707
SHA1 f88454bbd997825a18837802c38ad5971c6afa61
SHA512 706b15f85df53deb7a537b5bfd268b9ebf9f6ad28baa4f0885f9394f07d62165a1a3fd81a70f7843ee1f1cca8e59a7a06c21e8048bc58d634e4df002e3d5533b
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 7659814c106699da2c34732e8b60c0b0d481f4ca60718b03fdbfa2db435439b6
MD5 b21f1758bc958e0e34f538a8e25d8734
SHA1 3ef035514708844f33516a2f0806a9ad1c7bbefd
SHA512 99cda9e0ce726981bbd30ca3b17abdb37285fa046a7425d48b1c72ec99b798b954e4e26350ce196722de4165742886885ffa78edf5b09da640358fc434926a11
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 5817d7e71010f1f659cf70f7e3b73dc12b0bd3ca3f4e4cbeb236381cfe9b55d7
MD5 051c056cedaf1ca3d57f20d826a3a66d
SHA1 9933a0c8296478afdd0f40406d7d95c507573d70
SHA512 f700e2afe82bea2fe62792fb9749cbd977d8d096f98320b77ff4bd41237a9b017c7dd38cb4e97dd25c8418943a95a03daf4b28a69c87b53bc30059dffc27d0a8
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 44a95bea6985a1bf15f958417bbf14da6010c3d588cc3534f89168863ec1723c
MD5 d4fda9fc47ea3d029428667a215beb5f
SHA1 e995343b612e43316c885f8a0a198f1f06645bd8
SHA512 027ced075542ede16688ec147406f563c425790c521000d7eb238b1372d6adce9168c9ddc550cf4051ffacc9978680172d80c6e3d08b7205f47bee80976fade0
MD5 SHA1 SHA512

Submit Download

the-real-index~RFe58a0b0.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58a0b0.TMP
Size 2KB
SHA256 079190cc62983fcd165aff31a7c301b6af90ac76075ee5514d6740afc704cf73
MD5 15dfb6aba2eacc43ee726e76f2ec0c9e
SHA1 b1be8209d82f565e91197b1c935d0af6687bf5fd
SHA512 1b0a7b85031e3ab49290d90041d03cc9b5bf8c44a898a5fb62e2093eb1fea77f709dc04225f079bad56d3b4de430c93a8a1caa1dbbf8c112107d735967b0c141
MD5 SHA1 SHA512

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 108KB
SHA256 a5f47979e3d9dc7c49694d8e9e4dd8e98b45470f93161940daff0b96bfc84a91
MD5 3692b82273b09514a7212381ba0e0098
SHA1 5abf2cbf0bfd404c62a99944e2653830865eb23b
SHA512 d3611f1b0d1c4740eef4bb7d25dffc69de0afabb5f62164acb0d7e947175822cffdadfd607249028c6c6f9f39486e0e7dec0368f225793245ee820f59dcac4d7
SSDEEP 1536:IJcH74ohBGZqW3iPPDuVvpBI/S8tZsA62UYPq:PHSRiPjU1
MD5 SHA1 SHA512 SSDEEP

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 5KB
SHA256 596efa80b39cd6d2ec647d3260dfaa6eb00f7b5209d7a03e2be37b2730529f9c
MD5 91f68b5c8b0efacbdb4df9eb93026c00
SHA1 24b5890088b5e7dd8dbd674e558bf49a9c62c66a
SHA512 879c8a5381c03ff88e2dfbfa93e86c0bbeff30e8e7e9a1bf549e4bcaeb732a8a3d8943b6486c02f9fd5dd499c9f8a3bbbe31af09ed5ae2d6ec4477e9f0e5183e
SSDEEP 96:DTO9+Sdtccuuj6xr03fKM2kVGNSw5YLqYUx:DTO9+Sdtvuuj6xWyM2UGNSw5YOYq
MD5 SHA1 SHA512 SSDEEP

