killmbr | hxxp://bonavol[.]info

Analysis

user interaction
yes
max time kernel
330s
max time network
330s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/07/2026, 17:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://bonavol.info
Sample260710-v4fdlsf15v

Score

10^/10

bootkit discovery killmbr persistence trojan wiper

Malware Config

Signatures

Family: KillMBR
KillMBR is a trojan that attempts to overwrite the Master Boot Record.
wiper trojan killmbr

Detects KillMBR 1 IoCs

resource	yara_rule
behavioral1/files/0x0003000000023259-1546.dat	family_killmbr

Downloads MZ/PE file 1 IoCs

flow	pid	Process
245	2792	msedge.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\Control Panel\International\Geo\Nation	MEMZ-Destructive.exe
Key value queried	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\Control Panel\International\Geo\Nation	MEMZ-Destructive.exe

Executes dropped EXE 7 IoCs

pid	Process
4412	MEMZ-Destructive.exe
1072	MEMZ-Destructive.exe
1760	MEMZ-Destructive.exe
3764	MEMZ-Destructive.exe
876	MEMZ-Destructive.exe
4316	MEMZ-Destructive.exe
3304	MEMZ-Destructive.exe

Contacts third-party web service commonly abused for C2 1 TTPs 6 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
241	raw.githubusercontent.com
242	raw.githubusercontent.com
243	raw.githubusercontent.com
244	raw.githubusercontent.com
245	raw.githubusercontent.com
240	raw.githubusercontent.com

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	MEMZ-Destructive.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
3280	Bonavol_3uuv7.exe
3724	Bonavol_3uuv7.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MEMZ-Destructive.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MEMZ-Destructive.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MEMZ-Destructive.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MEMZ-Destructive.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MEMZ-Destructive.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MEMZ-Destructive.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MEMZ-Destructive.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2792	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134281783520004525"	msedge.exe

Modifies registry class 14 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-204488895-2999877624-296153668-1000\{DDF6418E-E0C3-4C17-87B0-DDE53F411211}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-204488895-2999877624-296153668-1000\{024F6F62-AB03-493A-AA6C-65190B01C71B}	Bonavol_3uuv7.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-204488895-2999877624-296153668-1000\{E6F4B07E-EB79-4603-A8F8-85CACA1703C2}	Bonavol_3uuv7.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-204488895-2999877624-296153668-1000\{D6DCC08E-E48D-4306-A2AF-3F00BE535BAD}	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3280	Bonavol_3uuv7.exe
3280	Bonavol_3uuv7.exe
3724	Bonavol_3uuv7.exe
3724	Bonavol_3uuv7.exe
4492	msedge.exe
4492	msedge.exe
4224	powershell.exe
4224	powershell.exe
4224	powershell.exe
1072	MEMZ-Destructive.exe
1072	MEMZ-Destructive.exe
1760	MEMZ-Destructive.exe
1760	MEMZ-Destructive.exe
1760	MEMZ-Destructive.exe
1072	MEMZ-Destructive.exe
1760	MEMZ-Destructive.exe
1072	MEMZ-Destructive.exe
1072	MEMZ-Destructive.exe
1072	MEMZ-Destructive.exe
1072	MEMZ-Destructive.exe
1072	MEMZ-Destructive.exe
1760	MEMZ-Destructive.exe
1760	MEMZ-Destructive.exe
4316	MEMZ-Destructive.exe
4316	MEMZ-Destructive.exe
876	MEMZ-Destructive.exe
876	MEMZ-Destructive.exe
3764	MEMZ-Destructive.exe
3764	MEMZ-Destructive.exe
1760	MEMZ-Destructive.exe
1760	MEMZ-Destructive.exe
1072	MEMZ-Destructive.exe
1072	MEMZ-Destructive.exe
876	MEMZ-Destructive.exe
4316	MEMZ-Destructive.exe
876	MEMZ-Destructive.exe
4316	MEMZ-Destructive.exe
4316	MEMZ-Destructive.exe
876	MEMZ-Destructive.exe
4316	MEMZ-Destructive.exe
876	MEMZ-Destructive.exe
1072	MEMZ-Destructive.exe
1072	MEMZ-Destructive.exe
1760	MEMZ-Destructive.exe
1760	MEMZ-Destructive.exe
3764	MEMZ-Destructive.exe
3764	MEMZ-Destructive.exe
4316	MEMZ-Destructive.exe
4316	MEMZ-Destructive.exe
1072	MEMZ-Destructive.exe
1072	MEMZ-Destructive.exe
876	MEMZ-Destructive.exe
876	MEMZ-Destructive.exe
876	MEMZ-Destructive.exe
876	MEMZ-Destructive.exe
1072	MEMZ-Destructive.exe
1072	MEMZ-Destructive.exe
4316	MEMZ-Destructive.exe
4316	MEMZ-Destructive.exe
3764	MEMZ-Destructive.exe
3764	MEMZ-Destructive.exe
1760	MEMZ-Destructive.exe
1760	MEMZ-Destructive.exe
876	MEMZ-Destructive.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 23 IoCs

pid	Process
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4224	powershell.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
4412	MEMZ-Destructive.exe
1072	MEMZ-Destructive.exe
1760	MEMZ-Destructive.exe
3764	MEMZ-Destructive.exe
876	MEMZ-Destructive.exe
4316	MEMZ-Destructive.exe
3304	MEMZ-Destructive.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4916 wrote to memory of 788	4916	msedge.exe	87
PID 4916 wrote to memory of 2792	4916	msedge.exe	88
PID 4916 wrote to memory of 4620	4916	msedge.exe	89
PID 4916 wrote to memory of 1368	4916	msedge.exe	90
PID 4916 wrote to memory of 4620	4916	msedge.exe	89
PID 4916 wrote to memory of 4620	4916	msedge.exe	89
PID 4916 wrote to memory of 1368	4916	msedge.exe	90
PID 4916 wrote to memory of 3480	4916	msedge.exe	91
PID 4916 wrote to memory of 4492	4916	msedge.exe	92
PID 4916 wrote to memory of 3480	4916	msedge.exe	91
PID 4916 wrote to memory of 3480	4916	msedge.exe	91
PID 4916 wrote to memory of 4492	4916	msedge.exe	92
PID 4916 wrote to memory of 4492	4916	msedge.exe	92
PID 4916 wrote to memory of 5016	4916	msedge.exe	93
PID 4916 wrote to memory of 5016	4916	msedge.exe	93
PID 4916 wrote to memory of 5016	4916	msedge.exe	93
PID 4916 wrote to memory of 4268	4916	msedge.exe	94
PID 4916 wrote to memory of 4268	4916	msedge.exe	94
PID 4916 wrote to memory of 4268	4916	msedge.exe	94
PID 4916 wrote to memory of 876	4916	msedge.exe	98
PID 4916 wrote to memory of 876	4916	msedge.exe	98
PID 4916 wrote to memory of 876	4916	msedge.exe	98
PID 4916 wrote to memory of 4056	4916	msedge.exe	100
PID 4916 wrote to memory of 2020	4916	msedge.exe	101
PID 4916 wrote to memory of 4056	4916	msedge.exe	100
PID 4916 wrote to memory of 2020	4916	msedge.exe	101
PID 4916 wrote to memory of 560	4916	msedge.exe	104
PID 4916 wrote to memory of 2144	4916	msedge.exe	105
PID 4916 wrote to memory of 2144	4916	msedge.exe	105
PID 4916 wrote to memory of 2144	4916	msedge.exe	105
PID 4916 wrote to memory of 1028	4916	msedge.exe	106
PID 4916 wrote to memory of 4896	4916	msedge.exe	107
PID 4916 wrote to memory of 1028	4916	msedge.exe	106
PID 4916 wrote to memory of 4896	4916	msedge.exe	107
PID 4916 wrote to memory of 4896	4916	msedge.exe	107
PID 4916 wrote to memory of 4020	4916	msedge.exe	112
PID 4916 wrote to memory of 5116	4916	msedge.exe	113
PID 4916 wrote to memory of 2920	4916	msedge.exe	114
PID 4916 wrote to memory of 4464	4916	msedge.exe	119
PID 4916 wrote to memory of 1188	4916	msedge.exe	127
PID 4916 wrote to memory of 1188	4916	msedge.exe	127
PID 4916 wrote to memory of 4492	4916	msedge.exe	133
PID 4916 wrote to memory of 1436	4916	msedge.exe	136
PID 4916 wrote to memory of 4492	4916	msedge.exe	137
PID 4916 wrote to memory of 1436	4916	msedge.exe	136
PID 4916 wrote to memory of 4492	4916	msedge.exe	137
PID 4916 wrote to memory of 3560	4916	msedge.exe	138
PID 4916 wrote to memory of 3560	4916	msedge.exe	138
PID 4916 wrote to memory of 3452	4916	msedge.exe	139
PID 4916 wrote to memory of 3452	4916	msedge.exe	139
PID 4916 wrote to memory of 3452	4916	msedge.exe	139
PID 4916 wrote to memory of 4052	4916	msedge.exe	140
PID 4916 wrote to memory of 4052	4916	msedge.exe	140
PID 4916 wrote to memory of 4052	4916	msedge.exe	140
PID 4916 wrote to memory of 3632	4916	msedge.exe	141
PID 4916 wrote to memory of 3632	4916	msedge.exe	141
PID 4916 wrote to memory of 3632	4916	msedge.exe	141
PID 4916 wrote to memory of 1220	4916	msedge.exe	142
PID 4916 wrote to memory of 1220	4916	msedge.exe	142
PID 4916 wrote to memory of 1220	4916	msedge.exe	142
PID 4916 wrote to memory of 3884	4916	msedge.exe	143
PID 4916 wrote to memory of 3884	4916	msedge.exe	143
PID 4916 wrote to memory of 3884	4916	msedge.exe	143
PID 4916 wrote to memory of 3948	4916	msedge.exe	144

