3ff64f10603f0330fa2386ff99471ca789391ace969bd0ec1c1b8ce1b4a6db42

Analysis

user interaction
yes
max time kernel
83s
max time network
94s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
12/07/2026, 02:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
MEMZ.exe
Size 12KB
Sample260712-c8vpzset61
SHA256 3ff64f10603f0330fa2386ff99471ca789391ace969bd0ec1c1b8ce1b4a6db42
MD5 a7bcf7ea8e9f3f36ebfb85b823e39d91
SHA1 761168201520c199dba68add3a607922d8d4a86e
SHA512 89923b669d31e590189fd06619bf27e47c5a47e82be6ae71fdb1b9b3b30b06fb7ca8ffed6d5c41ac410a367f2eb07589291e95a2644877d6bffd52775a5b1523
SSDEEP 192:HMDLTxWDf/pl3cIEiwqZKBktLe3P+qf2jhP6B5b2yL3:H4IDH3cIqqvUWq+jhyT2yL
TLSH
T195426EDBB8200823E0F142B334257434EFBE852E0BDADEC98DF62E519BC79032517165
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

bootkit discovery persistence

Malware Config

Signatures

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	MEMZ.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MEMZ.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MEMZ.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Taskmgr.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4840	msedge.exe
1744	msedge.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	Taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	Taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	Taskmgr.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4292	MEMZ.exe
4292	MEMZ.exe
4292	MEMZ.exe
4292	MEMZ.exe
4292	MEMZ.exe
4292	MEMZ.exe
3352	MEMZ.exe
3352	MEMZ.exe
4292	MEMZ.exe
4292	MEMZ.exe
3352	MEMZ.exe
3352	MEMZ.exe
4292	MEMZ.exe
4292	MEMZ.exe
3352	MEMZ.exe
3352	MEMZ.exe
2704	MEMZ.exe
2704	MEMZ.exe
4292	MEMZ.exe
2704	MEMZ.exe
4292	MEMZ.exe
2704	MEMZ.exe
3352	MEMZ.exe
3352	MEMZ.exe
3284	MEMZ.exe
3284	MEMZ.exe
4292	MEMZ.exe
4292	MEMZ.exe
3284	MEMZ.exe
3284	MEMZ.exe
3352	MEMZ.exe
3352	MEMZ.exe
2704	MEMZ.exe
2704	MEMZ.exe
4292	MEMZ.exe
4292	MEMZ.exe
2704	MEMZ.exe
2704	MEMZ.exe
3352	MEMZ.exe
3352	MEMZ.exe
3284	MEMZ.exe
3284	MEMZ.exe
3512	MEMZ.exe
3512	MEMZ.exe
4292	MEMZ.exe
4292	MEMZ.exe
3284	MEMZ.exe
3284	MEMZ.exe
3352	MEMZ.exe
3352	MEMZ.exe
2704	MEMZ.exe
2704	MEMZ.exe
4292	MEMZ.exe
4292	MEMZ.exe
3352	MEMZ.exe
3352	MEMZ.exe
3284	MEMZ.exe
3284	MEMZ.exe
3512	MEMZ.exe
3512	MEMZ.exe
4292	MEMZ.exe
4292	MEMZ.exe
2704	MEMZ.exe
2704	MEMZ.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1452	Taskmgr.exe
Token: SeSystemProfilePrivilege	1452	Taskmgr.exe
Token: SeCreateGlobalPrivilege	1452	Taskmgr.exe

Suspicious use of FindShellTrayWindow 42 IoCs

pid	Process
1452	Taskmgr.exe
1452	Taskmgr.exe
1452	Taskmgr.exe
1452	Taskmgr.exe
1452	Taskmgr.exe
1452	Taskmgr.exe
1452	Taskmgr.exe
1452	Taskmgr.exe
1452	Taskmgr.exe
1452	Taskmgr.exe
1452	Taskmgr.exe
1452	Taskmgr.exe
1452	Taskmgr.exe
1452	Taskmgr.exe
1452	Taskmgr.exe
1452	Taskmgr.exe
1452	Taskmgr.exe
1452	Taskmgr.exe
1452	Taskmgr.exe
1452	Taskmgr.exe
1452	Taskmgr.exe
1452	Taskmgr.exe
1452	Taskmgr.exe
1452	Taskmgr.exe
1452	Taskmgr.exe
1452	Taskmgr.exe
1452	Taskmgr.exe
1452	Taskmgr.exe
1452	Taskmgr.exe
1452	Taskmgr.exe
1452	Taskmgr.exe
1452	Taskmgr.exe
1452	Taskmgr.exe
1452	Taskmgr.exe
1452	Taskmgr.exe
1452	Taskmgr.exe
1452	Taskmgr.exe
1452	Taskmgr.exe
5108	msedge.exe
1452	Taskmgr.exe
1452	Taskmgr.exe
1452	Taskmgr.exe

