aa6613b095648e905693c7a1532e98891b4c9c5849b7a90d4901f9c30eb69ec9

Resubmissions

11/05/2026, 19:02

260511-xp6clact8m10

11/05/2026, 18:58

260511-xmvs3sct6l8

Analysis

user interaction
yes
max time kernel
307s
max time network
305s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
11/05/2026, 19:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Atlas.exe
Size 16.5MB
Sample260511-xp6clact8m
SHA256 aa6613b095648e905693c7a1532e98891b4c9c5849b7a90d4901f9c30eb69ec9
MD5 f7bc32f0a1f3689ae74b024288b2621e
SHA1 c13a65720505cc6107d749db3120f4291d80134d
SHA512 89ee9e685c505b2d887374b655a36c5886101b0062042e4341db57825d4849de4c7107450ea6581ab3664ff1254e5001acfb7312f7d878c88ac9972e0535e012
SSDEEP 393216:2I/1FqD6I9JhfhrnblRmRJXDg5fzMTnX:20zIrJrnbX5Y7
TLSH
T1A7072306F39586A9D476D13CC652A317EB72B8160322CBDB73DE59211FA71D04E3EB82
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

adware discovery spyware

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
123	4592	chrome.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000\Control Panel\International\Geo\Nation	MEMZ-Clean.exe

Executes dropped EXE 1 IoCs

pid	Process
3500	MEMZ-Clean.exe

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
122	raw.githubusercontent.com
123	raw.githubusercontent.com

Drops file in Program Files directory 18 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping740_1614062425\_metadata\verified_contents.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping740_1069125646\classification.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping740_1069125646\extraction.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping740_1069125646\travel-facilitated-booking-bing.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping740_469831054\nav_config.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping740_1080413842\smart_switch_list.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping740_1069125646\automation.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping740_1069125646\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping740_1991572385\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping740_469831054\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping740_1080413842\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping740_996334431\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping740_1614062425\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping740_1614062425\sets.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping740_1069125646\travel-facilitated-booking-kayak.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping740_1991572385\protocols.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping740_1080413842\office_endpoints_list.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping740_1614062425\LICENSE	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MEMZ-Clean.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regedit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	control.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DllHost.exe

System Time Discovery 1 TTPs 3 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4592	chrome.exe
4288	msedge.exe
60	msedge.exe

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 9 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe

Modifies data under HKEY_USERS 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134229998154786073"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\FirewallControlPanel.dll,-12122#immutable1 = "Windows Defender Firewall"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\Speech\SpeechUX\speechuxcpl.dll,-1#immutable1 = "Speech Recognition"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\Speech\SpeechUX\speechuxcpl.dll,-2#immutable1 = "Configure how speech recognition works on your computer."	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\usercpl.dll,-2#immutable1 = "Change user account settings and passwords for people who share this computer."	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\devmgr.dll,-5#immutable1 = "View and update your device hardware settings and driver software."	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\system32\colorcpl.exe,-7#immutable1 = "Change advanced color management settings for displays, scanners, and printers."	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\systemcpl.dll,-2#immutable1 = "View information about your computer, and change settings for hardware, performance, and remote connections."	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\Local Settings	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\main.cpl,-100#immutable1 = "Mouse"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\Local Settings	control.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\main.cpl,-102#immutable1 = "Keyboard"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\mmsys.cpl,-300#immutable1 = "Sound"	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\system32\Vault.dll,-2#immutable1 = "Manage your Windows credentials."	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\autoplay.dll,-1#immutable1 = "AutoPlay"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\sud.dll,-1#immutable1 = "Default Programs"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\FirewallControlPanel.dll,-12123#immutable1 = "Set firewall security options to help protect your computer from hackers and malicious software."	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\intl.cpl,-2#immutable1 = "Customize settings for the display of languages, numbers, times, and dates."	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\accessibilitycpl.dll,-10#immutable1 = "Ease of Access Center"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\timedate.cpl,-52#immutable1 = "Set the date, time, and time zone for your computer."	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\srchadmin.dll,-602#immutable1 = "Change how Windows indexes to search faster"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\inetcpl.cpl,-4313#immutable1 = "Configure your Internet display and connection settings."	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\sdcpl.dll,-100#immutable1 = "Recover copies of your files backed up in Windows 7"	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\powercpl.dll,-1#immutable1 = "Power Options"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\RADCUI.dll,-15301#immutable1 = "Manage your RemoteApp and Desktop Connections"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\recovery.dll,-2#immutable1 = "Recovery"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\systemcpl.dll,-1#immutable1 = "System"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\fvecpl.dll,-1#immutable1 = "BitLocker Drive Encryption"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\timedate.cpl,-51#immutable1 = "Date and Time"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\powercpl.dll,-2#immutable1 = "Conserve energy or maximize performance by choosing how your computer manages power."	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\usercpl.dll,-1#immutable1 = "User Accounts"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\srchadmin.dll,-601#immutable1 = "Indexing Options"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\netcenter.dll,-2#immutable1 = "Check network status, change network settings and set preferences for sharing files and printers."	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\fvecpl.dll,-2#immutable1 = "Protect your PC using BitLocker Drive Encryption."	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\SyncCenter.dll,-3000#immutable1 = "Sync Center"	explorer.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-312252282-3884318443-358092420-1000\{9FFBCE4C-8FD3-47FD-B86B-CFBA01D8C96B}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\sud.dll,-10#immutable1 = "Choose which programs you want Windows to use for activities like web browsing, editing photos, sending e-mail, and playing music."	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\main.cpl,-103#immutable1 = "Customize your keyboard settings, such as the cursor blink rate and the character repeat rate."	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\netcenter.dll,-1#immutable1 = "Network and Sharing Center"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\system32\appwiz.cpl,-159#immutable1 = "Programs and Features"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\recovery.dll,-101#immutable1 = "Recovery"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\system32\DeviceCenter.dll,-2000#immutable1 = "View and manage devices, printers, and print jobs"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\sdcpl.dll,-101#immutable1 = "Backup and Restore (Windows 7)"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\fhcpl.dll,-52#immutable1 = "File History"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\RADCUI.dll,-15300#immutable1 = "RemoteApp and Desktop Connections"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\intl.cpl,-3#immutable1 = "Region"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\devmgr.dll,-4#immutable1 = "Device Manager"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\autoplay.dll,-2#immutable1 = "Change default settings for CDs, DVDs, and devices so that you can automatically play music, view pictures, install software, and play games."	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\mmsys.cpl,-301#immutable1 = "Configure your audio devices or change the sound scheme for your computer."	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe

Runs regedit.exe 1 IoCs

pid	Process
6124	regedit.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
5068	explorer.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4796	Atlas.exe
4796	Atlas.exe
4796	Atlas.exe
4796	Atlas.exe
4796	Atlas.exe
4796	Atlas.exe
4796	Atlas.exe
4796	Atlas.exe
4796	Atlas.exe
4796	Atlas.exe
4796	Atlas.exe
4796	Atlas.exe
4796	Atlas.exe
4796	Atlas.exe
4796	Atlas.exe
4796	Atlas.exe
4796	Atlas.exe
4796	Atlas.exe
4796	Atlas.exe
4796	Atlas.exe
4796	Atlas.exe
4796	Atlas.exe
4796	Atlas.exe
4796	Atlas.exe
4796	Atlas.exe
4796	Atlas.exe
4796	Atlas.exe
4796	Atlas.exe
4796	Atlas.exe
4796	Atlas.exe
4796	Atlas.exe
4796	Atlas.exe
4796	Atlas.exe
4796	Atlas.exe
4796	Atlas.exe
4796	Atlas.exe
4796	Atlas.exe
4796	Atlas.exe
4796	Atlas.exe
4796	Atlas.exe
4796	Atlas.exe
4796	Atlas.exe
4796	Atlas.exe
4796	Atlas.exe
4796	Atlas.exe
4796	Atlas.exe
4796	Atlas.exe
4796	Atlas.exe
4796	Atlas.exe
4796	Atlas.exe
4796	Atlas.exe
4796	Atlas.exe
4796	Atlas.exe
4796	Atlas.exe
4796	Atlas.exe
4796	Atlas.exe
4796	Atlas.exe
4796	Atlas.exe
4796	Atlas.exe
4796	Atlas.exe
4796	Atlas.exe
4796	Atlas.exe
4796	Atlas.exe
4796	Atlas.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4796	Atlas.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 21 IoCs

pid	Process
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1756	chrome.exe
Token: SeCreatePagefilePrivilege	1756	chrome.exe
Token: SeShutdownPrivilege	1756	chrome.exe
Token: SeCreatePagefilePrivilege	1756	chrome.exe
Token: SeShutdownPrivilege	1756	chrome.exe
Token: SeCreatePagefilePrivilege	1756	chrome.exe
Token: SeShutdownPrivilege	1756	chrome.exe
Token: SeCreatePagefilePrivilege	1756	chrome.exe
Token: SeShutdownPrivilege	1756	chrome.exe
Token: SeCreatePagefilePrivilege	1756	chrome.exe
Token: SeShutdownPrivilege	1756	chrome.exe
Token: SeCreatePagefilePrivilege	1756	chrome.exe
Token: SeShutdownPrivilege	1756	chrome.exe
Token: SeCreatePagefilePrivilege	1756	chrome.exe
Token: SeShutdownPrivilege	1756	chrome.exe
Token: SeCreatePagefilePrivilege	1756	chrome.exe
Token: SeShutdownPrivilege	1756	chrome.exe
Token: SeCreatePagefilePrivilege	1756	chrome.exe
Token: SeShutdownPrivilege	1756	chrome.exe
Token: SeCreatePagefilePrivilege	1756	chrome.exe
Token: SeShutdownPrivilege	1756	chrome.exe
Token: SeCreatePagefilePrivilege	1756	chrome.exe
Token: SeShutdownPrivilege	1756	chrome.exe
Token: SeCreatePagefilePrivilege	1756	chrome.exe
Token: SeShutdownPrivilege	1756	chrome.exe
Token: SeCreatePagefilePrivilege	1756	chrome.exe
Token: SeShutdownPrivilege	1756	chrome.exe
Token: SeCreatePagefilePrivilege	1756	chrome.exe
Token: SeShutdownPrivilege	1756	chrome.exe
Token: SeCreatePagefilePrivilege	1756	chrome.exe
Token: SeShutdownPrivilege	1756	chrome.exe
Token: SeCreatePagefilePrivilege	1756	chrome.exe
Token: SeShutdownPrivilege	1756	chrome.exe
Token: SeCreatePagefilePrivilege	1756	chrome.exe
Token: SeShutdownPrivilege	1756	chrome.exe
Token: SeCreatePagefilePrivilege	1756	chrome.exe
Token: SeShutdownPrivilege	1756	chrome.exe
Token: SeCreatePagefilePrivilege	1756	chrome.exe
Token: SeShutdownPrivilege	1756	chrome.exe
Token: SeCreatePagefilePrivilege	1756	chrome.exe
Token: SeShutdownPrivilege	1756	chrome.exe
Token: SeCreatePagefilePrivilege	1756	chrome.exe
Token: SeShutdownPrivilege	1756	chrome.exe
Token: SeCreatePagefilePrivilege	1756	chrome.exe
Token: SeShutdownPrivilege	1756	chrome.exe
Token: SeCreatePagefilePrivilege	1756	chrome.exe
Token: SeShutdownPrivilege	1756	chrome.exe
Token: SeCreatePagefilePrivilege	1756	chrome.exe
Token: SeShutdownPrivilege	1756	chrome.exe
Token: SeCreatePagefilePrivilege	1756	chrome.exe
Token: SeShutdownPrivilege	1756	chrome.exe
Token: SeCreatePagefilePrivilege	1756	chrome.exe
Token: SeShutdownPrivilege	1756	chrome.exe
Token: SeCreatePagefilePrivilege	1756	chrome.exe
Token: SeShutdownPrivilege	1756	chrome.exe
Token: SeCreatePagefilePrivilege	1756	chrome.exe
Token: SeShutdownPrivilege	1756	chrome.exe
Token: SeCreatePagefilePrivilege	1756	chrome.exe
Token: SeShutdownPrivilege	1756	chrome.exe
Token: SeCreatePagefilePrivilege	1756	chrome.exe
Token: SeShutdownPrivilege	1756	chrome.exe
Token: SeCreatePagefilePrivilege	1756	chrome.exe
Token: SeShutdownPrivilege	1756	chrome.exe
Token: SeCreatePagefilePrivilege	1756	chrome.exe