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://bonavol.info
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x248,0x7ffe0d44c188,0x7ffe0d44c194,0x7ffe0d44c1a0
  2⤵
  PID:788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1948,i,3129230711383619884,13244868281960896992,524288 --field-trial-handle=2284,i,17609841417819085986,16718549774522142194,262144 --variations-seed-version --mojo-platform-channel-handle=2328 /prefetch:3
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:2792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1728,i,6189382578081733796,6818755307338839706,262144 --field-trial-handle=2284,i,17609841417819085986,16718549774522142194,262144 --variations-seed-version --mojo-platform-channel-handle=2280 /prefetch:2
  2⤵
  PID:4620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2404,i,6850072903121135890,6833686502209139270,524288 --field-trial-handle=2284,i,17609841417819085986,16718549774522142194,262144 --variations-seed-version --mojo-platform-channel-handle=2492 /prefetch:8
  2⤵
  PID:1368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3456,i,7474346179258214066,10699862795041162214,2097152 --field-trial-handle=2284,i,17609841417819085986,16718549774522142194,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:1
  2⤵
  PID:3480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3460,i,4118770744831189554,11848824366979376448,2097152 --field-trial-handle=2284,i,17609841417819085986,16718549774522142194,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:1
  2⤵
  PID:4492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4252,i,4841919981233769037,11902406260504734149,2097152 --field-trial-handle=2284,i,17609841417819085986,16718549774522142194,262144 --variations-seed-version --mojo-platform-channel-handle=4260 /prefetch:1
  2⤵
  PID:5016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4300,i,5181664593958952570,8919742245652884461,2097152 --field-trial-handle=2284,i,17609841417819085986,16718549774522142194,262144 --variations-seed-version --mojo-platform-channel-handle=4348 /prefetch:2
  2⤵
  PID:4268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3388,i,12648596535817244695,8713540957197792297,2097152 --field-trial-handle=2284,i,17609841417819085986,16718549774522142194,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:1
  2⤵
  PID:876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5224,i,1651910575023046246,5206638584115110276,524288 --field-trial-handle=2284,i,17609841417819085986,16718549774522142194,262144 --variations-seed-version --mojo-platform-channel-handle=5292 /prefetch:8
  2⤵
  PID:4056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5232,i,7256065850874368092,10003741083560383734,524288 --field-trial-handle=2284,i,17609841417819085986,16718549774522142194,262144 --variations-seed-version --mojo-platform-channel-handle=5316 /prefetch:8
  2⤵
  PID:2020
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3764,i,5006149283764875730,13302563553283387571,524288 --field-trial-handle=2284,i,17609841417819085986,16718549774522142194,262144 --variations-seed-version --mojo-platform-channel-handle=3728 /prefetch:8
  2⤵
  PID:3452
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3764,i,5006149283764875730,13302563553283387571,524288 --field-trial-handle=2284,i,17609841417819085986,16718549774522142194,262144 --variations-seed-version --mojo-platform-channel-handle=3728 /prefetch:8
  2⤵
  PID:560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=4268,i,2364974835175031548,4534652711494998915,2097152 --field-trial-handle=2284,i,17609841417819085986,16718549774522142194,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:1
  2⤵
  PID:2144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6364,i,7773942321340824935,3546174092770667540,524288 --field-trial-handle=2284,i,17609841417819085986,16718549774522142194,262144 --variations-seed-version --mojo-platform-channel-handle=5000 /prefetch:8
  2⤵
  PID:1028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6368,i,11793654759612917783,3814525217052487508,2097152 --field-trial-handle=2284,i,17609841417819085986,16718549774522142194,262144 --variations-seed-version --mojo-platform-channel-handle=6376 /prefetch:1
  2⤵
  PID:4896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6668,i,9957166789675935874,16951626561212392740,524288 --field-trial-handle=2284,i,17609841417819085986,16718549774522142194,262144 --variations-seed-version --mojo-platform-channel-handle=760 /prefetch:8
  2⤵
  PID:4020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6672,i,3726452897055886292,2880834941677756201,524288 --field-trial-handle=2284,i,17609841417819085986,16718549774522142194,262144 --variations-seed-version --mojo-platform-channel-handle=6636 /prefetch:8
  2⤵
  PID:5116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6664,i,6130516068119346710,1562000565141233165,524288 --field-trial-handle=2284,i,17609841417819085986,16718549774522142194,262144 --variations-seed-version --mojo-platform-channel-handle=6712 /prefetch:8
  2⤵
  PID:2920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6672,i,3226700180935986086,14140042286287234736,524288 --field-trial-handle=2284,i,17609841417819085986,16718549774522142194,262144 --variations-seed-version --mojo-platform-channel-handle=3736 /prefetch:8
  2⤵
  PID:4464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6464,i,4915538249559937809,521983564085194719,524288 --field-trial-handle=2284,i,17609841417819085986,16718549774522142194,262144 --variations-seed-version --mojo-platform-channel-handle=6468 /prefetch:8
  2⤵
  PID:1188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=3740,i,14791263840078129582,8813755354657101040,262144 --field-trial-handle=2284,i,17609841417819085986,16718549774522142194,262144 --variations-seed-version --mojo-platform-channel-handle=6148 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5616,i,17114995501957270221,14176733990917707115,524288 --field-trial-handle=2284,i,17609841417819085986,16718549774522142194,262144 --variations-seed-version --mojo-platform-channel-handle=3232 /prefetch:8
  2⤵
  PID:1436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2936,i,14365489203234646681,10146075043437624449,524288 --field-trial-handle=2284,i,17609841417819085986,16718549774522142194,262144 --variations-seed-version --mojo-platform-channel-handle=5404 /prefetch:8
  2⤵
  PID:4492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5624,i,10871072736893482552,1138885655439081693,524288 --field-trial-handle=2284,i,17609841417819085986,16718549774522142194,262144 --variations-seed-version --mojo-platform-channel-handle=5636 /prefetch:8
  2⤵
  PID:3560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=3752,i,13168202298101123295,11104299412637514301,2097152 --field-trial-handle=2284,i,17609841417819085986,16718549774522142194,262144 --variations-seed-version --mojo-platform-channel-handle=5104 /prefetch:1
  2⤵
  PID:3452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=4516,i,3034048470700053401,16355426814488718370,2097152 --field-trial-handle=2284,i,17609841417819085986,16718549774522142194,262144 --variations-seed-version --mojo-platform-channel-handle=4824 /prefetch:1
  2⤵
  PID:4052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=6868,i,13302931522367777486,4093564168316518477,2097152 --field-trial-handle=2284,i,17609841417819085986,16718549774522142194,262144 --variations-seed-version --mojo-platform-channel-handle=6864 /prefetch:1
  2⤵
  PID:3632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=7008,i,11281244390521544918,9810044500904874506,2097152 --field-trial-handle=2284,i,17609841417819085986,16718549774522142194,262144 --variations-seed-version --mojo-platform-channel-handle=6980 /prefetch:1
  2⤵
  PID:1220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=7048,i,14730436932321629671,12832546890743862866,2097152 --field-trial-handle=2284,i,17609841417819085986,16718549774522142194,262144 --variations-seed-version --mojo-platform-channel-handle=6964 /prefetch:1
  2⤵
  PID:3884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --metrics-shmem-handle=7556,i,1783319007963037043,1712019091541063522,2097152 --field-trial-handle=2284,i,17609841417819085986,16718549774522142194,262144 --variations-seed-version --mojo-platform-channel-handle=7544 /prefetch:1
  2⤵
  PID:3948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7392,i,9638995158102777067,17608051148872294309,524288 --field-trial-handle=2284,i,17609841417819085986,16718549774522142194,262144 --variations-seed-version --mojo-platform-channel-handle=7628 /prefetch:8
  2⤵
  PID:1992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7748,i,3158677700466211484,7282392440201381995,524288 --field-trial-handle=2284,i,17609841417819085986,16718549774522142194,262144 --variations-seed-version --mojo-platform-channel-handle=7548 /prefetch:8
  2⤵
  PID:3552
- C:\Users\Admin\Downloads\MEMZ-Destructive.exe
  "C:\Users\Admin\Downloads\MEMZ-Destructive.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:4412
- - C:\Users\Admin\Downloads\MEMZ-Destructive.exe
    "C:\Users\Admin\Downloads\MEMZ-Destructive.exe" /watchdog
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:1072
- - C:\Users\Admin\Downloads\MEMZ-Destructive.exe
    "C:\Users\Admin\Downloads\MEMZ-Destructive.exe" /watchdog
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:1760
- - C:\Users\Admin\Downloads\MEMZ-Destructive.exe
    "C:\Users\Admin\Downloads\MEMZ-Destructive.exe" /watchdog
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:3764
- - C:\Users\Admin\Downloads\MEMZ-Destructive.exe
    "C:\Users\Admin\Downloads\MEMZ-Destructive.exe" /watchdog
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:876
- - C:\Users\Admin\Downloads\MEMZ-Destructive.exe
    "C:\Users\Admin\Downloads\MEMZ-Destructive.exe" /watchdog
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:4316
- - C:\Users\Admin\Downloads\MEMZ-Destructive.exe
    "C:\Users\Admin\Downloads\MEMZ-Destructive.exe" /main
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Writes to the Master Boot Record (MBR)
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:3304
  - - C:\Windows\SysWOW64\notepad.exe
      "C:\Windows\System32\notepad.exe" \note.txt
      4⤵
      System Location Discovery: System Language Discovery
      PID:1420
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=the+memz+are+real
      4⤵
      PID:2296
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument http://google.co.ck/search?q=the+memz+are+real
        5⤵
        
        PID:3768
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=how+to+get+money
      4⤵
      PID:2020
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument http://google.co.ck/search?q=how+to+get+money
        5⤵
        