Suspicious use of SendNotifyMessage 41 IoCs

pid	Process
1452	Taskmgr.exe
1452	Taskmgr.exe
1452	Taskmgr.exe
1452	Taskmgr.exe
1452	Taskmgr.exe
1452	Taskmgr.exe
1452	Taskmgr.exe
1452	Taskmgr.exe
1452	Taskmgr.exe
1452	Taskmgr.exe
1452	Taskmgr.exe
1452	Taskmgr.exe
1452	Taskmgr.exe
1452	Taskmgr.exe
1452	Taskmgr.exe
1452	Taskmgr.exe
1452	Taskmgr.exe
1452	Taskmgr.exe
1452	Taskmgr.exe
1452	Taskmgr.exe
1452	Taskmgr.exe
1452	Taskmgr.exe
1452	Taskmgr.exe
1452	Taskmgr.exe
1452	Taskmgr.exe
1452	Taskmgr.exe
1452	Taskmgr.exe
1452	Taskmgr.exe
1452	Taskmgr.exe
1452	Taskmgr.exe
1452	Taskmgr.exe
1452	Taskmgr.exe
1452	Taskmgr.exe
1452	Taskmgr.exe
1452	Taskmgr.exe
1452	Taskmgr.exe
1452	Taskmgr.exe
1452	Taskmgr.exe
1452	Taskmgr.exe
1452	Taskmgr.exe
1452	Taskmgr.exe

Suspicious use of WriteProcessMemory 29 IoCs

description	pid	Process	procid_target
PID 2036 wrote to memory of 4292	2036	MEMZ.exe	87
PID 2036 wrote to memory of 3352	2036	MEMZ.exe	88
PID 2036 wrote to memory of 2704	2036	MEMZ.exe	89
PID 2036 wrote to memory of 3284	2036	MEMZ.exe	90
PID 2036 wrote to memory of 3512	2036	MEMZ.exe	91
PID 2036 wrote to memory of 5552	2036	MEMZ.exe	92
PID 5552 wrote to memory of 4408	5552	MEMZ.exe	93
PID 5552 wrote to memory of 3992	5552	MEMZ.exe	96
PID 5552 wrote to memory of 1452	5552	MEMZ.exe	97
PID 5552 wrote to memory of 5108	5552	MEMZ.exe	99
PID 5108 wrote to memory of 5176	5108	msedge.exe	100
PID 5108 wrote to memory of 3324	5108	msedge.exe	102
PID 5108 wrote to memory of 1744	5108	msedge.exe	101
PID 5108 wrote to memory of 3324	5108	msedge.exe	102
PID 5108 wrote to memory of 3324	5108	msedge.exe	102
PID 5108 wrote to memory of 4732	5108	msedge.exe	103
PID 5108 wrote to memory of 4732	5108	msedge.exe	103
PID 5108 wrote to memory of 2656	5108	msedge.exe	104
PID 5108 wrote to memory of 1556	5108	msedge.exe	105
PID 5108 wrote to memory of 2656	5108	msedge.exe	104
PID 5108 wrote to memory of 2656	5108	msedge.exe	104
PID 5108 wrote to memory of 1556	5108	msedge.exe	105
PID 5108 wrote to memory of 1556	5108	msedge.exe	105
PID 5108 wrote to memory of 3448	5108	msedge.exe	107
PID 5108 wrote to memory of 4800	5108	msedge.exe	108
PID 5108 wrote to memory of 3448	5108	msedge.exe	107
PID 5108 wrote to memory of 3448	5108	msedge.exe	107
PID 5108 wrote to memory of 4800	5108	msedge.exe	108
PID 5108 wrote to memory of 4800	5108	msedge.exe	108