Suspicious use of FindShellTrayWindow 48 IoCs

pid	Process
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
3500	MEMZ-Clean.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
740	msedge.exe
5068	explorer.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
1756	chrome.exe
3500	MEMZ-Clean.exe
3500	MEMZ-Clean.exe
3500	MEMZ-Clean.exe
3500	MEMZ-Clean.exe
3500	MEMZ-Clean.exe
3500	MEMZ-Clean.exe
3500	MEMZ-Clean.exe
3500	MEMZ-Clean.exe
3500	MEMZ-Clean.exe
3500	MEMZ-Clean.exe
3500	MEMZ-Clean.exe
3500	MEMZ-Clean.exe
3500	MEMZ-Clean.exe
3500	MEMZ-Clean.exe
3500	MEMZ-Clean.exe
3500	MEMZ-Clean.exe
3500	MEMZ-Clean.exe
3500	MEMZ-Clean.exe
3500	MEMZ-Clean.exe
3500	MEMZ-Clean.exe
3500	MEMZ-Clean.exe
3500	MEMZ-Clean.exe
3500	MEMZ-Clean.exe
3500	MEMZ-Clean.exe
3500	MEMZ-Clean.exe
3500	MEMZ-Clean.exe
3500	MEMZ-Clean.exe
3500	MEMZ-Clean.exe
3500	MEMZ-Clean.exe
3500	MEMZ-Clean.exe
3500	MEMZ-Clean.exe
3500	MEMZ-Clean.exe

Suspicious use of SetWindowsHookEx 9 IoCs

pid	Process
4796	Atlas.exe
3500	MEMZ-Clean.exe
3500	MEMZ-Clean.exe
3500	MEMZ-Clean.exe
3500	MEMZ-Clean.exe
3500	MEMZ-Clean.exe
3500	MEMZ-Clean.exe
3500	MEMZ-Clean.exe
3500	MEMZ-Clean.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1756 wrote to memory of 2416	1756	chrome.exe	96
PID 1756 wrote to memory of 3092	1756	chrome.exe	97
PID 1756 wrote to memory of 3092	1756	chrome.exe	97
PID 1756 wrote to memory of 4592	1756	chrome.exe	98
PID 1756 wrote to memory of 2708	1756	chrome.exe	99
PID 1756 wrote to memory of 2708	1756	chrome.exe	99
PID 1756 wrote to memory of 1480	1756	chrome.exe	100
PID 1756 wrote to memory of 1844	1756	chrome.exe	101
PID 1756 wrote to memory of 1480	1756	chrome.exe	100
PID 1756 wrote to memory of 1844	1756	chrome.exe	101
PID 1756 wrote to memory of 5108	1756	chrome.exe	103
PID 1756 wrote to memory of 5108	1756	chrome.exe	103
PID 1756 wrote to memory of 2024	1756	chrome.exe	104
PID 1756 wrote to memory of 2024	1756	chrome.exe	104
PID 1756 wrote to memory of 3776	1756	chrome.exe	105
PID 1756 wrote to memory of 3800	1756	chrome.exe	107
PID 1756 wrote to memory of 3800	1756	chrome.exe	107
PID 1756 wrote to memory of 2500	1756	chrome.exe	109
PID 1756 wrote to memory of 2500	1756	chrome.exe	109
PID 1756 wrote to memory of 4040	1756	chrome.exe	110
PID 1756 wrote to memory of 3500	1756	chrome.exe	111
PID 1756 wrote to memory of 3960	1756	chrome.exe	112
PID 1756 wrote to memory of 1832	1756	chrome.exe	113
PID 1756 wrote to memory of 4164	1756	chrome.exe	114
PID 3500 wrote to memory of 1500	3500	MEMZ-Clean.exe	117
PID 1500 wrote to memory of 1824	1500	msedge.exe	118
PID 1824 wrote to memory of 408	1824	msedge.exe	119
PID 1824 wrote to memory of 4288	1824	msedge.exe	120
PID 1824 wrote to memory of 2676	1824	msedge.exe	121
PID 1824 wrote to memory of 2676	1824	msedge.exe	121
PID 1824 wrote to memory of 2676	1824	msedge.exe	121
PID 1824 wrote to memory of 3808	1824	msedge.exe	123
PID 1824 wrote to memory of 3808	1824	msedge.exe	123
PID 1824 wrote to memory of 2824	1824	msedge.exe	124
PID 1824 wrote to memory of 2824	1824	msedge.exe	124
PID 1824 wrote to memory of 2824	1824	msedge.exe	124
PID 1824 wrote to memory of 4676	1824	msedge.exe	125
PID 1824 wrote to memory of 4676	1824	msedge.exe	125
PID 1824 wrote to memory of 4676	1824	msedge.exe	125
PID 1824 wrote to memory of 2656	1824	msedge.exe	126
PID 1824 wrote to memory of 4128	1824	msedge.exe	127
PID 1824 wrote to memory of 2656	1824	msedge.exe	126
PID 1824 wrote to memory of 2656	1824	msedge.exe	126
PID 1824 wrote to memory of 4128	1824	msedge.exe	127
PID 1824 wrote to memory of 4128	1824	msedge.exe	127
PID 1824 wrote to memory of 5384	1824	msedge.exe	129
PID 1824 wrote to memory of 5384	1824	msedge.exe	129
PID 1824 wrote to memory of 5580	1824	msedge.exe	131
PID 1824 wrote to memory of 5580	1824	msedge.exe	131
PID 1824 wrote to memory of 6040	1824	msedge.exe	133
PID 1824 wrote to memory of 6040	1824	msedge.exe	133
PID 1824 wrote to memory of 6040	1824	msedge.exe	133
PID 1824 wrote to memory of 6116	1824	msedge.exe	134
PID 1824 wrote to memory of 6124	1824	msedge.exe	135
PID 1824 wrote to memory of 6116	1824	msedge.exe	134
PID 1824 wrote to memory of 6124	1824	msedge.exe	135
PID 1824 wrote to memory of 5316	1824	msedge.exe	137
PID 1824 wrote to memory of 5908	1824	msedge.exe	138
PID 1824 wrote to memory of 5908	1824	msedge.exe	138
PID 1824 wrote to memory of 6020	1824	msedge.exe	139
PID 1824 wrote to memory of 6020	1824	msedge.exe	139
PID 3500 wrote to memory of 5260	3500	MEMZ-Clean.exe	140
PID 5260 wrote to memory of 740	5260	msedge.exe	141
PID 740 wrote to memory of 1780	740	msedge.exe	142

C:\Users\Admin\AppData\Local\Temp\Atlas.exe
"C:\Users\Admin\AppData\Local\Temp\Atlas.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:4796

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1756
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ff842bdc728,0x7ff842bdc734,0x7ff842bdc740
  2⤵
  PID:2416
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1700,i,9236388568764046531,663075826022918306,262144 --field-trial-handle=1836,i,12413561500552628891,3159038595506041082,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=1828 /prefetch:2
  2⤵
  PID:3092
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1604,i,7609724777357868863,15196710488721132177,524288 --field-trial-handle=1836,i,12413561500552628891,3159038595506041082,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2272 /prefetch:3
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:4592
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2408,i,17008397757710929199,12550053701756892605,524288 --field-trial-handle=1836,i,12413561500552628891,3159038595506041082,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2576 /prefetch:8
  2⤵
  PID:2708
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3256,i,704477385554348642,15020050820640056204,2097152 --field-trial-handle=1836,i,12413561500552628891,3159038595506041082,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:1480
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3048,i,15307489848891069914,16449788755298229690,2097152 --field-trial-handle=1836,i,12413561500552628891,3159038595506041082,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3304 /prefetch:1
  2⤵
  PID:1844
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4452,i,13680481813952452946,8855869387935871671,2097152 --field-trial-handle=1836,i,12413561500552628891,3159038595506041082,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3940 /prefetch:2
  2⤵
  PID:5108
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4632,i,12679150474165734003,5396668932793137592,2097152 --field-trial-handle=1836,i,12413561500552628891,3159038595506041082,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4756 /prefetch:1
  2⤵
  PID:2024
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5536,i,14613156488377540215,5019666181894619658,524288 --field-trial-handle=1836,i,12413561500552628891,3159038595506041082,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5544 /prefetch:8
  2⤵
  PID:3776
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5928,i,1008290617421487345,13552922899313354372,2097152 --field-trial-handle=1836,i,12413561500552628891,3159038595506041082,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5856 /prefetch:1
  2⤵
  PID:3800
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=3252,i,9809504753179523673,14529212960806776331,2097152 --field-trial-handle=1836,i,12413561500552628891,3159038595506041082,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3440 /prefetch:1
  2⤵
  PID:2500
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6056,i,9778592011720980543,17928304802586648294,524288 --field-trial-handle=1836,i,12413561500552628891,3159038595506041082,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=6020 /prefetch:8
  2⤵
  PID:4040
- C:\Users\Admin\Downloads\MEMZ-Clean.exe
  "C:\Users\Admin\Downloads\MEMZ-Clean.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3500
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=skrillex+scay+onster+an+nice+sprites+midi
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1500
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument http://google.co.ck/search?q=skrillex+scay+onster+an+nice+sprites+midi
      4⤵
      Checks processor information in registry
      Enumerates system info in registry
      Modifies data under HKEY_USERS
      Modifies registry class
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:1824
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x230,0x234,0x7ff83d99c188,0x7ff83d99c194,0x7ff83d99c1a0
        5⤵
        
        PID:408
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1932,i,8163445659873334396,15637249938739079349,524288 --field-trial-handle=2236,i,8333048351331773198,7445854671765648287,262144 --variations-seed-version --mojo-platform-channel-handle=2272 /prefetch:3
        5⤵
        System Time Discovery
        
        PID:4288
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1684,i,12820854320894618266,11618651948606873663,262144 --field-trial-handle=2236,i,8333048351331773198,7445854671765648287,262144 --variations-seed-version --mojo-platform-channel-handle=2232 /prefetch:2
        5⤵
        
        PID:2676
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2544,i,5447589989505748134,5950083430221321186,524288 --field-trial-handle=2236,i,8333048351331773198,7445854671765648287,262144 --variations-seed-version --mojo-platform-channel-handle=2564 /prefetch:8
        5⤵
        
        PID:3808
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3464,i,1202041809557806648,7791016142798158332,2097152 --field-trial-handle=2236,i,8333048351331773198,7445854671765648287,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:1
        5⤵
        
        PID:2824
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3456,i,15571202336454961175,12967444010364231463,2097152 --field-trial-handle=2236,i,8333048351331773198,7445854671765648287,262144 --variations-seed-version --mojo-platform-channel-handle=3468 /prefetch:1
        5⤵
        
        PID:4676
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4184,i,17065652588484731518,569934099583854552,2097152 --field-trial-handle=2236,i,8333048351331773198,7445854671765648287,262144 --variations-seed-version --mojo-platform-channel-handle=4268 /prefetch:1
        5⤵
        
        PID:2656
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4196,i,6251415706532529704,17858300355253216038,2097152 --field-trial-handle=2236,i,8333048351331773198,7445854671765648287,262144 --variations-seed-version --mojo-platform-channel-handle=4272 /prefetch:2
        5⤵
        