        PID:1824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7360,i,14518065921684413220,13123760078841024646,524288 --field-trial-handle=2284,i,17609841417819085986,16718549774522142194,262144 --variations-seed-version --mojo-platform-channel-handle=7364 /prefetch:8
  2⤵
  PID:3444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --always-read-main-dll --metrics-shmem-handle=7492,i,506449306707328347,9059351171363476932,2097152 --field-trial-handle=2284,i,17609841417819085986,16718549774522142194,262144 --variations-seed-version --mojo-platform-channel-handle=7156 /prefetch:1
  2⤵
  PID:176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --always-read-main-dll --metrics-shmem-handle=7416,i,7153621749143773192,5679729313347305187,2097152 --field-trial-handle=2284,i,17609841417819085986,16718549774522142194,262144 --variations-seed-version --mojo-platform-channel-handle=7788 /prefetch:1
  2⤵
  PID:3448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7024,i,12380813479135368774,2310634062576446011,524288 --field-trial-handle=2284,i,17609841417819085986,16718549774522142194,262144 --variations-seed-version --mojo-platform-channel-handle=6980 /prefetch:8
  2⤵
  PID:3320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7940,i,9863090635678824857,13805081711746622200,524288 --field-trial-handle=2284,i,17609841417819085986,16718549774522142194,262144 --variations-seed-version --mojo-platform-channel-handle=7380 /prefetch:8
  2⤵
  PID:4564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --always-read-main-dll --metrics-shmem-handle=8140,i,16031850085540913139,12594856282773890111,2097152 --field-trial-handle=2284,i,17609841417819085986,16718549774522142194,262144 --variations-seed-version --mojo-platform-channel-handle=8068 /prefetch:1
  2⤵
  PID:3040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --always-read-main-dll --metrics-shmem-handle=8196,i,4455171370372460217,2510663370639111836,2097152 --field-trial-handle=2284,i,17609841417819085986,16718549774522142194,262144 --variations-seed-version --mojo-platform-channel-handle=8028 /prefetch:1
  2⤵
  PID:1812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --always-read-main-dll --metrics-shmem-handle=8236,i,3820155345251856340,5272619085277384216,2097152 --field-trial-handle=2284,i,17609841417819085986,16718549774522142194,262144 --variations-seed-version --mojo-platform-channel-handle=8232 /prefetch:1
  2⤵
  PID:2840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --always-read-main-dll --metrics-shmem-handle=8416,i,16922038832309880688,3858169865158725637,2097152 --field-trial-handle=2284,i,17609841417819085986,16718549774522142194,262144 --variations-seed-version --mojo-platform-channel-handle=8496 /prefetch:1
  2⤵
  PID:4208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --always-read-main-dll --metrics-shmem-handle=7780,i,5154274125391936643,588789371637088378,2097152 --field-trial-handle=2284,i,17609841417819085986,16718549774522142194,262144 --variations-seed-version --mojo-platform-channel-handle=8384 /prefetch:1
  2⤵
  PID:1968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --always-read-main-dll --metrics-shmem-handle=8688,i,984257784729966871,4620791812740253314,2097152 --field-trial-handle=2284,i,17609841417819085986,16718549774522142194,262144 --variations-seed-version --mojo-platform-channel-handle=8664 /prefetch:1
  2⤵
  PID:3268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --always-read-main-dll --metrics-shmem-handle=8304,i,8877835136473809182,12853173726392785927,2097152 --field-trial-handle=2284,i,17609841417819085986,16718549774522142194,262144 --variations-seed-version --mojo-platform-channel-handle=8796 /prefetch:1
  2⤵
  PID:984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8196,i,15943560870534982735,3643840423691656021,524288 --field-trial-handle=2284,i,17609841417819085986,16718549774522142194,262144 --variations-seed-version --mojo-platform-channel-handle=8912 /prefetch:8
  2⤵
  - Modifies registry class
  PID:5220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7164,i,11627457547826301579,7890226658015310176,524288 --field-trial-handle=2284,i,17609841417819085986,16718549774522142194,262144 --variations-seed-version --mojo-platform-channel-handle=8804 /prefetch:8
  2⤵
  PID:5216

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4544

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3724

C:\Users\Admin\Downloads\Bonavol_3uuv7\Bonavol_3uuv7\Bonavol_3uuv7.exe
"C:\Users\Admin\Downloads\Bonavol_3uuv7\Bonavol_3uuv7\Bonavol_3uuv7.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:3280

C:\Users\Admin\Downloads\Bonavol_3uuv7\Bonavol_3uuv7\Bonavol_3uuv7.exe
"C:\Users\Admin\Downloads\Bonavol_3uuv7\Bonavol_3uuv7\Bonavol_3uuv7.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:3724

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4224

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8b98c8b6b381e81c2bbf54b9caa68f2c18c9e88f35c3a0ec4606ce6913bec6fb
MD5 63bf6d0df9b19fddac83abae873ac109
SHA1 5dd25151b771fd9586d645e48a09c3c90206c6bb
SHA512 e66a1dca651cf59894f7ab0cd8a741d4d6514106675ff2869a2da724d152ec5ba25cd4d2730c51475df230cad415588165a556047cfbef5d2717e3e00337d474
TLSH
T11ED0A720773978C2D2291071E4224B4076AD54B6215A82466254840D5C7A4C696CB682
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ab98da7535c8de464335204ae97fd672936e639269325c3a388b3039d8396b83
MD5 1656a3560c7aeae221756f3891b89fd3
SHA1 e48441fe2b843ba3bd0bb7799c07b22a27db8eb7
SHA512 c06d7152d11e33601716d4c5c33c7373ac4e0c16571e80ac4a8ffb9cabb52fae51d4fe8d808fc75be943287b55a320e90a186d71a5f06e9db006f6ab89266400
TLSH
T1CFD09B307B597042D3074031E8074790169E84B5249B86066554410D7D5A485E3DF547
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ec6419a915c6f94199df67c6cf1d67bc666c22ef160c8377d6792913a6518679
MD5 a8d0099e5966b86c13c6997282a63770
SHA1 df541b93a0caebe364906ec90c768bb625495f4c
SHA512 a2093c42c3f547b910f560ee7a58cb187cef96045e8e335276c7bde87fdc5e9894b670421e94170d0878e86a2bea8125d914e11181882004f966732f9670a693
TLSH
T135D09B303B597442D7074031E8064790169E84B5249BC7076554410D7D5B4C5E3DF547
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 6f622278065d05a35cdcf98df4b8e6788d28e458c569f1bfd8ceb789df33407b
MD5 5ecd2bff9db046cb9796cf8c2c704311
SHA1 6c7746f69e532036569ce6ea8a81298a2ff8d217
SHA512 97bef6fd9d5defa3586f8f30521cb7a531f008637af9ce6039961f100c4e761c093a2a66e1bb3cbcadaf03be7f5a4700949e59a607597a26eed8e1a3e9231525
TLSH
T10AE026C406CCCA2EF6406A87417C730C93803E4B93C8BA0E276C8485748A640AF8BAA8
MD5 SHA1 SHA512 TLSH

Submit Download

f_00009c

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00009c
Size 162KB
SHA256 dfc49b15c839f5c2e6478370f43b83757f49a9448c04fe46cfbcc4fa1496ee59
MD5 1fe6a28e99d7d46e99abea5fcfd50d35
SHA1 bb50cc2068be85837cb9722029bff00ed8964ed8
SHA512 d64c2106d7d14df4fb77cd65eabf1f4c8e8adbd36303af4ca5274a11a634fd4cdc25ad5de90b1029f1fc22233a5b5a08e77fb442655e753316f47923e541c241
SSDEEP 3072:0Q4u1wUMQE6zJWqViQ5gUQ2rCttwYnflU2Wvl6uMxAqu499faP1jHD:0h8wUMQE65hWMOttwzN6bbDaNTD
TLSH
T15BF312B8EDFE7F07D68983BA15CE4C6A918F24C8BC68D4808DD4549CA8F174F501ADB5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000a9

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000a9
Size 256KB
SHA256 adb7287fc26c0521616bb69adf7889e9318a0c1e00398825c51c01d2a06f4c05
MD5 81d44a31aedf4fb57ee9d944ea23dfe0
SHA1 9c1bc458e74d05c7ae5dc59dac6cc4a6dd67c43b
SHA512 d17ddff7df8373d8fb4acde11c43d00ee9bf701959e330cd4a14c1558a83ad445aa6263b3ee98e5de3daf98b431210ee149e7ffac763c6d50c06e93126b00a5f
SSDEEP 3072:zANhizEqXhXHWDRs2JZuEDBy2MoZLyBa09819SQql9jGdrTBvGoVR00I4QzUlW:zACcdZZJM2HZ+0nYjGbB00I4VW
TLSH
T1AB44F1B4FB829740CB036ABCD07C2E374B9A54E672C40E1B0B669D212684765EB17E1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000aa

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000aa
Size 512KB
SHA256 0e169dfd532e84c92cc907faf5b74f77c485659a069564f3fb4df09db5d7d473
MD5 33b8b8aad927d1e6649e19fdaf5819b9
SHA1 a629d5a71aeb436d6ad8b959291088951921d7e8
SHA512 f4551060dda057d499f4a8e7270af0bbd24ffb0f69331198e4975c8c911464aecbc11cabbd8bcb9a99f9ef059bc432a931f92083646e0f435b41238e68baf851
SSDEEP 12288:bOS45uyruFRW8uJOyPmhmOW2QJUVtVpSi4ky:aLsyrmWJJHP92QJUnJ4k
TLSH
T195B423565F931C2FC7FF2232F19BECC35A51A2AC20C82D35FBC454AA619171A9B285C3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000ab

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000ab
Size 256KB
SHA256 1a51a39a0181abb211af41600112378aa74b3c924fcb662ebd001a647233107d
MD5 455327b5819e32b79e98198399ec7a18
SHA1 43a90a3d3a2d989910edbf818393af1dcba2fe01
SHA512 f49ff3cce466d2e8a38cde077a149d342839f9531c9b4e801725e06bfe0cc01ba56d2c807cb14f584fa53b905616952a2029945bf808d110cdde5f3ffde80645
SSDEEP 3072:XUEGjRWiiI7+mJEpXj2xJZwVvWqRUXRf2QT3ScwuA63NonSznC3V:kvRb/6p2xJBmUXp2a3fztC3
TLSH
T1AF440250EF046AA2CE124BF4DC692F3359B551DB20D0AD0A8BB9DA107EC6193F70779B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000ac

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000ac
Size 17KB
SHA256 57c6927d73a5e2b55201b4e9270037b13c02d87a358342f63ce43daef96ad057
MD5 24b6957e1169e8137845276c684ab390
SHA1 a16a33ebafe82219248d2d48b4942733419ae26e
SHA512 bc261a84652a9ca80c5e574b25cd2eef8e009f8980f95f06c1b9fffd52bba9598dd5cd585cd95cbc19c186f688a16ec0645ca5e4002e500ec063044b01ec6a21
SSDEEP 384:0BwD25Q/tAFF2U1bc8cqqUzJahurvQd2MeXaZUXM:JIV4VqqIQuRlid
TLSH
T1B882D00523DBFC4E90D9F6B832E921B1BFA81F1F90711D1BD8582497A53CD0B3A3464A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000ad