C:\Users\Admin\AppData\Local\Temp\MEMZ.exe
"C:\Users\Admin\AppData\Local\Temp\MEMZ.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2036
- C:\Users\Admin\AppData\Local\Temp\MEMZ.exe
  "C:\Users\Admin\AppData\Local\Temp\MEMZ.exe" /watchdog
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4292
- C:\Users\Admin\AppData\Local\Temp\MEMZ.exe
  "C:\Users\Admin\AppData\Local\Temp\MEMZ.exe" /watchdog
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3352
- C:\Users\Admin\AppData\Local\Temp\MEMZ.exe
  "C:\Users\Admin\AppData\Local\Temp\MEMZ.exe" /watchdog
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2704
- C:\Users\Admin\AppData\Local\Temp\MEMZ.exe
  "C:\Users\Admin\AppData\Local\Temp\MEMZ.exe" /watchdog
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3284
- C:\Users\Admin\AppData\Local\Temp\MEMZ.exe
  "C:\Users\Admin\AppData\Local\Temp\MEMZ.exe" /watchdog
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3512
- C:\Users\Admin\AppData\Local\Temp\MEMZ.exe
  "C:\Users\Admin\AppData\Local\Temp\MEMZ.exe" /main
  2⤵
  - Writes to the Master Boot Record (MBR)
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5552
- - C:\Windows\SysWOW64\notepad.exe
    "C:\Windows\System32\notepad.exe" \note.txt
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4408
- - C:\Windows\SysWOW64\notepad.exe
    "C:\Windows\System32\notepad.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3992
- - C:\Windows\SysWOW64\Taskmgr.exe
    "C:\Windows\System32\Taskmgr.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Checks SCSI registry key(s)
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    PID:1452
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://google.co.ck/search?q=how+to+get+money
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:5108
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x304,0x7ffd8cc1c188,0x7ffd8cc1c194,0x7ffd8cc1c1a0
      4⤵
      PID:5176
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1868,i,8371526962159789327,8253722859311402311,524288 --field-trial-handle=2284,i,3601916239792624539,7232889009914977931,262144 --variations-seed-version --mojo-platform-channel-handle=2364 /prefetch:11
      4⤵
      System Time Discovery
      PID:1744
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1564,i,1579245576541107673,4335205440857906533,262144 --field-trial-handle=2284,i,3601916239792624539,7232889009914977931,262144 --variations-seed-version --mojo-platform-channel-handle=2280 /prefetch:2
      4⤵
      PID:3324
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2464,i,9205591050583359622,1564240146481384256,524288 --field-trial-handle=2284,i,3601916239792624539,7232889009914977931,262144 --variations-seed-version --mojo-platform-channel-handle=2996 /prefetch:13
      4⤵
      PID:4732
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3572,i,14957803767573115899,15412660193132542980,2097152 --field-trial-handle=2284,i,3601916239792624539,7232889009914977931,262144 --variations-seed-version --mojo-platform-channel-handle=3612 /prefetch:1
      4⤵
      PID:2656
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3592,i,9390014521816446539,2018786109470353449,2097152 --field-trial-handle=2284,i,3601916239792624539,7232889009914977931,262144 --variations-seed-version --mojo-platform-channel-handle=3620 /prefetch:1
      4⤵
      PID:1556
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4220,i,10118820707780395266,396649513200130405,2097152 --field-trial-handle=2284,i,3601916239792624539,7232889009914977931,262144 --variations-seed-version --mojo-platform-channel-handle=4248 /prefetch:1
      4⤵
      PID:3448
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4232,i,6935198832530047139,11099748638189959267,2097152 --field-trial-handle=2284,i,3601916239792624539,7232889009914977931,262144 --variations-seed-version --mojo-platform-channel-handle=4252 /prefetch:9
      4⤵
      PID:4800
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
      4⤵
      PID:1944
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x328,0x7ffd8cc1c188,0x7ffd8cc1c194,0x7ffd8cc1c1a0
        5⤵
        
        PID:4120
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1664,i,9387214617211525704,16360278097755268747,262144 --field-trial-handle=2204,i,5352415451095544502,10334483893070438622,262144 --variations-seed-version --mojo-platform-channel-handle=2368 /prefetch:2
        5⤵
        
        PID:4404
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1820,i,11543910993499009366,5813178814138552392,524288 --field-trial-handle=2204,i,5352415451095544502,10334483893070438622,262144 --variations-seed-version --mojo-platform-channel-handle=2452 /prefetch:11
        5⤵
        System Time Discovery
        
        PID:4840
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2496,i,12728687860736521140,117743207068782896,524288 --field-trial-handle=2204,i,5352415451095544502,10334483893070438622,262144 --variations-seed-version --mojo-platform-channel-handle=3420 /prefetch:13
        5⤵
        
        PID:3128
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4356,i,16160235476321940007,10510263810719114129,524288 --field-trial-handle=2204,i,5352415451095544502,10334483893070438622,262144 --variations-seed-version --mojo-platform-channel-handle=4428 /prefetch:14
        5⤵
        
        PID:2444
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4356,i,16160235476321940007,10510263810719114129,524288 --field-trial-handle=2204,i,5352415451095544502,10334483893070438622,262144 --variations-seed-version --mojo-platform-channel-handle=4428 /prefetch:14
        5⤵
        
