killmbr | hxxps://www[.]blackmagicdesign[.]com/products/davinciresolve

Analysis

geolocation tags

asiadelhiinindia
user interaction
yes
max time kernel
213s
max time network
214s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
22/05/2026, 22:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://www.blackmagicdesign.com/products/davinciresolve
Sample260522-2vr5daas8z

Score

10^/10

bootkit discovery killmbr persistence trojan wiper

Malware Config

Signatures

Family: KillMBR
KillMBR is a trojan that attempts to overwrite the Master Boot Record.
wiper trojan killmbr

Detects KillMBR 1 IoCs

resource	yara_rule
behavioral1/files/0x000a000000024652-1966.dat	family_killmbr

Downloads MZ/PE file 2 IoCs

flow	pid	Process
314	5752	msedge.exe
453	5752	msedge.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Control Panel\International\Geo\Nation	MEMZ-Destructive.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Control Panel\International\Geo\Nation	MEMZ-Destructive.exe

Executes dropped EXE 8 IoCs

pid	Process
2852	MEMZ-Clean.exe
572	MEMZ-Destructive.exe
1704	MEMZ-Destructive.exe
1860	MEMZ-Destructive.exe
3656	MEMZ-Destructive.exe
368	MEMZ-Destructive.exe
4688	MEMZ-Destructive.exe
2648	MEMZ-Destructive.exe

Contacts third-party web service commonly abused for C2 1 TTPs 8 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
310	raw.githubusercontent.com
311	raw.githubusercontent.com
312	raw.githubusercontent.com
313	raw.githubusercontent.com
314	raw.githubusercontent.com
451	raw.githubusercontent.com
453	raw.githubusercontent.com
309	raw.githubusercontent.com

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	MEMZ-Destructive.exe

Drops file in Program Files directory 28 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6076_1606287002\Filtering Rules	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6076_1606287002\Filtering Rules-AA	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6076_1606287002\Part-NL	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6076_908921670\shopping.html	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6076_908921670\shopping_fre.html	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6076_1606287002\Filtering Rules-CA	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6076_1606287002\LICENSE	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6076_1606287002\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6076_1606287002\Part-IT	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6076_1606287002\Part-RU	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6076_1606287002\Part-ZH	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6076_1541231673\data.txt	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6076_1541231673\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6076_148485994\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6076_908921670\auto_open_controller.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6076_908921670\edge_confirmation_page_validator.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6076_908921670\product_page.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6076_1606287002\Part-DE	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6076_1606287002\Part-FR	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6076_148485994\typosquatting_list.pb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6076_908921670\edge_checkout_page_validator.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6076_908921670\edge_tracking_page_validator.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6076_908921670\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6076_908921670\shopping.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6076_908921670\shopping_iframe_driver.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6076_1606287002\adblock_snippet.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6076_1606287002\Part-ES	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6076_908921670\edge_driver.js	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MEMZ-Clean.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MEMZ-Destructive.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MEMZ-Destructive.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MEMZ-Destructive.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MEMZ-Destructive.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MEMZ-Destructive.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MEMZ-Destructive.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MEMZ-Destructive.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5752	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134239640952157966"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3053180483-1881419501-3594244048-1000\{64E6B59F-2244-4B08-98D1-DA84AA0E1A59}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1772	msedge.exe
1772	msedge.exe
1704	MEMZ-Destructive.exe
1704	MEMZ-Destructive.exe
1704	MEMZ-Destructive.exe
1704	MEMZ-Destructive.exe
1704	MEMZ-Destructive.exe
1704	MEMZ-Destructive.exe
1860	MEMZ-Destructive.exe
1860	MEMZ-Destructive.exe
368	MEMZ-Destructive.exe
368	MEMZ-Destructive.exe
1860	MEMZ-Destructive.exe
1860	MEMZ-Destructive.exe
1704	MEMZ-Destructive.exe
1704	MEMZ-Destructive.exe
3656	MEMZ-Destructive.exe
3656	MEMZ-Destructive.exe
1704	MEMZ-Destructive.exe
1704	MEMZ-Destructive.exe
1860	MEMZ-Destructive.exe
1860	MEMZ-Destructive.exe
368	MEMZ-Destructive.exe
368	MEMZ-Destructive.exe
4688	MEMZ-Destructive.exe
4688	MEMZ-Destructive.exe
1860	MEMZ-Destructive.exe
368	MEMZ-Destructive.exe
1860	MEMZ-Destructive.exe
368	MEMZ-Destructive.exe
1704	MEMZ-Destructive.exe
1704	MEMZ-Destructive.exe
3656	MEMZ-Destructive.exe
3656	MEMZ-Destructive.exe
3656	MEMZ-Destructive.exe
1704	MEMZ-Destructive.exe
1704	MEMZ-Destructive.exe
3656	MEMZ-Destructive.exe
368	MEMZ-Destructive.exe
368	MEMZ-Destructive.exe
1860	MEMZ-Destructive.exe
1860	MEMZ-Destructive.exe
4688	MEMZ-Destructive.exe
4688	MEMZ-Destructive.exe
1860	MEMZ-Destructive.exe
368	MEMZ-Destructive.exe
1860	MEMZ-Destructive.exe
368	MEMZ-Destructive.exe
3656	MEMZ-Destructive.exe
3656	MEMZ-Destructive.exe
1704	MEMZ-Destructive.exe
1704	MEMZ-Destructive.exe
4688	MEMZ-Destructive.exe
4688	MEMZ-Destructive.exe
368	MEMZ-Destructive.exe
4688	MEMZ-Destructive.exe
368	MEMZ-Destructive.exe
4688	MEMZ-Destructive.exe
1704	MEMZ-Destructive.exe
3656	MEMZ-Destructive.exe
1704	MEMZ-Destructive.exe
3656	MEMZ-Destructive.exe
1860	MEMZ-Destructive.exe
1860	MEMZ-Destructive.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 15 IoCs

pid	Process
6076	msedge.exe
6076	msedge.exe
6076	msedge.exe
6076	msedge.exe
6076	msedge.exe
6076	msedge.exe
6076	msedge.exe
6076	msedge.exe
6076	msedge.exe
6076	msedge.exe
6076	msedge.exe
6076	msedge.exe
6076	msedge.exe
6076	msedge.exe
6076	msedge.exe

Suspicious use of FindShellTrayWindow 51 IoCs

pid	Process
6076	msedge.exe
6076	msedge.exe
6076	msedge.exe
6076	msedge.exe
6076	msedge.exe
6076	msedge.exe
6076	msedge.exe
6076	msedge.exe
6076	msedge.exe
6076	msedge.exe
6076	msedge.exe
6076	msedge.exe
6076	msedge.exe
6076	msedge.exe
6076	msedge.exe
6076	msedge.exe
6076	msedge.exe
6076	msedge.exe
6076	msedge.exe
6076	msedge.exe
6076	msedge.exe
6076	msedge.exe
6076	msedge.exe
6076	msedge.exe
6076	msedge.exe
6076	msedge.exe
6076	msedge.exe
6076	msedge.exe
6076	msedge.exe
6076	msedge.exe
6076	msedge.exe
6076	msedge.exe
6076	msedge.exe
6076	msedge.exe
6076	msedge.exe
6076	msedge.exe
6076	msedge.exe
6076	msedge.exe
6076	msedge.exe
6076	msedge.exe
6076	msedge.exe
6076	msedge.exe
6076	msedge.exe
6076	msedge.exe
6076	msedge.exe
6076	msedge.exe
6076	msedge.exe
6076	msedge.exe
6076	msedge.exe
6076	msedge.exe
6076	msedge.exe

Suspicious use of SendNotifyMessage 34 IoCs

pid	Process
6076	msedge.exe
6076	msedge.exe
6076	msedge.exe
6076	msedge.exe
6076	msedge.exe
6076	msedge.exe
6076	msedge.exe
6076	msedge.exe
6076	msedge.exe
6076	msedge.exe
6076	msedge.exe
6076	msedge.exe
6076	msedge.exe
6076	msedge.exe
6076	msedge.exe
6076	msedge.exe
6076	msedge.exe
6076	msedge.exe
6076	msedge.exe
6076	msedge.exe
6076	msedge.exe
6076	msedge.exe
6076	msedge.exe
6076	msedge.exe
6076	msedge.exe
6076	msedge.exe
6076	msedge.exe
6076	msedge.exe
6076	msedge.exe
6076	msedge.exe
6076	msedge.exe
6076	msedge.exe
6076	msedge.exe
6076	msedge.exe