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000ad
Size 17KB
SHA256 fe672d5c4e9570c5c4c30f7ffa25027237ec3a8766ec89d377a0f8964ee75937
MD5 7b25ade41ba17550d716530d18040b36
SHA1 d4d120778bc8ec1848baad09c6cfda312e02b155
SHA512 0785d61dc17879db03511c9977ebfed986072398665166edcda0ece0ffd0bdae44592d4a91064be3da462c571e13fab722aa5d9516c41d215b9a381faaef0e5f
SSDEEP 384:/nmVvU04jy2mdP6WxXByiQy1lm3W0KlGou/W2B9wv5iMOtLbnO2b:fAvX4jy2SP6WxxjhmuGoeW2B9wv6bnOG
TLSH
T1E882D1539CB2628EEFD09404FCB02B6E6B45CDAB700177ABB7D1426811C6187F2796B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000bb

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000bb
Size 17KB
SHA256 17bd64c4f43d604309e87d916f9233115180c0dc0cb5a94cdda36a2add279da6
MD5 64c1bca1e5194269bb0d451eab354a00
SHA1 42a610220f8d89348e0b21e928521bdb681e7431
SHA512 fe3615a09e7e83f01412f62e2b9d6c446d238efe59cc48edde5d50729f1ff700d9772fdaf0e64ef180c068dace00abcd2e284a2effd14db90b44a18fda9a870d
SSDEEP 384:T7ua+M7O7xk0Ib68GKHk6hZ/IwuXClM3lz0EXw8OHI2D7PwwjmTT:T7uxkZb3k3elM3p0Er2PIwmTT
TLSH
T16582C0C04F7AA46E28DB99B9C436CAFC716B8553721E19A1C07B0EDCCB050B29F975C2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000bf

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000bf
Size 16KB
SHA256 b17b23990851346a40d733da642788136fcc9913a5e690865be124637f16bf66
MD5 e97f51ffddb5102e601f568bebbe6656
SHA1 80b1ed86320c70b9a17f9d5981a132b9a4a6afeb
SHA512 0561e3a1f680d2cf8fa0d19282359588fbdb3a508831810aa5059d6b7b072c840b06323d4ce4c66464ab016fdca47bea6eedbd765acf8c6a503ff2edf91d5fb8
SSDEEP 384:PUsJMhkvuJpDKSNflVDtakrzt2ro/zvllLMZ3u:8bz7Y0ztmez3LWe
TLSH
T12872D0A96EF500237B2B8CEE15D083948E847AF36D6B7DF642883067849C6A17D1858F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000c4

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000c4
Size 19KB
SHA256 27b38334127d248f760ded14a3441b6ce3972eb110f73e50e1ae76dd16b73861
MD5 6a63dd3b4bdd8e27df920cbb7df0142b
SHA1 888febdc97e6e27e637e14b0017ce8c3c1b2ea09
SHA512 d691a06e50557c66496178460c13628b215b0616759788a8386c2bbec15d6be681104db6616a0840aa4941bfbb297d6cc345724957cba12752e1c2db675a8603
SSDEEP 384:dWANsy+GeX7PyAJGEXH5K5ldwQ88WAtM99LrUIra4dPTPxfNcUpxvRKY:dLNsdGeXbjJGEXH5K7di89tMXLrjaaLD
TLSH
T12192D128BC2F1F4A57A2B2A1EB2C51825CDB9853A9D5502CCD8E25C3706F1A46B47DF3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000c6

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000c6
Size 67KB
SHA256 f6b44ca7ed1b4ff6f87e7f1bb0cde6f132c7230b383963cb57df96d41cbdd895
MD5 9d4942caa48c44a0512bec2476823011
SHA1 b2f0afbafe7a1ff11fa773b978a0609abbeeac4e
SHA512 941356463e7adea494c9656087b58a7c90912a21e3c6ea50be187f6c3bd13cff6cdbbba846db46e31afd50c227820f34511ff323b9af4baf3817da7322ad54bb
SSDEEP 1536:Z7QWbSEOI3TWrDyO4MOkXbPqjtu6r8g4DEmiZ8096Ktryxr:NQ4OIjyDdTfyGyAF
TLSH
T14E63021CCE667DE0E8292906BAD7B8A0FDD8A8423B2C90D26F359F7DFCD9110515F820
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000c8

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000c8
Size 36KB
SHA256 86db6cd44df49977d457fff75bda1a63a31377dbb352e1c844fff5a062333840
MD5 761800cc7b13806703719d9761d3a64d
SHA1 cb6a0b530323ea43db8ac9ea9c6f14aa5209801b
SHA512 5ecd0dca6bb8fbc76245b6c606e8c9c3ff3cbea1e2cebd6e179f88eafeb084219657be14737425f40f0a691df55e46c0e771617ed5886a1352e1f49e8515c4eb
SSDEEP 768:fOQt/KvYIIAZ3kg6FXtDT9SSO7q4KpCLXk73ON/iN9xquWqhx+/w/:fv/KAfAZUg6HTkS6o3OK9xquVhxCS
TLSH
T148F201D9F348F6B92801E43BC5CE0B65F222CD8C51D9990E23774CB48896EC9E4E6277
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000d0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000d0
Size 62KB
SHA256 df670e09f278fea1d0684afdcd0392a83d7041585ba5996f7b527974d7d98ec3
MD5 c813a1b87f1651d642cdcad5fca7a7d8
SHA1 0e6628997674a7dfbeb321b59a6e829d0c2f4478
SHA512 af0d024ba1faafbd6f950c67977ed126827180a47cea9758ee51a95d13436f753eb5a7aa12a9090048a70328f6e779634c612aebde89b06740ffd770751e1c5b
SSDEEP 1536:Q9pfnSa+E9Az52gNbkYtUtqvUhZRHuLdrx07LXz:uhnSpE9A1EY6tBPix07Lj
TLSH
T1695301D4670EE2A579F2CF23BF59C5C00803162D8E11AA68FFA063878D8430BA793D1D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000d1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000d1
Size 68KB
SHA256 90e39936fa4a20f0fcdafc8ce17bd53e662b5ac7fe4c810b28ed5356b9da6d02
MD5 8b512e3b59cb89f3f306e9e69f799ab1
SHA1 e0a1c29cf12aa60249c80da1600a2d7778984788
SHA512 d5b39e2618e5cfcde62a34552aa24def071b21cea9913296d33edafc7fb024426ebc8e92550b40f0bb3231c8ddb2945538a7e6c0d4f308c7cdac7d5e53745b87
SSDEEP 1536:phILhlQU1HUf76Z+AGYguWv0KxwhT30N7Xw1RJiuwPy+R3zP5:p6Lhl/1HX9GjuW8KxwhYRXw1z+55
TLSH
T1FC6302008F370176B188A8D9FD49E3B6CAAF58E0914BF595020B188F7F5F8D1A55D2BB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000d2

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000d2
Size 19KB
SHA256 c1334e604dbbffdf38e9e2f359938569afe25f7150d1c39c293469c1ee4f7b6f
MD5 2e86a72f4e82614cd4842950d2e0a716
SHA1 d7b4ee0c9af735d098bff474632fc2c0113e0b9c
SHA512 7a5fd3e3e89c5f8afca33b2d02e5440934e5186b9fa6367436e8d20ad42b211579225e73e3a685e5e763fa3f907fc4632b9425e8bd6d6f07c5c986b6556d47b1
SSDEEP 384:eV4Eqc1qgk/XDVGi8m7JEM9TUKPqivdjfommfP974oNF38:eV9qlxhVEM9UKPpMV74kFM
TLSH
T1D692D043765579E9AF1280C82397E6A4EAAD9A88D6C0FD0950F56CBECF708D32261825
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000d3

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000d3
Size 38KB
SHA256 4392ddde86f22a921269feaf788a13509946046047df6926017041ff33d0293e
MD5 04bd0131c5ce154413f71d20017679e6
SHA1 a83459180dca62eb56edee213409f83e12fa6172
SHA512 5818141afbbc45553e72fc106699d9357437f1c2751751dab4f51ad7127e92a6ff85fb67905073addfdec5dd581c8c22ffc8dd6b85919d6a1d72550ebda5376c
SSDEEP 768:hrGgBfBZrOcgLWz/irLn2nTXzHXP0JsdgCQL1/UAv73nWEjvvuUwp5:hrGA51OQ2naXzP0Jsdns73WEaz
TLSH
T1170302AD7D526331E7FB684CC972AA1340C424498063CB1FBEFF098E9D44A4FE056A23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000d4