        PID:4128
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3724,i,16731603234754402582,11067469756751149952,524288 --field-trial-handle=2236,i,8333048351331773198,7445854671765648287,262144 --variations-seed-version --mojo-platform-channel-handle=3460 /prefetch:8
        5⤵
        
        PID:5384
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5164,i,11523105801517811701,7923276263587787245,524288 --field-trial-handle=2236,i,8333048351331773198,7445854671765648287,262144 --variations-seed-version --mojo-platform-channel-handle=5200 /prefetch:8
        5⤵
        
        PID:5580
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=5216,i,16466470996953114169,16318907983369968148,2097152 --field-trial-handle=2236,i,8333048351331773198,7445854671765648287,262144 --variations-seed-version --mojo-platform-channel-handle=5204 /prefetch:1
        5⤵
        
        PID:6040
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3548,i,14596677637402341947,8229601280950223034,524288 --field-trial-handle=2236,i,8333048351331773198,7445854671765648287,262144 --variations-seed-version --mojo-platform-channel-handle=3640 /prefetch:8
        5⤵
        
        PID:6116
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3540,i,16942670196616720920,6654055828598925445,524288 --field-trial-handle=2236,i,8333048351331773198,7445854671765648287,262144 --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:8
        5⤵
        
        PID:6124
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5780,i,2936887580706094817,8340254057320667181,524288 --field-trial-handle=2236,i,8333048351331773198,7445854671765648287,262144 --variations-seed-version --mojo-platform-channel-handle=5796 /prefetch:8
        5⤵
        
        PID:5300
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5780,i,2936887580706094817,8340254057320667181,524288 --field-trial-handle=2236,i,8333048351331773198,7445854671765648287,262144 --variations-seed-version --mojo-platform-channel-handle=5796 /prefetch:8
        5⤵
        
        PID:5316
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6020,i,971144424171363190,12665285366841016761,524288 --field-trial-handle=2236,i,8333048351331773198,7445854671765648287,262144 --variations-seed-version --mojo-platform-channel-handle=6024 /prefetch:8
        5⤵
        
        PID:5908
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6180,i,3321523898419147521,17653458603360264459,524288 --field-trial-handle=2236,i,8333048351331773198,7445854671765648287,262144 --variations-seed-version --mojo-platform-channel-handle=6164 /prefetch:8
        5⤵
        
        PID:6020
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=how+to+send+a+virus+to+my+friend
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5260
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument http://google.co.ck/search?q=how+to+send+a+virus+to+my+friend
      4⤵
      Drops file in Program Files directory
      Checks processor information in registry
      Enumerates system info in registry
      Modifies data under HKEY_USERS
      Modifies registry class
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:740
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x234,0x238,0x23c,0x230,0x260,0x7ff83d99c188,0x7ff83d99c194,0x7ff83d99c1a0
        5⤵
        
        PID:1780
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1908,i,999465923500572157,10528208905508772816,524288 --field-trial-handle=2328,i,15500506431014942571,6614655864219266074,262144 --variations-seed-version --mojo-platform-channel-handle=2872 /prefetch:3
        5⤵
        System Time Discovery
        
        PID:60
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1620,i,13339512461898361947,12779488912947580023,262144 --field-trial-handle=2328,i,15500506431014942571,6614655864219266074,262144 --variations-seed-version --mojo-platform-channel-handle=2324 /prefetch:2
        5⤵
        
        PID:5612
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2180,i,2120026743286524748,12027167754397305329,524288 --field-trial-handle=2328,i,15500506431014942571,6614655864219266074,262144 --variations-seed-version --mojo-platform-channel-handle=3100 /prefetch:8
        5⤵
        
        PID:5756
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3432,i,6213421731374862728,5831444667509709713,2097152 --field-trial-handle=2328,i,15500506431014942571,6614655864219266074,262144 --variations-seed-version --mojo-platform-channel-handle=3468 /prefetch:1
        5⤵
        
        PID:5996
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3448,i,3114616898311082506,11904504429614372555,2097152 --field-trial-handle=2328,i,15500506431014942571,6614655864219266074,262144 --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:1
        5⤵
        
        PID:3676
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4716,i,10785288674015325551,2125045139480787750,524288 --field-trial-handle=2328,i,15500506431014942571,6614655864219266074,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:8
        5⤵
        
        PID:5328
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4952,i,13140722540582683994,4071551026861400934,524288 --field-trial-handle=2328,i,15500506431014942571,6614655864219266074,262144 --variations-seed-version --mojo-platform-channel-handle=4712 /prefetch:8
        5⤵
        
        PID:2824
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=4964,i,16061074582795248784,14637849068900108944,2097152 --field-trial-handle=2328,i,15500506431014942571,6614655864219266074,262144 --variations-seed-version --mojo-platform-channel-handle=4976 /prefetch:1
        5⤵
        
        PID:1728
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3708,i,17951387866085833612,2756094970141545558,524288 --field-trial-handle=2328,i,15500506431014942571,6614655864219266074,262144 --variations-seed-version --mojo-platform-channel-handle=3704 /prefetch:8
        5⤵
        
        PID:3812
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3712,i,6164295601112041299,12879383152129591070,524288 --field-trial-handle=2328,i,15500506431014942571,6614655864219266074,262144 --variations-seed-version --mojo-platform-channel-handle=3368 /prefetch:8
        5⤵
        
        PID:2580
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5584,i,9478397506698575567,5395422096722478823,524288 --field-trial-handle=2328,i,15500506431014942571,6614655864219266074,262144 --variations-seed-version --mojo-platform-channel-handle=5600 /prefetch:8
        5⤵
        
        PID:5272
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5584,i,9478397506698575567,5395422096722478823,524288 --field-trial-handle=2328,i,15500506431014942571,6614655864219266074,262144 --variations-seed-version --mojo-platform-channel-handle=5600 /prefetch:8
        5⤵
        
        PID:2864
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5760,i,11180309831717515961,15520287610706239649,524288 --field-trial-handle=2328,i,15500506431014942571,6614655864219266074,262144 --variations-seed-version --mojo-platform-channel-handle=5804 /prefetch:8
        5⤵
        
        PID:5432
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5948,i,6984787607195840139,16945629656075050604,524288 --field-trial-handle=2328,i,15500506431014942571,6614655864219266074,262144 --variations-seed-version --mojo-platform-channel-handle=5952 /prefetch:8
        5⤵
        
        PID:2376
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6100,i,11419970284980579063,4816502219883857787,524288 --field-trial-handle=2328,i,15500506431014942571,6614655864219266074,262144 --variations-seed-version --mojo-platform-channel-handle=5964 /prefetch:8
        5⤵
        
        PID:5272
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5768,i,17414578998826324693,5422093635364903398,524288 --field-trial-handle=2328,i,15500506431014942571,6614655864219266074,262144 --variations-seed-version --mojo-platform-channel-handle=6088 /prefetch:8
        5⤵
        
        PID:3232
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6156,i,2464123178369484183,6773963310213286928,524288 --field-trial-handle=2328,i,15500506431014942571,6614655864219266074,262144 --variations-seed-version --mojo-platform-channel-handle=6092 /prefetch:8
        5⤵
        
        PID:2544
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5768,i,15445789328122638213,16191602989266855897,524288 --field-trial-handle=2328,i,15500506431014942571,6614655864219266074,262144 --variations-seed-version --mojo-platform-channel-handle=5996 /prefetch:8
        5⤵
        
        PID:6092
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6292,i,9644399348657850762,541066148109091757,524288 --field-trial-handle=2328,i,15500506431014942571,6614655864219266074,262144 --variations-seed-version --mojo-platform-channel-handle=5644 /prefetch:8
        5⤵
        
        PID:3984
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6060,i,17152526918000386377,6018075030050642787,524288 --field-trial-handle=2328,i,15500506431014942571,6614655864219266074,262144 --variations-seed-version --mojo-platform-channel-handle=6224 /prefetch:8
        5⤵
        
        PID:6024
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4016,i,3213355807732694365,9092345589516993797,524288 --field-trial-handle=2328,i,15500506431014942571,6614655864219266074,262144 --variations-seed-version --mojo-platform-channel-handle=4816 /prefetch:8
        5⤵
        
        PID:5724
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5128,i,1629126753355608792,13118542970938136844,524288 --field-trial-handle=2328,i,15500506431014942571,6614655864219266074,262144 --variations-seed-version --mojo-platform-channel-handle=3776 /prefetch:8
        5⤵
        
        PID:5200
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=3320,i,10549610753140436829,8867344574610835362,2097152 --field-trial-handle=2328,i,15500506431014942571,6614655864219266074,262144 --variations-seed-version --mojo-platform-channel-handle=5648 /prefetch:1
        5⤵
        
        PID:2124
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=6300,i,1651320337747926725,1031343902689168167,2097152 --field-trial-handle=2328,i,15500506431014942571,6614655864219266074,262144 --variations-seed-version --mojo-platform-channel-handle=6036 /prefetch:1
        5⤵
        
        PID:3256
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4740,i,16617767540004547405,14988784207787847123,524288 --field-trial-handle=2328,i,15500506431014942571,6614655864219266074,262144 --variations-seed-version --mojo-platform-channel-handle=5072 /prefetch:8
        5⤵
        
        PID:360
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=4264,i,6952604893340400022,5240401775931923590,2097152 --field-trial-handle=2328,i,15500506431014942571,6614655864219266074,262144 --variations-seed-version --mojo-platform-channel-handle=3732 /prefetch:1
        5⤵
        
        PID:2088
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=6448,i,17946807415081477506,8357148594939757037,2097152 --field-trial-handle=2328,i,15500506431014942571,6614655864219266074,262144 --variations-seed-version --mojo-platform-channel-handle=6464 /prefetch:1
        5⤵
        
        PID:960
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6280,i,8005390149021704362,10287466857691258810,524288 --field-trial-handle=2328,i,15500506431014942571,6614655864219266074,262144 --variations-seed-version --mojo-platform-channel-handle=6300 /prefetch:8
        5⤵
        
        PID:1292
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6604,i,418218834383753511,12332659478338499450,262144 --field-trial-handle=2328,i,15500506431014942571,6614655864219266074,262144 --variations-seed-version --mojo-platform-channel-handle=6584 /prefetch:8
        5⤵
        
        PID:4128
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --always-read-main-dll --metrics-shmem-handle=6564,i,13752414286085149685,2402836543657145493,2097152 --field-trial-handle=2328,i,15500506431014942571,6614655864219266074,262144 --variations-seed-version --mojo-platform-channel-handle=6652 /prefetch:1
        5⤵
        
        PID:4596
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --always-read-main-dll --metrics-shmem-handle=6672,i,2850712689074888585,14957833083660020162,2097152 --field-trial-handle=2328,i,15500506431014942571,6614655864219266074,262144 --variations-seed-version --mojo-platform-channel-handle=6664 /prefetch:1
        5⤵
        
        PID:2312
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5072,i,16297065345883078653,1820577174192428306,524288 --field-trial-handle=2328,i,15500506431014942571,6614655864219266074,262144 --variations-seed-version --mojo-platform-channel-handle=6464 /prefetch:8
        5⤵
        
        PID:5336
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5072,i,14869749037316730047,2865704753324649255,524288 --field-trial-handle=2328,i,15500506431014942571,6614655864219266074,262144 --variations-seed-version --mojo-platform-channel-handle=6824 /prefetch:8
        5⤵
        
        PID:6120
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5928,i,2130689080602550047,17802455198805536892,524288 --field-trial-handle=2328,i,15500506431014942571,6614655864219266074,262144 --variations-seed-version --mojo-platform-channel-handle=5908 /prefetch:8
        5⤵
        