Suspicious use of SetWindowsHookEx 9 IoCs

pid	Process
2852	MEMZ-Clean.exe
572	MEMZ-Destructive.exe
1704	MEMZ-Destructive.exe
1860	MEMZ-Destructive.exe
3656	MEMZ-Destructive.exe
368	MEMZ-Destructive.exe
4688	MEMZ-Destructive.exe
2648	MEMZ-Destructive.exe
2852	MEMZ-Clean.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 6076 wrote to memory of 3484	6076	msedge.exe	87
PID 6076 wrote to memory of 5752	6076	msedge.exe	88
PID 6076 wrote to memory of 5760	6076	msedge.exe	89
PID 6076 wrote to memory of 5760	6076	msedge.exe	89
PID 6076 wrote to memory of 5760	6076	msedge.exe	89
PID 6076 wrote to memory of 5884	6076	msedge.exe	91
PID 6076 wrote to memory of 5884	6076	msedge.exe	91
PID 6076 wrote to memory of 6000	6076	msedge.exe	93
PID 6076 wrote to memory of 6080	6076	msedge.exe	92
PID 6076 wrote to memory of 6000	6076	msedge.exe	93
PID 6076 wrote to memory of 6000	6076	msedge.exe	93
PID 6076 wrote to memory of 6080	6076	msedge.exe	92
PID 6076 wrote to memory of 6080	6076	msedge.exe	92
PID 6076 wrote to memory of 3752	6076	msedge.exe	103
PID 6076 wrote to memory of 3752	6076	msedge.exe	103
PID 6076 wrote to memory of 5308	6076	msedge.exe	109
PID 6076 wrote to memory of 5308	6076	msedge.exe	109
PID 6076 wrote to memory of 4540	6076	msedge.exe	110
PID 6076 wrote to memory of 4540	6076	msedge.exe	110
PID 6076 wrote to memory of 3992	6076	msedge.exe	112
PID 6076 wrote to memory of 2968	6076	msedge.exe	119
PID 6076 wrote to memory of 1592	6076	msedge.exe	120
PID 6076 wrote to memory of 5004	6076	msedge.exe	121
PID 6076 wrote to memory of 5948	6076	msedge.exe	124
PID 6076 wrote to memory of 5948	6076	msedge.exe	124
PID 6076 wrote to memory of 2360	6076	msedge.exe	130
PID 6076 wrote to memory of 2360	6076	msedge.exe	130
PID 6076 wrote to memory of 4580	6076	msedge.exe	131
PID 6076 wrote to memory of 4580	6076	msedge.exe	131
PID 6076 wrote to memory of 4580	6076	msedge.exe	131
PID 6076 wrote to memory of 5848	6076	msedge.exe	133
PID 6076 wrote to memory of 5848	6076	msedge.exe	133
PID 6076 wrote to memory of 5848	6076	msedge.exe	133
PID 6076 wrote to memory of 6136	6076	msedge.exe	134
PID 6076 wrote to memory of 6136	6076	msedge.exe	134
PID 6076 wrote to memory of 6136	6076	msedge.exe	134
PID 6076 wrote to memory of 5904	6076	msedge.exe	135
PID 6076 wrote to memory of 5904	6076	msedge.exe	135
PID 6076 wrote to memory of 4604	6076	msedge.exe	136
PID 6076 wrote to memory of 4604	6076	msedge.exe	136
PID 6076 wrote to memory of 4604	6076	msedge.exe	136
PID 6076 wrote to memory of 3508	6076	msedge.exe	137
PID 6076 wrote to memory of 3508	6076	msedge.exe	137
PID 6076 wrote to memory of 3508	6076	msedge.exe	137
PID 6076 wrote to memory of 4672	6076	msedge.exe	138
PID 6076 wrote to memory of 4672	6076	msedge.exe	138
PID 6076 wrote to memory of 1772	6076	msedge.exe	140
PID 6076 wrote to memory of 3496	6076	msedge.exe	141
PID 6076 wrote to memory of 3496	6076	msedge.exe	141
PID 6076 wrote to memory of 3496	6076	msedge.exe	141
PID 6076 wrote to memory of 3264	6076	msedge.exe	142
PID 6076 wrote to memory of 2852	6076	msedge.exe	143
PID 6076 wrote to memory of 4700	6076	msedge.exe	145
PID 6076 wrote to memory of 4700	6076	msedge.exe	145
PID 2852 wrote to memory of 716	2852	MEMZ-Clean.exe	147
PID 716 wrote to memory of 4260	716	msedge.exe	148
PID 6076 wrote to memory of 1064	6076	msedge.exe	149
PID 6076 wrote to memory of 1064	6076	msedge.exe	149
PID 6076 wrote to memory of 1064	6076	msedge.exe	149
PID 6076 wrote to memory of 3456	6076	msedge.exe	150
PID 6076 wrote to memory of 3456	6076	msedge.exe	150
PID 6076 wrote to memory of 3456	6076	msedge.exe	150
PID 6076 wrote to memory of 5496	6076	msedge.exe	151
PID 6076 wrote to memory of 5496	6076	msedge.exe	151