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000d4
Size 65KB
SHA256 f12de7e272171cda36389813df4ba68eb2b8b23c58e515391614284e7b03c4d4
MD5 56d57bc655526551f217536f19195495
SHA1 28b430886d1220855a805d78dc5d6414aeee6995
SHA512 7814c60dc377e400bbbcc2000e48b617e577a21045a0f5c79af163faa0087c6203d9f667e531bbb049c9bd8fb296678e6a5cdcad149498d7f22ffa11236b51cb
SSDEEP 1536:654NcGosP0w+UcGoanS2RR/QwNdIvEsgXn:6iRsw+UkC5QdEfXn
TLSH
T1055302E4123CA75C49FC43EA5434D635BA4B31ADABD4102FB69BC4258F6EA824447CFB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 12KB
SHA256 f9260463b59ec74f7dd451a38efc6d1ec1acfd95f7999ee5e50459e6414304dc
MD5 b12694fe9f04dbe0be6e1b98a1b4692c
SHA1 5d9e5ab2795d7dcc602102dbd568bad74dfa3733
SHA512 9592363c2c3809c1b669f6066b5fa9e55afc6807f99ac0933a36dd7548eb628e59f0c4ead5f77cd2f736c10dac43e5bf759fa98ce442b9064af8c7348e9a3b40
SSDEEP 192:UClIAIc8mSk/+JydKJGZYI84PpoU7ctdT5El3KNf7pm:UClIAkmV+JVGQM78i3sTw
TLSH
T197426F34F78249E7EF611EBA62C1D64C33F670D4F8936E8E500555B828463E581BACD8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 10KB
SHA256 e72bf859c9e3d3b527e45356791a733d5885c3c0cff6ad6eb9cf994570d553cb
MD5 92fa8879eada7ac544b5bfa87b7b0847
SHA1 dde6a4ccbfbd99945c1535b84f5280297af17cbd
SHA512 98b78a1acade1716c9856ccda81d83524429a6baa5123d74ac1e294a58e64cffd383f5ab409a2a7c42acdfc384b356b0e1faf43d1f5779f886c56f3f1c449d1f
SSDEEP 192:VeJlIRYmEhtjXHG+J8qVuG+BmuRtET7T/:AJlnmytLGibA+vz
TLSH
T1D522EA74E39606C7DF156DBA66D1C94833F8A0D4F8E32F9A810555BC24873E682FACD8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 3f83104d2a004de96f9a2ba0d5353aded72139848b98cea7cbdf8112640f1c1f
MD5 b484de226d3190d55b06f4742edfee0c
SHA1 3bc9fb114270f1279e865e2e3cd1ac4a66b3c54e
SHA512 715a30fd766df9e0c753d87d3e58f4dfcfe571e7ded0f2008a1fd660d7274228c9aea8b0a54bca8ac084ea2dda31f3ea9b3e579fcac70c58b4a4a2d7e573ad50
TLSH
T182811A38715612D8EB6686BD73D1D24032F0A5E8F8931E46914B59BC3A0A7D143FF8E9
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58d08a.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58d08a.TMP
Size 3KB
SHA256 2e2f163e1222ac7aa51cfe3c8eec2988aaf6882117848dee094a0bb0a3237c15
MD5 7a55dd547f6fe4dc4859c921be6a17f0
SHA1 446596ba5e4e4f705ec228028cfe97ccc35fc6c4
SHA512 c827870952a69d3dbaf359cea82a7f734b8789d70e06e6363ece7f709510774c892eb1dfbb9fd9a6311fc953efacdba400d5c6c0cb903f4205cb283f85532ab1
TLSH
T1C1811A38719612D8EB6686BD73D1D24032F0E5E9F8931E06918B59BC3A0A7D143FB4E9
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000001.dbtmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_ntp.msn.com_0.indexeddb.leveldb\000001.dbtmp
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_ntp.msn.com_0.indexeddb.leveldb\000003.log
Size 21KB
SHA256 77e6259a85824df28d8ead0e3eac399bc344bb480379180603c1952bb9d317c8
MD5 ae447951d37690dd9333fb64b16b6bca
SHA1 cdc1f6d1d45d32afe024c39590c732c84011b8f1
SHA512 5586c82ea8b414fe32b9e28a07563abcf0c6b34ff51428ee24e445b370cd9772596cfd75927488859bf6e48cb5a9942a7e43383d502a65c5ffb21629b24be7d0
SSDEEP 384:fBuCHltFo6+yLyyJvm3l0kVJ+vDzD+54MOI8cBSkM3MAMj1ImxYIYIRIhIbIhIe7:JuCHrFo6+yLyyJvm3GkVJ+vDzD+54MOJ
TLSH
T128A28656B5F95509F27B9FBAE8B21BA14C7ABE552D00DC1D58A0324E4C71F408E33F2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_ntp.msn.com_0.indexeddb.leveldb\LOG
Size 345B
SHA256 a6d7a02bc45d791c9be6ea1f9ee4c337d5279bb44758037fd649629989892e3d
MD5 9c800b79273ad87ebfe2311832b62d08
SHA1 441e1d744c56b49d9e8f3e6089a1561f1ba0000c
SHA512 bbb234256d7fe7773942b3f73cc442a3106101a69ff9c1a56bfbf9e812ff912213d99e7b5b0a42cbe33b4cf4c678369395980db286d5307e28f9f8ef29c9c2d0
TLSH
T13BE0687C88C8C12FA18411D20024BB0EC5A7620EE788AE460E8DDC10B483544B82D141
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_ntp.msn.com_0.indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 7b961f5d3ebc9f1933ee35b9c4e87c7bc388a252f356304eec1119d0c6f278c9
MD5 6b3601bc95e8a2b6fe923aa872cfae31
SHA1 f22323ab5376fb7598e10f1971df4a4b6fd29246
SHA512 afbc8c220914ecf35aedf70fabe153f5b80e414e87a40d4f14ea271df8b276d06fbbd174a70b39282792c12d2351f1a15ebd1bfaf18ac9ac6cab0243d7bec5bf
TLSH
T190518DB3C3E4896DCD5156F0AA247E1BCE1D091583283D1EC9E4EF9BA3E2474E11194F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 6KB
SHA256 82f1e654c1e562f46a155a3f3c96aef2913660c3f5b61cc0ed013539f2be8e16
MD5 d9452668a35ec379a0b3cad72acf1e64
SHA1 2b4df90296ed7ce8ec467a532f22c215280768b9
SHA512 0ec9fb7568f8a7d2b6b96c96cb51bbc307f168fc72f4198a879d5d3f157f31ed310ec512c99ec96d02701daac22ef8c8af026218dafb6d134ba21d401c1f2e9c
SSDEEP 192:DkeEXqgvHUgmb9oby1kj6Vfjc5S2gmTvfWGmT/mDmXmDtiBmzmIx:DkeEXqgvHUgmb9oby1kGVfjc5S2gmTvr
TLSH
T138E1AAF383E5862DDD1155F0AA18AE1BCE1D0512836C3C6A89E4AF4BA3F2471E151B9F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 14KB
SHA256 b35b02da6bddfdc4d7b552359a55856e826cf1d77523498c4ad675909d166358
MD5 da73a0b9eb2914c6c653996c5ad2e2c7
SHA1 189164aed1ce0d45e2b202debbd851dd0ab0f416
SHA512 b1de18d6fe6382eebfb5e6f52b952aa87e069317389ad41964a4c24d815d7bc582d38800647bcd14eb8ded8c262f655166e819c543bda065e71abc8fb11a70fa
SSDEEP 384:DWABIqgvHUgmQrWtuuczU6JMJ3H9h871GVmrmBmDmXmDIfmgmjt57Hi0GtFCE48w:lWS/kqQiWdJU6HWJw/OET1
TLSH
T1BE628CF7C3E4862DCC6156F49B257F1FCE1D0918432C3E6A89D9AE4B93E2871E21164E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 211B
SHA256 47068d9fc7b564ba1243574122bedcefb9e44a61793874fa9a97f357900a2de1
MD5 684f4c198184ae89ad3fb2ce5f9330aa
SHA1 171d0bd972a576ac629c83814650c0eba4e49fa1
SHA512 42227b0039244b291916daff79c524b22e595021b741385efde04b208176a7ed05fc4f7a7696f2c8bfb4748e112abaeb549e3dcd6fa1ec5ff320f214f247b186
TLSH
T126D0226B1340B0B5A56D7E8A48BBEC8FCB2660220A03EDE612D499DC553686C151BA46
MD5 SHA1 SHA512 TLSH

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 211B
SHA256 e1f60c024f1455f62e9fcf4928ec5ce44d32f67d1082eccbfceb2f0de859c991
MD5 32aea0b1f4bac46c007abf6205ad8ebd
SHA1 f2dc1bb9942655d13c5bad5840e3233839f41e79
SHA512 8e7e940cffdfac3c3d541cb80f2b4acefb5f8e80557353f2fdc20a7e2b3a29197490855a6e6bb3b3c0bed3051641c9aea781fc65a204ae772611660e5052f1c0
TLSH
T11BD02377234070B4555D3DA744BBECCEC725602145039DD511D059DC553645C1517145
MD5 SHA1 SHA512 TLSH