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 5KB
SHA256 aebefa0b1b6b064a9a2082dc100300d311bf0cf0dc23a5b2469ed07f66ad4f6b
MD5 2ca83f543ca7ef3eef7ddafcd4439083
SHA1 2bcee6aed3a6b902f0a000f564bb417f21c20718
SHA512 de0270ae103e615b0725e1150396fe6207cfe67ec841fbd4f6bf455618f22951a82b067682c454c36085bd72fda160318ac94e3a8ddfdc718ed6a02d326c23b6
SSDEEP 96:DTO9+Sdtcgmuuj6xr03fKMKNK6WS+eDLkVfx:DTO9+SdtLmuuj6xWyMKNK6WS+eDLUp
MD5 SHA1 SHA512 SSDEEP

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 39d68719260b8764113efb94e74ab2aaab9342d9a4199cbbb3b287e707c5343e
MD5 2912aaf4db566c50e3c19d0833bb34db
SHA1 fde194747378a6014794326a51f2f6335eea747a
SHA512 38ba917f436b85a3e73e05a2a9831a20dcf774db636bde203426d1a112ccc6874ed43b0361d626d9772b31af1a71b16448d1baff24e76e84799a6cd7189dfa09
SSDEEP 192:sVxRByMqv/K1Ml8UQyg8sqvd5kL6Cey57XtZ/J2zoZ8pzppHY+WNCkgoYMVBqr8l:sVx4q98sql5kLReydXtP83HS2o9gwC8
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 9c87e4a0836d82ecc73c3c2906d387c0f54c0a6f07fa288d6356dd04d20c42a9
MD5 eb58c14c8c236a091876ad949d429f96
SHA1 ca1d39b61d41780962eff6e274e610b7ff5b68ea
SHA512 42c32931932bcc0308261d14fbdf047c84c3b31cbc57cebbee9ee9571bb6e0632a3f3126e2cedb1941299d21f16fed01c61f59813fa6dfdb47af022b15bbf31d
SSDEEP 192:sVxRByMqv/K1Ml8Mg8sqvd5GL6Cey57XtZ/J/zoZ8pzwsHY+WNCOswYtqpY7I6K5:sVx4I8sql5GLReydXtPbfHSswXwC1
MD5 SHA1 SHA512 SSDEEP

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 36KB
SHA256 2738cf33f90ea6c849e4ee26e57f6de239a2d04ba5a3d5011ec521b48620405d
MD5 e70ed8584d1325f4618155d367076e13
SHA1 cf73ed04fbfd29a37476f80901bceca2abf13c79
SHA512 315c17891dd33dabd7b416210b3e8ff8022f3cb23ead4a9f3c7e48f00f7007727bfa6784f4b03595aaddcae8fc109b4f2f6847bc60bdbe1664b36eb6035c0870
SSDEEP 768:E2NkWcJ7pL5LZsnWFHBXt8F1+UoAYDCx9Tuqh0VfUC9xbog/OVrsRWLlwC/OHrof:E2NkWcfVZsnWFHBXtu1jaUsRWLyUOU4u
MD5 SHA1 SHA512 SSDEEP

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 22KB
SHA256 e6305bf4884dce99f327369f34376bf38d3594baa5ad2ed0a6c09b8a02132466
MD5 7dd74b21b6eca57cd6b40c1617d0d00f
SHA1 9686e5e138409597dfae698ad013dc326a79b2a1
SHA512 4496b614562f33652174d999753217a48d2fe324f683a5f933acfef7c69c4b8f86f99a4034885b4c2b316692647de225a7c80a9b770514c06ae6d2da36e63db4
SSDEEP 96:7Z4tpTvjgPnCthgKpv7hybO5tyfKnrKnCDKLdK7SXKLnKfmwK4dKriZKjzKnTphw:OgyQMeyec1
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\EADPData Component\4.0.3.19\data.txt
Size 140KB
SHA256 f5e72faee9cd1aef917e12d005c7dca11035ea169e6a02417fbefb1f164051c2
MD5 d1248dc5d70652412468a4aab1913a30
SHA1 5725a0c9f9c0a69a2ee6e4fba309854aaadaec33
SHA512 60489e3424c4b50bda523da3f9ffd995decc1daf3408a19a31d48ee99e2d52a3ce29a10edcf15d7165247db68bd67aee3f2e95bd0d80089ec95d092e88eaf4ef
SSDEEP 3072:Uy4byvwQpaFzpRKXu9XmkfFTVZKuuGtgh8kGq2MR6gLAqcvn:U5byvw8aF9ou93rZKuuMDqDdLVE
MD5 SHA1 SHA512 SSDEEP