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://www.blackmagicdesign.com/products/davinciresolve
1⤵
- Drops file in Program Files directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:6076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x25c,0x7ffcff25c188,0x7ffcff25c194,0x7ffcff25c1a0
  2⤵
  PID:3484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1956,i,1161658903048928016,8718369295957488520,524288 --field-trial-handle=2128,i,17336023056268917961,14816941340078454941,262144 --variations-seed-version --mojo-platform-channel-handle=2192 /prefetch:3
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:5752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1672,i,8920024781539623647,15769994921389685714,262144 --field-trial-handle=2128,i,17336023056268917961,14816941340078454941,262144 --variations-seed-version --mojo-platform-channel-handle=2124 /prefetch:2
  2⤵
  PID:5760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2596,i,3294473298234221759,5183692349498508924,524288 --field-trial-handle=2128,i,17336023056268917961,14816941340078454941,262144 --variations-seed-version --mojo-platform-channel-handle=2020 /prefetch:8
  2⤵
  PID:5884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3380,i,6745714037190408793,4007207714880050763,2097152 --field-trial-handle=2128,i,17336023056268917961,14816941340078454941,262144 --variations-seed-version --mojo-platform-channel-handle=3456 /prefetch:1
  2⤵
  PID:6080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3384,i,12316827600586949706,16466525740851097577,2097152 --field-trial-handle=2128,i,17336023056268917961,14816941340078454941,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:1
  2⤵
  PID:6000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4996,i,2213848298528410448,13801182256283107565,524288 --field-trial-handle=2128,i,17336023056268917961,14816941340078454941,262144 --variations-seed-version --mojo-platform-channel-handle=5080 /prefetch:8
  2⤵
  PID:3752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5240,i,2493091448428707143,9881019087822466648,524288 --field-trial-handle=2128,i,17336023056268917961,14816941340078454941,262144 --variations-seed-version --mojo-platform-channel-handle=5280 /prefetch:8
  2⤵
  PID:5308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5252,i,6937866860869540317,12246000170561759783,524288 --field-trial-handle=2128,i,17336023056268917961,14816941340078454941,262144 --variations-seed-version --mojo-platform-channel-handle=5340 /prefetch:8
  2⤵
  PID:4540
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6088,i,214484504119253611,9234166388256711029,524288 --field-trial-handle=2128,i,17336023056268917961,14816941340078454941,262144 --variations-seed-version --mojo-platform-channel-handle=6108 /prefetch:8
  2⤵
  PID:3024
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6088,i,214484504119253611,9234166388256711029,524288 --field-trial-handle=2128,i,17336023056268917961,14816941340078454941,262144 --variations-seed-version --mojo-platform-channel-handle=6108 /prefetch:8
  2⤵
  PID:3992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6136,i,4263482971972511421,3664758277022082992,524288 --field-trial-handle=2128,i,17336023056268917961,14816941340078454941,262144 --variations-seed-version --mojo-platform-channel-handle=120 /prefetch:8
  2⤵
  PID:2968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6124,i,15710602764842754944,7983606320694554874,524288 --field-trial-handle=2128,i,17336023056268917961,14816941340078454941,262144 --variations-seed-version --mojo-platform-channel-handle=5872 /prefetch:8
  2⤵
  PID:1592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6184,i,535756871368992295,14568239777383620154,524288 --field-trial-handle=2128,i,17336023056268917961,14816941340078454941,262144 --variations-seed-version --mojo-platform-channel-handle=4940 /prefetch:8
  2⤵
  PID:5004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5436,i,5055703148850786096,14171010350923132020,524288 --field-trial-handle=2128,i,17336023056268917961,14816941340078454941,262144 --variations-seed-version --mojo-platform-channel-handle=5424 /prefetch:8
  2⤵
  PID:5948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5988,i,10761619636810281365,1371155067403439543,524288 --field-trial-handle=2128,i,17336023056268917961,14816941340078454941,262144 --variations-seed-version --mojo-platform-channel-handle=6388 /prefetch:8
  2⤵
  PID:2360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6396,i,1203710906875611749,4417390133500751665,2097152 --field-trial-handle=2128,i,17336023056268917961,14816941340078454941,262144 --variations-seed-version --mojo-platform-channel-handle=620 /prefetch:1
  2⤵
  PID:4580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=6688,i,7447393204830041084,1308570789294741635,2097152 --field-trial-handle=2128,i,17336023056268917961,14816941340078454941,262144 --variations-seed-version --mojo-platform-channel-handle=6696 /prefetch:1
  2⤵
  PID:5848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=6836,i,9750152725419674069,6864454515220803066,2097152 --field-trial-handle=2128,i,17336023056268917961,14816941340078454941,262144 --variations-seed-version --mojo-platform-channel-handle=6892 /prefetch:1
  2⤵
  PID:6136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7048,i,4821642519961272207,2163121101128400242,524288 --field-trial-handle=2128,i,17336023056268917961,14816941340078454941,262144 --variations-seed-version --mojo-platform-channel-handle=6824 /prefetch:8
  2⤵
  PID:5904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=7036,i,4993618425227313482,16245250730309681650,2097152 --field-trial-handle=2128,i,17336023056268917961,14816941340078454941,262144 --variations-seed-version --mojo-platform-channel-handle=7072 /prefetch:1
  2⤵
  PID:4604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=6316,i,13746784722425236239,8023837719472008427,2097152 --field-trial-handle=2128,i,17336023056268917961,14816941340078454941,262144 --variations-seed-version --mojo-platform-channel-handle=5248 /prefetch:1
  2⤵
  PID:3508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6388,i,3814309728007333743,3419191357537773230,524288 --field-trial-handle=2128,i,17336023056268917961,14816941340078454941,262144 --variations-seed-version --mojo-platform-channel-handle=3704 /prefetch:8
  2⤵
  PID:4672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=7484,i,13554867194514556018,9005290515832049081,262144 --field-trial-handle=2128,i,17336023056268917961,14816941340078454941,262144 --variations-seed-version --mojo-platform-channel-handle=3656 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=3440,i,14184998206562611290,11286432437286611882,2097152 --field-trial-handle=2128,i,17336023056268917961,14816941340078454941,262144 --variations-seed-version --mojo-platform-channel-handle=7500 /prefetch:1
  2⤵
  PID:3496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7424,i,8082725572341606973,12222519071195778637,524288 --field-trial-handle=2128,i,17336023056268917961,14816941340078454941,262144 --variations-seed-version --mojo-platform-channel-handle=3704 /prefetch:8
  2⤵
  PID:3264
- C:\Users\Admin\Downloads\MEMZ-Clean.exe
  "C:\Users\Admin\Downloads\MEMZ-Clean.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2852
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://answers.microsoft.com/en-us/protect/forum/protect_other-protect_scanning/memz-malwarevirus-trojan-completely-destroying/268bc1c2-39f4-42f8-90c2-597a673b6b45
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:716
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument http://answers.microsoft.com/en-us/protect/forum/protect_other-protect_scanning/memz-malwarevirus-trojan-completely-destroying/268bc1c2-39f4-42f8-90c2-597a673b6b45
      4⤵
      PID:4260
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=minecraft+hax+download+no+virus
    3⤵
    PID:4676
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument http://google.co.ck/search?q=minecraft+hax+download+no+virus
      4⤵
      PID:5168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6152,i,17273357833523663187,4997758259254811442,524288 --field-trial-handle=2128,i,17336023056268917961,14816941340078454941,262144 --variations-seed-version --mojo-platform-channel-handle=5464 /prefetch:8
  2⤵
  PID:4700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=6880,i,15157792397675625219,8503240070297529708,2097152 --field-trial-handle=2128,i,17336023056268917961,14816941340078454941,262144 --variations-seed-version --mojo-platform-channel-handle=6472 /prefetch:1
  2⤵
  PID:1064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=7172,i,2877664682490532774,13573085821850942926,2097152 --field-trial-handle=2128,i,17336023056268917961,14816941340078454941,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:1
  2⤵
  PID:3456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6792,i,6322934658989042742,16794766553739135375,524288 --field-trial-handle=2128,i,17336023056268917961,14816941340078454941,262144 --variations-seed-version --mojo-platform-channel-handle=6768 /prefetch:8
  2⤵
  PID:5496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7332,i,15274822469840625414,12303051951615446455,524288 --field-trial-handle=2128,i,17336023056268917961,14816941340078454941,262144 --variations-seed-version --mojo-platform-channel-handle=4228 /prefetch:8
  2⤵
  PID:5288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --always-read-main-dll --metrics-shmem-handle=7708,i,13651958206424612440,2564403407547506638,2097152 --field-trial-handle=2128,i,17336023056268917961,14816941340078454941,262144 --variations-seed-version --mojo-platform-channel-handle=7568 /prefetch:1
  2⤵
  PID:3296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3380,i,16133943741682300713,7038066956196683355,524288 --field-trial-handle=2128,i,17336023056268917961,14816941340078454941,262144 --variations-seed-version --mojo-platform-channel-handle=7320 /prefetch:8
  2⤵
  PID:6044
- C:\Users\Admin\Downloads\MEMZ-Destructive.exe
  "C:\Users\Admin\Downloads\MEMZ-Destructive.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:572
- - C:\Users\Admin\Downloads\MEMZ-Destructive.exe
    "C:\Users\Admin\Downloads\MEMZ-Destructive.exe" /watchdog
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:1704
- - C:\Users\Admin\Downloads\MEMZ-Destructive.exe
    "C:\Users\Admin\Downloads\MEMZ-Destructive.exe" /watchdog
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:1860
- - C:\Users\Admin\Downloads\MEMZ-Destructive.exe
    "C:\Users\Admin\Downloads\MEMZ-Destructive.exe" /watchdog
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:3656
- - C:\Users\Admin\Downloads\MEMZ-Destructive.exe
    "C:\Users\Admin\Downloads\MEMZ-Destructive.exe" /watchdog
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:368
- - C:\Users\Admin\Downloads\MEMZ-Destructive.exe
    "C:\Users\Admin\Downloads\MEMZ-Destructive.exe" /watchdog
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:4688
- - C:\Users\Admin\Downloads\MEMZ-Destructive.exe
    "C:\Users\Admin\Downloads\MEMZ-Destructive.exe" /main
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Writes to the Master Boot Record (MBR)
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2648
  - - C:\Windows\SysWOW64\notepad.exe
      "C:\Windows\System32\notepad.exe" \note.txt
      4⤵
      System Location Discovery: System Language Discovery
      PID:4544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --always-read-main-dll --metrics-shmem-handle=6928,i,16552824684257462480,13630601123050218131,2097152 --field-trial-handle=2128,i,17336023056268917961,14816941340078454941,262144 --variations-seed-version --mojo-platform-channel-handle=7200 /prefetch:1
  2⤵
  PID:4088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --always-read-main-dll --metrics-shmem-handle=3476,i,75424834884291600,15049625576870872469,2097152 --field-trial-handle=2128,i,17336023056268917961,14816941340078454941,262144 --variations-seed-version --mojo-platform-channel-handle=6732 /prefetch:1
  2⤵
  PID:1560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --always-read-main-dll --metrics-shmem-handle=6884,i,3830715885062393217,2614858816640848422,2097152 --field-trial-handle=2128,i,17336023056268917961,14816941340078454941,262144 --variations-seed-version --mojo-platform-channel-handle=7316 /prefetch:1
  2⤵
  PID:6080

