6805b3c7c5234bd7f0fdc6355fddbb53152f605865d96deb5ed115b67baff445

max time kernel
372s
max time network
375s
platform
windows10-2004_x64
resource
win10v2004-20251016-de
resource tags

arch:x64arch:x86image:win10v2004-20251016-delocale:de-deos:windows10-2004-x64systemwindows
submitted
22/11/2025, 17:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Malware-1-master/MEMZ-Clean.bat
Size 9KB
Sample251122-vsrmhabm4v
SHA256 5c3fde60c178ed0306dd3e396032acdc9bc55c690e27a926923dd18238bbd64c
MD5 bbae81b88416d8fba76dd3145a831d19
SHA1 42fa0e1b90ad49f66d4ab96c8cca02f81248da8b
SHA512 f03ac63bbb504cb53dc896c2bec8666257034b1c4a5827a4ad75c434af05f1cd631a814cc8689e60210e4ca757e61390db8d222f05bf9f3a0fa7026bdf8c4368
SSDEEP 192:XBOTDzoOgdlf7MAdTyQuHq2b1vXei2SLca5icrLJlz3:ss/tDyQuHZddL5Jlz3
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

discovery execution

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2960	MEMZ.exe

Drops desktop.ini file(s) 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Videos\Captures\desktop.ini	svchost.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MEMZ.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	svchost.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 15 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134083057605263119"	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1872826379-1646062183-4110371642-1000\{E8FFDD21-D0F7-48BE-9DF3-4B9E2C482298}	svchost.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
936	chrome.exe
936	chrome.exe
936	chrome.exe
936	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
936	chrome.exe
936	chrome.exe
936	chrome.exe
936	chrome.exe
2104	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: 33	4240	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	4240	AUDIODG.EXE
Token: SeShutdownPrivilege	936	chrome.exe
Token: SeCreatePagefilePrivilege	936	chrome.exe
Token: SeShutdownPrivilege	936	chrome.exe
Token: SeCreatePagefilePrivilege	936	chrome.exe
Token: SeShutdownPrivilege	936	chrome.exe
Token: SeCreatePagefilePrivilege	936	chrome.exe
Token: SeShutdownPrivilege	936	chrome.exe
Token: SeCreatePagefilePrivilege	936	chrome.exe
Token: SeShutdownPrivilege	936	chrome.exe
Token: SeCreatePagefilePrivilege	936	chrome.exe
Token: SeShutdownPrivilege	936	chrome.exe
Token: SeCreatePagefilePrivilege	936	chrome.exe
Token: SeShutdownPrivilege	936	chrome.exe
Token: SeCreatePagefilePrivilege	936	chrome.exe
Token: SeShutdownPrivilege	936	chrome.exe
Token: SeCreatePagefilePrivilege	936	chrome.exe
Token: SeShutdownPrivilege	936	chrome.exe
Token: SeCreatePagefilePrivilege	936	chrome.exe
Token: SeShutdownPrivilege	936	chrome.exe
Token: SeCreatePagefilePrivilege	936	chrome.exe
Token: SeShutdownPrivilege	936	chrome.exe
Token: SeCreatePagefilePrivilege	936	chrome.exe
Token: SeShutdownPrivilege	936	chrome.exe
Token: SeCreatePagefilePrivilege	936	chrome.exe
Token: SeShutdownPrivilege	936	chrome.exe
Token: SeCreatePagefilePrivilege	936	chrome.exe
Token: SeShutdownPrivilege	936	chrome.exe
Token: SeCreatePagefilePrivilege	936	chrome.exe
Token: SeShutdownPrivilege	936	chrome.exe
Token: SeCreatePagefilePrivilege	936	chrome.exe
Token: SeShutdownPrivilege	936	chrome.exe
Token: SeCreatePagefilePrivilege	936	chrome.exe
Token: SeShutdownPrivilege	936	chrome.exe
Token: SeCreatePagefilePrivilege	936	chrome.exe
Token: SeShutdownPrivilege	936	chrome.exe
Token: SeCreatePagefilePrivilege	936	chrome.exe
Token: SeShutdownPrivilege	936	chrome.exe
Token: SeCreatePagefilePrivilege	936	chrome.exe
Token: SeShutdownPrivilege	936	chrome.exe
Token: SeCreatePagefilePrivilege	936	chrome.exe
Token: SeShutdownPrivilege	936	chrome.exe
Token: SeCreatePagefilePrivilege	936	chrome.exe
Token: SeShutdownPrivilege	936	chrome.exe
Token: SeCreatePagefilePrivilege	936	chrome.exe
Token: SeShutdownPrivilege	936	chrome.exe
Token: SeCreatePagefilePrivilege	936	chrome.exe
Token: SeShutdownPrivilege	936	chrome.exe
Token: SeCreatePagefilePrivilege	936	chrome.exe
Token: SeShutdownPrivilege	936	chrome.exe
Token: SeCreatePagefilePrivilege	936	chrome.exe
Token: SeShutdownPrivilege	936	chrome.exe
Token: SeCreatePagefilePrivilege	936	chrome.exe
Token: SeShutdownPrivilege	936	chrome.exe
Token: SeCreatePagefilePrivilege	936	chrome.exe
Token: SeShutdownPrivilege	936	chrome.exe
Token: SeCreatePagefilePrivilege	936	chrome.exe
Token: SeShutdownPrivilege	936	chrome.exe
Token: SeCreatePagefilePrivilege	936	chrome.exe
Token: SeShutdownPrivilege	936	chrome.exe
Token: SeCreatePagefilePrivilege	936	chrome.exe
Token: SeShutdownPrivilege	936	chrome.exe
Token: SeCreatePagefilePrivilege	936	chrome.exe