        PID:5408
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6288,i,7390176423002706711,9745620318125814801,524288 --field-trial-handle=2328,i,15500506431014942571,6614655864219266074,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:8
        5⤵
        
        PID:1428
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5400,i,11463317971140584025,5905738173747915091,524288 --field-trial-handle=2328,i,15500506431014942571,6614655864219266074,262144 --variations-seed-version --mojo-platform-channel-handle=6784 /prefetch:8
        5⤵
        
        PID:5332
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6852,i,16876326254456556692,12458984883788952591,524288 --field-trial-handle=2328,i,15500506431014942571,6614655864219266074,262144 --variations-seed-version --mojo-platform-channel-handle=6868 /prefetch:8
        5⤵
        
        PID:4624
- - C:\Windows\SysWOW64\explorer.exe
    "C:\Windows\System32\explorer.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:5208
- - C:\Windows\SysWOW64\regedit.exe
    "C:\Windows\System32\regedit.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Runs regedit.exe
    PID:6124
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://pcoptimizerpro.com/
    3⤵
    PID:3956
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument http://pcoptimizerpro.com/
      4⤵
      PID:5324
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=how+to+remove+memz+trojan+virus
    3⤵
    PID:5740
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument http://google.co.ck/search?q=how+to+remove+memz+trojan+virus
      4⤵
      PID:5324
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=bonzi+buddy+download+free
    3⤵
    PID:3444
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument http://google.co.ck/search?q=bonzi+buddy+download+free
      4⤵
      PID:6120
- - C:\Windows\SysWOW64\control.exe
    "C:\Windows\System32\control.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:1884
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6152,i,11818728153446367773,5209578021397611942,524288 --field-trial-handle=1836,i,12413561500552628891,3159038595506041082,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=6044 /prefetch:8
  2⤵
  PID:3960
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6008,i,15926282490325863683,16962050345160848758,524288 --field-trial-handle=1836,i,12413561500552628891,3159038595506041082,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=6224 /prefetch:8
  2⤵
  PID:1832
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6056,i,9018545138446764858,7026660718650681341,524288 --field-trial-handle=1836,i,12413561500552628891,3159038595506041082,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=6236 /prefetch:8
  2⤵
  PID:4164
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5688,i,8359602889625345512,16748899830890221748,262144 --field-trial-handle=1836,i,12413561500552628891,3159038595506041082,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=6248 /prefetch:8
  2⤵
  PID:2792
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=3388,i,15232985724842485501,5414069904516421370,524288 --field-trial-handle=1836,i,12413561500552628891,3159038595506041082,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=6384 /prefetch:8
  2⤵
  PID:5652

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3368

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:960

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x498 0x248
1⤵
PID:4052

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4876

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5200

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4908

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{5BD95610-9434-43C2-886C-57852CC8A120} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
PID:5068

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
1⤵
- System Location Discovery: System Language Discovery
PID:2956

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping740_1069125646\manifest.json
Size 135B
SHA256 cb929ae2d466e597ecc4f588ba22faf68f7cfc204b3986819c85ac608d6f82b5
MD5 4055ba4ebd5546fb6306d6a3151a236a
SHA1 609a989f14f8ee9ed9bffbd6ddba3214fd0d0109
SHA512 58d39f7ae0dafd067c6dba34c686506c1718112ad5af8a255eb9a7d6ec0edca318b557565f5914c5140eb9d1b6e2ffbb08c9d596f43e7a79fdb4ef95457bf29a
TLSH
T1CEC09223CC019CB119743B642AB2AB82F7B41B0B6869705A3AB3148C1F7E1B48082680
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping740_1080413842\manifest.json
Size 160B
SHA256 2a7fe18a087d8e8be847d9569420b6e8907917ff6ca0fa42be15d4e3653c8747
MD5 a24a1941bbb8d90784f5ef76712002f5
SHA1 5c2b6323c7ed8913b5d0d65a4d21062c96df24eb
SHA512 fd7dfec3d46b2af0bddb5aaeae79467507e0c29bab814007a39ea61231e76123659f18a453ed3feb25f16652a0c63c33545e2a0d419fafea89f563fca6a07ce2
TLSH
T133C04C23ED18BABA12F587D40971DB43F7F0031B34E169463B39948C5F761B8925175A
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping740_1614062425\manifest.json
Size 85B
SHA256 2d905d7b28b1afd313753d14f6a916a2e56ec4c1316bfa43046b09214ceb6090
MD5 8ce95626b39ebc2401eee0b34c24fc7c
SHA1 f97a2fefe756f7a03e388e1333573b884730c2b0
SHA512 f04e4f695977918adf6e0603386b6f9c75a4a2202b0fe7215b642f3db491a1db398039cc28633b8e2541749403581622d28c1400f3f8fc66a3daab200e27266d
TLSH
T106A0121018015DE318880320213143D2D3A51C05247437001106108019B8636027A22E
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping740_1991572385\manifest.json
Size 135B
SHA256 ba5c9096d20a482aaa1aa9e5f98ad6127d3e97c2f21de84f7c78d9b8073c8e26
MD5 fbebd68ecaa98928909421f66909c054
SHA1 99d787d90f7ed2e5ad924f9c5668eb988b5a6c07
SHA512 749a3b2be47fe28399dc763888654a3e8d397e06e8d3c3af3965bb45846a1336e6ab4ca82c82c3df846b34a2afafa2156f2690e9bf347ab175408dc0171c61cc
TLSH
T158C04C668D51DEAB00A747A56B295315E23B4B4B5044800A7AF5429C1A288964171944
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping740_469831054\manifest.json
Size 160B
SHA256 31952875f8bb2e71f49231c95349945ffc0c1dd975f06309a0d138f002cfd23d
MD5 c3911ceb35539db42e5654bdd60ac956
SHA1 71be0751e5fc583b119730dbceb2c723f2389f6c
SHA512 d8b2c7c5b7105a6f0c4bc9c79c05b1202bc8deb90e60a037fec59429c04fc688a745ee1a0d06a8311466b4d14e2921dfb4476104432178c01df1e99deb48b331
TLSH
T1F1C08C73CC08AE7911B14B371B214642E3B8030B600039093A32084C0BA47B00262328
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping740_996334431\manifest.json
Size 43B
SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
MD5 af3a9104ca46f35bb5f6123d89c25966
SHA1 1ffb1b0aa9f44bdbc57bdf4b98d26d3be0207ee8
SHA512 6a7a543fa2d1ead3574b4897d2fc714bb218c60a04a70a7e92ecfd2ea59d67028f91b6a2094313f606560087336c619093f1d38d66a3c63a1d1d235ca03d36d1
MD5 SHA1 SHA512