Submit Download

CloudConfigLog

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog
Size 464B
SHA256 b19609c9f2df9aa540e0800abc3a43c928b0127be6a1eb34d3617ae32e78e22f
MD5 9c001baffd390352e763bcb2fb16fad8
SHA1 950b57c63ac18b3976bf27f469dc550526682513
SHA512 86337afd8756013cc2fcf358b4c8bd3ac6a32d2932a9f04df522a1a07f437284bef3710441f30738304f1d9dd19d10c8a3de253413ec3f905d9e28ae8b1b6c92
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 44KB
SHA256 2d5f95e9d4dac02aa394d8c4c1e97de08b1fbcc06219554afb45430c1ecb5564
MD5 929d60f94d94bc1e0b307ca897080d61
SHA1 5f7a38679311efc2e9cf3d03420b603c763c197f
SHA512 e92dbf5f2baaa01b1e60299eb62892d88a54115c0d6f34f6d22374565d259ac538974a0bf4975325e6af2f929830ec64a11d978e9bb20eee1073688a92d3073d
SSDEEP 768:8FhYfJSJLdOuDwLAL3G4CgiRMRaHQlUUL+1qB/bwLjwsaO6DSlN:oYfEhOun3GGRSU6I2jwxlI
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 44KB
SHA256 2c2dbaa47aa24a7f0b987483c19635319acb470b46301b09f6c055b6d2778eea
MD5 7d72907099d68b65daec4d87b4aed8db
SHA1 531df8c2ae4b160b1feee6f0c2b121d4aa0ac6a8
SHA512 e9119f8c58cbc9bacf9d016fe72cacfb080eca9419e95730772834b20425f78a78f251224246ebbe2ead84f47da694ca34cf272f24c163db4ff0c16bb8a7bcfb
SSDEEP 768:8FcYfJSJLdOuDwLA13G4Cgo1QRaHQlUUL+1qB/bwLjwsaO6DSlN:HYfEhOuh3GERSU6I2jwxlI
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 44KB
SHA256 9314d72832cea8d51a29b6b73cc0c8fef3ea2e91333c412a4ef8f2b69d9442b5
MD5 3a9de35faeaec0d23647bc344d5aeecc
SHA1 a17e6293b5eb841b4322a6328c2a3ac1a18d1ce7
SHA512 66a9f99fbf53ae97b23d438985dbe4f82a6a8941c0e2ccc9f5ab48ab5147f118f2ceba57786993c28cd46405efc87d3205c4482e0a618139330a20ddc67786ec
SSDEEP 768:8FlYfJSJLdOuDwLAL3G4CgQhMPaHQlUUL+1qB/bwLjwsaO6DSlN:mYfEhOun3GoPSU6I2jwxlI
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 f7915e21134ac0b61b671276723ecb37d15a4ffca1f85afecc6e377b31b5c1a4
MD5 f7b07411f454af65df6a7e40e99074b0
SHA1 bfd994ac176859abb4c2400b9237c637b17cefbc
SHA512 6e7bba4efb4e45d317e0123264225bf967b43c0f629e0b133753e1b514aa360a7d389930873601b3f05683cff0c37850fdc2f25ed29fe90e8a5fa9b25851de4f
SSDEEP 768:8FqYfJSJLdOuDwLAJ3uCgvhJaHQlUUL+03qB/bwLjwsaO6DSlN:zYfEhOu93wSU6f2jwxlI
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 5f7895f842c97a26792a693d62eb558d28c7b23f0074c65f2f19f4cdfae8297c
MD5 796d9223ee60c3c9c20273ae9f2b5271
SHA1 4d63e8258c0e1dd0c0e454552837a57f275079dd
SHA512 899032d81f72e793fa679f53754e60766a7262f1b1cd78cab63ce9d77990c2def0496b221a54629012b3e894989502e513114f5c82967d33e013adeae628210b
SSDEEP 768:bF5BLv7I5wCPFdV6Zi63rCgDSJaHQlUUL+LymsaO6DSnjm:bJUV6ZL3+SU62mxl0jm
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 2e02845c05523e7a5ff737f7e515b3781a3bf2b55ef82d57c3fdda3304e5400a
MD5 322c9a088ab53375e56c9256c9cf043a
SHA1 4cbbbf37168752ba395ca2126d3ae8552e0eee77
SHA512 740fb10994c6de7665f4b42e130c0bd8c25e7a3686cf0c346ede9b077351c537899ec59235f40946fda1b9b3a644edd655bd24bb0fa09b7f027e38d399384e1f
SSDEEP 768:+F5BLv7I5wCPFdV6Zi63rCgbCJaHQlUUL+8qmsaO6DSnjm:mJUV6ZL3+SU6jmxl0jm
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 04f218f0d563e5d4d701da228d8dd02d19d8d69aec80c40a1226ad0699630e38
MD5 89b3786ce674e929ffaf567d71238333
SHA1 6aa84157733b37003d66035bd086ab23f7caf5e7
SHA512 ea0dc380e7316037a3954b48d1897b68848403b5b16f27de6951facf1464464034cf5dfa0b53e5a03b60118677e4aad97beba62b542d09c68347d880743ac8d7
SSDEEP 768:OFqYfJSJLdOuDwLAo3uCgn1JaHQlUUL+8qB/bwLjwsaO6DSlN:FYfEhOus3ASU6j2jwxlI
MD5 SHA1 SHA512 SSDEEP