Suspicious use of FindShellTrayWindow 57 IoCs

pid	Process
2960	MEMZ.exe
2960	MEMZ.exe
2960	MEMZ.exe
936	chrome.exe
936	chrome.exe
936	chrome.exe
936	chrome.exe
936	chrome.exe
936	chrome.exe
936	chrome.exe
936	chrome.exe
936	chrome.exe
936	chrome.exe
936	chrome.exe
936	chrome.exe
936	chrome.exe
936	chrome.exe
936	chrome.exe
936	chrome.exe
936	chrome.exe
936	chrome.exe
936	chrome.exe
936	chrome.exe
936	chrome.exe
936	chrome.exe
936	chrome.exe
936	chrome.exe
936	chrome.exe
936	chrome.exe
936	chrome.exe
936	chrome.exe
936	chrome.exe
936	chrome.exe
936	chrome.exe
936	chrome.exe
936	chrome.exe
936	chrome.exe
936	chrome.exe
936	chrome.exe
936	chrome.exe
936	chrome.exe
936	chrome.exe
936	chrome.exe
936	chrome.exe
936	chrome.exe
936	chrome.exe
936	chrome.exe
936	chrome.exe
936	chrome.exe
936	chrome.exe
936	chrome.exe
936	chrome.exe
936	chrome.exe
936	chrome.exe
936	chrome.exe
936	chrome.exe
936	chrome.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
2960	MEMZ.exe
2960	MEMZ.exe
2960	MEMZ.exe
2960	MEMZ.exe
2960	MEMZ.exe
2960	MEMZ.exe
936	chrome.exe
936	chrome.exe
936	chrome.exe
936	chrome.exe
936	chrome.exe
936	chrome.exe
936	chrome.exe
936	chrome.exe
936	chrome.exe
936	chrome.exe
936	chrome.exe
936	chrome.exe
936	chrome.exe
936	chrome.exe
936	chrome.exe
936	chrome.exe
936	chrome.exe
936	chrome.exe
936	chrome.exe
936	chrome.exe
936	chrome.exe
936	chrome.exe
936	chrome.exe
936	chrome.exe
936	chrome.exe
936	chrome.exe
936	chrome.exe
936	chrome.exe
936	chrome.exe
936	chrome.exe
936	chrome.exe
936	chrome.exe
936	chrome.exe
936	chrome.exe
936	chrome.exe
936	chrome.exe
936	chrome.exe
936	chrome.exe
936	chrome.exe
936	chrome.exe
936	chrome.exe
936	chrome.exe
936	chrome.exe
936	chrome.exe
936	chrome.exe
936	chrome.exe
936	chrome.exe
936	chrome.exe
2960	MEMZ.exe
2960	MEMZ.exe
2960	MEMZ.exe
2960	MEMZ.exe
2960	MEMZ.exe
2960	MEMZ.exe
2960	MEMZ.exe
2960	MEMZ.exe
2960	MEMZ.exe
2960	MEMZ.exe

Suspicious use of SetWindowsHookEx 11 IoCs

pid	Process
2960	MEMZ.exe
2960	MEMZ.exe
2960	MEMZ.exe
2960	MEMZ.exe
2960	MEMZ.exe
2960	MEMZ.exe
2960	MEMZ.exe
2960	MEMZ.exe
2960	MEMZ.exe
2960	MEMZ.exe
2960	MEMZ.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4440 wrote to memory of 4964	4440	cmd.exe	84
PID 4440 wrote to memory of 4964	4440	cmd.exe	84
PID 4440 wrote to memory of 2960	4440	cmd.exe	85
PID 4440 wrote to memory of 2960	4440	cmd.exe	85
PID 4440 wrote to memory of 2960	4440	cmd.exe	85
PID 936 wrote to memory of 4192	936	chrome.exe	107
PID 936 wrote to memory of 4192	936	chrome.exe	107
PID 4744 wrote to memory of 3940	4744	chrome.exe	109
PID 4744 wrote to memory of 3940	4744	chrome.exe	109
PID 936 wrote to memory of 2448	936	chrome.exe	111
PID 936 wrote to memory of 2448	936	chrome.exe	111
PID 936 wrote to memory of 4844	936	chrome.exe	112
PID 936 wrote to memory of 4844	936	chrome.exe	112
PID 936 wrote to memory of 4844	936	chrome.exe	112
PID 936 wrote to memory of 4844	936	chrome.exe	112
PID 936 wrote to memory of 4844	936	chrome.exe	112
PID 936 wrote to memory of 4844	936	chrome.exe	112
PID 936 wrote to memory of 4844	936	chrome.exe	112
PID 936 wrote to memory of 4844	936	chrome.exe	112
PID 936 wrote to memory of 4844	936	chrome.exe	112
PID 936 wrote to memory of 4844	936	chrome.exe	112
PID 936 wrote to memory of 4844	936	chrome.exe	112
PID 936 wrote to memory of 4844	936	chrome.exe	112
PID 936 wrote to memory of 4844	936	chrome.exe	112
PID 936 wrote to memory of 4844	936	chrome.exe	112
PID 936 wrote to memory of 4844	936	chrome.exe	112
PID 936 wrote to memory of 4844	936	chrome.exe	112
PID 936 wrote to memory of 4844	936	chrome.exe	112
PID 936 wrote to memory of 4844	936	chrome.exe	112
PID 936 wrote to memory of 4844	936	chrome.exe	112
PID 936 wrote to memory of 4844	936	chrome.exe	112
PID 936 wrote to memory of 4844	936	chrome.exe	112
PID 936 wrote to memory of 4844	936	chrome.exe	112
PID 936 wrote to memory of 4844	936	chrome.exe	112
PID 936 wrote to memory of 4844	936	chrome.exe	112
PID 936 wrote to memory of 4844	936	chrome.exe	112
PID 936 wrote to memory of 4844	936	chrome.exe	112
PID 936 wrote to memory of 4844	936	chrome.exe	112
PID 936 wrote to memory of 4844	936	chrome.exe	112
PID 936 wrote to memory of 4844	936	chrome.exe	112
PID 936 wrote to memory of 4844	936	chrome.exe	112
PID 936 wrote to memory of 1288	936	chrome.exe	113
PID 936 wrote to memory of 1288	936	chrome.exe	113
PID 936 wrote to memory of 1288	936	chrome.exe	113
PID 936 wrote to memory of 1288	936	chrome.exe	113
PID 936 wrote to memory of 1288	936	chrome.exe	113
PID 936 wrote to memory of 1288	936	chrome.exe	113
PID 936 wrote to memory of 1288	936	chrome.exe	113
PID 936 wrote to memory of 1288	936	chrome.exe	113
PID 936 wrote to memory of 1288	936	chrome.exe	113
PID 936 wrote to memory of 1288	936	chrome.exe	113
PID 936 wrote to memory of 1288	936	chrome.exe	113
PID 936 wrote to memory of 1288	936	chrome.exe	113
PID 936 wrote to memory of 1288	936	chrome.exe	113
PID 936 wrote to memory of 1288	936	chrome.exe	113
PID 936 wrote to memory of 1288	936	chrome.exe	113
PID 936 wrote to memory of 1288	936	chrome.exe	113
PID 936 wrote to memory of 1288	936	chrome.exe	113
PID 936 wrote to memory of 1288	936	chrome.exe	113
PID 936 wrote to memory of 1288	936	chrome.exe	113
PID 936 wrote to memory of 1288	936	chrome.exe	113
PID 936 wrote to memory of 1288	936	chrome.exe	113
PID 936 wrote to memory of 1288	936	chrome.exe	113
PID 936 wrote to memory of 1288	936	chrome.exe	113