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 b539af58c6e8ae602f9a61650edc7cb8cfdb3b3fce7647dfc364d0f1fb2d9414
MD5 6a0e91617577a852c120538c059b5fa0
SHA1 3266f393e2ca08d6a29bf1898ec9a6ae93ad9223
SHA512 685d1501e616c320a0200c66504f1d6c8c557accbada4e5f1c92e026e741beb139fc3d1213a387f9672397e49cf6bcafcdff4993c64652f90d9cc4cd0ff23a1e
TLSH
T108E02BF6D821EC3B08FD07596051078AE742232B2BC0840F7A3D830D8FF46360582D5C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 086db0f605030023420b1dfc36a03d443bdc566ba19f6e89df69a6365929ae40
MD5 c9bb210318ed809d99ae522fa5b80104
SHA1 254564e07e1ba310d9a797d5d8855f0f8d8adc7c
SHA512 2caf537d051356e8761956f65b702996ec45f738e1d77baf603e977b1a185f79749907b2945415467f6af269f9a0d3f7819c5a06fdb4735947d73e9d8facd340
TLSH
T18571D60884E9AE28FF2C40B080C17D59777F142680673F57E1995B326433BE3279F456
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 8KB
SHA256 e2344825faef235647c2c4494f133bdb4f479bb257d6c2150ce024efdfd74436
MD5 c755220dde778497e837be1d48180ff0
SHA1 efe5865f69e1a266638398ed0be32143536a830a
SHA512 725377ca055edc2488942c917a986b46c8759e7c709f6eecb099d629d19783edf640fd6b3ead1db730d5fb13f14ffd00444ff716c8800feb0403748cb8fee265
SSDEEP 192:DDDDy7kJeq9q+fLm13m5BczqeaIatSjqUwqt6IfynIhoBNmrm7LmGmmmgmtmCGij:D3uAg6/jm1mLCHaIatSjqUwqt6IfynId
TLSH
T1B5F1BFF3C3D4C56D8A1155F4AB25AE1FCE290A24431D3C6AC8E4BE4BD3E2871D21139E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 8KB
SHA256 da2cef8f2d19c91badca87b545950cadadade050dfb286f822c0093ec80e991b
MD5 ddb700f77fbb3d42da6e13e8582f98e0
SHA1 f00003ed890ff2952317a9a9c831dc218faec4c9
SHA512 4e598c12bc6c71b896f6174265b13adac30c480031fd2480b8b906527c8a8aa9ecd967f65ba4fb1e241c5244ccc3ebd06626379f37dbf98ee595ad59b8eafc92
SSDEEP 192:DDDDy7kJeq9q+fLm13m5BczqWMaIatSjqUwqt6IfynIhoBNmrm7LmGmmmgmtm+xY:D3uAg6/jm1mLCzMaIatSjqUwqt6Ifynb
TLSH
T15F02BFF7C3D5856DCA1155F4AB25AE1FCE290A24431D3C6AC8E4BE4BD3E2871E21139E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 36d82a83587782009ce85ab06ad70ff8eeb29452d67fe913e25df5404318daaf
MD5 b13623965e916df36d1a5732ff0ad08b
SHA1 3c653565c463c087cb744fdcb122105eb7e6bd7b
SHA512 aa240bd0bfa69648dd4a029fb70dacfb7c7d9f2b9b5c5ff09e2c4c1adfc3ca51da1befaf904e7afbaf8e523dfc659fcfda3751c5b96962402fc671acc758beec
SSDEEP 192:VhRucBzUh0faAzsCFv7CMpAPRp2f2N93Hsb+WNnrr4QM2ygqkw8vaVyIsnAUgtaJ:PRumzUQB1xUXbxwnY2zqf8
TLSH
T13552C36EBD14693B9CFAD31AF9227B07D7F21021B5961E84EAFC8A2C14E75CC2117417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 3ced5294c833aa6023da1be47238968cb91e100a27302a74153da0b45a992eae
MD5 b31d81dd9bdcbd2191b99d808d7656da
SHA1 f0d108a24b2a8782cfd0f8b4f069d213179a3928
SHA512 9f35a82c9697c691fd533c2101871d9dd521c7f98ab66e173d20a0f0e56311bb80842adc4c3a0b4dbc665160aad2074cdd009dd54c494d4ae49e14c0a59fa59a
SSDEEP 192:VhRucBhUh0faAzsCFv7CMpAPRp2VkYICsy93Hsb+WNOBrr4QM2ygqkw8vaVyIsnH:PRumhUQB1xUXMNxwOY2zqf8
TLSH
T11552D46EB920393B9CFAD32AF9117747D7F22021B5961E84EAFC8A2C14E75CC2117417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 0966156a3457ee54b995f97cda5d1e6fc109e4ad85b8e82edbb27425d54cad67
MD5 4163ea18709cc26876a87b8f6742e8f3
SHA1 93205e871aa28fc52b1adc7ccea1abbd5338cbd8
SHA512 186cd1ee2483ecd0635f8a12bd81647af634ff651ad872ed4e24ff9c86796d38b29d54a383f67d351f75ba082b012ee49754881a9827548d0d6aa95855d861f3
SSDEEP 192:VhRucBh8h0faAzsCFv7CMpAPRp2VkYICsy93Hsb+WNOBrr4QM2jgqkw8vgVyIsnB:PRumh8QB1xUXMNxwOY28qle
TLSH
T13452D56EB914393BACFAD31AF9127747D7F22021B5961E84EAFC8A2C14E75CC2217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 9c430f8c17feb865c008f25efcb04058f5ca91ec3e589c4f1ad8c3f157cbd990
MD5 d8cfe36a6891342c51bc518f22217e71
SHA1 73290bff0114201260216b0cb931cd9bda0228c8
SHA512 7e9778e0fd6323fceb05d3cc91303d1d284a486f525d995ef288db3363d58c76ff756e8e5e9add87e5a95e7ffd83adb3cf949ed5b7444a047d33f0fd1fa9184a
SSDEEP 384:AmjUj7KxkXqKf/pUZNCgVLH2Hfgsl5x7pLuLcifuvXODUf+ErU3xeHGHHe7omBcw:AGUj7KxkXqKf/pUZNCgVLH2Hfgsfx7pH
TLSH
T15772EA677C4C9D3B0F94C68CD816BF4FADB6024B55ED886443FA982903D5ACB110A2F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 7ff7afdba7b782b1d04c287fc373957510c74b10b7f3d994c35f60fdc324d1bc
MD5 7b8198d45b1aa37001e4902bc43abeb9
SHA1 40388553e4f7271293fc4c4aedcda55b8b99eecd
SHA512 efb060b8f2caf7ca14d30d1f16feb5eec02d6f0c5e4bb665e656fe2250aad656b8003a86d45c3375d6ad2fde20ae60c704b3809a1328b2a199df435758e75cd4
TLSH
T164B01290C0025511C44302F412C604C8322CDF148706270263F0FD71AC2B1D18418190
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58964f.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58964f.TMP
Size 96B
SHA256 7c7c7e5ec437ad13e9dc3c415cf7d813aa74dbc13aedb7f974804a921ed1cd48
MD5 f445fa8543bce1b38c682b0742a87f9a
SHA1 d237f8fc799c3c13ef4c7a4c4b41266ab983d930
SHA512 5e377fc686646310438cc4399e22aae6db5ae37586a20f744aed286a3a52a1d75ecd5471d5b9542929b2a6ede148a99215bbcedbef1385e9476cf4a0e38d5e2e
TLSH
T135B02208C00BAA0AC00203B02CE8C0C83028CFB0C2032A0A82E00E2ACC202200C20330
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 72B
SHA256 18c0cd765d0fe15ae8ca6f5f7c082f67389b7c0570a4ff6cad9c88297daca45d
MD5 86bbd499da09dffaff5e26f61871c85a
SHA1 390916c7766d42d6b68589bb3558237ef4b3ddda
SHA512 d0a5a415351b392876a854bf8087f4862668b12885eb4462195dcdf048a38e1fe74745da363834c8c54928796bc2e1525a6a1f27c70f761661027ea2477e146e
TLSH
T1B3A0026075D67C11CD0513F0109192407359BC701D56E34364E445C6C9562614299001
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 202KB
SHA256 d4218d0288b4cf5ba12115a24d7c0d0b86aa2c589007f4b3d501e8c09fb9f57b
MD5 b4bbe279b363a6260bdd92ed74feada8
SHA1 b2287c712341b8eb70790792238c3e7acf474382
SHA512 6c6e1cfceedd8b0e37c477243c046402530bbaed9d5c4c3a01fd08e2923b520f6ec87489804f0e947ec38596399517e2b4a4ad44f5af7794241ec14ed16a5c86
SSDEEP 6144:EDtDaE4zD0mKWd7U4XcrOk0HOGm/SFyEE8:Cj403WSrOjuGdF28
TLSH
T1FD1423BA7E3B259B1ABC8783B51D380CCC866397525BD4CC565E73C8E2653422E33D62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 202KB
SHA256 ecd5e859f0a07cc854d89006ba243ff9433e5391e8fffd12795367f87a8c5013
MD5 6fea5ef27ef1785f362651df80d7a6f0
SHA1 36cf17ebe2b80d30b99e94e2bf972dbc5c067798
SHA512 6698d5887e1f43ea9ebabe50d07c1099b9264a13f1c1da7636a9ba7eb3e7a2623ff8db60e87ef743fa67ea1e1f253c47603f359c9f27159f2c3ba5b618b10e8d
SSDEEP 6144:cDtDaE4zD0mKWd7U4XcrOk0HOGm/SFyEE8:aj403WSrOjuGdF28
TLSH
T1621423B97E3B256B2ABC4783B51D380CCC866397525BD4CC565E73C8E2653422E33D62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 89KB
SHA256 31e2901a611856ad00e740212b11d0bbf4fba9e453a66792a50dab1685c6a863
MD5 6953745e8567aeda9bb69399215a578a
SHA1 57b82df74a5d8effd6d9cba3b14faea51a67cc7a
SHA512 aaee6147418f9f7c098b43869b333e29f1f5d59b1bbd3f038348d64fe6b24243273415eb20aedf47f6ec67c739f1dd72588c3b2aef8842b45f2d09e15881146f
SSDEEP 1536:ip/CcYRrL+PTA5F9/EO93Sos5EA3A820kOzXmUWUSGbqRszr6vFAlZLPm+6jR9YW:aC3Qw/xLANk0mUW5GmRntSFCjEENL
TLSH
T1349312BA4E2646E7997D4A8276AE7909CE12534D705FA9CC325C638C61D02C82F72F73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 201KB
SHA256 559618b39da180936ee688d07230463f5536f0ead3497fe5c0e2798cbf2fb1d7
MD5 33e984cc72faaac7842504caf9e74ebd
SHA1 02a0c061ee7e63d3c216e905a3df06c1dbbc49df
SHA512 ea68861cc5ceb1acaa711543eb0f4278a5788519405400e73608ad83ca576aa3be225ec21bbc7696d739a2c192790e221b60d58600f097786bfa773377154914
SSDEEP 6144:HtDaE4zD0mKWd7U4XcrOk0HOGm/SFyEE8:Nj403WSrOjuGdF28
TLSH
T16F1413A97E3F256B2ABD4383B51D280CCC4A5397229B94D8475F73D8D2603862E33D66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2d44a47c-e534-4219-8b1d-3a30feee1969.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\2d44a47c-e534-4219-8b1d-3a30feee1969.tmp
Size 8KB
SHA256 9df3663861e2e863d43848179509a36186e82ad7af2d3b3938696faf780e07d5
MD5 898b4aafb7e91fea541fa072fb6b3127
SHA1 67e5f4acc6c051541d35fb50598e6c36e484543e
SHA512 334633a17a9d65bf5edc2be2db80e97b042a34f133b9a3ae0ed5e511142a9b67ad459dc27b8b85961a1c2356898df53f20801c287b9c63978d6b5492ae93c6b7
SSDEEP 192:SONl6IT0AQmiUyFmFgibFF1m3kneJBh1tqlU6:SONl6o7Fgi/gkyAU6
TLSH
T184121A72A4BC682F5EF3A956B0873A135EB1821BE7C97F84D5D81A0C00DB19C230B963
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

protocols.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent\1.0.0.10\protocols.json
Size 3KB
SHA256 4fd800e7b1a5fb24b13fac2e31946d205012b7c28d8c61580b0669b2fa3517cc
MD5 1de85fec2dfcc28011a7c2aaab95eb5f
SHA1 80e8c954bfbe8f7ee5a2335c8d969ae033935dc3
SHA512 9c7dd37eb0c094b6aa05201e7c71a8f33b9db81284223bcfa595a44a6ac95d5a6820ab6f07b7aa8d26bf207454e94277bf35332e9c009ee63f083752b6b51750
TLSH
T1D1611DB79A3048090E3412B86B19B35DF63E029F1AD598EB76BE568F1F710F7245C54C
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 6b65e3f6d57bee85b90392c47f2236ea7ffcfe9cba07ca29930764c7dacc0ea2
MD5 726476576ad538c648305e214c389ece
SHA1 03960d925aa07a6736b28a431ddf422fa8bba04d
SHA512 7b99250e71a507574a7ea1c326ff4f687cffd7e1a0eb1ba5aa847f5b5e0c5d997dbef37ede7c2815a11e03b25f291a4f19173dd0aa9d22472d224e9b1d6349a5
TLSH
T11ED0808995F15C35D5D78CF1154B37067915C577DF42932374633C3C8C435D19546283
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 d084fddc35d62ab10457432373865714cd0577ad9bebe9188135998b9f802bd3
MD5 ff587c8337b9997eb40f19fb41bffd1a
SHA1 75e9be1412e32cbe6e960e041e872bbb48ab464e
SHA512 d50cc729f4f047045aba003643fd356cb1ac85c1d90f9ed992f787f682a862005a91103e9e388ad5cbd4f884c2668a35a0e5a0d011d0684ef2d6bc59a10b1701
TLSH
T15ED08089D5B15C35D1D78CF1154B37067915C577DF42532274633C3C8C435919546283
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 5ffe048d16b280d159b9f3005f5c5ae1d61c5490bcea1d88aa6b38d9a02f3962
MD5 526d3a8e497d74dbad8614bfc30d4197
SHA1 b247927cbce169a316f3b4264f3a7bc2a1cc8530
SHA512 feabad212c4d5e2cb3192258587cc72e18e0965776ae95dad60ed5093cce4fa8ba975a5918b217a2d898ec38f7437842f7210dd11d5f91cbaf064d2772ade989
TLSH
T187D02373EE4DA015E36F45F16213831527168175BE434511F205C44CCDB95E9A3C22C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c5b49c7d6c76a4d7802f4b24fa1b200bce02450255e2cf1b3b809e2235e272c4
MD5 7355d162c219cc936f23c94d2e869fe3
SHA1 0ec52aa82551da54f67bc3f1d6ac4ed7247f5108
SHA512 0c34414a6d9bd61ffc246ecbb6a030918d37261d85f19741620a99fa0231ecc1ae8555b8b66e8c7bc406479a488eb6e5ab5a0c53eaca52b44554327d276899ef
TLSH
T182D0A7A7AA8A6040E25745F16053C707671682796E525501F1559C1C8D660F6A3C6282
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e722a9afaa8fac834cad2d59c6328d936a2c33ee5d872af2f8db0943c2846716
MD5 eface4b8574b552dcb019e4c1e5525ab
SHA1 e5d96ddbdabfa648deb552890702108c20aa057e
SHA512 68785c5aa5b7af2d9b34391ef5fb5c2bdd131b90e283d88276269a7d532e48512b332401a3753c546ba4c0385ef9b75e5dbc19c05e8f53f27cbba4f258fc7b1e
TLSH
T10BD0A7A7AE8AA040E25745F1A053C707671682B96E525501F1599C1C8D660F6A3C6282
MD5 SHA1 SHA512 TLSH