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5696

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3208

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x2f8 0x3dc
1⤵
PID:3120

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

data.txt

Path C:\Program Files\chrome_Unpacker_BeginUnzipping6076_1541231673\data.txt
Size 145KB
SHA256 5f9da8ac4889421d2020e6246daa63b3d5d4fb5a19019b1c20fc803481f01484
MD5 b4802e5464604d772904c865a0d5e532
SHA1 77d577350787cc6d5fe65bdcb5e2a574f552fcf7
SHA512 05205448cf3424787f64bc99dd6b958ec497f1963a2d37a7fcac3cc9676b389e151ea456913c36358d07a92b6864557927fe0f53c37f890bb285a0e5446fd31f
SSDEEP 3072:UPAgDcCHaLHl65aynyosxb3+B1xh0OrlwYEgG5v7UFSk8KH99jo:4X1aI5aZoKzMJ07NJB7U58KPo
TLSH
T15CE3F220CDC45FD8DFAC252C90BE0B1DA391C69D842A7686E763FE4ABF9760452271CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping6076_1541231673\manifest.json
Size 52B
SHA256 90f59dd0f7cd3fb4906d133943819da7aaf33f7ae5b5a0241e03ddea2611885d
MD5 c86c55c53e2bf572642bd11d17a15dff
SHA1 dd16da5cbdc5519179a01396cb94f1194a814939
SHA512 a079421f077a5f2b822469efb6f4b1822e095beff27b2d1551c74d1d880c9fe085bc0f64ea040d17be2d2ad2969051e13f3a782e72bfa692752a16c3316fa49d
TLSH
T185900270042591172AC10E506570F8859391661955860D1D08551548029546CE4502D8
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping6076_1606287002\manifest.json
Size 116B
SHA256 181a1631374b5ac1fff89559f7e23498ad9ee4796885d7b956d5e7d5f9c3f8c7
MD5 daf93729356a67ea1f849554827fdab1
SHA1 17dad0cbc82d5e04fb068896a5832f983e124c01
SHA512 473d9d608f2f3324d5db6eddeb4554a7271df4a6b62377820d935c001a8a2376479aa4d3e3b80ffbfdd3ba80f56fe72f1bc9dd020bcb396182b753353b883a30
TLSH
T1FBB09262A8084633249523F4A2639363CBA86D4A91346606091B9480659E73B22A5219
MD5 SHA1 SHA512 TLSH

Submit Download

edge_checkout_page_validator.js

Path C:\Program Files\chrome_Unpacker_BeginUnzipping6076_908921670\edge_checkout_page_validator.js
Size 1009KB
SHA256 9960614ae3d67b2a2b2b1bb1fdd6a427f4d103835e50e45f2e2cf3b1c540fa44
MD5 f4cf71ceaf44655238e8f6e445479361
SHA1 4d184496decd453261423d11a681bb925d1c466f
SHA512 c6af515da4c1eaa6689c829be6a99602f148090989c7f8b5aa5cd0620ca73d8b217ba266b188aa72bd219f863c86fb00d6e48758278346f5959f2c5169c1e382
SSDEEP 24576:cs4ymRAbsvvG3kJ6ARjiQixwaErn9VUfWEo0EQ1Xp8C9T0dK/vzHEiJsfaG81E9/:cs4ymRAgvvG3kJ6ARjiQixwaErn9VUfq
TLSH
T15F252B84E1E2253466D74CB960B7D2C4B5DC04583399F1E8FA6C68CADA0FD4723F663A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping6076_908921670\manifest.json
Size 146B
SHA256 1d4f529025d274699f815657573b828ae880ae0d44ee0b0ce66a6a273f2bddff
MD5 94e3a47681712a13578f122b3158c015
SHA1 376442061baa7018ee9e784d991798fc9f302b31
SHA512 6974139805e18959c2ad2a71727705f1c5268ee598b8864833732e042beffe2416db033180b8d01bf8bb3b2b901d4ccbb090dd677ecded939aa3d07797ba05b2
TLSH
T12FC09B73C931AC71157507D449F59745EB74574BF511B1563730018D4B3D57550606D1
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 9300dc4b11c647d4484e20f994dffbbd9939379d590fc7dedf9875372c431ce1
MD5 b031933009b03b3dcfc6f363760f83dd
SHA1 a9d3126d19c73dafd7e12a688bb3a802627790ee
SHA512 f606a12a9a0879bb3f7d6c9bcb6e3754434b9f0d8f1d351e8104aef087c326f689af5174eddcb6a3cd1f1d07864ff544fc76e73f8b76bf6d4330e19666cb7b28
TLSH
T18FD012BA2A4E7010F26D4A31B416CB00776D15A12852A705E22D944C99A90A562C62C6
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8da58a9b03c676d64167caf3657c5315a0b78038e3ae23bfef432a40d8d22290
MD5 81f1d957977f2d73471366011b7128bf
SHA1 c3403bfa34ee45b494966cf8be9bed08da2c5168
SHA512 171afd7f20b750bc0bdc1fc9fd4cf14984e63031e562c60a7b1bab3112c84572ebc63669b744e0e5399b2f5453039fb86937cf7ab417a72da7f1ad931c88f0c5
TLSH
T152D012B62A4A7010F2694A31B456CB00776D15A12852A705E26D945C99A90A566C62C6
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 0bf847703f01893ad17903163ea1d53d907cbfba4bece35bd1f23bcbb6f3118c
MD5 f7197dddc45e7cfddf3550f58721a65b
SHA1 351b1ffb637bca4240613803eede2c4181017f56
SHA512 9e287a55e621078977c72bc4d217483dd04fbe854e30bc74ec94cf45d70f241bcaefd6b060089baa882fcdf8cecd73afeea666cb215a1bb4c228486a89b3db5c
TLSH
T16DF0F4B6D921EC371CFD0B6870594B46E751132B2780999B3B3D830D8FB4A3B4685C1C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 9KB
SHA256 0c7e57141e6c245e2104054350d20374a928823639fd857c4c66b2a4b11fad12
MD5 bc93320583b9673da0594ba237126ad6
SHA1 5c387998c81c948c8444ed9645af1ca5a452d8fe
SHA512 7c1df0ff166fa94c1fc729c9a95862c67642e1ccb728d03b178e049368fd711774f4096d6995508053de84deb87291e34e1e064e05b1a07d129f5631f60e8787
SSDEEP 192:vMckuIRa7yATwgBfkVkK2kL8iuGp9CmXEzOT:tkuILATwgBfkVt2kLVuGplpT
TLSH
T1D8128B352AC46ED9DB1041782EC10A44377F58D4FA8F2FA28BD42CB4545FB84BA49CAE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 0be7cdd1d99f50a563c966732a05db9a5f262700699ca130045e1b7d725fb4f8
MD5 574af272bac8f97545e4beafff7af687
SHA1 3dfaca3ae5c3ddfddc2b3757b4785745fae24d7f
SHA512 eb66080006027c2a87003dc75b17ab23370d69bdcb6f7181a2bafbfa2b95b9fb7ad6a98ccad724b747305e8cc4edf7b87708e3b8c1eebb9b064ec13b7408a70e
TLSH
T1B471C636389287E2EB10C17CBDC5894430336ED9F9DB1E2912A03CF9192FB99C10A5ED
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 9KB
SHA256 d503610970311c75a0ada96bedf3573f026f393c0ea0d455d08c7f64ba84298d
MD5 fee45a3ede5138d96fb59f8b97033c9a
SHA1 5508fa984ca41af7ca18e9a3b8f15440fa006c44
SHA512 5122dc3a9d3755d200464cce039dc4cea37e012cc3231fa66dbfc87960579614eae96b40971be0f95c58477a2d1936d0e8a8a177f366d1ed676e923d6e67120c
SSDEEP 192:vMckuIRa7yATwgBftVkKLkLZiuGp9Cm7EzdZ:tkuILATwgBftVtLkLUuGplWZ
TLSH
T13D228B3526C46ED9DB1041782EC10A44377F58D4FA8F2FA28BD46CB4545F784BA49CAE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe58fa0b.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58fa0b.TMP
Size 3KB
SHA256 3fa98628c938fb870f6ac5f596842a71c48321d3f2f2b021ddd2404f89f54fc2
MD5 6012b1a51632506bceee78a81d0fa351
SHA1 28666640e5e82bf1b35c490f5b3d7b6e4d90a896
SHA512 58786e8383f0498573cfd487808a7a65de7574dbd8d56895338d8c08a0df5d730265b6a2e0112b5daf32d849816b376a833c6dc8e00b1929e0a9d825e767872c
TLSH
T14C51B3383952CBE2EB50C27DBDD4029074736ED9F5C30E6510603CFA2A2CB62C15A2EC
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_ntp.msn.com_0.indexeddb.leveldb\000003.log
Size 31KB
SHA256 2932fa0bb4469d368c4ee74327fc98975009de140c6a0daaede8bfe105ae8d04
MD5 6586d2be96413ae7b48c7d2a286d111e
SHA1 a7d567f9bb13242c80f2b47e842d9318ac486097
SHA512 dfeedbb03b5a3d320d12bf1644675ab10d0ff827ac98026866fdc99110ce443d4f1867559a625d4f84142a41dfacfb4626fdb83f6c16f63d330ca372a140fbea
SSDEEP 768:JuCL5APiyaMao48G0xkRIJpApA0iNwFko9a8Z77C7gtRbtZMc:FAbx8HFT9DLZMc
TLSH
T1A9E26A66B5F9060AF2B75EBBE8B217554CBABD962D04D81E6860220D4C71F40CD73B3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_ntp.msn.com_0.indexeddb.leveldb\LOG
Size 386B
SHA256 43e57e802737f1c7242469d2831e35b710e1f5ed3623fe6793722b6c45929c6b
MD5 199ed48104f568e56767c3a3dd520f99
SHA1 6a36fb1ea82ddb23375ef2e892ae485f2122ede1
SHA512 35c6aa2f322a0319a356ff30d9a5c25d26a632f50c32736de147ea4192ec9e5ba378981e1cde8bff78dfd03f82de049b0a45b9727fb5906a9c2866766d03a90d
TLSH
T107E092B9ACCDC21FA29420974F24BB09D2E33A1AD68D7DC51B0CE9DAF042181F5BE551
MD5 SHA1 SHA512 TLSH