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Malware-1-master\MEMZ-Clean.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:4440
- C:\Windows\system32\cscript.exe
  cscript x.js
  2⤵
  PID:4964
- C:\Users\Admin\AppData\Roaming\MEMZ.exe
  "C:\Users\Admin\AppData\Roaming\MEMZ.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:2960

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x320 0x310
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4240

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:936
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0x120,0x124,0x128,0xf8,0x12c,0x7fffcf9edcf8,0x7fffcf9edd04,0x7fffcf9edd10
  2⤵
  PID:4192
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=de --service-sandbox-type=none --string-annotations --field-trial-handle=1952,i,16632924664331966065,16383141321468279330,262144 --variations-seed-version=20251016-090045.586000 --mojo-platform-channel-handle=2076 /prefetch:3
  2⤵
  PID:2448
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=2012,i,16632924664331966065,16383141321468279330,262144 --variations-seed-version=20251016-090045.586000 --mojo-platform-channel-handle=1992 /prefetch:2
  2⤵
  PID:4844
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=de --service-sandbox-type=service --string-annotations --field-trial-handle=2412,i,16632924664331966065,16383141321468279330,262144 --variations-seed-version=20251016-090045.586000 --mojo-platform-channel-handle=2472 /prefetch:8
  2⤵
  PID:1288
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=de --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3144,i,16632924664331966065,16383141321468279330,262144 --variations-seed-version=20251016-090045.586000 --mojo-platform-channel-handle=3156 /prefetch:1
  2⤵
  PID:4624
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=de --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3164,i,16632924664331966065,16383141321468279330,262144 --variations-seed-version=20251016-090045.586000 --mojo-platform-channel-handle=3208 /prefetch:1
  2⤵
  PID:1088
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --extension-process --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=de --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4364,i,16632924664331966065,16383141321468279330,262144 --variations-seed-version=20251016-090045.586000 --mojo-platform-channel-handle=4444 /prefetch:2
  2⤵
  PID:3820
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=de --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=4868,i,16632924664331966065,16383141321468279330,262144 --variations-seed-version=20251016-090045.586000 --mojo-platform-channel-handle=4852 /prefetch:1
  2⤵
  PID:380
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=de --service-sandbox-type=none --string-annotations --field-trial-handle=5412,i,16632924664331966065,16383141321468279330,262144 --variations-seed-version=20251016-090045.586000 --mojo-platform-channel-handle=5432 /prefetch:8
  2⤵
  PID:1680
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=de --service-sandbox-type=none --message-loop-type-ui --string-annotations --field-trial-handle=5672,i,16632924664331966065,16383141321468279330,262144 --variations-seed-version=20251016-090045.586000 --mojo-platform-channel-handle=244 /prefetch:8
  2⤵
  PID:5736
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=de --service-sandbox-type=none --message-loop-type-ui --string-annotations --field-trial-handle=5700,i,16632924664331966065,16383141321468279330,262144 --variations-seed-version=20251016-090045.586000 --mojo-platform-channel-handle=5952 /prefetch:8
  2⤵
  PID:5744
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=de --service-sandbox-type=none --message-loop-type-ui --string-annotations --field-trial-handle=5696,i,16632924664331966065,16383141321468279330,262144 --variations-seed-version=20251016-090045.586000 --mojo-platform-channel-handle=5748 /prefetch:8
  2⤵
  PID:5764

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4744
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7fffcf9edcf8,0x7fffcf9edd04,0x7fffcf9edd10
  2⤵
  PID:3940

C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"
1⤵
PID:4120

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4300

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
PID:1456

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --default-search-provider=? --out-pipe-name=MSEdgeDefaultd0a6ec04hada7h46cfh81d0h5f49244b5b37
1⤵
PID:5044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --default-search-provider=? --out-pipe-name=MSEdgeDefaultd0a6ec04hada7h46cfh81d0h5f49244b5b37 --edge-skip-compat-layer-relaunch
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  PID:2104
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x238,0x23c,0x240,0x234,0x2ac,0x7fffca05f208,0x7fffca05f214,0x7fffca05f220
    3⤵
    PID:1284
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=de --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=2008,i,89205639305555837,13660370665931202037,262144 --variations-seed-version --mojo-platform-channel-handle=2352 /prefetch:3
    3⤵
    PID:5324
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1892,i,89205639305555837,13660370665931202037,262144 --variations-seed-version --mojo-platform-channel-handle=1888 /prefetch:2
    3⤵
    PID:5340
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=de --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2456,i,89205639305555837,13660370665931202037,262144 --variations-seed-version --mojo-platform-channel-handle=2628 /prefetch:8
    3⤵
    PID:5360
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --extension-process --renderer-sub-type=extension --video-capture-use-gpu-memory-buffer --lang=de --js-flags=--ms-user-locale=de_DE --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3692,i,89205639305555837,13660370665931202037,262144 --variations-seed-version --mojo-platform-channel-handle=3700 /prefetch:2
    3⤵
    PID:5496

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:5452

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DevicesFlow -s DevicesFlowUserSvc
1⤵
PID:5784

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --default-search-provider=? --out-pipe-name=MSEdgeDefault5ad432a5h019ch4c91hb5b3h5c2931e12cf6
1⤵
- Enumerates system info in registry
PID:5548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x258,0x25c,0x260,0x254,0x310,0x7fffca05f208,0x7fffca05f214,0x7fffca05f220
  2⤵
  PID:5512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=de --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1868,i,5875997788444120860,7849648702784711316,262144 --variations-seed-version --mojo-platform-channel-handle=2224 /prefetch:3
  2⤵
  PID:2732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2196,i,5875997788444120860,7849648702784711316,262144 --variations-seed-version --mojo-platform-channel-handle=2192 /prefetch:2
  2⤵
  PID:6088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=de --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2524,i,5875997788444120860,7849648702784711316,262144 --variations-seed-version --mojo-platform-channel-handle=3228 /prefetch:8
  2⤵
  PID:5304

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:5404

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --default-search-provider=? --out-pipe-name=MSEdgeDefault309d2913h2309h4aceh835ahba2d13b35710
1⤵
- Enumerates system info in registry
PID:5464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x258,0x25c,0x260,0x254,0x268,0x7fffca05f208,0x7fffca05f214,0x7fffca05f220
  2⤵
  PID:3864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=de --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1952,i,8886283881920805735,1311769980042676511,262144 --variations-seed-version --mojo-platform-channel-handle=2376 /prefetch:3
  2⤵
  PID:5300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2348,i,8886283881920805735,1311769980042676511,262144 --variations-seed-version --mojo-platform-channel-handle=2344 /prefetch:2
  2⤵
  PID:5348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=de --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2308,i,8886283881920805735,1311769980042676511,262144 --variations-seed-version --mojo-platform-channel-handle=2392 /prefetch:8
  2⤵
  PID:5248