Submit Download

0a34a6b6-47cc-46f9-8a46-b06ad06f2938.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\0a34a6b6-47cc-46f9-8a46-b06ad06f2938.tmp
Size 414B
SHA256 9ca1d49c36645d7c22386fe6a82b993a5b4939be14399f314318eaa405154885
MD5 4c252b9b5759c1028c11b650eed06b6a
SHA1 c8deeac50a24ca2eaf98f73b0a6ce7acaa37dd2c
SHA512 aee3943353db2ac5748a4b82a02742e26240245915ff8bfbba067378905e73f5e20444f8d7382c0af7ea86d6deac70da8635f80b2a04c983101e070578790acb
TLSH
T182E02BE6C951AC3718FD0B2961554B86EF5513172740481F7B3C850C8FF553A4686C6C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 b374302e57c32521c335ba7660e54ced1310f3c4cd25f7fb653b2293886d1947
MD5 3986fdd88e76c7024200a0ef9c270f54
SHA1 de27195b0e76010c787384cb5072e4609f3ff6fe
SHA512 186d6a399c16ea48721e389a8951b4f6e08efe30e936205534dc436f75ce1887d3c3dbfee0b429cd47c1b1227e8b466f675262ed105952a2843968e1c32bb385
TLSH
T155717E484C838F2DEBF1B3F03EF720247278C758548B6FA8B6F554FDA622B046860860
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 3723c5759bf29b6c4b6ef0caa0e35ffd7d4f10e3335251d306021ed2559dbe78
MD5 fe6f47e9717e2fd125b01382cdf9a5eb
SHA1 7f9ff2599ca96207b908b95d14ba55f27a3b7402
SHA512 00655704db3b4f4cad357fb2d63b1d5cddc90c5d8dda9e8321ccb8a1e0e5e17b27e753d81a9206454e46120a512309f5b6ff7ebe253d8b6a361d166f9de41f66
TLSH
T1757160884C938F2DE7F0B3F13EF32065B274DB58548B6F583AF565FD9621B106864850
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log
Size 570B
SHA256 99def1b557f19f04c1affc6f247d0451f33fc10ec42e73792223c3215ac98be6
MD5 d4ba0ae0bb0b9faff3da6f35fdbc3c8a
SHA1 fb3e9dec7f35a9b1d94e54a5659dd0de484055e7
SHA512 86fd07c34b9abd4c52ba19eae291936f92bc6d38a75c021edc1dedbc15617669876180cd99f959c62476d82ec6bb9f5fe4c6cb4d82cb037efb76d99a4d3d9c51
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG
Size 319B
SHA256 ef0d839b789adc48338d5a1db65b833bb03497fa42b0363570ee8e9f418fb865
MD5 39a60b023675f80484e308562dfd134c
SHA1 706def7247f939a31761a70428a13f1188922c32
SHA512 37781df471d880cd9cd9f9498d29f3c112ad1a10284a1386ade89d8a0adf8d4070dc91de159afebec547b84c19809c500b87e17425957dfbf009bce3123fcdda
TLSH
T17EE0DF8444C8C32BA4E469D38378674DC2F23813A2883D626748EC80B181241E2AE2E4
MD5 SHA1 SHA512 TLSH

Submit Download

Favicons

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Favicons
Size 20KB
SHA256 09af6fba6b46ad485bb70b75b0c545027f4232f55eb8b8171e7eb167318a15ef
MD5 8584e06f48c44233c62e11a00f4e6b4b
SHA1 cabfd969ae31f51732ef4b96dbd93051013e3882
SHA512 c13531e408abf632151c57c3cc00cec8b532f7d34a228d4e7ef5efd22af70f810b7e59a5849a775cd59a74203835daba78bc5f74d8b286cc28ffb3084c55eab5
SSDEEP 48:uzBmw6QU1PzQ6NWpNWAqLmi77E2uNrku4JyVsCeUHzsLxfH0vrST6J0w+at5qgSr:6BCxPnoqu4Jy9emzkSvr/5kdKi
TLSH
T13592D6876E743803EB846836212DAA31CD37C29D6E6A2C8834C840214DF9C97943D9FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

History

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History
Size 204KB
SHA256 75b09c2ab1fc1bf3beada459a5a22125d4f57ccd0d01d20ed9392ad6fd9fa176
MD5 e63a13a862274b1924a0583e8d1c9a1f
SHA1 f5b8781c944f75d806ba4ccfb831b093220c2dc8
SHA512 be2102c16d4dc7ae92ae6b72dd14e3afb64436ad00bacbecf38f3cca0afa1422ed073681a7ef9535151e8c58d32a08548eac2ee9bef55c43e7417b9cf93c8181
SSDEEP 192:0nFbAf+G83uy3Ct7XBBKodzH7DXspU3if:0nFbA/83uICtTBBR7DXspU3if
TLSH
T1DC14211F5F342712CDBD917668E655B35D6DF03F8B5226CA6CA10470CEE3A52A02C8BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG
Size 331B
SHA256 a3d7d9a75cf5e038b0b6aa8918e5d2a1b99c66acf244ad9fdb10c201fd869212
MD5 a7ed86e2c87206d66610591b0a0a4ba7
SHA1 21b18ee5c5dcf11bbb6a4a273dd5e9a15c280a0c
SHA512 d85bd626931e9646f52aebcef670a624b287ca2af311bb6ea7da94665e1421613499b5fa4db0de0ed5f588645d5869505c9cadec70ebbb41cb11bd6bfe1e9cbb
TLSH
T1A0E0D8A445CDC25F666424C743386F4AC3F53446D7882E016B04FC80B189004E79A1E9
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 6KB
SHA256 72c792e3f0102fddeafbf79368b191ddc382636569c33769a13650d67169d42e
MD5 105208e8270508461f4d78e7c79f2ee6
SHA1 81a5ea727ac9ec245f006b20472259520c090889
SHA512 7a5357a914fcec432a61adb6f500f74aa7b9fa10c0001042228b0d31b2fdfac9018a079865ef590d849a10e5c985f32eba9b63038c607e9b5d27507ae0811eb9
SSDEEP 192:DPfSofWaTG4UK7Nakuaj6TIk7EyEe6jr3fj01SejVfCQyZE:D31+epUKNakuaGTIkohzjr3fj01SejVT
TLSH
T12DD1D0F7C3F88A6DCA5251F0A6292E1BDE1D0614435C3E8AC4E9EF0BA7F1471E14198E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 c9b4d41b9bd2adf0d6159b939f3128080f68f2a4f245f2a22f66a51daf74c863
MD5 2e897926168f9f25f5310e42c8347829
SHA1 f159fa8e3c304a45617c4220f9daabd84c9efa73
SHA512 ba0a41947fc058cbb85853252cbdf66d1548cadf964e231df3def0614d2f1dcda8322ebc5b79c7c3ca2673594f4cc5f4191f1c7579e54a886020fe477caf2921
TLSH
T1EB61CEF7C2E8866EC95152F0A7147F1FCE2D0A14832C3D5A88E4AF1B97E2471E101A9E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 d1ce38d0f812cdea69a677dc598dccdc3a2c8dc286075cc8ffb331700bb5bb9f
MD5 71fa0a49edbc028d2a0e50d7c4f02d2d
SHA1 65dd6a4e103dfe9759c67e2c8bcd84af28b38a14
SHA512 ba4ef0fb449e61e82ba5fc7328e1a75e80f9af186df92769d2bdeae07282e385029e152560918bdf4198809e74a795b58e5b3e9990d43dd507e2732231d6bd83
TLSH
T1EC41AAF7C3E8856D894186F4AB156F2FCE2D0A14432C3C1A85E4AE1B97E28F4E10199F
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 929f4db11d7a76a88efe39e20834cf65000f38ef213833c4999572a7fb08444f
MD5 d83769bfa30ca93a9f7357c310faad1b
SHA1 bb86385b5a69359678890eaa64a4f3295cb24d83
SHA512 a2361f9373d67a954baefd4cde5d289bd35f4e92ac6db90fd2fabf426aec7748e55b9ed37f9617b691b832d56e09416d6027d738e931fbb365826d5d619d827a
SSDEEP 192:sxZLRUyM//K1Ml8cBj0/ffsEWpVMGIVGMEdp7AfHW6+WNdAnAbEV/YN0OAOrtdVl:sxZLmZ0/ffsEWvMdkzcHbU/ukO
TLSH
T1AE52D9166A34A97BCCD7D30AF955BF53D6F90562E2900E44A9FCCA1C04E6AED2213C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 d9ccf13f59ac83e36edd050889e4b6927f2cbf591d6a4bb4e70d2792d82b9dc2
MD5 7f655b7e27a69818da6f6f7564c2c710
SHA1 566dee39bce7562b2d51d7224fa6c6f36bb66e84
SHA512 71d07f6d6e9d19b39e9a76d5e869b7854c451b4cae846323682f442acebbbc5f8a1262b6a1b9119487124864de11143eba6432e7e1dfe429bf57ee684c4f9758
SSDEEP 384:sxZLPql0/ffsWWvepOhvHb6bZjDVKYkkw:sjyl0/fBYepOJHbojDTkd
TLSH
T16072D847B934597BDCE7D21AF955BB57D6F50462E2940E44AAFCCA0C00E6AED2203C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 eb45cf7f9261c2e97d7c6be011a1f8894c3d7468d334f2f99f46eba722907d79
MD5 8accb71a3ec3172c177c9e8d385bde37
SHA1 7f6186d9370f561a68e2bf4130daae6927065d37
SHA512 06d60254dbd5ac491bd5e78a0ff4fdd18374a0e124eb4fe6885efb7fd5c766a9cb06e878527e7eb9038d7bd0fbc0204eb6275cc9379a93b774a5935b6e6ed784
SSDEEP 192:sxZLRUyM//K1hl8cBj0/ffsMZWpVeGIhKMGMzkdp79HW6+WNdAnvsfYMukcpG/+b:sxZLPZ0/ffsIWved0hxHb5f2QkkO
TLSH
T14E62EA066A34997BDCD7D30AF955BF53D6F90422A2950D44A9FCCA1C00E6AED2213C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 287c48a3c09031af78394921dc87f73dcbbe05db23a3f648e8ddce2e01351ffa
MD5 f4c392ae5fa4e2a0a42af0a8a2788192
SHA1 eac6219ecf47fa318d355111f1e7122f4a7f7ba9
SHA512 0a5ec56a16317f1265e6993c853defed6b473c6ca470ce16f4a183000822254d894d7099b2e396ba46756e3e570aace2d53ff00531e5b65de9c58a28ffe9c68f
SSDEEP 768:9VQv2KqWve+l+8F1+UoAYDCx9Tuqh0VfUC9xbog/OVhFLllnWhSroxj1S:9VQv2KqWve+l+u1ja6FLfWhJxhS
TLSH
T13EE20B3B280CCB7E4FC45E5CEC2A6F866EE801CBA6584D5447FA894C03C66EB51178DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 35KB
SHA256 f43136bd9597869944bbde476f1a9fab92b774020f75fbb2e48e499d0d66bc95
MD5 b394afd729879f6319caf5e2a65d8861
SHA1 fa6aeaf79e54d5269a5e635267388771df11c0d4
SHA512 54687717420dedf03b409fda7f206c4aa83859953ebb7c11013a3cc87f1548679e232d2fdd4d6612f67f491621b42fd9554c0c0c009d9243d32ad63ee554753f
SSDEEP 768:9OQv20a7pLuLneqWve+l+8F1+UoAYDCx9Tuqh0VfUC9xbog/OVd0nFLllnWhSroL:9OQv20yEneqWve+l+u1ja00nFLfWhJx9
TLSH
T17CF20C3B6C0CCB7E4F804E9CEC2A7E8E6DE801CB9698895447FA845C03C66EB55175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG
Size 335B
SHA256 430d74b3e001ffb156b7df47788db6393491e9b85e6dcbece18a74570e339eeb
MD5 a64e7f4413fb51aca15ad046784c43ef
SHA1 a4abbba73d2227d011f729269f74b07807b66181
SHA512 832aa9858f382a2f190177f32b1a4be1c238072720a08d9ae1d7340dff5bcddf067ab651be1531c7946496b3034b89bb629eb9732cfa819c0b48cc4440d6a71f
TLSH
T126E0DFA005C9C27B61A524C3032CCB49D3F9744BD2C83D023F84EC806142904F19B1A1
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG
Size 319B
SHA256 526e6c248a50af3e7e52258662184f1b6e2d2e2628002c7c988e1ee373153a0d
MD5 a3218eb8b4d56d4a25d39af3f00aff5d
SHA1 3a1e1795fb6061b7e0e0b6f77d1e31394a6e974f
SHA512 682bec0fddf9b5a5ff3c03e8472dc786af7c6b6bf7a36f263ffd2a12b085d3eec3c771e7f7854aa09ff0439275989097c84c4117d0f3b3688c3e411ab2ebbfba
TLSH
T1D1E026A808C8C26F61646CE70338574EC2FA3452E3982E023700F8807245101F38B1F5
MD5 SHA1 SHA512 TLSH