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 c25dfa00653ae205584a837e85a999a64054c1de44a43033b4459c71b234bb7f
MD5 980f4f58d9858c6c01b7d8310af13718
SHA1 47fa005a3f000d079df1ef89fa99937f2447092e
SHA512 a4af4ef06dc5f56f8d11fd0a6862ff1fc4828cfe144daaf79c5dee22253e50b73b75e2844168a55b837e67f525dc730b7a4521c269b1333449a4264b83721dc1
MD5 SHA1 SHA512

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 a5b94f5edd8d30e8f866e7e417961b52379d6e7c6a2a837260c1f7603419f705
MD5 23708765ff6c5084792b5ef74095f9ea
SHA1 361e6359f5807120b6cf633e8cc39c4cff796b4b
SHA512 a100c001d046f6a65be1bba122c8a495d4f757cee85312a8da8eeea9fe69fd3df68a65aed09246db40a4d22548f21a5295bcaa32a7ce37f7769acb333cd62aac
MD5 SHA1 SHA512

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 aac7a6692e316152664c74dbb0fb2266f073ae3f1fe55e6073bcd5f485202602
MD5 efe21ef10521626039b0758643f601ac
SHA1 896a499e37fa2030f6af09086d8b7c6b932fd570
SHA512 01718bcfdf376c6b4f85f3a526390b37bae4eb92c8a267b655e5169b4d4615b65cc1cb5381e2bb0d7845a3fb4e957e96925e066ccd5d1f72f26ae77f0e4778f9
MD5 SHA1 SHA512