        PID:4192

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:5084

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2804

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4748

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5888

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 dfacefa73d018d54e3feba3eef28ec722a8422fee8768a2c3d8d6253f863b375
MD5 cb5000b6fab1115bfff50bedcc3eb9fd
SHA1 afbfe0ec03df59e7a1eba1da4227111508419c03
SHA512 aab9a1afd5de2f983466724b6ecf0dbc2e176c5a1eb2f059b9507511cc53643fcf9ed990bd565f22f8d53fb82db71cba238962a75c68db02d5f10b526661bd08
TLSH
T15AD09B667354991CC9C439712462565161015820941443581D96B16CCDE56C707561DA
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ecdd5c8034c45eff453cbaf31d8886e2bd9609a73853367a6d096a69cc81f1be
MD5 a774534a956a5c8affebe08e87c80683
SHA1 b3e4e20a91e4087d3b9247b5ef6815f51858a041
SHA512 27769aee2cac148a0154fe42b51da2a9a1088e9e990873915b4c7ab9bd5442a3facf82b2bd1cbaef75328bd5937813698b96ac06aa76d934d07ab5ebb194a824
TLSH
T103D09B6673449A1CC9C439712461565161115820E41443581C96715CCDE56C707571DE
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_0
Size 44KB
SHA256 2d5eb10e7e88aff67baae7493ab72efe0aca9923d9c8b1773fa83f7e52b67e2f
MD5 3e0957ad521781dec78c0b2b68bc67cd
SHA1 5ab434972df4d0a92df33209ec9e1ca2349a433d
SHA512 394747c1b0e7897135b1d5002f85b869a932d29307b32bd7905c086c46e1e100209bf2a5befe8ca0dfa193639ee03462463be69e68dddb5669ebff74a0392489
SSDEEP 96:wpP9ovVVoEd/uV7f4x6r+/qsc1JeC1Z2oW9vCYaNwIW0y6nNalEnVj4crO:wpP9WVoEN07k6lPHZc5jaWlr2F4H
TLSH
T1C0132DBF06174C57E2D7137C13575F793F38C502DAD9051F2AB9B0A290A6377588E852
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_1
Size 264KB
SHA256 083669da30ae8a8a620992cebec79bbdce570556249cc6af0242d09a083f54b9
MD5 79f4d25947558bfd6927931a1c45d618
SHA1 a6e4071c5fd942f43e7082292bffec0a86c56470
SHA512 ea1e28e1474ecf09333f62eb143206ed071afe62280b481555344cf627675323ab44a6546310746283b5f4c2d1b70919733fbf6c47b6e3479aa92a8b0a8ce58e
SSDEEP 768:4Rc+lNi/hhNL/u8IL/J7nY0dkD1uYobcYSIlXt1vP34xdiYdKkcB6/B:4RcZ/fNL/u1L/JHiMwJIlXHWic
TLSH
T17F443DFB1911A01BCBA852F5E6033A7DD177855E6CD1F8E9E57C4C812825F32B2BCA84
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_3
Size 4.0MB
SHA256 f4aa2d8f511955306922b52e312476855458c0ae2b8cb8b032ca1685f3c815a1
MD5 f013cf2f8084a0f30872ae16059076cb
SHA1 49e8a20aa56115ec0f25870f4208bd101eea661b
SHA512 28933a7b646a4e8486c2ab1b85c3425df7243c4593f36edb29b1d17aff78e7f8768cda92f637013b695f488ecc09191ef0b5fef6cdfdb63d713c3417a464225c
SSDEEP 12288:a4+RBHyDuxvtdGtydXXcXiQ+MDBLTFHms8wNq852imtr6fRfNMvd62ArRd45TiDK:pOH0SwOa/nWUvql59XHJV06v
TLSH
T146166DEDC96858C3CD63AA30B1F0E9477C7413C3F995C1D68898C584026BBC5BFAB669
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 f6148480bb56dc0c8f933784bd3213098e266c4de875c69d2e70d12d784948e4
MD5 fd25e49c8c16f30b566311eba5bbb135
SHA1 c541e32189f7e3d3231e41291c5783a877094bab
SHA512 a07f8edc20d86a1b4b49b537df90567b4469a3e95374dda2234b49fec62a970067091529ad3cd30bc988a103e19ea5e0173bd8a25cc0aee7fce9073773fe9ebd
TLSH
T13251A3537BAF8AE2E73D49F192F240CABE7D94160E8F2A6D11442173DBC736BA104230
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a7291.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5a7291.TMP
Size 2KB
SHA256 22457fb9cfe128df1f45be53deb59c89f1a0666459b13edd3aee310855213848
MD5 f1e0e2d6f25f0bc732d64147a5ea7f60
SHA1 1a6e9eaf0d422d8ac732ab5f50e8f4af7774dea0
SHA512 abced4ab1dc319ed70c8a4816798568dfd43e56e9d913604eaa8b4b40c1d4c3e0e2f5627544d84d4731677a3be3695ce8c62209e2ab07096f7bfd362ec1b7d22
TLSH
T10A51A3537BAF8AE2E73D49F192F240CABE7D94164E8F2A1D11486173DBC735BA100231
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG
Size 343B
SHA256 24359aea9e2efa81458aef394f538bd7dfc45db6a91ebeceb7dd170be1975d90
MD5 acb0104115d617f6c0ff9862381616b9
SHA1 5d158157826f722cae6e0f511838cad54ec134a9
SHA512 05f1b6b16897f0826c0fb5f9e301e3658606c1fd7161dead6349f88c6d0e4b75b2098a5c5883bea817a21a761b929f7ebb73d3a10e0f6fc4c2f1a8933f70b623
TLSH
T1B2E0D8E8A6C6C51DA65034C381B89B0CA6C13493D7C56F431B448CC47607415B791A8A
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log
Size 285B
SHA256 fff9c841af450dfefe7f284f645d4a26b048e6bd5709ad766b308172bc260a53
MD5 785c71b68bf89a0e9973e06d76434ab1
SHA1 2eb96ed892a724f5f223fe37abbd075d448d45e3
SHA512 a84d94a4b22d325a41b84c193a2e279bc3969085d87eda3fad0dc1032989bd26e67aba7cefa085838590e5aef8958c40e22a000d158fd80782b614dcdbc55030
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG
Size 322B
SHA256 5c7302c524a4e84c12461a3287f1bf006f28b773195f43c01ec90991fcb2782d
MD5 d496e8ab53a06294bbf8c6b793e540d2
SHA1 f426cb50e78f282af27382e1f8f9edd4692baae9
SHA512 413076faf2f7408246429e4948b1ca3845a3d7fd7cf246b7a188ac51724eda2b7111d41ca2bff3956f2655359eb73dbf187097cde8051026f5c07b1111775c8c
TLSH
T1E4E04FA456C9DB299754E893C368630CC6D274CBE7C83A021BCD8C646112B56A39A685
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG
Size 334B
SHA256 bb502540058b130c025455bb986273d43bfeb8e558bf48d31bce36c5397c6c35
MD5 19281a2b2945aab4958d86ced07ca91d
SHA1 37daf3dde39994a9608c1b5ed809fa9bb6e8cda5
SHA512 87ca7654f2357b8b23edf55c63b8c5e195819b36bb22a59766571b4d4a028ac1a0dd7e725d9fb73e7c5d9c27c0de576bd4417ba41de9a9a0b9bb7f60324689cd
TLSH
T1C4E0DFF157CDCBAE6344245B832D670DE7A1354BE7C83B025B889848B546A04A3822CA
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 0f1fcc42a9c08933d24326ae9ac2f1073c592a6c575340fddba4207110c34aa2
MD5 53d6fd156041f16ed58c6071a2eb5a9d
SHA1 677689abd8fe97da13c2eff747285013d7eea546
SHA512 bc3bc1085dd0e5d7acfb5f55cfaf327ed532f260c8f3018f3a3cc13cf0344c17c0d030bdc2d0dec480ad99534ba5ea20ee8a997382d1776efbf7797899ed711e
TLSH
T14F218EF787F4957D8A0181F4A6086E1BCE290815531C3D56C5E46E1BA3E24B1E14095E
MD5 SHA1 SHA512 TLSH