Submit Download

Tabs_13422999861944657

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sessions\Tabs_13422999861944657
Size 2KB
SHA256 2f3eed6c7ab37bf8c5c0da4301fe181700076a746a4458d5da2b9ed535b36767
MD5 16e5250d3596e53a0fce21dcdc750aa3
SHA1 9e5ec180e716f8655069dc60abbd5c617dd3b0ce
SHA512 d0c75833d0ef1a010c5c15066d6cf995bb055a32e195ce5f4133f761795ef215229b402f82427adfd79b539ac4ba1b6c7b2c176a822732f365e6c25309310223
TLSH
T1A4414211A6F6061CE1B98938A5EE2231BC3CB913AD41AE5F10C143460892C959E31FEE
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG
Size 350B
SHA256 60578c188bf36ac8e8d06fdbaab3bf8bd86f57c8672c289052c8965a53cd980a
MD5 055e05bad0148b833c47c29b27ab1531
SHA1 e5e008d5c9163aaa649cb0aaace38223af9b07d2
SHA512 154cec80d43be9b2025be7dc02c5ec3a5e400bf2b3b780668c0c2d1e033171d9dc364d3ce2f43d29f3e89273a2a4bdb1e43ad4161a580008ecbb751abfa4542d
TLSH
T19BE0D8A026C9C73B619534CB9328D74DC2F37452DAD93D217F08F9D0720A140F24F2A0
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync App Settings\dcaajljecejllikfgbhjdgeognacjkkp\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync App Settings\dcaajljecejllikfgbhjdgeognacjkkp\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\000003.log
Size 175B
SHA256 80d1388b9a7150eb0291175fe693dd7b6bce910c3e4fff51e94841d31d771dbe
MD5 cb63c64828a27af7253afb7c7d986654
SHA1 8a54aeb86f79cc69e6f11278d874cebd328ae466
SHA512 e0dbdd6931c9272e0b52bb2ef7895121f6324379f584899343342a057737a9837cc476842ea781a1de5c17a20c06e0a7d24c0ed6ea41fdd95bb99296e8810f9a
TLSH
T135C09BD55F903023FDCA5D3D0DAB53041720C4752F74CF57D28430901C0A285FF61145
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG
Size 326B
SHA256 e3a27e4d3dee6dc334ae77492afaa2b2c515254dd0d0b08f99ab78ab20090190
MD5 d039d3e1ae9fd6eb59e2d172995e4f36
SHA1 32d1fb017254344c4c5cc2f3f38fe4944c40fbd6
SHA512 f4429d0c006598e24da7bbac8a3b7811e2a54e42d1225a31d413077d16416bd25075b674352916ef1878160c9fe5de33478fc0a451fd337b63f50c4de2711817
TLSH
T13EE04FF085CAC73B549864C383789B8EC2F6781697993E566B08ECC0B541244F2AE6E4
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 ec4f7a78a5a9aa4b06b6607f0b7c716f61214c385f3f03d065b8133bd2540bf1
MD5 e26273302894b194c7aafa09aabb1cbd
SHA1 1eb2521aa3bf56c7f8e031446ea5cc20c2172dc0
SHA512 3c24e73c33be8a774e8b228bb8ce590b3d27943683be7853c750b6419e32dbbd1ebff54abc2cf49ff46827a1755cdc040a837ba0d855499fbf1f36e611b03895
SSDEEP 192:SnBF8bn9DDQPCDfRcIdK1davDmBWtSWIggbw3m2W7I0nO2fE+rHz:SPJTLz
TLSH
T1FEE14651317B02B12A3E299FA950B41E02C27B633059E56B3BB840B54F27E35DDFC8E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

load_statistics.db

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db
Size 108KB
SHA256 1cb5da34cd6022dcb559400861bc63c82cb3d64949f9ed0bb3ae2f8ac8ada857
MD5 f095cacbd0426f0f224929514de4fea3
SHA1 7853445bc8922cb5ee8d1c8bc9a049459cbb8385
SHA512 cb364866507166d94a7907afd36ad71408e4f69b390a092f6cd6051c974345f7cf0947e869440611351a2c252ccfe0be985b09815c2d4c9cbc79881afaeaff2b
SSDEEP 768:yraM5U6IXE5u52Kr4TSGPPllScAh3rfNtwP6vMRyDyRDo56evw/NDABwuF6uVVPP:fhPyRvoxvV0h6K3Fp56
TLSH
T1E0B323F7AD0981A6C9CDD1B4D50BEE0454B30626CE24D9E6A97C04C37B79B033EBA5C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log
Size 1KB
SHA256 aeffd9b9ccf9a42a76f272e0bd54dc642d4be51ae8b7432572f9e028d31b27b1
MD5 5feb263cada9b41abf461691f8b84505
SHA1 3e42bd9059841746d077114d64fcb81ea103c56a
SHA512 6800e0d3437042c963693b4afa5029dcfc869166270aef33c1398c6051ec78dcb856cadc3335a8c33ba650104ee0ae6da1d9504eb05547306b79a0f030a7054a
TLSH
T190212D51F334C049C246467A543E6B261338D8029FF8EC0F547A34743E76F040E4B6E5
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG
Size 337B
SHA256 c2e224a088e112a96a9be057f9f04e5d488fd5ac025380d6ca5a4eecbc0d97cf
MD5 f8fab2c168fde885c30dbcf2e61a2715
SHA1 adf8fdb472a80a5b9c01b521484835f231e2adfa
SHA512 40029d66de185f15364c3d8d4cb2b0faca38eb25001a2da0183fc89b6fb0515328039e69b4903550f72c7c36d1f6ae220938e76b5999a2ee5e57ca6fde5526a4
TLSH
T17FE0D8E0A5C5C29F506024C3027897CAC2F73812FA942F023F41DC847142181FA5F1E1
MD5 SHA1 SHA512 TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5a51bb.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5a51bb.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

office_endpoints_list.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Data Protection Lists\2.0.0.0\office_endpoints_list.json
Size 3KB
SHA256 8480f3d58faa017896ba8239f3395e3551325d7a6466497a9a69bf182647b25e
MD5 94406cdd51b55c0f006cfea05745effb
SHA1 a15dc50ca0fd54d6f54fbc6e0788f6dcfc876cc9
SHA512 d4e621f57454fea7049cffc9cc3adfb0d8016360912e6a580f6fe16677e7dd7aa2ee0671cb3c5092a9435708a817f497c3b2cc7aba237d32dbdaae82f10591c3
TLSH
T1F681BE27C5B58E2796F060119750E654F53D43AFA600C6AFB5FC825C2F373ECE88A4A8
MD5 SHA1 SHA512 TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Size 14B
SHA256 ee1367d356a136a11664001cd90e05ba08dbaa85f496584158f5e42be8e836fd
MD5 8297da058a737611abcc3a0ede9ffc24
SHA1 e532552672ecffbe3509fb4c334833a67f16d05b
SHA512 fefc70ebe486693310a00beb5ae125abb1569c4455538124d897566f2e44f2b3854ad4451196607137301a811ac7f96f1d488a36eb6d6cd566f2f7cdc7c7568f
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 abb7e93625c78ec4257bb7268868fc061ebbc655c8a7ed67f374062345ca8812
MD5 7c257359fa34c2dba8a7bd0a85f19a11
SHA1 94664625ccc838582680be6a20334b1720bde793
SHA512 09b438141a05b9ac6a208f4ddca9ca4758d5dabfef59f6966744abbaa0b9dac761f2e291c0adb9523a59cf8d54cca5af2ebf4dbb4ebe94f1348f2e873bbbb331
SSDEEP 192:ZONm6IT0JZQmiUynmOgibFF1m3OFuLeU6:ZONm6B37Ogi/g/aU6
TLSH
T18802C835A87C686F8FB3AE49B08B3B175FE5116BE6953F88D6D41A1C00D729C2307922
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 16a6e61289f5bdc10db4af29c1b7c2ac38dff112898c9113209032d806ee4eee
MD5 9bbc88d152b8dfd98661247b1d7ee8ae
SHA1 be950f12123160529a122f9009c00474be5b55a4
SHA512 f95d23196fc5d5130dc76b43a263e405c733f18fc9f23c4655466d4363d0273cfd92039218a8adbbb7ac72d2ac0d4d4197c80c7cc48a7d2c4b5f7e3de1de8a0a
SSDEEP 384:nFYCcmyWC1sN8kUzgQtp3gD/gkCkbK4AStQk1AN5Gk8ce4KV8p0G9y:Zcp1EUcwQ0YbgSkN5EcI8p0yy
TLSH
T181B25BB1E4A82CEB4992E6C9708BE4036DB08137838C5A6CE6F87B3D31DF0B85306955
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 780cb152dc76bb483acab31439a3c761ab315becd56b977b0a085b8fdc8adaf3
MD5 fa3c603e67d3cf088c77b51c2784e34f
SHA1 e551d4ac942d3bfd37c1f0db047b33233cc5e367
SHA512 dda65f3745546090419cda47c2e1545a1420b93f7d90424f30d213e23142ce1b863004d9d62bb9679d66386c75ad8d378d19d9783aec564f42579ab68b30acbb
SSDEEP 384:nXRCcmyWC1sNGU/UzgQSW3gD/gkcjDe4KV8p0Gyty/7Ig7M:ocp1oUcCQ0RjDI8p04M
TLSH
T143927D75787C6CBB9DD3E20AF14B2A036EF0917787C52F68D6E88B0D14C7198270B516
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 30KB
SHA256 8f83e5e639740036489b7cfb84596f8467cd29531488914c4905a8d363449a7d
MD5 f15f9ec7d4c97495414b099d22b43e39
SHA1 0d3ea10c31c32bb4af755ab94929991871d32274
SHA512 c5f694c6dfff92742d66f59c5e40b183ce27b0adfadb70582a315604c7f461b31ca458b610bdd8271281e50e80c3333757f8ba650fab486a7b6e372d310dbe34
SSDEEP 384:nPeiFuCcmyWC9sNg8TUNTUlIl/UzgQSo42gTifpp/gk3jDe4KV8p0Gyty/7Ig7M:dFtcp9jwgVUcs4zMW0jDI8p04M
TLSH
T178D2B2F198D7997AE9AE4787A33E2E429DBCC163B5885994F7D44D0CCC821BFD70A801
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 29KB
SHA256 4bd7fa688ad4b7392d9fd05c2054421ae28d807bf34d10c52c577fcd6cc57154
MD5 0ca23bf6d431f670af600b92f74a7036
SHA1 9731b3ac9a0efc757d1f46bc80895f03fedc2d47
SHA512 0eb3c01cff060e6e38d8acba6c76e17e66978f54b617be649d5e8e0bf342df46777d4339289aea5def2c30cc1bef3b438b5231a6fb1fa7e222fa01f7cb8a0026
SSDEEP 384:nPeiF0CcmyWC7sNL8TUNTUlIl/UzgQSJ3gTDfYp/gkgjDe4KV8p0Gyty/7Ig7M:dF/cp7WwgVUcNQYWzjDI8p04M
TLSH
T145D2B3F198D7997BE9AE4387A33E2E429DBCC163B5885994B7D44D0CCC821BFD70A801
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 30KB
SHA256 b7ed8e8fc224ecb1ff2b6e592ce16a6b26c3f3c17f2039591f599cac6418dbf4
MD5 6cda2a39b303c9bb87347daff9e6cd0d
SHA1 56ef9bd6b373096c52d1e3f95c297949836cbf7f
SHA512 4ee0851d090f358a7b8bfd3bbbff5233da5ae62bd5643d8d300c1ecef9d2a8d0277232df99272ffb7cf3709f9ce0e26c9a38678cc36a511468b98990da59833f
SSDEEP 384:nPeiFDCcmyWCnsNg8TUNTUlIl/UzgQLarzgTxfcp/gkgjDe4KV8p0Gyty/7Ig7M:dFWcpnjwgVUcJE+W7jDI8p04M
TLSH
T184D2B2F198D7997AE9AE4787A33E2D429DBCC163B5885994F7D44D0CCC821BFD70A802
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 30KB
SHA256 1178fc1f70045e5ee57f77d0cddc94f8c6f9a5444b3153649272c680a0727be5
MD5 a44b7952bae144c65ccb175d4a37d702
SHA1 251b6ce172a57b25b63666cd96058ec68e937a3f
SHA512 fd9e57b623aaa6c87de8f0dff21661b7332e1001e032e38e356b34fe91c98f7b82e2c1ef6176c0daf53d0b74eed91d2fe645f60c50912f9aca4e481665ebacbf
SSDEEP 384:nPeiFJCcmyWCksNg8TUNTUlIl/UzgQugDgTxfpp/gkTjDe4KV8p0Gyty/7Ig7M:dFQcpkjwgVUcK07WojDI8p04M
TLSH
T10DD2B2F198E7897AE9AE4787A33E2D429DBCC163B5885994F7D40D0CCC821BFD70A801
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 bdd5112fab3425aa1bafd798cc71202531813823cf954bb262193aa071da29d0
MD5 366232ce3bbb53d3c6dbbf79f6b759c8
SHA1 6796b0984444f2aa8ee77a6db1c5029ac16e282b
SHA512 6d81a5932883795ff892816720b7f99fc11076b39f0d3dcd35018ae3f5a9e1f96dcbf12e353b7f14ff7f60b1e7849f771d74edc4b9cd93e514cac3a03a5ba70e
SSDEEP 384:nFYCcmyWC1sN8kUzgQt+3gD/gkCkbK4AStQk1AN5Gk8ce4KV8p0G9y:Zcp1EUcPQ0YbgSkN5EcI8p0yy
TLSH
T182B26BB1E4B82CEB4992E6C9708BE4036DB08137838C5A6CE6F87B3D31DF0B85306955
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 c4238bcd31482c5abc1d15e22991936dbc4582fa71df1c770868d99a444fff04
MD5 f56792534b6bd41878ed5631496b6e72
SHA1 36552a560d7a85399046e9281979b4884803cd46
SHA512 61fc8dfa71a96edcbbf710e745a236fff1dcc26631fc0a6f2ebb997aee512c79710daf275b6a426f87cc71895f89df8c637f6dca61a7873f803f2f65c8aaf8de
SSDEEP 384:nqCcmyWC1sNGUGUzgQSW3gD/gkcjDe4KV8p0Gyty/7Ig7M:Bcp1TUcCQ0RjDI8p04M
TLSH
T114927D75787C6CBB9DD3D20AF14B2A036EF0917787C52FA8D6E88B0D14C7198270B516
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 450cca3a179fdb839883a94f91e4bb705b5dfc1a5b24fc19c1de50ca8dd45457
MD5 533204403aa28414251856514aacace4
SHA1 7da6fbd11a011e14f525e740b0c2d2be7a6222a8
SHA512 10c6afbcf531c6cfa2e5011fe5a74de3b7253618d3dfbc52504fa9362caa3696176f37ee126516c9bb5602194186cd4cc1f87d1d65b7d7ed6797018d3a392cdc
MD5 SHA1 SHA512