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:6032

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService
1⤵
- Drops desktop.ini file(s)
- Checks processor information in registry
- Modifies registry class
PID:6112

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --default-search-provider=? --out-pipe-name=MSEdgeDefault63f12f44h30f0h4349hb316h3fb122b985e9
1⤵
- Enumerates system info in registry
PID:1828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x258,0x25c,0x260,0x254,0x280,0x7fffca05f208,0x7fffca05f214,0x7fffca05f220
  2⤵
  PID:4836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=de --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1712,i,9954276047116637301,18278026879955691714,262144 --variations-seed-version --mojo-platform-channel-handle=2196 /prefetch:3
  2⤵
  PID:5220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2168,i,9954276047116637301,18278026879955691714,262144 --variations-seed-version --mojo-platform-channel-handle=2164 /prefetch:2
  2⤵
  PID:4264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=de --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=1904,i,9954276047116637301,18278026879955691714,262144 --variations-seed-version --mojo-platform-channel-handle=2524 /prefetch:8
  2⤵
  PID:5564

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:5488

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
Size 40B
SHA256 de1b13ca2ae4acc6d92f27c07f89f30ab29a82a5ef610d6f65149527c7384a62
MD5 5347b8556b095b7fb326a63c8ea921ea
SHA1 d844afb52a0e7e9bd8538bf7fbf909e089c8675e
SHA512 2415b7291fb2b8e760adde638c420b784f48edeac42f2d18a881cbc9adfadb12282a80b6ccc431582c884f4de0082c04d4e366a875d7a2ce8742040d391fa2f9
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 19e038ac60474d3eb617f37dc89f868b9da8d0da3ec03129eeef036af3f331b7
MD5 440dfc609716b207f24816463961537e
SHA1 99f0b5cd0874efffe803b544b335351643647aaf
SHA512 fed8dc39f14346910cb3c7ac95b77029faa510907e87998e6d5cd48d70a029a420801b70c120c2bddd6f6952f4779d1ff91b223d38657b680103726109cf8396
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 aba0f2e7c71686cd9a23d890d5953afc8423db26d6748263c1dae16279316373
MD5 83ba738c84cee70222ecbf871ecb5bf8
SHA1 7f43209d8b3751dd2fb486b63ca23681cd812dc9
SHA512 0b35f818ab961daa5d547bd85cf7366fb59e9097f8f727edf5195c1a1d3aa93440cb1ee482419adbebd212af3bf29e0b375e465ab6597dfbbcb33d54a9eb0840
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 10KB
SHA256 8a179d05f0c922f1689fd22a0614a9f647f40d1d00d5eb18b194ab9c7f13fa26
MD5 876bb3c4668c395ce9a9c489ea4a337a
SHA1 78cc8ee9db741dbe7a23c2d7a9036e6f2c5be4fe
SHA512 9150c17dc6a71bac32bc6c4bc18707cebacb105710c124cae729eeb6d1dd10ea3a2202762f72684c3525ddb696c9524e4e24607ed9a03274ddf7e21c9bcb656e
SSDEEP 192:IpRXKQj/GsoZ8PRpm9LHS+WN4weRLzHTvckwypQyIsnA/gNar:IpR6QLXm5cuRnHoMZu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 10KB
SHA256 668adf6243f2c4a0d9403b5f2a61a49ed8b8b4848730776bfff7dd9aceb8beb9
MD5 fa67b4fb301a1c80350a1d8072aa1d72
SHA1 ece80c9b875872a40a4646aa68a9b7011125a9e9
SHA512 4790a155414ed8dc554a2ab442844ba0d9750bf75b153d9349817e4ec31a7c2b369525a110d82a77a92ab620460745743ca42adb03fbf6296ad3b12d5935af2f
SSDEEP 192:IpTXKQj/GsoZ8PRpm9LHS+WN4weRLzHTvckwypQyIsnA/gNar:IpT6QLXm5cuRnHoMZu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 16KB
SHA256 2f2d113faeee5af9b1b82353263798403e1c1de76bfaf927dde0270f3ccb7145
MD5 75b7418775b260798936454ccbe531b8
SHA1 cbecab18aa40ae9a575bfe86603a18a6b49582c9
SHA512 06201a39b5f9c0fbe8a6390a224fca5ad7f011fe5f7511ceb8b5d41d80d61ef2478a912ef1b1d45bb1c387e8ea5a4b1a6318fc6e7081df898f16a066f2c9c3d8
SSDEEP 384:f/T37pLkdLco9XmXtiPkXqKf/pUZNCgVLH2Hf1bOrUxwHw3/Gbx:f737pLkdLhdstiPkXqKf/pUZNCgVLH2S
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 292eb128b1bb669f05460581c8304df54f41391fb440b49ddbe8d7766fb0e596
MD5 5b392503b1c8c8377ddf4e6c5e8dcd9f
SHA1 69b0a8531b268a9a16bdbd9ee6b5e35d8d634ab1
SHA512 491dd6da93103e823ec34786e2ea9fd1144248ea4aa6ef5170310567fb858aa309b63d9860000316461fc36f443ac280fb5bc80e0d3db197379da927f797f80d
MD5 SHA1 SHA512