Submit Download

410bdbc2-6cf5-4135-b95d-133ba9d2c8d7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\410bdbc2-6cf5-4135-b95d-133ba9d2c8d7.tmp
Size 1KB
SHA256 c9a7326e957e100c394598f56da9194430eeadf78a04350a0dd9e74d5d9c8762
MD5 d37e8d7b31f90fa885dbab2e9075b27b
SHA1 4ebdfd03af6b48383e4d7972c666a2ad9bccf93e
SHA512 1f8a6b952f66039fc3d8ec184ffdb17b5d3105bbe36a2b61b8c843b67abe59455785bfc697d6e467499e4af671d6077fcec84da20501f53405629ce47a3d9bc2
TLSH
T1F131C0F383E8856E8A1095F0B618AE2FDE1D0510436C3D9AC5E4AF1B93E2471E041A5F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 8KB
SHA256 b27a3b6b3718a72b191759578872cabd43aa5b448397a3a6f9b94a576957f36f
MD5 be98a8494d1a2044fa5fcb0e747c5c46
SHA1 93f94740c4d1b526f1aa4321e64d6b912574c32f
SHA512 a6dd52125fdb6123a1063cd6c2b6df61ece693eeeced0525c06f5ab6cae47d078ee3a949f6974d0bbcd35b0e5ca93597feafdb06ce5a87579dd4af02e9995bd0
SSDEEP 192:D1nmlF7/mOkaij6QoU27V+VYmV2mx8kCNijgAbU2Wvc7g75mrmBmgmPmDmtiBmQz:D1nmlF7/mOkaiGQoU27V+VYmV2mx8kCt
TLSH
T13402CEF783F4466DDA2195F0AA18BF2B9F1D0411936C785A84E4AF0BE3F2471E181B5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 10KB
SHA256 ce18a6e04a514cc12d52010131ef12e418fafb8b602ed668558ab03154974dad
MD5 996685bb01cdf7d04c7a86fef284ee09
SHA1 fe0884cf9b536f1c167567fb90547079311f0b15
SHA512 ec14f8eb4d28afd91ae8766579b987b9e5c46cb0a5b708e81fe21c98b75912c8072172cbd6aff431fa92fcad24fcd6581b19f9d7c84daae40c6551d893eb3423
SSDEEP 192:D1nmlF7/mOEykazoU27V+VYmV2mx8CNijgAbU2Wvc7g5mrmBmOd/GtI5bbov0kj4:D1nmlF7/mOEykazoU27V+VYmV2mx8CNx
TLSH
T19322CCF783F5862DDA1196F0AA18BF2B9F1C0411936C785A84D4AE17E3F2471E141B9F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 2467a6ab550de2dd7208ded37c3d733ed873a8f2b07c7c54f731ec848c662f63
MD5 6f455b0fafd3bf094f7668e4550a07ad
SHA1 5d72f5d70ec28b3e4a00c9dc27bbb70904284448
SHA512 7823b38a784246a81da991e9c443784305bb46dd117d8a300b4fdca32f15c6e2fd84ef2423ece77321d6d43a8c541bd9b683adc5248136be36e321e35bc5aa21
SSDEEP 96:D1sOmxkaij6QzEUep74A+VYmV2mxmGwBN0:D1nmxkaij6QoU27V+VYmV2mxmGkN0
TLSH
T192A19EF783F48A6DD91196F0BA147F2B9F1D0914A37C394AD4D89F1BA3F2460E180A4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 211B
SHA256 a20f5bba54fb1f88afc24535f3afbb4ff91e8f4c707cc4da8fc4447f1468dee2
MD5 073c5bdcc1d013497b6e07f5d03ed9bc
SHA1 849b5eadfb230b3149db5770ee7e13b7fca26fdd
SHA512 0ba97a10164e68d90ecad7a812d73cb415b1bed8d53c50552a5688b93a83a80ab48f70e9a14aae8cd6c7bd8c5d77c3c7dbfb215aaa545c231b0fc6fb61ecd2b0
TLSH
T1AFD022B3631070B6EA6DAEC1906EED8FD36AB0683882D9E620E098DC153E56C4A07184
MD5 SHA1 SHA512 TLSH