Submit Download

RevisitationBloomfilter~RFe591f56.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe591f56.TMP
Size 392B
SHA256 181042088ed7213d97bd424ffc87c7252fff457ce338321796d8ec3c19dade7b
MD5 927d2ad5b356ba7e60ff115cd074efaf
SHA1 5d022e20e269d3504ebc04566af7b3910f7731a2
SHA512 a1cbc976a406311bde4afb06ff69c03a0392f17e1442eadc725bde5ee790372542e4e557b9e882dd763140d4603710b936c7911aed6feb6d974f101c1f32df06
MD5 SHA1 SHA512

Submit Download

Advertising

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.34\Mu\Advertising
Size 19KB
SHA256 5989ccf9a58e4ffd47c2422bd8dfcb3ea4e1d412fbdec2291385a9955af9eace
MD5 3495430eefd1e96e8bd95b67ccab0f91
SHA1 54129d2d72e062ad36a66922331818e81bd34df3
SHA512 9197537719b70837ce997cd2b168c6bf6fe877811f81459a0c0f1363b7179960594761df147c85034c628b8e9a3463084ac26fb8bcc3fbc765089adfeea56f6b
SSDEEP 384:/jA5024xyUE2oAklQth8rYWepdFhgX/0lRwjTV2qh8NmrbijF4E5C65aNbC:q0WCoAklQcrJepdFeP0lmjTV2qSV9C6P
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analytics

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.34\Mu\Analytics
Size 4KB
SHA256 163a5318312b814104d244a4b37b676a02f827068820aa60fc069e6346cb2b75
MD5 db9a3dbc4820c8d84a0a569be1234dc0
SHA1 78fe9b49b800627cd2eb458cbe0251591a2a693a
SHA512 a6735713a801d28e644b31f34335e29d55a46d4b263e923cbec9b57fd18f8b0cecf9b78fab578065207080faa5e81156d04c8fbedb436b718893b6d17123742c
SSDEEP 96:2eHeEcb6eD0Hl1LJEmjwsi4RjBzGPeKkF7y5W4jNU/oyw:2/EcWeQ0d4OZkVkW4jNoo1
MD5 SHA1 SHA512 SSDEEP

Submit Download

CompatExceptions

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.34\Mu\CompatExceptions
Size 689B
SHA256 5b462316a51c918d0bae95959bf827cb9c72bbd84ffb0e43b750aa91fbf3ba53
MD5 108de320dc5348d3b6af1f06a4374407
SHA1 90aa226d3c9d50cf4435ecdd2b8b0086d8edeb8b
SHA512 70f30c45e20b7cddd0cba6476af9338975cec8e40b8b19603af5fa859a34c6eb2138957daaa263633fe65213e2186402d05d9d29ad53e8f311335555116314c2
MD5 SHA1 SHA512

Submit Download

Content

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.34\Mu\Content
Size 4KB
SHA256 7869993fcb93b302598643be96c6ab94c4f3be47c9fc344959773c754291376e
MD5 26c006f350f70dbc8c18098b773c3d4c
SHA1 eb015f7010dd74c874675d0599e634027363b7b4
SHA512 0f56d119a5f89689d0e45a6163133048aa95255447c4156d4fb2565f45c32dbb95adc39666a833d2127ce57f3f4198ce45d2a174955ec088bcdd2f74f59b3f6b
SSDEEP 96:lApOOxO7bthcySBm1yJJzyEsQBCETe+yH:+xqT6mcJJz4QBXTeBH
MD5 SHA1 SHA512 SSDEEP

Submit Download

Cryptomining

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.34\Mu\Cryptomining
Size 668B
SHA256 1e92781e88ee786bf6d1d5cb71d467a92fe7f281f2d1e548524bf119d7ddc700
MD5 95aa820d67ec466eb3444a9458eb7e56
SHA1 f93e178ff40310e071e4d596f0aff0514666f787
SHA512 15281c334f013f0200ca2d6faaaec81dc5602058cf3522b805e21ca5f031cb4ca68606d353e6745bfb86f07fdd6ccc892942aee5ad7cf0f9f0798a4d7f497a47
MD5 SHA1 SHA512