Submit Download

the-real-index~RFe5c45bb.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5c45bb.TMP
Size 48B
SHA256 cec0cabe0a4d1a4fe8fe0bf1c72a777418bb0cbef2fafd7b6efe217b7f665dc3
MD5 198ad566761362e60ca09a4565b6f697
SHA1 a1e955866d30adcf4835b348e7e4a34ec4f276cb
SHA512 eb821217833c5efe531e6551ab32efc167d6b4e57af8a810dc108f4f8215ae64a344c7f5bb62c10991965a7eb03d4acbdbb58d24e424ef7b45741009c8d81400
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 233KB
SHA256 51a2e321a9fd23581ff2bd67be2886e3369c90eaaedc32ccc56f5ed64aefdd74
MD5 aa293e7f1f34860357ef8446a057782a
SHA1 7512ed95364dded2b18a83710def58e18128384a
SHA512 26c261aa27a328506948548d1136b58b9ec1f4a521f45ec3db92421c2edf47ea7b78ba9e2d19f11490f552e0ef64f864869b834947ff63b74b622bb913eb8e98
SSDEEP 6144:z8YtRCzomLVyVXTkboPFE+7pS0lVUbxOgY00VLJbu7IBz:z8IRC5yVXTkbB+7pS0rOUgRsLJCkz
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 117KB
SHA256 fe6adf536ce71d5e29eb105d6c6cbeb64716b7d0dcbeffe55857654350da8dd1
MD5 20c4697f81e125c941fb67e03f8aa2cd
SHA1 5f18ff28087582348cad1678eb2a4da605068a9f
SHA512 d7255dd9f595ac3bb0a4c5d7b0ef3993c650e4aed00ddc7ae6d4b219fe638f0906258811b75c3a93393228de8e5aa107ab76299a727d860069180d69116b5296
SSDEEP 3072:2ZW79BZS0lwR6BsmXWqqbx8TPgS5yCY0VLJbdYvjIBa:n7pS0lVUbxOgY00VLJbu7IBa
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 233KB
SHA256 363bb2c3f5dfe1a7e7841400ceafd5f7a60f04e0509a318821902a4b59f25331
MD5 2f69ee75ca299e1a1ca79eab331bacb5
SHA1 74955a40fb6bb8e1f229c30ca5d0196a286b51d6
SHA512 d67ba8c26d23c2f37a8293bb3d0834f61bb528eccbc55d04d1c2dfc96fd63c256e972b5a48c4dac040b21c3299a6bc550ba2b91fda8b7b23e6b40301bf3ac187
SSDEEP 6144:G8YtRCzomLVyVXTkboPFE+7pS0lVUbxOgY00VLJbu7IBz:G8IRC5yVXTkbB+7pS0rOUgRsLJCkz
MD5 SHA1 SHA512 SSDEEP

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b84d1464357a5079fa2176fcd1e039f96dc5b496be68fd95e6b3e7f897c5ff4a
MD5 0bed30cbfbb03fbc088d2569653cda9f
SHA1 ddac9aec4632b5d4a16cdf7062e816f4d290a3ab
SHA512 95620be5ea7c6fab9b9996328049f9fd7a6ab9bf4cb6e7d9a8fb5b69e5d3ce9f7dcecfd60cfdee283eab8dcef53d2201399ec4ba14de3e441370b265ab79d702
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 3ef91c8f132f24f8df2c11b1e3d42dd01ae8dfecee2dd04f752a6f687b9f4f12
MD5 a7564532f29a98da084436b5a07bd5e2
SHA1 21dd58553d7b38b457e6440d51f3ce283a754897
SHA512 4020cfc4f519396f24675603098a355130bd2dcb536a12c8b4af9115003133f94af047cc5afb623299657be40f358129db26f14dde9fcfdf3d685152427f9f42
MD5 SHA1 SHA512

Submit Download

61194bcb-9e42-496a-aadd-22834303a3fc.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\61194bcb-9e42-496a-aadd-22834303a3fc.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 69KB
SHA256 b305e470fb9f8b69a8cd53b5a8ffb88538c9f6a9c7c2c194a226e8f6c9b53c17
MD5 164a788f50529fc93a6077e50675c617
SHA1 c53f6cd0531fd98d6abbd2a9e5fbb4319b221f48
SHA512 ec7d173b55283f3e59a468a0037921dc4e1bf3fab1c693330b9d8e5826273c917b374c4b802f3234bbb5e5e210d55e52351426867e0eb8c9f6fba1a053cb05d4
SSDEEP 1536:hAlMWz7vLDtDSVlXXwpFlorgLUxF+i2IFXaH5EoVDRnaXW:hvuWAUxFhFpoaXW
MD5 SHA1 SHA512 SSDEEP

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG
Size 346B
SHA256 3482920a35e7628892227c4df28da45c8e55cbec0d0a6ae6e22ace176c03587e
MD5 69c1631787cf38b7c3849155cbf5108b
SHA1 49f5683f6de10572a9d4ba1abe053aadf17d0653
SHA512 337cef0b8e340e0ca2c5ea7123e7757003714417e94d7c02f9949b01206f7d9de0844005a897042720349b55ac9cae571301775c953f64dee026b61d2908c6e2
MD5 SHA1 SHA512

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log
Size 456B
SHA256 c5ce9aaf8ffdcb8a00463a7bf24001885e0a792f110c8db74a1e2f4392cb0e31
MD5 f23d2df21a39aa8d814cade6c37856c8
SHA1 233e65707015a53f83a0d53db03a4af8fab21ea6
SHA512 a7b50b8cafba80f6baca44b260f8379852c4176f3dd57168812f3b4b811d2ff340f09f8ce625cc2adecab2851cc33725cb729548a3da98b041387c7952077918
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG
Size 322B
SHA256 d1f023d299f39181decae0e8c589ebfcd2e81f20e6e7a4523c682db2221543dd
MD5 1319ad79884a8cea5e1cc83aba01cb67
SHA1 1216ffb1423bc87520298824e49c5f5910eef773
SHA512 a16840d18934858ff2c41cf3ef8d59ef5d90376d6035fa3c3e828ec8625519241f64f476d8cb2ae4842914cb3643e0ef9f31652ca160f8599bd6d023918cd394
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG
Size 322B
SHA256 000115f89a815676795e2161d252c3852154c2b2e55eacff86574354ff735e0d
MD5 0bfe34c1fe81341f4489c9dc715945b6
SHA1 e5d38cc5878c677a7fb02716eaeed59920672623
SHA512 29719b477f2da5729fa1969f7e974493605d9cfbf4a55503ff7e9d6c8d35c9c4977d609877643596527c8c9d1e73078b8e37da778fc12eba12e535cf9d1fc154
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG
Size 334B
SHA256 b8a68bb8fe77957eabf815c7fe4188934a088ac311866360af48858d6c81a204
MD5 fecec685245f254768571c6fc02bf863
SHA1 45b6706e0ef7247b6953480ad6b580d443a2a598
SHA512 98d7a27ce8b640cdac60a8138124e70aec051f0ed1c53bd70d6e002633579adca73e3edcb08ba6f64eb9b8d86a100de369984674524df51652335a1314988633
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 61B
SHA256 e1b77550222c2451772c958e44026abe518a2c8766862f331765788ddd196377
MD5 4df4574bfbb7e0b0bc56c2c9b12b6c47
SHA1 81efcbd3e3da8221444a21f45305af6fa4b71907
SHA512 78b14f60f2d80400fe50360cf303a961685396b7697775d078825a29b717081442d357c2039ad0984d4b622976b0314ede8f478cde320daec118da546cb0682a
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 5b7cc44796f1583a8a392fe976f8fe2680aa74669927056c2d014548dc72b762
MD5 5c37d3e2bbe273c4f456e51789263541
SHA1 e46c24e6a421feaf8e2e71746f31bceb32342c26
SHA512 d19cbd83cdb3e5cab47ed105fbf99227807a7e614f9985db8ad6993da96f9b68100d987a92f39c540f12a4ab95de4635849efca6a3d57bce7d4468dbfa8fd3a5
SSDEEP 96:sfi4WZB4tXscVb9DyTl+adN8i046W6ZlmH9qx+WVoMpm+uecaYQjr5HhWd4UhgYc:sfGeXsl1N8p+HY+WNrYmWdphg3J
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 d86d393a5c86350d57332d7c167d139930e0125f51720e4c06491315ae961e3b
MD5 c315f2f51fabf4f38a3c7d44da2ad01a
SHA1 3bf3f4661c6daa6eee8a8237ae38eb2e34d78635
SHA512 e98e135742823904e9dccbc95864422a7342deafdaf1fded795b89084d839e09792686a82bf93f28730521cb1d2b0f8a99fb517d4fcaeff74338e7c51a8d0d5e
SSDEEP 96:sfi4WZB4tXscVbDDyTl+adN8i046W6ZlmH9qx+WVoMpm+uecaYQjD+gt5Hhcd4U0:sfGeXsX1N8p+HY+WNrYMXcdphg3J
MD5 SHA1 SHA512 SSDEEP