Submit Download

Sdch Dictionaries~RFe5c0f3a.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries~RFe5c0f3a.TMP
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 0493e3ad244fddbc06d926f88bdfa139aa1b7bbdc6d6d855715784a4d846443a
MD5 5772a4a6699ef7ad8986963ae2a37ac1
SHA1 d37d46de0e91ebdb66f728d7bad3462c591a984b
SHA512 be69a2a8dd40b3531f552aa89d5cc1559e78471389142105ddcad5b0b02dee16e593c45ebffbc8fd59fd0b20560a7e429f5abb6bebeaaadf592ecf6ff8c32ee8
SSDEEP 192:sxZkR+yM/jK1Ml8M9V/fgsfsUvMG0IdpQloHW6+WNnzYXYz3oBVmIg5zJ:sxZkI1V/fgsfsUvMEVHbsXLej
TLSH
T13F52C856AA345977CCDBD20DFA45BB93D6F5147292900E48AAFCCA0C04E7BDD221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 18KB
SHA256 b4870eb7e6ad83e2a881f8cbcde169ac6b8bc92ebefb1da6d88b44725b76aef2
MD5 b0f6fd3dc61c459744d1d20a272de237
SHA1 50052786251462eca496f90478edacf3f442fbf9
SHA512 788209f78525cb17ea1b537fc02ef256152984b5174bef7d9f16cc2dd741e59d137809e256b10dbc6fbd4d36c52010e66987b331626d93893119abc253e72e40
SSDEEP 384:sxZiIqNm4V/fgsfsUv5fBMzS7HbgkF/NecBk:sqPNm4V/fr55flHbPvk
TLSH
T17A82B752A6248977CDD7D619F9217FA3D6F51463CA500E4CAAFCCA0C04E66ED2613C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 35KB
SHA256 d9a42f1e320b16bbde2acfc2c22893328fc4fb08b28019e96a49e706ff73fc55
MD5 7bbe56c568b0b8a96da5e8fe7a109ee1
SHA1 b9b630ef6d0d298cbfacdd4e515e74ca9ddeb286
SHA512 237f20ccb5115722a89ef93d43d515c38974d2d9389d4ab715986a21a2cc4eae6f84e3be84782058065210a45a4f02104d33e1c1308b24aeb56ccd83bb6dceb2
SSDEEP 384:sxZTnlfqNm4V/fgsfsUvQ66s8qMpRiYnazAW8pZS15posJWeT+l9+CzSXHbg98xV:sLliNm4V/fr5Q4Mnc7WeT+l9uHbByk
TLSH
T1F4F2F9429520C8779AC39D19B93D7F73DAAC10539A84CEDE5AECCA0C009E5FD6B07867
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 adea46b4bdeb4f9af9f66e6588eba47b0365d662368f0a6eff33c672739514e4
MD5 250d3b9783bdec10adb226acadaa338b
SHA1 c8fc6f4e8afd024fa9bee945b20be5847eca5241
SHA512 43b22959fb909ceda06a5bae2f8742f95a0fb092121478b11412023eeed88db24588b3a677820f9e798a36aed7fd9881aacb69e534b7d915ed0933d278d74fc7
SSDEEP 192:sxZkR+yM/jK1Ml8UQS9V/fgsfsUv5G0Idp6loHW6+WNnzYXYzYnBVmIg5BJ:sxZkIqkV/fgsfsUv5E/HbsXReV
TLSH
T10C52B756AA345977CCDBD20DFA55BB93D6F5147392900E48AAFCCA0C04E7ADD221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 19KB
SHA256 cce356b3b2eedb31a2b74f241b93a8e57de23541bb9ba10f6eb239d3ee884bb7
MD5 e1db1df603a6b8cfdeae0b9458b0d6e0
SHA1 3b9a9979d9ee123df4c8bb54019b863130153312
SHA512 81ccbec3bcc1c084fe1e86391751aaa4244027e8121bbc0f078462e6b2817e8c2c13ec8d300c8af57617d6879e093fec0c192a6a372077e192b7984a8757dd02
SSDEEP 384:sxZTnOIqj2m4V/fgsfsUv5e+MzShHbg98F/6eiBk:sLOPCm4V/fr55eqHbBGk
TLSH
T10992C65265248977CDD7D619FD217FA3D6F91463CA904E4CEAFCCA0C00E66ED261382B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 32d46db706a1781165667f59dc2cc20cb327a571686bb61f1a4a42c6c4e1f5ba
MD5 a81c86d3e31cc629a1c7289561a3c022
SHA1 e5eb3825ed7f46ff48bb22e3dee2b7832dc5f8cf
SHA512 d99b3dcaa2286ca2d7a0d46b6b2d92417bce0940a73de12f609250f7e3310f6a479af5046f59c9a8b8804953435459c4cd83cccb330c84140e8db46fa2508311
SSDEEP 192:sxZkR+yM/jK1Ml8MkV/fgsfsUvMG0IdpQloHW6+WNnJe/YzVoBVmIgrJ:sxZkIMV/fgsfsUvMEVHbc/Ne9
TLSH
T10A52D956AA345977CCCBD20DFA55BB93D6F5146292940E48AAFCCA0C04E7BED220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 34KB
SHA256 acf96db463c7e56f456acf1dd9d4b8195e6cd16f584ab4afe4d4c30c1d064f57
MD5 8ff59e65af2615b55f6057def1d935a5
SHA1 92ebf9b361ccca44bdd8fa3fb0785876467a93dd
SHA512 82c35920166f95cb3acfcbf82a0a0972c084eea2c88b58abd04acb4d3e9eaecb0a6c9e7e5502ca56107022332e9baaf2c463284f3acdf15be3b49a29aa6c806a
SSDEEP 384:sxZTnOfqNm4V/fgsfsUvQ66s8qMpRiYnazAW8pZS15posJWeT+l0+CzSTHbg98Fg:sLOiNm4V/fr5Q4Mnc7WeT+l0UHb1jk
TLSH
T114F2F842A520C8779AC39D19B83D7F73DAAC10539A85CEDD5AECCA0C009E5FD6B07867
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 80ceaa52d958332e86949c39e2689ab814c8fd00b605ed3703e899c6da257c7d
MD5 047324344f86c8b41bcaf82584b4b6f3
SHA1 74a48b9026c1d7e150dcf1b9900ac5c528ef95a9
SHA512 e0ecf920d9bfa961b86be504d89d7822154d7c8e44e26fcb76e82ab1c09a582abcfa1a3c4a5bbe8a9ecde62517854fe229f1d6306fc49aee17a6033048b6b031
SSDEEP 768:0nW7kf0Wvqida8F1+UoAYDCx9Tuqh0VfUC9xbog/OVX5LlWYSj7roIYimYg:0nW7kf0Wvqidau1jaa5LA3jIsg
TLSH
T1C7D2FB3B680CCB7E4F841E5CEC266F966ED801CB67988D5487FA884C03CB6EA51175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\035db77d-7d10-4dd6-b1cd-bde9906a170f\index-dir\the-real-index
Size 72B
SHA256 dc9ca3db7e0236e94cedaec5845a9bfbae89a490d48f24024c905588d08f4290
MD5 94018aea9e525677de687707688148b6
SHA1 c2323cb209b1af828a9fa0bb05e625f28dd581e8
SHA512 16d0c1c6714e85febdc0cd5258d86ca5405aac1eed3afd92c21a4afe1dadbd3f19e70596de85047c132f6414b17526adc403a93c225873b289598dcae78fc851
TLSH
T167A0029045C94986FC008F751FE322C866144E28110B07119691E0749A506C0C153600
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5d27ce.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\035db77d-7d10-4dd6-b1cd-bde9906a170f\index-dir\the-real-index~RFe5d27ce.TMP
Size 48B
SHA256 3221d5ff393c7b5a0d3089279c895a00573739cb868aaaabe4e19cf2013b845a
MD5 398329321adc0723112a094cdf923d66
SHA1 899fc9c9a0011fb20f76c9b195a2fe684691dc71
SHA512 19ed6f48f01f096a30137cff1113c4c1f79cbe058439ecbeab5d41c0896b66b2066c8a5e4c39416ede6c5ffefde0ae06269796833feb6639f294c8ac36a9b8dd
MD5 SHA1 SHA512