Submit Download

Entities

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.34\Mu\Entities
Size 68KB
SHA256 f6e93c83d9e3cfdff064535647cee76fc85aa1c86fd22a93dcf3d2c377346d94
MD5 478a605d5578236f2d1ddc93c2f22456
SHA1 917f05453d497b3e3de684a905e141972c34a267
SHA512 26d75309976fac0bd03ffe7596209c50ead7518584dd9f27d12a86d80ecec0889bb58da1b8dc8cdb38fc6bfdca7928a54c5a15903c4b8d293633d4d58ec147b5
SSDEEP 1536:Wz20p1W8VMVLwecMFUh+oP9jt1PNEOjy+in:W2W1WUMzUT1jpw
MD5 SHA1 SHA512 SSDEEP

Submit Download

Fingerprinting

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.34\Mu\Fingerprinting
Size 1KB
SHA256 c7d2b05ff6e790af78b0f1f341219fdb554dc5e14fbf3e3981819fccdd1ddfed
MD5 3d90e5235a4bee8f1dccfc2aecf7c585
SHA1 5beb333084b3af33e7fbd8c83326e18650a87f85
SHA512 c81af723cadaa57f638b9dbc60aca5d2600cebb8282d78a7b86edc6b473bd3a1768c8fde1b11d50b6b967b2866495655de09577973778038434bf4b513ba74a7
MD5 SHA1 SHA512

Submit Download

Other

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.34\Mu\Other
Size 34B
SHA256 2b4a47b82cbe70e34407c7df126a24007aff8b45d5716db384d27cc1f3b30707
MD5 cd0395742b85e2b669eaec1d5f15b65b
SHA1 43c81d1c62fc7ff94f9364639c9a46a0747d122e
SHA512 4df2ce734e2f7bc5f02bb7845ea801b57dcf649565dd94b1b71f578b453ba0a17c61ccee73e7cff8f23cdd6aa37e55be5cb15f4767ff88a9a06de3623604fbf0
MD5 SHA1 SHA512

Submit Download

Social

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.34\Mu\Social
Size 754B
SHA256 4955c3e7f56641a4ae0ce9c79b4ceee4b21733b0f6dedc980bf8d822a792eba2
MD5 1d06d58fe9131c14ba5ba5ff740b020f
SHA1 e6ed812e23e201b20170e928686a5d612165df85
SHA512 2854c73c6ef4d271d0e992113732ad65e406d6310711551952b4d451e2c577a2c3dcb06052e3ab30003b01619a39e87e5dd28d54f459f94efe879d1a79039b8f
MD5 SHA1 SHA512

Submit Download

Advertising

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.34\Sigma\Advertising
Size 20KB
SHA256 868f3ed3f86f1e82a5041f0a7b382bdd720e411531df2dc680da34eb60580b75
MD5 6959a6835772c67f4e72105e4be259a2
SHA1 72d1fe9070a5c0eed55d989cbd961dbc5442796c
SHA512 98085236a15e810642602e5dd475aa5a9532bb38917aef784e977bb398b3f9e39f7966370d39c1b554cf3e39858713e8b45bc27fbdb8a701b2a903e453a67591
SSDEEP 384:5z8Qpkm9jXUmEtMANAgFYNX8htrCoEeZCNyn9CbRqKi8iyZd0KE:1lb9TU/t9NAgFYNMhte1eZ0yn9is38iT
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analytics

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.34\Sigma\Analytics
Size 3KB
SHA256 33d2b069ea874c12ec96242ca7eb539c1086d38ac6c2e4858c0efcd74fc632e5
MD5 e018dfa2df54c80ffbfd02c6d2ff5430
SHA1 de3f876b05355c6024d76f1bc24a552e532e2a2a
SHA512 b6d7886b4094837b271d1aa1f72b8c521970527552186604bcb83e17f85fa4a22e658628f79eca7d164ace781555abaa07c423a380fe87006aaed77f53e37838
MD5 SHA1 SHA512