Submit Download

Reporting and NEL

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Reporting and NEL
Size 36KB
SHA256 a576f517a3bc1f9ac6ce7db9da8214c42477ae10356ee2f243b48e5645314dc8
MD5 71567a948106bf35e037291fd86cb928
SHA1 52a92b30d6c879688a1940ce81fbd5dacfd3fd63
SHA512 337042ab76c8538975a87bdf255e6ae4bcb691054fc78a81f4b940e5ded451d79a0d6fb540002c31bd39611d2f7fb17f0560f62f494321736510f11093224167
SSDEEP 48:T6IopKWurJNVr1GJmA8pv82pfurJNVrdHXuccaurJN2VrJ1n4n1GmzNGU1cSBGlZ:OIEumQv8m1ccnvS6nWdEf6CnFg0G4g
TLSH
T1CFF2CEFA07276205D99484B0E4009FCEAF1A410B47B6B7DC66D447E3F7A20E2B17875A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 4f6494ef6419f2dfc1630034f7e2634ec6b873f791b0c23481ee79d2c3ee240c
MD5 170feb4249eef5d1f6c607b9db0786b2
SHA1 700c04e65026cf40b712d4b2b24dbae74f93accf
SHA512 6a72233905e729f6c050a4b5df4ba1a7aee2e910f11465407578a57bd4a53d1e53b062b3d32a2535428e7d889ef57980529b70258ee1a3e96923da52f2262967
SSDEEP 192:sxR3NCt/fhsC8WpVqBKCA94/r3zoA8pi/g6+WNIYD9l6SugNnhIgFJ:sxR3st/fhsRWvaZ8Xi/5InSfv
TLSH
T10432A5166928A93B9CC7E21DFB657F53D6FD103361916E48A7FC861C04EA6DD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 bbf469410d1a6a05aa384b31b8b55dd24eb192601e6dfcf3567d1ae0ba3eb120
MD5 6b6c73d3ff400f08e0cf40381349d2c5
SHA1 6f48e4087482f750447ee22a5d53daf694f222f4
SHA512 c12fc439864e1174c362000174888bfcafbd53fe7060aab6cd5df64656e854ce14fa84eb6c2935e779bf1c2a5a3580f733bc48dd8310396be090d08c975ef2d5
SSDEEP 768:azfW/L7pLuL7J0Wg/XfHf8F1+UoAYDCx9Tuqh0VfUC9xbog/OVOc16uropiBExw:azfW/dE7J0Wg/XfHfu1jazy6lpiF
TLSH
T19DC2FA3B240CCF7F4F800A9DAD197E9B6DA802CB9698CD5047FE941C02C6BEA52164DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG
Size 338B
SHA256 56c67bba46bae2221759af5ed5c779fe928a21bf40f2758dba1b0a81b9d3d7a6
MD5 01f577a0d857aa88327ad9e79f6dcbcb
SHA1 19ec605407f75ee99d1de1e23e500a5ac1c672dc
SHA512 61c2e28c8f5dc2dabe0d3de9f8746ba9960643e193726c6fa378161e4a26fff42abd78097ef94ff1c176c87d00460442ff94bce0426bf88b071bb6e9e65122db
TLSH
T160E07DF01AC8C9BD625566C30229834CC3F57987D3CC3E422FC9CA64A2C390CB397290
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG
Size 350B
SHA256 6e8dd775dcd1ee62f02f863f04442e888cb9d1d729b2f514cc17c659aa5d5f64
MD5 d308f93dbcd3ee8efbc3c33fff8ec41d
SHA1 7800e99be836a6f9281d669589de3e5e78d0e00d
SHA512 9ad113b90fc9185528b022714c130aa8b0a60407eb4df3fedf815f028afa0ef6134ea1c2247f22d9aac5a04fca4973e30ff06a0b330d162daa7a95665cf86a46
TLSH
T1A2E0DFF127C9CA6A6286748B8264E74CC3B37443E7C82A526B4CD4A8B387640B387290
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\000003.log
Size 175B
SHA256 80d1388b9a7150eb0291175fe693dd7b6bce910c3e4fff51e94841d31d771dbe
MD5 cb63c64828a27af7253afb7c7d986654
SHA1 8a54aeb86f79cc69e6f11278d874cebd328ae466
SHA512 e0dbdd6931c9272e0b52bb2ef7895121f6324379f584899343342a057737a9837cc476842ea781a1de5c17a20c06e0a7d24c0ed6ea41fdd95bb99296e8810f9a
TLSH
T135C09BD55F903023FDCA5D3D0DAB53041720C4752F74CF57D28430901C0A285FF61145
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG
Size 326B