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 cc76ca58333ffcba5c0090934388900411f1e22167bcc507e4c4e20f93e163dd
MD5 2e1130b66867aa79d350a2f91c038c80
SHA1 a0b91e44dd5dbfd8c71d93a29a898f4c406f05b0
SHA512 38512aa58a7a8e948db9d04a1abbf8f991c298963c24dfe6f21f631b5080b335f40c6ca731d05d8a56f03e712a9b6b12c7b2c8f4e63fbba7965d4288453e59d5
TLSH
T146E00243630441B5C01C037400575F011ED3803441F902090F31459C1C333503C30F44
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe5b1f7b.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe5b1f7b.TMP
Size 392B
SHA256 e6caa114e252db4878466c534ddd6457439ca9c1c841eae57601b4dbd615bea9
MD5 be6833b343c7bb265adf84560e636773
SHA1 a59e58a637fe442b39e01f54f04149acb8286556
SHA512 d801be337d15098f06f12f1358a87e2ae2c8ab27f9525ea826d5d9a1a16fd9ae22e6d2e1b82f34f7af571dc886f4dcf6773024d70d549c091caeb06556c3d353
MD5 SHA1 SHA512

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations
Size 86B
SHA256 f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed
MD5 961e3604f228b0d10541ebf921500c86
SHA1 6e00570d9f78d9cfebe67d4da5efe546543949a7
SHA512 535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472
TLSH
T196A02407C473C00FF4144051C45C034114FCC447011DD0015074D31314D40CF03F5435
MD5 SHA1 SHA512 TLSH

Submit Download

nav_config.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\WorkspacesNavigationComponent\1.0.0.5\nav_config.json
Size 2KB
SHA256 98252dc9f9e81167e893f2c32f08ee60e9a6c43fadb454400ed3bff3a68fbf0d
MD5 499d9e568b96e759959dc69635470211
SHA1 2462a315342e0c09fd6c5fbd7f1e7ff6914c17e6
SHA512 3a5922697b5356fd29ccf8dcc2e5e0e8c1fd955046a5bacf11b8ac5b7c147625d31ade6ff17be86e79c2c613104b2d2aebb11557399084d422e304f287d8b905
TLSH
T16B51DB73D5988C4B9BF4A29CE919A309F11107CF75D48C0B76BE010C1F7757AB5C6588
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 02092b017b3b45a2cf26673a6a2c3fa2b49ab211943cadade98b98777ee73afc
MD5 2a1939fc3b2926cf2b82fae71c5f6bee
SHA1 3f9d6974ce660bbc0c85f3d9741b734cfd466fac
SHA512 cceb75873ca288bfcb71f5d74fec5ad8ca61807ec55369055f4fbd095fd904097c974102d3296db3a1aa949c6edc5abd1a7c320e53daaf947ee61c28f5659707
TLSH
T1A3E068C29D7D26C196E60F7FD04B69F844C4580AF048697A088DE8C8913A94B258287E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 492B
SHA256 30e8b5d48a130d6bf81847b89c208c7a087525e9b7d9a0a97bcf21598332b63b
MD5 bf165c172af1f75083dd4c7e8915ad0e
SHA1 2eb27e18672fd0a1816ab00d00078a570eb62711
SHA512 a58ad7ee2e18750242b9c5d53224218bef54ecd50e067170da12510559c455979fb0523044d4c23d5d5a523562165e471f95d939376df623bfdea9228ca25256
TLSH
T181F09ED29D7E36C0D6E50F6ED44B64FC40D89506F05CB579484CEAD8913950B254287E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 612B
SHA256 ce7879978d6dc1ebc353b93e509ab0dcd980bc78615af00080f3db1cb23e79d4
MD5 a15cd0a1e68c6b9c3945d3192091dc4a
SHA1 5162188f19a245162594501e5febb31a7626aeb4
SHA512 a7ec103cf7c6fa801e1850205c4c06cadf96c21b1fd56db058a2980c472b1ff2f25c69a73f943de8dff815d69217995ad880e85ca7b8ced8cfa1c506315f7368
TLSH
T18DF0ACD29D7E35C2D5AA0F2ED44B25EC54D89606F49CB57A484CEAD4913940F248287E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 732B
SHA256 0c1b4dc8f72139abc5b2e25e5d0097c1d3529ae18001b1a64ff535e345378b32
MD5 0ad641099b286eebf58a290b5bde86c0
SHA1 922d3e17ccc238f1bf276051af3ad5cdffb20397
SHA512 8661612608382058967a1f2ef25c7fbee41a3c2c748838346c044a48058ba081e84750e4a0de424903813499876fa7f69beba345d8ebc396340d830f1a7c81e0
TLSH
T1220110D29D7E26C2C1AA0F6ED08B26EC40C8D106F19CB07A0C8CF9D4823880E188283F
MD5 SHA1 SHA512 TLSH

Submit Download

2644ce97-423f-4cfd-b800-257119e9d945.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\2644ce97-423f-4cfd-b800-257119e9d945.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 6a64072f05b97abfa0dedb4a66d38e663088bae3bae3eb220bb9173a9e4f8f28
MD5 a4b0f9d2dae8b2a11dbd9727321a8ae3
SHA1 1eaaf0e3ba6f458f65604f54a7207f0c76c708d8
SHA512 aa5db7d75f57368dacf3439b4bfbcbbcc7ea12872a74724f5b6030e214c0157f7f633756f36e600c90b89cfdd782e3df5558562a02cc972a4adeb4913b4a6788
TLSH
T156418E5CAAE91118B3B76F5A9BF7A86D447BBC772F06D49D10110E4F0A26740C8B1737
MD5 SHA1 SHA512 TLSH

Submit Download

35ca6d0e-058c-4e8a-a76b-4cffc13ede78.tmp

Path C:\Users\Admin\AppData\Local\Temp\35ca6d0e-058c-4e8a-a76b-4cffc13ede78.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

7f70ff0a-da1f-4a00-a3ac-cd9357e120bf.tmp

Path C:\Users\Admin\AppData\Local\Temp\7f70ff0a-da1f-4a00-a3ac-cd9357e120bf.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4a674b35-a493-4499-a765-d6e0cda93fe3.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1824_1953031603\4a674b35-a493-4499-a765-d6e0cda93fe3.tmp
Size 147KB
SHA256 3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
MD5 9c670f04d98ab7404f16423f6ee6cdfa
SHA1 8d01079b2d065731df8a7ef52f447cd4b7add353
SHA512 102cee76d9dfcfe91e044f529672fbec042b50c5db55a3cc137197b2013dd7f81e47f50dbb0db96cb621c5732610e1eb553c4146837c11075c7c4dbd67546a3b
SSDEEP 3072:F7R0M+jCozOtDTsjMcT0JnFjkbxnEbm/+OdGmlVVklFHEpCm+:F7WxxzyDTM0JnRkb5bJdGmJkvkpx+
TLSH
T12DE3E16D3DE6DE1FC41B58F53E64708BC80E8F0B820A644FB64988345A60B5D1BD6AFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir740_1463220007\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MEMZ-Clean.exe

Path C:\Users\Admin\Downloads\MEMZ-Clean.exe
Size 12KB
SHA256 4bbf7589615ebdb6c769d6d2e7bdcb26072bac0cda6e225a4133ba8819e688d5
MD5 9c642c5b111ee85a6bccffc7af896a51
SHA1 eca8571b994fd40e2018f48c214fab6472a98bab
SHA512 23cc74b5a7bdf70ba789d1730a0009414cfb9c780544e3d8d841be58782b9a9a089969c4295a0da25d07285505992386486d6ff0524e75605b96bb99cd3aaa1c
SSDEEP 192:BCMfc/GinpRBueYDw4+kEeN4FRrfMFFp3+f2dvGhT59uay:AMfceinpOeRENYhfOj+eGdKa
TLSH
T13042E88BBAE05007F1F1C57A24B56738DB7DBB631FA58ECEECB11E429A90C466407352
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1884-1785-0x0000000002540000-0x000000000259F000-memory.dmp

Download

memory/3500-575-0x0000000003640000-0x000000000369F000-memory.dmp

Download

memory/4796-0-0x0000028C35720000-0x0000028C357BB000-memory.dmp

Download

memory/5208-1383-0x0000000000A90000-0x0000000000AEF000-memory.dmp

Download

memory/6124-1420-0x0000000003080000-0x00000000030DF000-memory.dmp

Download