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 20KB
SHA256 fca162aa165d93e6dfdd99e8e684299613415486509f51258d632a46a0fcfa95
MD5 573c12551fb807a2fac51b949affb286
SHA1 a9166cea2c17c84842ea3820fdd13d92cd4ea9e9
SHA512 a41d376d0ce46962ca013273163a2cc05e998497a2032059fff514646a73a653a76446d848b002e8a5f6f6ce6ec20326b5cb728ce5bb0b101725b577575dfb9f
SSDEEP 384:sxZsTsm4X/fHsqIzIKY9hfsHblEfN4Y/VXR9Uqpv:skwm4X/fpIz2WHbmP/BXpv
TLSH
T169A2E8536534497B8DD7D65AF914BF63D7F804739A905E88A9FCCA0C04DA6ED2202C1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 21KB
SHA256 d47b9f476eb982097c902b15206e87a36fcbbc0dd10b19c89a735dc4bb502370
MD5 c90cb8cc2672fc4efd2d5fa580d6d0b8
SHA1 c506deab361967e4b0884fe4f27d7548afb62f27
SHA512 ac5e5aa638104f83c7422f9d1c80fb3e2a3057306305f2a33d0d537a7dd80cb14dada82f31f636add446cdd40c47080d3fd27c50a6000b84ff81951121a66102
SSDEEP 384:sxZsTqBm4X/fHsqIzIKY9hPsHbRlEfN4Y/VzR99qpv:skuBm4X/fpIz2SHbUP/Zkpv
TLSH
T11EA2F753653449BB8DD7D65AF954BF63E7F804739A905E88A9FCCA0C04DA6EC2203C1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 a6bcf0b6646d52caafadff567831151a9f3c987c15a9f7088ed32a02b0aca35a
MD5 bc1f22e96684745fd99211e0c9fd83e3
SHA1 338f68e0c091d9f2e2760d8547e4bb012f92ce60
SHA512 050e4b4a64451d6439618760a827950ae5a54aeed708c5cbaaf36b0168ff00999ee43c375bf00b67e269dc9912febfc132c220bc51c9e9c142fbacdb96eebfc4
SSDEEP 192:sxZnR6yMqZjK1Ml8MkX/fHssv4OaZdIaRuvVzodpyMHW6+WNApq/hPTDVIt7vlCT:sxZnhMX/fHsswOazIKY+rHbp/JViRjc
TLSH
T16972D6066938597B8DD7D219FA45BB53D7F90172A2944E449AFC8B0C04E7BED2203C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 7759f43321a748a1c534f1ac2073ea296638866ec833318ad364bd08167f4488
MD5 fd67f538514a37c5abc060ec99de1af7
SHA1 ebdf868920a670d8f33044a30ac367034bf9cd7b
SHA512 a98faf428c89d4644d2a150b2f5bd984fe8c259d8594976f93e0830568e720372aacec8374acfe2763d3e6746818a65cd1bd3e21078ef75572495b25cca3f273
SSDEEP 192:sxZzR6yMqZjK1Ml8MkX/fHsN4OaZdIaRuvVzodpyMHW6+WNA8KVhPTDVIt7vEC+8:sxZzTMX/fHsqOazIKY+rHbKVJVFR9c
TLSH
T11B72D7466A38597B8DD7D219FA44BB53D7F90572A2944E449AFC8B0C04D7BED2203C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 35KB
SHA256 514abeab8487a2037f504e66827d55e5c706b2e1f0d6b46eda7abb1b90f26fcb
MD5 731056e6150a67b657f1664d0a1c4161
SHA1 433395442ea0f8fce488d2da38474ad48fa02ec0
SHA512 fb04eabdeaccbba99cca984d2dbdd6109c79936170656dec488975a7e302498c6198da2f4dd8f6fc555069c5d7613b070ed1a89a6cb27a0312bdfab72359f87d
SSDEEP 768:ZYsv8OdF6ssi7pLuLnFhWvFvmX8F1+UoAYDCx9Tuqh0VfUC9xbog/OVYysy10Ll7:eY8Od/HEnFhWvFvmXu1jaIt10Lm2NuAF
TLSH
T1D0F2EA3B6C0CCB7E4F844E9CEC2A6F8A6DE802CB5698895447FA844C02C76EB55175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\bc34455a-c0c0-4ad5-9d7c-df0e9e63825f\index-dir\the-real-index
Size 72B
SHA256 b8b3c0a75d7ab1d9e236447738db2649efc68ff4807eb23eaddb3a5967e06f34
MD5 dc700651f843b76fa99c4c0cfded81ad
SHA1 9d620fdd1a950351024b50889f0b8219a3b71b70
SHA512 6e3d71c2b9b8bcc7be07dfd74f7255c50940f868bdeba5b3de66385fb3c92a1768e4a94f40ea2e1f74295eca7a0868dfac02f815d3f9c1b344d0deb979aa4402
TLSH
T10AA0023101543045C04107B251D6017077189EA50626C72A50DC547DC8EA35855411A9
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a3b26.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\bc34455a-c0c0-4ad5-9d7c-df0e9e63825f\index-dir\the-real-index~RFe5a3b26.TMP
Size 72B
SHA256 9a4a2491180ca3cd48a1602af24ffdfe5c22b38fadea419f410b36f0a948bca7
MD5 9fb5a12866fd3b030192d2f5d6c3a766
SHA1 cca87dcea31c2f51a3f66d06f8d13800775ba624
SHA512 779f9c9cc59f46975003ea714d246ce84d61ebe982e92b2781ca8902912ed89c43f49e1f68b47de819b8bb1b086035b9125ad8969512b6a6db7d0ab9d8e805f5
TLSH
T1AFA00224425A0056D00847B9559D02643306DE152503471B44A0245D8CA55984D01140
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\cdf12dee-6673-4e91-954c-23b338c514e6\index-dir\the-real-index
Size 3KB
SHA256 6112dbe5f16056a9d3d20ac957badc50ad01a577d6b82f92f6665daf71e7004a
MD5 0e3d117461a714673c1e52c47fc23a90
SHA1 3e991e150656e2bc4586fc6ea0677714320c5f16
SHA512 e0d234d715cfb7cb1bd85ec1208562316440f6e21e6789f6149c00f93cf1445757778cae8af9cd9c40ad2482a071dbb7ecd8a5673738b89a0ccd991cac1b9dba
TLSH
T10251D78E4D460A71CFBC09B344715041B73D9CCE2A848F0BA5FC5078FA87A6918B1239
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\e0d663d7-d7e0-4210-b899-8f527f9ec61f\index-dir\the-real-index
Size 72B
SHA256 29678c8717bb6f823ee7b3ef5a57f139825b4054b2f6b6dbdd1ac4eda5eec527
MD5 0247665379d35bda15db07c7e076b3c5
SHA1 283908d9b41dbfc6f45f584ae21847243a984000
SHA512 8fdb0773023b95f9dd507eb9d93c953c39c7b3ebe0cd6e6de5f4745ca463181935f12e9d7a0b7ddf92da73a8dfb4dfc4725fe810da9548783df8e72c1c71efe7
TLSH
T1C3A0025742880471D124037214E926456B747E110906534770DC0175CCD83DDE105B04
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a41fc.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\e0d663d7-d7e0-4210-b899-8f527f9ec61f\index-dir\the-real-index~RFe5a41fc.TMP
Size 48B
SHA256 899082c4d88ebbf3d3b54c96de0687678155440832fc6dcaf2e9fb9ac9ef025a
MD5 c709787801ffa2d2194611f627c871f8
SHA1 27e238893d186dc85bfcd8bf5dbd353044f0dced
SHA512 5eb3bc2fc21dc860d065e731df7301fbe92e00e824c3d9dfefc18ecc9e4ba183297dbdbb62e373a2a076ea48283b9da800428daf6ed8ba169845fe4e8f5fb13c
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 476B
SHA256 12da377f5751979a3cd59168e32b3e0ba656d69e7ac384ea425a575a9ca646e4
MD5 0890617e35d6d2b35eb1aba21d8c5b82
SHA1 23063e282d43a51f803e70a63d30fbd990c0a1f4
SHA512 4773d087bb5f16c5c33a74ca326b741e1a78b9090505c7bed55fc22fcfaf954c089c1715b3c06939575376d0c5cdcb4af1529d2fc6d3856e9d00f4424ac4a52e
TLSH
T159F027B33FFB1C54FCABE3D6203019B10549B89488909C5F2416B39755B13192159CB2
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 481B
SHA256 232b76494391f3b716dad7d6b4b695be2651e4a290cf3e5fbd663f9ca05b2444
MD5 adb4e19a9239e61be42cd8644e8a6f6f
SHA1 6723ac5d1929a4bd8dafcb0d41ded3355c7a223b
SHA512 d47d5bdab0f1c6db960d623f74f4517321c86fdfdb0e12289de1365ca4f837e1eebb08ab6384c56aa1ae319a8dd86403d831e34dc9f0a23a551cf4f256d9ade9
TLSH
T130F027B73FFB1854FDABD3D6643119A005497C549880AD0F241AB39795B1319215DCB2
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 53353b0102c1167f165b0d136c021588beb2431eb5d8294a2944a8ecf3b1dc56
MD5 e6397c052eb5b83885f98a6bf779575a
SHA1 c0516d82cf80d16a3d3fc424205dd0e684f8ed06
SHA512 adf5172d5e5f6062370408f850c1f1bdd9fd7411179a11e4861f6ca7b7848166a132b975d552dadb5af4383690e74a4f0c401c76b704bc203307c0afc0ce5115
TLSH
T18CA002338149144AD4050775308575943396C8518E4E165155E4E0FCBCA1340A172121
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 24KB
SHA256 ca79e482d6651af4db7d3ab1e89dfb07c51952efdf1984ff79278d728f2aa80c
MD5 1873bc40e4a2258c52e4311ffd0a8df7
SHA1 2b4fe6c6d553c7ce5f0c27c627211fdc68b1a148