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\4520dadc-db5b-4f2e-9026-0b551f142464\index-dir\temp-index
Size 2KB
SHA256 49d5dec58b90fe04d58f9913b1e6795ee3aafe7c9f61e92b6a9807fae1370f1d
MD5 c31fe73876b0f09b50b1c1624ff848d1
SHA1 3d2b12a62cc0656ef7b1b65f83143f1dab638327
SHA512 a5d60d17761ad7adf2b5b3d073c9e15499b78487d935cd39764d7832bac7ac448885d866709e43df1a278ef9ba470da675109294fae6c1b0d19194424b887da2
TLSH
T17651B84E8D8B7A56CC6C61F275BB18C3373924FE4A898F0B54AC9D3578C32381969658
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\4520dadc-db5b-4f2e-9026-0b551f142464\index-dir\the-real-index
Size 1KB
SHA256 87d813fe9803682ff7710119b6e0733d8cd67392ae4dd2d7a93f380eebb436cb
MD5 c8a971beb366cd6bf5d943cc880f1b81
SHA1 a0c134819da0a23e5cb04458f2fa473c51fdcdbb
SHA512 f40db75e79fd2af1b6b0782d4b3435e25d85b64b90d887395c48b5c2643ffe4902b54c5f36f1d128a389b35c7ba3ac6970ffe8a770f1b09a79f7f05a81c88978
TLSH
T10D2161484EE08A2FE9A841B215B7A8E47370D8CD8721B3A35C2C36302E273493A4B1CC
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5bbef7.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\4520dadc-db5b-4f2e-9026-0b551f142464\index-dir\the-real-index~RFe5bbef7.TMP
Size 1KB
SHA256 c87904b0191301d74fff9e290ec87146093c228b0d89d88857dc0583aa85c03f
MD5 44216962f152a038f3aff88d20ef19cc
SHA1 960505da4f60b92f7ff6eda416faccca0bc4dcb6
SHA512 0801bbb652f0a24795ca40aa973d18406d56221020eab5e1ad62a44c90e8ca39a023a788413d98523618582a0a46e58d80ebdbfee2a286400c16617f9bc7c261
TLSH
T12521449946E18E4BFDC4517B1A53B8F4B3308D009322B3D3693C26799D36B8E1A5B0C9
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\d841de8d-c56b-44d4-bb04-c5df20c573ba\index-dir\the-real-index
Size 72B
SHA256 ca167701a3fc370a50d5a5e861a72f8e4d294b08ad9d8ce8c70ac0dbf42e1857
MD5 b4d6e5ad698bf04df3cb967aba1aca84
SHA1 d8d5aa91d9fd2f0cd60a179391dadadf5e7d4ea7
SHA512 47acbfab11ceeac60116e04e7018d246db1a6b9dc32d530bca545c71315746bc04bc117fd916ff1d17734100232fbaa456d9c6884411dbfa1996b0dd1f728398
TLSH
T1A3A0023601E80849E7050AF0514357517316DC1E0745930981A0C46788612684D62045
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\dc577b94-5e5d-41ae-97a8-afa364edec75\index-dir\the-real-index
Size 72B
SHA256 829873f6dd4c22b9b183dc1f734962d84ce60fc74198cfb190c346c8607bc00d
MD5 2bc8f2720bee94ea752844341ab40af3
SHA1 f2a9d8694a58dc8fbddc374a15095d4a3a986175
SHA512 784621ca0266cd92a24b4f241f3f97f69c806a2aec4cabda706073c5abf50763b3d7816fbb425d6295801fe111676c05021cbf0d71a39078fb6d55f704581508
TLSH
T114A0021047859515C01B15B19E521A593340C8D121012307509E4144EC50A805DC110E
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\dc577b94-5e5d-41ae-97a8-afa364edec75\index-dir\the-real-index
Size 72B
SHA256 70401d35afbc55c52abdeb595b7554f740f75098c7abeb9bc1c0e52c61fe1400
MD5 9675c611440092abfd25cfed5d1da95a
SHA1 1dc3e29d9c0e6a3743b09a07b40d381461c376e2
SHA512 4bf9ed267c0d89a92a22ec91ca0a8a5d325ddedadfa44a6ba83f61a9328c5cbc067f95cb0a5741c01b5496dc5db029537801e379a65dced0ad650324dbfab5bb
TLSH
T1A2A002180384B501D54617F239F6017166514AA04215A76D5194005EDCD0746565504C
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 2fb0dc979f3b714fb693b4df9573ec49508e6605d11f02970212e1ecc75a5249
MD5 c7ae680262d5721d3ac2d0fba922a3c9
SHA1 f81d50231a83cc5f5407eacfc4bbd54fde302862
SHA512 dd5eb733b92ae14bd04650fd6cffa05572f16d17ee3f7cf88143b6acd9e576d9ae718b3ad13f378bc60fce4792ca987bdb4f4ecaaa06b41b5b9599aa96c5140a
TLSH
T1C0E068BB2DFB1C20AC6F97C538B054A081853818D504EC0E3067A28730F23652406C25
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 481B
SHA256 9c402b8932317dee70f9fb5aa8a1f19370997b504fc367592b7dc3f3fa12ebe4
MD5 ba8f988a14c872d4e782c574f60a18bc
SHA1 d58e901a76626f75762a5e5a9ec2b4e0f6316f35
SHA512 c091ef2919746aace6bd453aa251c930d7b30f4dc6ba8519353bde82342de06955cf22f31c3f4fc156c1d9e4d236fd7085d589ca9a437a2a33e6cb4fae3f5ea2
TLSH
T159F027B73FFB1824BC6F97D6247064B445493C589805EC0E2027B697B0B232A240EC72
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 476B
SHA256 5fe3f1adf4e9da982d66ace0df03ae7eeeb8c10bb5ed8b0bd2682f997a657ac0
MD5 38b58c37a614d318ff84203e1da8f0bb
SHA1 80e39eafde376618206cff950eac15518fe55ea7
SHA512 9d1e18d392436d0239a5d9fe12a07a6c1c1d901dcba6c3b9a37968f81a8ecc83991892328b60e60dbe618f4055e06366463d4917e07ae281c87753d873dfcd17
TLSH
T123F027B72FFB1824BC7FD7D524716474414A3C589814EC4E2027B69760B2329240AC72
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 48c063739c1c2acd1963fc66a43819c44cf5cde9ec4442d4fd66b33167c9d023
MD5 b615de0824e8233f54141c75fc23d952
SHA1 47832116216ec530e2f841fb0d49e4778869fd15
SHA512 2747caf01f277ffec968e8dda8ca295f0e424a428e70e292950ad1c99dd9d29d1cd693d90528a2cae0e1e3f5364906a3c3d392ceb7437328ee3450518ae0271e
TLSH
T178A00211C965D07DC81106F590A10185279089ED4609771264AD10DC8D5498259F26B6
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5c1f28.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5c1f28.TMP
Size 48B
SHA256 6af42e62cc54d2b0ff2e470a951d8564515a4ad99897c6af4b8abc99a1d46749
MD5 ff11f151efa75675da29624d31d22ca5
SHA1 8f1d08eb49420aeaf7b5f56bda4195f0c2b90df4
SHA512 86a90b170b38055757c2edc45f9d7b687e309aa25b83b8cbf06633f530b37df5d8dd8bec25302e3e828daf523a67e23d24d0d2427ae4d0ca615d94c790697c19
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 f8a3e324b83d1b272f26f0089d883cb68a2e0664095018485f158d6d2b861f02
MD5 196ab2e319a2199db024c939d712a66a
SHA1 36c2d7af6cb57479dd3afeca56f8d84118c00a1f
SHA512 bb4f363823ae3e428f98b01245aeac82095624f0bef28b0476ea67014a01f81cf6003597899e84f4c17e5ebb418fc6dcd49a00519fe71dbac6cebcf676939411
SSDEEP 48:KfSVOyIQA2aQL9IZy2KYTrGIvKLS0ny15IdKagYny15IZKk:KIbCKcrGgKLSuu52KagaG5KKk
TLSH
T1EC914E11307B465239BE29099295E626DF8271E37468E97F3BB800620F66E129DFDCCD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\3\CacheStorage\index.txt
Size 78B
SHA256 136df9591bb17177e010ed1b3b4adc768c34a88b7e7066d8f36efc940b6f078c
MD5 a005b4cce74683d4880071e59e28badf
SHA1 126408f680beca9d6233172a48de211a42f181e8
SHA512 b2764c29730088a8d781fe4d58fb7cc84e48780500fa6cb1c67ce8d5b729c3fb45ea4a49cfb9ebbfe85b51f7dcd6ac9334addfe6d8c3c4cdd9f7bb1e44c93bc3
TLSH
T105A001F72808819B1AA0A8E82025B22EE41B968C8CC4DEF4840895522168E260002960
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\3\CacheStorage\index.txt
Size 159B
SHA256 9f772ea9620c56a8d71750ebbe702cc034df83afa22a594c158203972ec02cf6
MD5 3615551d3ff5cfddaaa462be1740d7cf
SHA1 bb73cd2e98b04859b74ad84943675357d8918bd7
SHA512 daf6040c825fb46ed9bc99dfb743a28716eb5567f1e0507c1d41b52668c57dc92afed6c13eadd090abee8b72f9fe608283691dbfaddf4de2999d770cc0dc7b16
TLSH
T168C08CE32A208A530BB0A5C46020735DD13B4D0D4CC0DDF4880970032074E624001B34
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\3\CacheStorage\index.txt
Size 152B
SHA256 86b1dd33eb8b529fc80c2e315b655f6e19e895199f001d08cc3a8ea34a969efa
MD5 f026126816e9042c9d66f72a9feaec92
SHA1 ed3332e6d4037b073a0d18f241ace82bcbf3f558
SHA512 8d4e6a83fa8ec73d495544864089b97c64d28260fde092c2ccdb1b3a38e139749686f53e867b4ca0975a27e3cc66c34dbbf0457c9917d1f83fd69814570294d9
TLSH
T106C09BE32A34C9570FF0EBD87414776DD52B464D4CC4DDF4980871076474E624412E35
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe5d79c6.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\3\CacheStorage\index.txt~RFe5d79c6.TMP
Size 162B
SHA256 0726c1581c61f8efcef7c8d66ba71a4ad45449b9fd5466e0f38d6b350a7949fc
MD5 34f849ab00f04918a3b68f65d178c42c
SHA1 56b2ab96114f3aed38eb146836c604dd73162164
SHA512 903122b8ad9957e0bc2cddf9f57fe5a78f1761449406d4e33c3f26a790b902b43380bafd163e20eaaf2decb4484ad731380e2fdc8c8ab47268f7d6cc4c946abf
TLSH
T168C08CA3893162465660E5E86830722DE46B9D8C8CCAAEB8C808B49230F8A129002960
MD5 SHA1 SHA512 TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe596b24.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe596b24.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 3e24126e60986f44d07d8785084533536ee8e61e8342a7256d562529037111a4
MD5 80a240c2ac834b5922d5ebbaebedcd78
SHA1 1c54507c05e0bc541f1d90336c88d99b7766d82c
SHA512 9aacf77df7823341781a54f7cf586fe1f455af6836f85d3b791180d0a1f76729db93cdbae09fafe7c6e8837879cae91f84ccb0fb6868f32e00d45b654d7294e2
SSDEEP 384:2iFL4htNn/s3n9S4isNT8TUNTUlIR0T/8vpbSTcoDFDSXOObjI9G6w7A:dFL4hj+9yOwgdvp8BEX29MA
TLSH
T132D23AF658D7893AD9AE8747B37D2E035EBCC1A7B1845A44B7C85A0CCC971BFC206905
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 057eec6b80ef2f7ed22ad8b3afce9fbfd8ae836a0a82d5cd34b564234fdac435
MD5 8ce612b9a9ccd26cde28778d3a7606f1
SHA1 f3a71f99d56b8af2fa824997c85452f00dfbc780
SHA512 3bb6d23a598c1454ab9b388652f377cb152ed17e12baa0869a28ab4054e4b6367d5578929f9f80221f100933ca4ef1eb26fa9a25f85d461a1099c16afaaa69fc
SSDEEP 192:uILsNjzQF8vfBbykQmiU1i3/4aGBPKulCx9FLvGhdNzqVeU8:zsNjzi8vpbnSwoDFD4XU8
TLSH
T118321976BC789C3B5DA2A254F48633036FA45167E7846F44FADC6B0C01DB69C230A51A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 7e142a5b770f7d750032706d1968d9fa7c6e3b47a3563b2645b487e72a0e7cf8
MD5 f521f510495ee89535701272d5ae38b4
SHA1 bdc9b92daebbc27f81f34ce734ead77a1f093307
SHA512 9daed58eb0770b689f2c3137787d5f7c65c2ae2293888f5520744ae8a954dbb26edeef7572ec03663c02f9d03f8f3175df97d2ac8e1051dfe94d06cfceab16cc
SSDEEP 384:2iFptNn/s3n9S4GsNT8TUNTUlIR0T/8vpbcTcoDFDXXOObjI9G6w7A:dFpj+9WOwgdvpuB9X29MA
TLSH
T1A9D23AF658D7893AD9AE8747B37D2E035EBCC1A7B1845A44B7C86A0CCC971BFC206905
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 740dcb43574f7736bc341bd553a630db264586d2246e838efb2282a98b4a7a18
MD5 5d67a9638a11eec930b6f56d419151f6
SHA1 cc4e8ad1d842630feda8c0da93870852961b82de
SHA512 6c340620e9a2caf08e56518bb55610e2cc131d7e7bc50c5260dfb4b1e6664470c3a6d6db3feb36d4b16e25bf0d890aefa0c3b773f749b47737a6b550abb48fe3
SSDEEP 384:2iFItNn/s3n9S4HsNv8TUNTUlIRHT/8vpbfvAoDFDOqx2vOVSEuvgjUkFw9THL+O:dFIj+9XewgKvpjl8qugSgFw9Di29MA
TLSH
T18BF24AE198D74DBAD49D9BC7A37DAE062ABCC177B0444908B7E4A92DEC4B0BFC311415
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 112d5741f9dd8a594464f91b6307b2e9fdc4cef89054e880654d7aa777987067
MD5 d429984ea9ff083653c07b050fea5b8a
SHA1 4a952a86941a0d1c62570ea2aa1738e6e06c1202
SHA512 2bfef69a207ab52f7dc210f9002869094394d6605f824852a11ad78be090392b81e8eedb22127a2e95f0b4be24971dfc651ac07b0f99aaabb88ccd1782760683
SSDEEP 384:2iFttNn/s3n9S4TsN98TUNTUlIl0i8vpbpCwoDFD7XOObjI9G6w7A:dFtj+9jMwg+vpU1lX29MA
TLSH
T10DC239F258D7893AD9AE8747B37E2E075EBCC1A7B1845A44B7C85A0CCC971BFC206905
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 7fa9b9a5cf1b6f104845ed9977ceceb094df8ee5afd094a9709eef4f3046a8b1
MD5 88195eafa3fe28e1f5c4d68b0ca67b48
SHA1 95b45272fc6817c46bd6f5e9d409d45ea93a3884
SHA512 aed0d698d9f8bde5dd4847ec2dfb59e4c0e601ec90040df54a215e1fb501b89ff2b2f7367607f195dd129352775305b7b2a6f967d8eda60301e6533f9d4d4d48
SSDEEP 192:MONH64BAQmiUyr1mW5GBPKulCx9FUaDT0U6:MONH6eAMkW7DFF4U6
TLSH
T102020B75ACB96C7B9DB2AE45F48A37176FE4117BE6945F44EAE82B1C00D724C230342B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 978993d1fed5fb5be56a51ff2e6bc5a183103ec8cdd03cbf7ccf6771165097f3
MD5 8eb9953655d0b5cae794b10864c86559
SHA1 270bfb7b4df7f1e82e286b6588f5651e485e7839
SHA512 6d22b4e9a108ac174345973fba61aa05b1dad96178333632c63c8b5c6893ceb68b5bc0fcdd6cc692b6e082f1e051b5f3b20585100d12bb45ea94c3e8cd65227d
SSDEEP 384:2iFKtNn/s3n9S4TsNT8TUNTUlIR0T/8vpblTcoDFDXXOObjI9G6w7A:dFKj+9jOwgdvpFB9X29MA
TLSH
T155D23AF658D7893AD9AE8747B37D2E035EBCC1A7B1845A44B7C86A0CCC971BFC206905
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 74b27f35c0d6b48aa77c4c3d59ed8a7654158d184cd7473e8cc1f44dc2c77b74
MD5 c1e993a99b85e99d7f0c0a11f0c737b3
SHA1 cfcded384cd864f577c766f265c721d729e2cef7
SHA512 f133e9cd5b9aa4280dd1cc9277d10e1045b87cbdff26f6fc2bfc4839a74b7951fa46dfd10c2e1612bf378453f1d1596ecb94c059e64c1f1603747f70b91c5733
SSDEEP 192:7ONG64BjQmiUyzmw5GBPKulCx9FLvGrWwzqVeU6:7ONG6eV3w7DFDyXU6
TLSH
T17C120976BCB95C3B5DA2A145F48633076FA5416BE684AB40FAEC3F1C01EB69C270741A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 108866b3d9aa9e14bc6fb4470ba0e52a020f4d88031dda9e43870c768ae4f7b4
MD5 da7f34098ab02afdb20fb37a7e78d0e6
SHA1 c159fee276415b37cb1031097aac603946230652
SHA512 e08d89b667ede12ec250b10dc2c1e573acf1b22a2aa890f29b954a661e7787cc208b467c85e4f87f591a67c3569d94979f60af23ebc4aba77b5a4ccb68c12f0b
SSDEEP 384:ztNn/s3n9SfsNjgi8vpbnSwoDFD4XOObjI9G6w7A:zj+9U1vp21GX29MA
TLSH
T18B928E36AC795E3B5DA2A254F08B37075FF491BBA3841F44EADCAF0C01DB6AC531251A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 05edc64214c2f3e03539b0df5b27e9aeed46a1649b45601375810186f601b448
MD5 9905a6b63db21e6513e11a58f6354e35
SHA1 5cee61a9f9ea4dc2ec8a2f9864609b2c29840c9d
SHA512 3d16bd146e757cc6f6f81071373d4e55c67d80c752a481bd35686b9db43d5dc7547c0fea60ef9d4ca68591f62fdfe7c49f3fe2232f807d271587d37794de2e21
SSDEEP 384:ntNn/s3n9S3sNj0i8vpbpSwoDFD4XOObjI9G6w7A:nj+9s5vpY1GX29MA
TLSH
T1D5929E36AC795E3B5DA29254F08B37075FF491BBA3881F44EADCAF0C01DB6AC531251A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 87367454f28300f6d8b440b5bf576412dd6ea697f6909a413539f34818170e2e
MD5 abd20fe80c04fb922c154b855fa3895c
SHA1 6b1b95fc7d521e07e9cbad15dad48e9658f43aa4
SHA512 f5cda6ae40be8cb78cd95ea2bbef6d8a6bd7baa23611986d6154a4ebf4a2960ccd114e7daa9ad5a94688a7ee0f30b48908a247546c939c9d976b27889d38cfe2
TLSH
T1D9E00913970115BAD46E533010D31B203BF7847023B3024A9E6012756C637A0AEB0F81
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 b655375119f2e86150bf7c2d609d35b05d9f4cd7812a5841aec0c7c2c1bb039b
MD5 199a0a98bc50dd5981d1cbb5e0894505
SHA1 438674b83078127757f2d1a8c5ba5b1b2a5c0118
SHA512 f056a2ad1af1541f1dec426356f39b77c130fba56d685888b4ec039a488e0a005795d4c07fae13865b4b077077126bbcff922defb2b89c7f69fadcfe36364908
TLSH
T12FE002039300117BD01E533000C31B203BF6C47023B3124B4E1011742C13760EEB0F42
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 be5d11dd130b6a2041e1fa68a9bff3b16c2487399a64ed35ba09e960d8433337
MD5 bbf81c9ba11355347638d8ad64a782a8
SHA1 3dcfe91e8a804010db8874a2763f3b971817bedc
SHA512 7825ff1ada6ebcce7a72173786c9f1f70446dfbf74f85bd6cb5db363bc29131ffb191aa27fdc462d9725a4d095f229068159079f5bc89398b25a64954b981d8c
TLSH
T1C5E00202D3000076D04A533000D31B003EF5C42023B3020A4A2011782C233906C70F41
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 95776520557649964c66dab8ea3a7c19401334aefaada0b33f3d369a8678b861
MD5 f20cd46146a0aedefea987433cf6efa6
SHA1 53259f03158903b7c129d7e7f9a19c7ac156bed5
SHA512 2958fa952230c488ecf34dc8ef279f7d9d2f4a308b34a5d0ac6bfe973cbfa8cff210e059bd046f8cd8efa736d22577414f223e7758b44ca79f1eda1b68839292
TLSH
T13AE00913970115FAD52E533110C32B203BF784B063B6064AAE6412796D63660AEB1F95
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 a450588de0ff5e688211b8e4eda5d4b10537aa4c01f13881426bc4c4bb338e82
MD5 ccc6b41a6fc057acd70bc557811cf174
SHA1 2af65756859e791662615f8de5f34160e450b9b7
SHA512 d327c007012e65ea1b7a546fb0e5549543b27a38cd46a2790a0c5681f498d5e78329ee389c5d99499ea48f7628fb49561fb27ce32ac075cf7c0a12904afd16fa
TLSH
T1C7E00112930115BAD45E533000D31B203BF6846023B3124B5A1011752C237A0AEB0F82
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe5be53c.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe5be53c.TMP
Size 392B
SHA256 7347e6cb260b8618f1f708961b5ea6c023f53ee140578ba2cec042a2d7801600
MD5 21bbe1cacb90cdb66b7b2bc0dc63618b
SHA1 3afe14fa73567a9b2c13f50d9552a6a331af98b5
SHA512 1af8acc19442b809a57601bfd9c220a438ba600de8f408b8aac2cadb7b0a960c376dbc6ef7083f32db560b9ccab85d5954d8a74f72719b54b8f231eba6521bed
MD5 SHA1 SHA512