Submit Download

Content

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.34\Sigma\Content
Size 5KB
SHA256 d99df5936c57a50aebb7f0a3ca65fcc682f523ace93641fbcfb9b09cfb71c739
MD5 dee2a727844dd3cea088941e82722406
SHA1 24ebec9b92eeb6af83841ab02e858f415580f719
SHA512 e48edf5f6dcbbd615f42f1b3181b2998bd700508094466009a6a48193a48c3e30e6c4d71cc43aae81d18a88ad9fd7e28eb50a0a52ca6889a270001fecdb64dfb
SSDEEP 96:PwYuGYJywH2R7pBBYy+wf0yhZ7RBJ1ja8nBwGhQmxpFD1Lcg:Pnf03H2/KwfNL7vNTBR
MD5 SHA1 SHA512 SSDEEP

Submit Download

Cryptomining

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.34\Sigma\Cryptomining
Size 32B
SHA256 696e930706b5d391eb8778f73b0627ffc2be7f6c9a3e7659170d9d37fc4a97b5
MD5 4ec1eda0e8a06238ff5bf88569964d59
SHA1 a2e78944fcac34d89385487ccbbfa4d8f078d612
SHA512 c9b1ed7b61f26d94d7f5eded2d42d40f3e4300eee2319fe28e04b25cdb6dd92daf67828bff453bf5fc8d7b6ceb58cab319fc0daac9b0050e27a89efe74d2734e
MD5 SHA1 SHA512

Submit Download

Entities

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.34\Sigma\Entities
Size 106KB
SHA256 0f305323c627cf0c790831c7e0bc38455b7a99983c4ab5bd9d2d9567766c3499
MD5 751e7cc660220e7464935a9b90643274
SHA1 05a725af45c74a9e129839b2fa7acca5d83066d8
SHA512 bc879a9bed224b6abdaed2581f948fcad53361b17dc76d5b5df10607ac893db2f39bc5ce5fbbe86e6392ae66f29fc93ac1079fd2d029b9338697b004325c4b36
SSDEEP 1536:PYNbfqJF3b6wgb6hh2Dgf+x8GC2kMYdSKySPxVMRjAxUR9Wv:Gbi3M6hjf+W2kMk26VMRjaUX4
MD5 SHA1 SHA512 SSDEEP

Submit Download

Fingerprinting

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.34\Sigma\Fingerprinting
Size 2KB
SHA256 ec0fcbf71d58e707aaf6ba8d3c0719972f26727febe03f8efbf570b9635faddf
MD5 5330ccc991b45c6f2777d23c7d8afe8d
SHA1 d11187c035458fe1201608a91062962903de2e53
SHA512 2db42b7a6b7f2170f6cad2a26a606ff6357cb8c707ba9947baab14dd7f566df04a274e46e36cee72c43ee87ebf4d455b4af3f6da973f29bdbefeb0304f1d6f93
MD5 SHA1 SHA512

Submit Download

Other

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.34\Sigma\Other
Size 198B
SHA256 c9ab8dbc87043c71dd649fc06bb006e7f62e81c973c37b125afb88e654e436f8
MD5 7bb2f4076e4f47781b77d811b21ef1ff
SHA1 fc0feddf6f52841bbd780d21b8e0ddff74fd70ac
SHA512 28356614bc38576ecb37218f9f6f631bd9e55573206c3aa854b91956a33fc828c71f42c7dc7dc6aa86540dab8e345b8f88bf9c6eb56e49824f492854c193b27b
MD5 SHA1 SHA512

Submit Download

Social

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.34\Sigma\Social
Size 3KB
SHA256 e520603e6fb543cd078b2a7dbd8ccfc175e9aecf71654fc19785927a014d3435
MD5 fbfc314bba2160b09a3376521c762772
SHA1 3566357486c5d466958334e813c90c0a97bfc985
SHA512 e4383491ce5170d0daf4abee61484c62611dfc604549b537d0080f24bfb8cf379ec3efbfb6caf10e7c066ec06457fb077832d5f780d226f0a957f624e0ba9383
MD5 SHA1 SHA512