SHA512 c032aa4fa35608ba38e9636e9ea8f1afecca25e2321e470cd0993483185dff8f6f079332f7bdf1e760bac1c80e0879506d308f09994965ae3d1f471ee3f7c959
SSDEEP 96:Ko7iKcsW23iKoM7LKKc026WEKjKkAAK9Gq+xGKqkJ7yKkc++dmKWI94gK966GbG6:05ppxnY753RNBvRJJdt7p5J9D7nQz
TLSH
T159B27A5A713A0212397E2948B39696374F4235A33058E4BF7FB814A14F67E225CFD8ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 c0a0ae08354917db7e9217e6ef9f021ef9e79ea61579f2e8ac9d66c4cf7c9b07
MD5 83b32d9571d4ebcec1b2dbe7135182fe
SHA1 90cb653142c12ac84f40729ffcf931a29c6560e0
SHA512 353a99e15c340ec72a8ee1427d20418e5bf1e6c4ce7256542918cd55afd09cc0c77a7e77fa8aa4c3d66e7896b80024f09f9e5f787c4518e6490690e00ba0aec2
SSDEEP 384:npviF9CcmyWCs3sNj8TUNTUlIm2QckCr9lKKphifGGY6sK1pwe4KV8p0lHrty/7a:p6Fccps3CwgbkUwkFGYaYI8p0V7
TLSH
T18CB25C36EC68D9BBEDE74F89B74E7A07DEE0112785989AD4DAD81E0D00971DC070BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 90393b4126913d95010829b851e33e850ef90b6dc57190131cad4d499dfd2902
MD5 f7bbd6b1bb307b83b81f102bc219c5db
SHA1 606a50fca6a6c48f287275e6325a3df01713628c
SHA512 dde130f0711e673bfc7478686a55aca0f55449e08cc099bbed0d29582169f48f9cf07b5a2d69d01cc705422dcd0341ec5ac430e5e7e7954ea8e2ae6f455f3b21
SSDEEP 384:ntiFVtNnNnb9SfsNiH8TUNTUlI42TpckCrm8wphifaGY6sx8rPXpbImbDWnhoJfe:kFVjZbYTHwg6kE2hGYBCPlImnkSXBcr
TLSH
T103E2A4F6A8E79977E9AE4B87633D2E429AFCC16375481990B7D90D0CCC861BFC306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 673a2127fdb000c25368ee97646b30b24657ccc171bd6c2f033370a85aa475ea
MD5 fb2ae573bd708c9b306308ebae59c263
SHA1 e218e2fde2fe780c24d48897ac34792844a8fbb1
SHA512 a56b6770adedf26ed2367d1583cc71100e776aaa7d4e93b6b992cd7c44b85fe8a5d46204d433e5f2cbf4b4c943d17db47df0c5ea73b3faa8e32c2bd81f44d428
SSDEEP 384:npZiF9CcmyWCs3sNF8TUNTUlI4BQckCrL40phifGGY6sx8rUXpbIrvty/7IgC:pwFccps3Awg2kFSFGYBCUlIr
TLSH
T153B22936E868DAB7FDE74F9AA75E7A43DFE0116385888AD4DAD90D0D00871DD030BD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 7a06b28f75b6ccb15b98b01998df5f8cdb93db7b41209e50e41581b78cf81491
MD5 085bd8228e75cc22842eb851211527d1
SHA1 c21deb6f47a2c801cf44c0f3fbb5f0dba06237d2
SHA512 abe2ee7ee74e0b8f42fee4f3f259769fd247809a8f824b3ef1a564ecf52e267917443a72a4a2d1dc7dd91fb956489ec90ce3079f6975c8e96a6477d746af537b
SSDEEP 384:npZiF1tNnNnb9t3sNF8TUNTUlI4CQckCrL40phifGGY6sx8rUXpbImbDWnhoJfPm:pwF1jZbb3Awg5kFSFGYBCUlImnkSXBcr
TLSH
T160D22936E868EAABFDE64F95A74E7B43EFF0016385881AD4D9D91E1D00C719D030BD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 f6bd535df0c737472deb884f3d928a62692de7b4a14197d57b0613b6ec271f5f
MD5 10db3ad3ef6e375b81a89bd7fe276bee
SHA1 59b372aaf18571557a3fea33f2364fbdfb77adaf
SHA512 6e02c4bdaacc8de2a2a292807ef85f4fc2a6124ed1fde1c33f24ac3dad4463d7d2f1ad196c574ef1d077024246aaf0162c690c559a9faa543812bf2354ebd03b
SSDEEP 384:n/iF1tNnNnb9t3sNF8TUNTUlI4CQckCrB40phifGGY6sx8rUXpbImbDWnhoJfPZQ:KF1jZbb3Awg5kDSFGYBCUlImnkSXBcr
TLSH
T167D23936E868DEABFEE64F95A74E7A43EFF0016385881AD4D9D91E1D00C719D030BD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 9eeb3eae0487494cbb6393bf1850fbde93637c1ee14dcc9a852a855747edf042
MD5 7f5e03f609c952e1c81ec8c2bcf82f3d
SHA1 7863a1ffdd5bdc2b3232239e19b142cfa5ccfd3e
SHA512 1649a19af28bf061317748aee359565fce28c1b32d56062f3807fa30e0f350ef64daa970dfc5b38034676790a96443e69f90c0e6eeba3bd5956c785491ae7eb7
SSDEEP 384:ntiFKtNnNnb9SfsNiH8TUNTUlI42TpckCrIlwphifiGY6sx8rdXpbImbDWnhoJfe:kFKjZbYTHwg6kn29GYBCdlImnkSXBcr
TLSH
T1BCF2A3F6A8E79977E9AE4B87633D2E429AFCC16375481990B7D90D0CCC861BFC306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 759d0a4eda66a12d1c3894b14720aa36161bbc29b3087f5d9ed300010e62dc1e
MD5 8e0a88ea8df128ac4edc27bdd56e1d0e
SHA1 56e28e898d30a925dc5d0ddf81c577a00df81458
SHA512 db928c4364547e18e32bec2c9209344618435dcd2534a9b1318edccca704a2335cf58a240f209333882e736f065b51bc758cbf4601b867cd61a8db49d6b38fa9
SSDEEP 384:ntiFgtNnNnb9SusNiH8TUNTUlI42TpckCrXtwphif9GY6sx8rdXpbImbDWnhoJfe:kFgjZbxTHwg6kU2sGYBCdlImnkSXBcr
TLSH
T1A5F2A3F6A8E79977E9AE4B87633D2E429AFCC16375881990B7D50D0CCC861BFC306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 cfe3a67a54d2a1a554fcece16733e062cea603d94d684f0b9c46dac720b36dd2
MD5 1325b364cb21bb2b47945c92b9a531c8
SHA1 d193420461a621059eac5afd1d6e1004ec486336
SHA512 f71d5866be9d4bd908512f77b767df136ad47c913f36a1b2900b5f1d8c4ea2463e0145e3216466ea7e21f728dc08376bcb5d8c5bee8d33994f6d8ce45335044e
SSDEEP 384:ntiF1tNnNnb9Sq3sNF8TUNTUlI4CQckCrB40phifGGY6sx8rPXpbImbDWnhoJfPm:kF1jZbL3Awg5kDSFGYBCPlImnkSXBcr
TLSH
T198D23936E868DEABFEE64F95A70A7A43EFF0116385881AD4D9D91E1D00C719D030BD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 647ebceb77404e84c3ed479e8c3159ad0d8a3e6dd01f87b114786e5fab0f2670
MD5 ede65b1ae34d3756bde84129702691da
SHA1 9763b90cad408d8a54766bf36f65b5ef39d08481
SHA512 259968bfaea04907c360ef52ba0c12e04ed6c993458fe4069dbd52e18e2e39e4281eb9aa6519695e20f953456b373d438e531c700f6f3f76d8d13251b72a88f4
TLSH
T10CE00243571441F6D02C1370058F1B101FD7C4B111E103070E20415C1D2332C7D32F46
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 2c2dc8554a4b4942b2557ce8b55ebd746794cad571e6a4b1410522a10cef2aa5
MD5 7e60e6f07ebec98e283859ea668489be
SHA1 0cb2e60282d47cc6b00d445558cca1c0550b6db5
SHA512 9751966e96ef07b02e6f2f610dfe6b274e6e18ba6f3e68961f0960bac753815bac1b1e3b7fa814feb89595e4aa374f72ab5019a5fd6edcb417e0faabfc688728
TLSH
T1B1E009439B1481B7D02C137449EB17103BEBC4B512E2030B0E1441681D223296E72E86
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 5d30f636808cda28e82ce037afacae4a860cd6a2280a7c82ea9d999aa6b290e4
MD5 8a4dce3e5436f74ce70afc8b36b9f241
SHA1 d88ba98d2243f2c65641c3f501cacf4c1dfc54db
SHA512 e6e79a3a98bd1b668bf627094787dfdcf44de7540c519e12fe9cfe5568f97fc88662c7c95ebefe624a1bd436ec727c0a4c5a2537ad8dff0ffb9779a499ef906a
TLSH
T181E00983DB1481B7D02C137548DB1B103FEBC4B512E2030B1E2442AC2D233297E76E46
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 a749913c76d146f4cc5c30fe4ee8391aebdafdaae9938c21c1b80734e1556343
MD5 151b59134faf6878c86689d2f1a4626c
SHA1 f6ef15b4cf2d0a7d14c36b43c844263fb208c2fc
SHA512 17fda4244b1bd170fcae299edaf239da07be3de16566c99e461f6e3cac1981d164564b50e5447b097c80da0ce8cddb4bb9b3d3c8922f62118d909a17eb3f231e
TLSH
T10DE00443171441F5D03C1330044F131007C3C4F110F003070D1041440D1303C5D31F45
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe5a0030.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe5a0030.TMP
Size 392B
SHA256 c0c5cdb8c8abbcff4d8e7c365e388fbb78268810a7c7e5fba3692ef5cab71908
MD5 cee25a657f6d5a2b5a5ee5ae3b15d475
SHA1 22e5a59668c9d014918fd8204c5aaad30c05a683
SHA512 6d86e5be65e2053c0ca122fb4d4e96851a41d4c19d29aa7645c4b0990c4d5cd130182a87240d7251148c502cb9010b5f9246eff8958f6f823911da9194ec2940
MD5 SHA1 SHA512