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 eefd629ca755d4948383ef92cc5034ac1970dbc95487ba8551d7ae43c396d131
MD5 3fd9e46e8f9e271f9f03afc6f80eceb2
SHA1 ba08b6148934584cddcd17214863dcfe45dafb71
SHA512 8ed2c1260f745b27691bcf60f36ab862412cc70d7fcf2f6e97e0c45b608dbe8a8e215f2f2f378ef8fbb6212700111bce22f78672c2ae44e70397c12eff4d69cd
SSDEEP 3:MsEllllkEthXllkl2zEflcGs:/M/xT02zP
TLSH
T1794404047FD04507DD003430D455C3501370D41C0511D7433CD104335DC7F500C00040
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

738d6fc4-4c84-452e-bda4-79497bd352f9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\738d6fc4-4c84-452e-bda4-79497bd352f9.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 eccb55c2521eccbf8abe2b7f4b5e2e113bd1485ce19ae21ee956b7d0917ebf2e
MD5 2288c1d6223ee95ea793440e70671907
SHA1 905e2420e8fd4cccbac7b6c01d7cdc0f3710d0ad
SHA512 be1e8fdce19e289c4cb5d8df2c7790c2de43e55a22c2051f61cef10b5d6d3d820ebdb8b62e7cc757f366775b08dda7ab3e539fea9755b9a3dc46731b553965ea
TLSH
T12541275CA6F91108B3B76F5AABF6A96D443F7D372F06D05E10110E4F0622A40C961B37
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_m1z5dnfx.05f.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_m1z5dnfx.05f.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

MEMZ-Destructive.exe

Path C:\Users\Admin\Downloads\MEMZ-Destructive.exe
Size 14KB
SHA256 a3d5715a81f2fbeb5f76c88c9c21eeee87142909716472f911ff6950c790c24d
MD5 19dbec50735b5f2a72d4199c4e184960
SHA1 6fed7732f7cb6f59743795b2ab154a3676f4c822
SHA512 aa8a6bbb1ec516d5d5acf8be6863a4c6c5d754cee12b3d374c3a6acb393376806edc422f0ffb661c210e5b9485da88521e4a0956a4b7b08a5467cfaacd90591d
SSDEEP 192:sIvxdXSQeWSg9JJS/lcIEiwqZKBkDFR43xWTM3LHn8f26gyr6yfFCj3r:sMVSaSEglcIqq3agmLc+6gyWqFCj
TLSH
T180624BCFBE204417D8F0C57530659234DFBACABA1B968EDF9CF91E529AC4C072823265
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

note.txt

Path C:\note.txt
Size 218B
SHA256 8e9f20f6864c66576536c0b866c6ffdcf11397db67fe120e972e244c3c022270
MD5 afa6955439b8d516721231029fb9ca1b
SHA1 087a043cc123c0c0df2ffadcf8e71e3ac86bbae9
SHA512 5da21a31fbc4e8250dffed30f66b896bdf007ac91948140334fe36a3f010e1bac3e70a07e9f3eb9da8633189091fd5cadcabbaacd3e01da0fe7ae28a11b3dddf
TLSH
T1C3D0A719040784251C7052D17145A5A09B70562D77F626EB74DC690C212700F0B37C9A
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3280-262-0x00007FFE07FF0000-0x00007FFE08410000-memory.dmp

Download

memory/3280-246-0x000002134CD70000-0x000002134CDC1000-memory.dmp

Download

memory/3280-263-0x00007FFDE5B40000-0x00007FFDE7E0C000-memory.dmp

Download

memory/3724-305-0x000001EB76AE0000-0x000001EB76B31000-memory.dmp

Download

memory/3724-310-0x00007FFE09D30000-0x00007FFE0A150000-memory.dmp

Download

memory/3724-311-0x00007FFDE5B40000-0x00007FFDE7E0C000-memory.dmp

Download

memory/4224-324-0x000001B1F1A80000-0x000001B1F1AA2000-memory.dmp

Download

memory/4224-325-0x000001B1F2300000-0x000001B1F2344000-memory.dmp

Download

memory/4224-326-0x000001B1F23D0000-0x000001B1F2446000-memory.dmp

Download

memory/4224-336-0x000001B1F2020000-0x000001B1F216E000-memory.dmp

Download