SHA256 cf8eff9a3d3d5b5694dd72209d0aea6d931494148c6d124fcab35b4b4615f82c
MD5 0b83d2c69392de3a46f88f683cbcd735
SHA1 0da0d1593354c64b15bb73efad2021c8f7d6583f
SHA512 8d141a583812497bfb07144a76232b337a2ff851c16e5dc38a58ae5f0184fe25b7f5b3d30c9dbcb43f718a03268c6bec7d951527ff6a62a896752148855b6c0f
TLSH
T112E026B096C8CA795652E49382689B4CC3F1B84B93C83B82678C4C48A242501F3EEE91
MD5 SHA1 SHA512 TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data
Size 256KB
SHA256 a4087e495d08571663c86ede2068f55a8e71427daefa28b2f577c12b1a4b23b6
MD5 c0aabd7b7f6dafef3c191a5d5becb0a3
SHA1 0d91a1533c868974bb27819ccc95a7c6d5027bdf
SHA512 68f470a8c78ef3e9532a2a47bfd85c1b27e75e052f3ef90f10a0e48c1a27da6d42d829dd6a41537724999b4180fd42db2711872ca3bc9990e43e54033d5fd09e
SSDEEP 384:DNrRZyCSDnxTICHHMEhIKyll7svbFKfk7:xFZJSDniFyI1l7svbF9
TLSH
T10044740A7B747001EDE6DD725CB080771E3CB16D8F22A6916DA254698DB3853A23D8FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cf99f565-1549-4a81-9020-88c791d24dd2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\cf99f565-1549-4a81-9020-88c791d24dd2.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log
Size 497B
SHA256 5b8137f1de11f724938f439ed1228cdbbd11e4b64daf521ca13cba2786f0c8c8
MD5 241df05a839d4ec4c8f08ec033cc0c02
SHA1 497179580ca03f3880dfdfd5338d87e2fa564b6c
SHA512 029520953c6c3b7a700a25f98c41cb6428559098533e774a9241e0db5aa98986bcc4b11cf00ca1085a08dfaac76c038657efba7660a52c7e55b7ecba45ba4408
TLSH
T1ACF0A8CB6E0209B7CC02903140336B82FF2189CB002465AB438D242A5A2E2F2C9CC0E5
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG
Size 322B
SHA256 6f01b9a1cb7b2999f62f3e0837989f7c4f7204de097abf53caddb0506cce064a
MD5 fcbf5bf0b209f8a667685e0a6db889fd
SHA1 3e09d76bfb5711e997915a63d2f6f6e9560cd130
SHA512 a46bd390b8fd05e6a16f7b587e8f8b8e7fc2b645e2ef602d49f5133023f5eca07c8a7110c2cc167beaf1393ba35795d6f3e92caa20172c1ac7c803655b52c599
TLSH
T104E026A0BBC8CAAEB159248B0224470C82923847EBC82A061F88C848A002B41B3C7281
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log
Size 1KB
SHA256 f1bc2e77fb9513ff937638d01da3164507074c39b8f914e2bebbcb19c2bd7ef4
MD5 867a8cd0e4f695150d59e114cb82e10b
SHA1 a9187678d4b421f13d85be0e83770042edd4f022
SHA512 3a69eb9b7252e96ec5dfdb2f757ed36668eb94d129eb3407cf2d0c5833fa6300da3d84dab0ed8066fc230b7532cef6bc2d0d56a010c0157303b50e1b70b00bcf
TLSH
T1D021F15AF330C104E24A823E607FAB250B38E8168FBCEC0F447930256E36B440E8B7E4
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG
Size 340B
SHA256 7f3368f09be193be812039b7b49d659d8b0b03807078eba309ac333c4cacc497
MD5 acaa72ec39f7da6d0d743f56c238632e
SHA1 5e31a94e71e151259930ef094bf497a2f2526af0
SHA512 de0abd45332f056ea2783aeeffe52984f3107398a08397971c0f6c8958026231a9c49a43eca246c0f657206e9038f2c0b59ac6126f2092f14fc7f0b48e0cf741
TLSH
T1DFE0206076C4CDDF615665870264B74C83923843EBC42F031FC5CC585102682F3C7241
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_1
Size 264KB
SHA256 0f7cf2881b859a9da3ca0c98226a4eb480a0575ea2e1a58fa1d11c1f4a9157a6
MD5 832e1b345efc760b4fa93546f50f0c0b
SHA1 41f6a7f20d4ab3fd509b7366d1aa56541ee4a9a2