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 26KB
SHA256 b61b8f3fd20d9e443ee825ffed3629b21b2e70b22527b2c0c53b03b609c19b61
MD5 4b32f5d3d4c433181301c33c02ab8f54
SHA1 13487db7e287d2cd8364546adca2d80c9e0fe55d
SHA512 5ef0cd85c7ca5a7beb3d2b3f1e302511d90163d453c445b12c69959399261b1857a8fce299b844e68b4843a67aaba25ac3978cda9662cc01dbfbdce6fc1fd812
SSDEEP 768:itOrUr+WFGy8K8F1+UoAYDCx9Tuqh0VfUC9xbog/OVnpLliouH4roQsw:itOrUr+WFGy8Ku1ja+pLg3HDU
MD5 SHA1 SHA512 SSDEEP

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG
Size 338B
SHA256 ac1638137d52386ebb0db418a17b5897da05bb890e1eb09ba4c96f7653264c95
MD5 2e402873aaa4bb070e1d3da6fdfd2ec5
SHA1 8d4f143ecf61afd9ce8e8e92c130b6ac68e966b8
SHA512 c8a7737022f2287526e85a3415e4735037506858b5c631a6187837c5a3de1ced52ff6f6db14d2276d345262eee630ba1827175e3ba1a2f8e8bc7847f25ec955d
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG
Size 338B
SHA256 e82da51f685fc92ed68e35b718eadf5955f41e11ae368ee7538a114ef41d428c
MD5 e1096697d7adf7a486fccaff6b766529
SHA1 0871818a33ed6f565621ab7fe5ba50540917c681
SHA512 01a276d5ac4253c07faa38aa7d1ebf1d701dec8a8717c055ab8e7583efe264039a2de552c2627fec68c78b117f8a625d7ce8a1d5a13fb95adcdd098e901cd132
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG
Size 350B
SHA256 2763bf4e7fb969654d7f2f8ed2da7136faf9494296a169697f0191e104f019da
MD5 19ef7aec9813736f8b966f8b2361d387
SHA1 481cd47a7006b95556880d9cdfde5d8aefb02491
SHA512 d930c240cc33343b4a0bcc7107f400f6afde2f990c326b84accb656aac0c2fa9e0d0da05089cd9b72e4b8cbd0b5aa86961ea0d69ac1d6aae3196bb1083515d3a
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG
Size 350B
SHA256 7a557c3c648a6929db97975472163d89bce6ff03b2931abc72502f49e56612bb
MD5 2824387fb31bb9efc44c90f76cef0e24
SHA1 9b62a3c9108eb6f3ca3c4aaa64a1ee332db1b140
SHA512 09345a0e68e692de2ea920c7b275d2c40736f2507401d47c9da404d2274dcdd866377b5cc118a55e13500b81ea860e1465aa40788831db1acbd2cc9e7bf9d7fe
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG
Size 326B
SHA256 e517b31faa50be5f8cd7b14b095d0883fc719e249c585c6407375201f8d67e03
MD5 37b9fb0774b04cbf5d2a7414bee6d481
SHA1 c552af8d519f4b2ca291582f1f5e9e9dc0ed26e7
SHA512 ae5a3675319c00eaa89d43075533230e97efbc3f5bc500f2cf7b5fa61a0c025ea6e22e9c6f2b2903049401ca3febb522d093f244105b4db79f2d984a019cc610
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG
Size 326B
SHA256 6bef316bcdb17bc7f35cb29da9bf77f110de9c0adff8fa7de4d6682c5c8c7a50
MD5 5b423e7e413363d068778504bbb75693
SHA1 a839a672335c72b8fe9f1479a51c4cd30d53bc95
SHA512 18d426e08a551d566329a4350ae3e930f20719462fbbb525efbada14a01149a651d132c30171a72db9000077b2764397dcb2d1ab4b04b980606cf22928bbbc88
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG
Size 322B
SHA256 885aa1e63dd5d542f20399962262b8d31ae05b0759ebf8db2d327806052a31e0
MD5 0990b80cfc5687f8f479ee8f1f2f1879
SHA1 bac4c6f457aa2e0e20dc86f10e005d9e2c35010e
SHA512 c8a69e5a1698b72bf4d5d360a8d5c4c971adb91c848b0bfa83fea63f3ece07d5257990e0840066998772edf91ff67b8a4c82e3dc560559c283dddf6346e9bef5
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG
Size 322B
SHA256 ff43c60188b352702735f93528b5f46235a40944ee1e384451201a45c38b9ade
MD5 79828332136267bad5602f4bf7a48d35
SHA1 f963a4f842f2fb0d33163c5ba05ba68851e379f3
SHA512 ab9b123f710a40152c01e27da95abe73a83c82c316f11b5836da737fa1b6249d2e92f879204618c21b7cc9721f9b30d3e32d805ff048c7bab10d3409fa8836e1
MD5 SHA1 SHA512