Submit Download

Staging

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.34\Sigma\Staging
Size 36B
SHA256 411a706def2e70f96a507208bf80bceb93e950c4c2d671cd1ddb4134ce54b2a9
MD5 0163de1b14421d4eee3757ff76fd81e4
SHA1 96c75c4fe1e3f33a367f45293bd1bd8bff1c06f4
SHA512 80114d59db8f3654dd6821589e5ad03daa923a35610a372756a8865b3e769621e32ef2aed92c2494de2b9fc06d9796b12f1e3bb75873ed794e8c9ae8a0d5e965
MD5 SHA1 SHA512

Submit Download

typosquatting_list.pb

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Typosquatting\2025.11.22.5\typosquatting_list.pb
Size 1.4MB
SHA256 286b76c97dee844dc860a5f918d478087c8d22259eee5b7ef0573f162086a5c1
MD5 c38931342171129beeb09afd417d93d8
SHA1 c9be3dd2696f67a9370dd6b6b849f5e93d00aa10
SHA512 988c6ea7da01123a0632e358353b1a7bce6c2d7c9114829ab3caa90d73fd38c565d424ef8376b0271b137284c5128067d1ad467302dc3124d7fed945028ac89a
SSDEEP 12288:2Ok223Fk85IHRG85ZNVpXRrNAIArejy8i2e7:kqiIHRGeNV1N+jre8
MD5 SHA1 SHA512 SSDEEP

Submit Download

ghbmnnjooekpmoecnnnilnnbdlolhkhi_1.8db781cdf6d05cbf452dfaf7eaec6c4818e2c979fbe876c2178a449681374b09

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\ghbmnnjooekpmoecnnnilnnbdlolhkhi_1.8db781cdf6d05cbf452dfaf7eaec6c4818e2c979fbe876c2178a449681374b09
Size 161KB
SHA256 8db781cdf6d05cbf452dfaf7eaec6c4818e2c979fbe876c2178a449681374b09
MD5 f4e4a2ec27084ae8e2d291b22cfba16a
SHA1 75ef323d2573847b366647019ac6486362fc40b5
SHA512 606ff1219382c3e4367ec8e929928b21031a3c9340c9e2064e1297a879f22ccc4f9289b59db7c35cf78c5b97d8827a3a2c37c62ed40aceea29d1c59bd0d90692
SSDEEP 3072:SBBV1VTKa0F/TnqOK7CcvlUsUc7/3fDN4UKzCGLr8Xqjj6iI+onWr+SZuTF8YB:S/V3mbZrqOUpUgPbN4UXGLqqjGiIXWGB
MD5 SHA1 SHA512 SSDEEP

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 74d0bc7ac865cc1356ced38189e9449f98cf8ba92d3b5bc224173841cf31ebae
MD5 322a0aad40fa7999139f6d230ca59545
SHA1 11c5ba4c6eb6748e40c4b1bd24c79039569e4576
SHA512 bc687fd991f2a8f390013a0822995d627f85d8069a13dcfa8861bb6bd2725cb758394f05102caec2b2d75d76af417c334729467135d6809960f3497ce6688550
MD5 SHA1 SHA512

Submit Download

note.txt

Path C:\note.txt
Size 218B
SHA256 8e9f20f6864c66576536c0b866c6ffdcf11397db67fe120e972e244c3c022270
MD5 afa6955439b8d516721231029fb9ca1b
SHA1 087a043cc123c0c0df2ffadcf8e71e3ac86bbae9
SHA512 5da21a31fbc4e8250dffed30f66b896bdf007ac91948140334fe36a3f010e1bac3e70a07e9f3eb9da8633189091fd5cadcabbaacd3e01da0fe7ae28a11b3dddf
MD5 SHA1 SHA512

Submit Download

memory/3964-387-0x000001FC55510000-0x000001FC56510000-memory.dmp

Download