SHA512 3cce49317ff7640857ee6a4cf10467a5192252b18103feec71dcbeb7bbbfc176e0c3b08e018da6cc72ede29b36ef7d57a3ac60ce89268a324a7e4804765cdbfe
SSDEEP 3:MsEllllkEthXllkl2zEflwFhRKlt:/M/xT02zRFHKl
TLSH
T1D24404047FC0740FD50010304073C3D017F0F7100511574334D1043F7CC75400C44000
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\data_1
Size 264KB
SHA256 0fbae1515dfc4e7b00a3e57f0c98af9fb77480b845a0b14df72e2a77e5215a87
MD5 683cf7797540eea39d09601ad0b04a45
SHA1 5d1edf13f833dde4b1311c0de8a11e78d4bfe2b6
SHA512 23ae527f29ed2f641793db82e5d0a40801c2b9f6ad2e85f11530fe616c69f98340503465501436469f933143cbd8ca148e0fd993280c0964857e1af99db11625
SSDEEP 3:MsEllllkEthXllkl2zEfldRKX:/M/xT02z9
TLSH
T1524404047FC5140DC514503050D5C7501371F415051357477CD1043F7CC7FC00C00004
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Size 14B
SHA256 ee1367d356a136a11664001cd90e05ba08dbaa85f496584158f5e42be8e836fd
MD5 8297da058a737611abcc3a0ede9ffc24
SHA1 e532552672ecffbe3509fb4c334833a67f16d05b
SHA512 fefc70ebe486693310a00beb5ae125abb1569c4455538124d897566f2e44f2b3854ad4451196607137301a811ac7f96f1d488a36eb6d6cd566f2f7cdc7c7568f
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 45KB
SHA256 0a563e8b91d5dc5f1dec08eedad70a77efc7fdd9f9f216a8b8e9c738e7b50ddd
MD5 8fcac3bdb8e3bec1a5ff4e166f5831ee
SHA1 fc4d4d52dfc7a30800640d67009c7de74fe054d9
SHA512 33536d32715c632830d560dbf895669d5577fe09d47f7c2e7adda632e2458abce1d9eca9e1768736315b222dc85377debf7f4d062f6daededbb9514ab6ff0a8a
SSDEEP 768:Yrv+4UNbdm3usi0acrEnjN3Gac1FnwMbG5eVH1SCx:YbsbI3zLQnjMaaweG5EH1X
TLSH
T16D239D3C5D64997F88EEFB45714E7A136EA81277C1B40AA8CBC91B0CC577898F307926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 defab66c4be89a1051cb56536be525beadf6cf312eeb52f132de747549628a16
MD5 4cf4d3d80a38eef764945df774b0826d
SHA1 041cbe903cca25b4557f87044785f0cfc527045e
SHA512 5516786617ee62ec6696c51cb22277f82d853ac87b57b34dea733d2a6071145b9620401f0ba68986854b1abd997436bc63a100391a776e5565637fece46fd966
SSDEEP 768:rrv+4UNbdS3kmi0aNrEnjN3Gac1ZGeVH1SCz:rbsbg3j0QnjMaVEH1V
TLSH
T1EB03CF3669A89E738CE7E385B5877A037FF4525386840BE4C6DD6B0D029B5EC130B867
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 2d70ebb6bb784970a691ffd5d3f44402939c0fd6e3d81a833c05cbc42e1b5a07
MD5 1f42ca87a7ac03c444b15b5139ffe08f
SHA1 410624c4b4ae4e537616c9346ed71ba837f8ce12
SHA512 4ce60fe1080abadb58a80cc18c68430c1a55c33d06ad2dddd813e29142afa94db7638fe7594af322046b88f9b60f8cc52aba9168bec747939b4b37a647b06852
SSDEEP 3:MsEllllkEthXllkl2zEflQH+l/:/M/xT02zlH+
TLSH
T11C4404057FC0144DCD0010304051C3501370D4101551575734D304337CC75400C04000
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations
Size 86B
SHA256 5cd2c4d9f13524923046198c92213691539407e04fa520cdae9eade1bad3d91d
MD5 e9e365607374115b92e4abe4b9628101
SHA1 d5054ea9b22317dca83801eb3586017bfcc0e2a8
SHA512 a84d65ed53e43883e5ecb7848fbd48f5305a63e6975e6af480cf85532879720061106be54f2a5888ebc3569f7123081a0e6eb48ccb8d7dba3e1da1c8a3c50401
TLSH
T151A012078473800AE4144051C49C024114A4804A0219D0015060932314A40CA03A5435
MD5 SHA1 SHA512 TLSH