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log
Size 1KB
SHA256 ce9f23c92cc00ab3d97843ce55f7cc458443de33701ad3f938f162c5ef440f75
MD5 4454a3c7f0d007f5ba4e28b409d2b54c
SHA1 c744c2bb3b05c3a1ba5dcd21f5275c58509b14fc
SHA512 0277515837c82c1f356e406572ad46b888144bf8e4a7205df8414fb9cb1ad04a9b1ec4ddc3d68887da76449120488c8cb17844cb38865277d5f3a981682a2f1e
MD5 SHA1 SHA512

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log
Size 1KB
SHA256 bc3f6de76321d7ec699951036b19b2197dc85b2cd87fc2c044ef125079ab7421
MD5 42973f17d3e5126ac81a17327572842e
SHA1 9513ac37d9a3207b7d8b66813fcb177f96ad313a
SHA512 39c86aa15343e07c1a0caacb84bfcad94924fe6544b0744773845a29ac846dc623a4d41648d6491c6c1786e97ec301feae521f6699a390372aedac2105e92758
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG
Size 340B
SHA256 f672c8be05e8c7c40beac5cffab5e505eeaadef79015d7aa81cd370e68c9d15a
MD5 2e35806677f5c5254f7e85f8dbe608a4
SHA1 ad2ed567a29f4bfcbe8a47123ac16accbf371a1c
SHA512 af886ace28de408ea9e0084e99ebb348b5bd9410e2522c51166fa7a603ac12d073993bb93af7b8da89736b929792fff66271625753def4402dfffc9d431c4ed1
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG
Size 340B
SHA256 61d14478d90ab9b5b27b56e80458c66d9aaa32e2b57deb1903133e60fd12281a
MD5 bb5a98f1160eca0958c76b80c0e48d9e
SHA1 eafc76da7645cd98045086ee577f53b93a6f2112
SHA512 a4bc3f74b5a478305d2fdfd32ed3d5f532a2071ccb4573e79608263d55510b2e6cf07f88037e9db96bdc082004fb9fa28a256a2359bb3aaec5be7be4c4541301
MD5 SHA1 SHA512

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Size 13B
SHA256 01a3e5d854762d8fdd01b235ce536fde31bf9a6be0596c295e3cea9aaf40f3dd
MD5 3e45022839c8def44fd96e24f29a9f4b
SHA1 c798352b5a0860f8edfd5c1589cf6e5842c5c226
SHA512 2888982860091421f89f3d7444cacccb1938ef70fc084d3028d8a29021e6e1d83eaef62108eace2f0d590ed41ece0e443d8b564e9c9a860fc48d766edb1dc3d9
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 9KB
SHA256 ef100e8e2f4aaf6e461793936cd6a9796dd390834b8beab45284af2cd028c503
MD5 bf7f08f38823cecea6d90410ce7af61c
SHA1 bfb52d54192fadd4caed9947b58126dfbd872e57
SHA512 b337c3af60c78ca59b49506af2ecade5e89737c6b7d07e6d7a866d6626ba9b2f0b96652ad214a0eb6213f26b6f5ac5af975b8984acd27680f7e349f635ed0da6
SSDEEP 192:zOsNBSapBWiRUyDG8qNkG5TTy3V3appGOIk+Yc9hyVH/oUB:zOsNBSazcJNT5TTYVnOIk+ApoUB
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 9KB
SHA256 dc6ef630c8b87d4346e0ff417db1b01754fc593b70e5160a8fd5b53289a33166
MD5 cbdd26d7ed5df35022b1b38635fb9043
SHA1 626497be69e3fb576d66ac6744fc5f95dbe38ebe
SHA512 830330903857940d1f379b655caeb1a88ae181d5c9ba0919bf4bfa9926277150e7b20f2c282d10de41450aeec04d6d372b6082b375890c7037e2a44a607bf220
SSDEEP 192:zOsNBSapBWiRUyDGjqNkG5TTy3V3appGOIk+Yc9cj2HzM2SUB:zOsNBSazc2NT5TTYVnOIk+0kqUB
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 0c55d6971c02bcd44c75acb3386a804f9c2982370a85b840356521542375bff2
MD5 1f3a2b1e18c4e1d4f9e848a1a0e12077
SHA1 0c489bcbf28c39eaa823e2eafb4ebddedb1b17fe
SHA512 841a5eee6a314870621990931354720e373a8ac592d007d20fb4a47e7b775fda7e00467ab9eb393668cbe389ae5a7313bf4a0e1057998f322880613fc68684e3
SSDEEP 192:bONbypBWiRUybGjJNkGATTy3V3appGOIk+Yc9caYHzM2SUL:bONbyzwtNTATTYVnOIk+lyqUL
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 9KB
SHA256 baac2f89b8bb96de8279ea15d777368d0d27af328ef9bf5c2cb3d9bc7c546205
MD5 c81ab53c9bcfbff36a738c9e4d793936
SHA1 09307288bd8f30a82b49456344937bc7f4a608e4
SHA512 1cc506a6f57458b83b92f6295e667ca5ce0690b2e0248dbbbd46100482443c8a6615dfada1cc688ec05f302ab9e340ee4ea35d2b71ff298883900b11037a2d21
SSDEEP 192:zOsNBSapBWiRUyDGdqNkG5TTy3V3appGOIk+Yc94UtHxUoUB:zOsNBSazc8NT5TTYVnOIk+f0oUB
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 9KB
SHA256 fd487561adf23de56c9cfc12834ca5c186de7d1c1012f13bef2fb3be6063f48a
MD5 6e9a1afb51a14aff452f0c692ea77889
SHA1 7a4a5bee602645977c5776493f86f00069cef279
SHA512 16c15d0c977432b58421e225afb26cc67ff2d7f192c348bb7323b16773a1750161335510fbb50d4c80a37b0660dd5d1f2adae4acbeadaca6b1a2406549832e18
SSDEEP 192:zOsNBSapBWiRUyDG8qNkG5TTy3V3appGOIk+Yc9hy7H/oUB:zOsNBSazcJNT5TTYVnOIk+AzoUB
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 9KB
SHA256 d1feefad0e914fe8b8faafd88ef98caf51d966d0fa3841fe9c9cc5e867fe298b
MD5 935275829141c9d132d0181c71e48c36
SHA1 2f97a0d646cb58a3d74635e5d7fa26795bc157fc
SHA512 14f0990057aadbf9a44e0464c2fa1ff78cbd2e9640eefa6a4d3c1f8c72f4e4914ab5d68fc035f3264942908966807af982474c0b237679b2b98a89330069c74d
SSDEEP 192:zOsNBSapBWiRUyDG+qNkG5TTy3V3appGOIk+Yc9m1aEHrFUB:zOsNBSazc/NT5TTYVnOIk+waiFUB
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 7KB
SHA256 13bbebe01b650bc208df217f7244bc5ea6a94bfaf038aa3db1dbddfbd4580a90
MD5 0436f3f088c51660225cc90da1061f4b
SHA1 b81860e5ced98201001df84d865d3c1b0b8cf122
SHA512 4ddbe25d477eb9d4dfd9edd8021ad1d86c823cd236739fe327e7dd3e56bb1348370711be7bfd7f05e0acc7a3a57de8723678ed82f2713c30ced2d3cdabc472a8
SSDEEP 192:SONbypXWiRUyFnJnATTy3V3ap6gJYglIUL:SONby9nJnATTYVGVIUL
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 9KB
SHA256 5b1a0dd616969b8718a42c7d84f48b1477fb7b5947e82f7e365783463e979685
MD5 f0a57ba705fab79b645fa40221229236
SHA1 becf23ef866ff40b6e2284afc342783f9b138f3a
SHA512 87789e7a5f6d18055d51cadc4920a9dc87b0ebda1f65a4f50fedb8482e592115ae8105e7b1424ea026772ff2b3ddc79d8c7dedf8d3b6f41641d07b04b00b497a
SSDEEP 192:zOsNBSapBWiRUyeGjqNkG5TTy3V3appGOIk+Yc9cj2HzM2SUB:zOsNBSazp2NT5TTYVnOIk+0kqUB
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations
Size 86B
SHA256 5cd2c4d9f13524923046198c92213691539407e04fa520cdae9eade1bad3d91d
MD5 e9e365607374115b92e4abe4b9628101
SHA1 d5054ea9b22317dca83801eb3586017bfcc0e2a8
SHA512 a84d65ed53e43883e5ecb7848fbd48f5305a63e6975e6af480cf85532879720061106be54f2a5888ebc3569f7123081a0e6eb48ccb8d7dba3e1da1c8a3c50401
MD5 SHA1 SHA512