Submit Download

Filtering Rules

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Subresource Filter\Unindexed Rules\10.34.0.84\Filtering Rules
Size 2.1MB
SHA256 5e301c48e6d7290990971e9f0bcb2263c8adba06ed0a2c6db5086949825d999b
MD5 43f62d9f35fa6597cec4e2ad5643e282
SHA1 8dba6404724ffd6a2e89901e8dc6e5e55fed3374
SHA512 91891d23464f89e6769d9ec7a28867e28f77925e6e3b3b75fb628d8672157ba239676c07699c931ac307a21ccc4dae95dd707d410f988ff82be4015103d4d6a3
SSDEEP 49152:ua2qP9SKIrivd04TxN/7Uw+zJEhs6dl61n4Kmq9SL6bbBT0HjTsQc8cxjw:u8d
TLSH
T1BAA55D237518BDF45BB31F3EA44B6D48823962A483E3EDC5EA2BD10ED5E014F79601B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICENSE

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Subresource Filter\Unindexed Rules\10.34.0.84\LICENSE
Size 24KB
SHA256 ed0f972d56566a96fb2f128a7b58091dfbf32dc365b975bc9318c9701677f44d
MD5 aad9405766b20014ab3beb08b99536de
SHA1 486a379bdfeecdc99ed3f4617f35ae65babe9d47
SHA512 bd9bf257306fdaff3f1e3e1fccb1f0d6a3181d436035124bd4953679d1af2cd5b4cc053b0e2ef17745ae44ae919cd8fd9663fbc0cd9ed36607e9b2472c206852
SSDEEP 384:mva5sf5dXrCN7tnBxpxkepTqzazijFgZk231Py9zD6WApYbm9:mvagXreRnTqzazWgj0v6XqK
TLSH
T140B2526EB64903731AF30116AA4B64DBF31ED03F362A4564346CC1481FB6E7443FA6EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 33f09ca56379c56a47154743a36e472d8fce03c061208a01ed28b4bee5ed024d
MD5 1962d971e82db6ecbd1a45b30bdb2310
SHA1 1712eadf373a0a3ee6cb0ea3f870e1cc4db9ef0d
SHA512 e62442af9a114c2b8b566f790026a96201a973cace074a3e8607d3f931aa7d74170d39d633253fa03ea610ff7e21543b6b3fd99639aa87167f474e7dc01b342b
TLSH
T1CB414FE25C381AC1C4BD1A7EA4CB78FC85E8C725F5A4357A7C64DA990A29B1E308543F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 11ef571ff8f4a9b4f8a7150e0ac7eaa9c5e07ba6c8cb86fbefa8d7b3474491e4
MD5 c2c890236ed63c209c4ec637e42fbbeb
SHA1 26696b540d7c3b219c1d99eee369129d2a450f01
SHA512 fb448670d6e1d9f645e105abb8d867add16c847785c8ff8bcdec598cc38e6f38a05527426e90a79b417ffe032beef0df8d0eba07225f8facc28e6be5ae2fbb05
TLSH
T15A4161E15C381AC1C4BD1A7EA0CB78FC84ECC725F5A0347E7C54DA980A29A1E248543F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 61ccebf20edab66582da5c9a3655ae1863a55e375155145bcb0c531baa555bb9
MD5 fc1e5946a89b6dda9720aca5f85cc492
SHA1 d69a6539b0017244432cc3be1bcfddc20b642f3b
SHA512 9210f312cd3a49f8aea5be47c90db73d961502c4fe5a0fca066395d90a0a92ad8cf7a044835dc90d89be4d25ff9df0fbe415e3c94a8b09a6459ef046a8c1847e
TLSH
T1124153E15C385AD1C4BD0A7EB4CB78FC85E8C725F5A4307E7C58DA940A29A1D348543F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 76c44ef7f20dc5bd1d62411666a6fb62dfd05af663de30bc86be860e2640f317
MD5 733a4f8548d1aeb13b233fb4c685fbd9
SHA1 4b83cd3d84d27dacff9bdf40faf8f19dce98ccc7
SHA512 3f27bfa73db7d9723ff11f37f47907f60ecef2cff2b81ad7d484a26ed1433ae41f9cc082027422b7a3946eab97b7802f53791f8e0cbfc507afc5c050c2cf1500
TLSH
T11B4142E15C385AD1C4BD0E7EB4CB74FCC5E8D629F5A0717E6C58EA940A2DA0D648143F
MD5 SHA1 SHA512 TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 faacbb7bc023eb4080e392bb05331314b2b46817c9d156b4b81346b1bf8637a4
MD5 8162bfcb0673bc8b128734f4ac771cbd
SHA1 6b0f0821ba7512f978e579b84b6dc2016920e643
SHA512 177e6a9d95e6f299d100f18ea73288848ce4bc25df30f59df5522952d205cf20eb5afd9e751746f740848bdb45c185814accd74e9ac40127ee2b252236fa224c
TLSH
T1E8411759BAF91148B3B76F5AABF6A86D447EB8772E07C59D10010E4F0623B40C861B33
MD5 SHA1 SHA512 TLSH

Submit Download

MEMZ-Clean.exe

Path C:\Users\Admin\Downloads\MEMZ-Clean.exe
Size 12KB
SHA256 4bbf7589615ebdb6c769d6d2e7bdcb26072bac0cda6e225a4133ba8819e688d5
MD5 9c642c5b111ee85a6bccffc7af896a51
SHA1 eca8571b994fd40e2018f48c214fab6472a98bab
SHA512 23cc74b5a7bdf70ba789d1730a0009414cfb9c780544e3d8d841be58782b9a9a089969c4295a0da25d07285505992386486d6ff0524e75605b96bb99cd3aaa1c
SSDEEP 192:BCMfc/GinpRBueYDw4+kEeN4FRrfMFFp3+f2dvGhT59uay:AMfceinpOeRENYhfOj+eGdKa
TLSH
T13042E88BBAE05007F1F1C57A24B56738DB7DBB631FA58ECEECB11E429A90C466407352
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MEMZ-Destructive.exe

Path C:\Users\Admin\Downloads\MEMZ-Destructive.exe
Size 14KB
SHA256 a3d5715a81f2fbeb5f76c88c9c21eeee87142909716472f911ff6950c790c24d
MD5 19dbec50735b5f2a72d4199c4e184960
SHA1 6fed7732f7cb6f59743795b2ab154a3676f4c822
SHA512 aa8a6bbb1ec516d5d5acf8be6863a4c6c5d754cee12b3d374c3a6acb393376806edc422f0ffb661c210e5b9485da88521e4a0956a4b7b08a5467cfaacd90591d
SSDEEP 192:sIvxdXSQeWSg9JJS/lcIEiwqZKBkDFR43xWTM3LHn8f26gyr6yfFCj3r:sMVSaSEglcIqq3agmLc+6gyWqFCj
TLSH
T180624BCFBE204417D8F0C57530659234DFBACABA1B968EDF9CF91E529AC4C072823265
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

note.txt

Path C:\note.txt
Size 218B
SHA256 8e9f20f6864c66576536c0b866c6ffdcf11397db67fe120e972e244c3c022270
MD5 afa6955439b8d516721231029fb9ca1b
SHA1 087a043cc123c0c0df2ffadcf8e71e3ac86bbae9
SHA512 5da21a31fbc4e8250dffed30f66b896bdf007ac91948140334fe36a3f010e1bac3e70a07e9f3eb9da8633189091fd5cadcabbaacd3e01da0fe7ae28a11b3dddf
TLSH
T1C3D0A719040784251C7052D17145A5A09B70562D77F626EB74DC690C212700F0B37C9A
MD5 SHA1 SHA512 TLSH

Submit Download