Submit Download

0996f10f-8c14-4b79-8c61-f045c2956720.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\0996f10f-8c14-4b79-8c61-f045c2956720.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

note.txt

Path C:\note.txt
Size 218B
SHA256 8e9f20f6864c66576536c0b866c6ffdcf11397db67fe120e972e244c3c022270
MD5 afa6955439b8d516721231029fb9ca1b
SHA1 087a043cc123c0c0df2ffadcf8e71e3ac86bbae9
SHA512 5da21a31fbc4e8250dffed30f66b896bdf007ac91948140334fe36a3f010e1bac3e70a07e9f3eb9da8633189091fd5cadcabbaacd3e01da0fe7ae28a11b3dddf
TLSH
T1C3D0A719040784251C7052D17145A5A09B70562D77F626EB74DC690C212700F0B37C9A
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1452-21-0x0000000006520000-0x0000000006521000-memory.dmp

Download

memory/1452-10-0x0000000006520000-0x0000000006521000-memory.dmp

Download

memory/1452-9-0x0000000006520000-0x0000000006521000-memory.dmp

Download

memory/1452-14-0x0000000006520000-0x0000000006521000-memory.dmp

Download

memory/1452-16-0x0000000006520000-0x0000000006521000-memory.dmp

Download

memory/1452-20-0x0000000006520000-0x0000000006521000-memory.dmp

Download

memory/1452-23-0x0000000006520000-0x0000000006521000-memory.dmp

Download

memory/1452-11-0x0000000006520000-0x0000000006521000-memory.dmp

Download

memory/1452-12-0x0000000006520000-0x0000000006521000-memory.dmp

Download

memory/1452-13-0x0000000006520000-0x0000000006521000-memory.dmp

Download

memory/1452-8-0x0000000006520000-0x0000000006521000-memory.dmp

Download

memory/1452-22-0x0000000006520000-0x0000000006521000-memory.dmp

Download

memory/1452-4-0x0000000006520000-0x0000000006521000-memory.dmp

Download

memory/1452-2-0x0000000006520000-0x0000000006521000-memory.dmp

Download