Submit Download

Path C:\Users\Admin\AppData\Local\Temp\Malware-1-master\x
Size 8KB
SHA256 0557ea4c5e309b16458ca32ac617b76d1a55f5f0103e368d05c0f0386b7a0a43
MD5 5ce1a2162bf5e16485f5e263b3cc5cf5
SHA1 e9ec3e06bef08fcf29be35c6a4b2217a8328133c
SHA512 ceb5e270bdbcab5be645e50705e3111a5c4751a7a865580d53fa86580025201264a49dd0ea9135b10cff28d7bb21b767ac5d4aff40e880a866ab35df273b5de1
SSDEEP 192:T4KX0Tg44AQsHkuxaWJOnJjWv07iVKmWynWmFr+E:BKu+xawOdFtmHWs
MD5 SHA1 SHA512 SSDEEP

Submit Download

Path C:\Users\Admin\AppData\Local\Temp\Malware-1-master\x
Size 4KB
SHA256 88339750431112ed60cdf9bdb7697434ba9b38e2d15ad604c4462705bc1bdfcf
MD5 20e335859ff991575cf1ddf538e5817c
SHA1 1e81b804d67d6c0e22c0cef7e1cb9f86ce0ef5ee
SHA512 012251b342722cf35ebec2c7d071db505a992d81fc4b3492cd87640b5c955dc084825fc5e72edc821f4c481867183f21d26cd904fe7f0373d1156332f87b031d
SSDEEP 96:Tm/Ldo2g0Tg4JlIAQ5uJ80JyunrOTCC1WJPmZ:T4KX0Tg44AQsHkuxaWJOZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

x.js

Path C:\Users\Admin\AppData\Local\Temp\Malware-1-master\x.js
Size 448B
SHA256 aa01b8864b43e92077a106ed3d4656a511f3ba1910fba40c78a32ee6a621d596
MD5 8eec8704d2a7bc80b95b7460c06f4854
SHA1 1b34585c1fa7ec0bd0505478ac9dbb8b8d19f326
SHA512 e274b92810e9a30627a65f87448d784967a2fcfbf49858cbe6ccb841f09e0f53fde253ecc1ea0c7de491d8cc56a6cf8c79d1b7c657e72928cfb0479d11035210
MD5 SHA1 SHA512

Submit Download

z.zip

Path C:\Users\Admin\AppData\Local\Temp\Malware-1-master\z.zip
Size 5KB
SHA256 39df3364a3af6f7d360aa7e1345e27befc4be960e0e7e7e060b20f3389b80e76
MD5 d2ea024b943caa1361833885b832d20b
SHA1 1e17c27a3260862645bdaff5cf82c44172d4df9a
SHA512 7b7cfb5e689feed6a52eedf36b89a7b5cc411191571c0af5e5d704b5f24bfa04afa62d1daab159a7e5702d80e56f3946bf32db0551d256419ca12cd3c57dcecb
SSDEEP 96:cCfNDkKYP0EaCl4Nmw3oEpQGgRSYFJffDoWYISIwnCAeTghpGPFCmN:bfVkVCC0mw3pxgdrjpYISDKg+t
MD5 SHA1 SHA512 SSDEEP

Submit Download

MEMZ.exe

Path C:\Users\Admin\AppData\Roaming\MEMZ.exe
Size 12KB
SHA256 4bbf7589615ebdb6c769d6d2e7bdcb26072bac0cda6e225a4133ba8819e688d5
MD5 9c642c5b111ee85a6bccffc7af896a51
SHA1 eca8571b994fd40e2018f48c214fab6472a98bab
SHA512 23cc74b5a7bdf70ba789d1730a0009414cfb9c780544e3d8d841be58782b9a9a089969c4295a0da25d07285505992386486d6ff0524e75605b96bb99cd3aaa1c
SSDEEP 192:BCMfc/GinpRBueYDw4+kEeN4FRrfMFFp3+f2dvGhT59uay:AMfceinpOeRENYhfOj+eGdKa
MD5 SHA1 SHA512 SSDEEP

Submit Download

desktop.ini

Path C:\Users\Admin\Videos\Captures\desktop.ini
Size 190B
SHA256 86d9f822aeb989755fac82929e8db369b3f5f04117ef96fd76e3d5f920a501d2
MD5 b0d27eaec71f1cd73b015f5ceeb15f9d
SHA1 62264f8b5c2f5034a1e4143df6e8c787165fbc2f
SHA512 7b5c9783a0a14b600b156825639d24cbbc000f5066c48ce9fecc195255603fc55129aaaca336d7ce6ad4e941d5492b756562f2c7a1d151fcfc2dabac76f3946c
MD5 SHA1 SHA512

Submit Download