7612d5e44a5a392ab9f0d1b5b8a79bda3cdbe19848e8ee9ec23909aaf3daad45

Analysis

geolocation tags

nanew-jerseynorth-americaunited-statesususa
user interaction
yes
max time kernel
249s
max time network
228s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
08/08/2026, 03:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
systeminformer-3.2.25011-release-setup.exe
Size 22.6MB
Sample260808-dwfkzagq5s
SHA256 7612d5e44a5a392ab9f0d1b5b8a79bda3cdbe19848e8ee9ec23909aaf3daad45
MD5 979b20755ddf86eddb3e2892003a2ca6
SHA1 3a0b6f9ee4ee12872e733948465be5ece5b25629
SHA512 3238f77f7810460cb7cdfe7692892879c28e14ccd95969e80cf83d1dff320c8354173a87503b893b7095b99ee81c61e195004ad5f5e6a28e09e3e9c1fc080d44
SSDEEP 393216:Cg+SqZ3hd0y0HNQvVun6kljEGVHXQYGSE1fggY6Q1Gv0ZOfBKy48/ZtwnvmFO4lL:CB/Z3hd0heVu8GyYGSE19eGv0Zvyd/31
TLSH
T1F5373390F6B242E4E9F1177069A3EB19907C28D01F2489FF0BE95C845FB16D1973AF29
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

bootkit discovery persistence

Malware Config

Signatures

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	MEMZ.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 47 IoCs

description	ioc	Process
File created	C:\Program Files\SystemInformer\Resources\icon.png	systeminformer-3.2.25011-release-setup.exe
File created	C:\Program Files\SystemInformer\x86\plugins\ExtendedTools.dll	systeminformer-3.2.25011-release-setup.exe
File created	C:\Program Files\SystemInformer\plugins\ExtendedNotifications.sig	systeminformer-3.2.25011-release-setup.exe
File created	C:\Program Files\SystemInformer\plugins\ExtendedServices.sig	systeminformer-3.2.25011-release-setup.exe
File created	C:\Program Files\SystemInformer\plugins\UserNotes.sig	systeminformer-3.2.25011-release-setup.exe
File created	C:\Program Files\SystemInformer\Resources\CapsList.txt	systeminformer-3.2.25011-release-setup.exe
File created	C:\Program Files\SystemInformer\ksidyn.bin	systeminformer-3.2.25011-release-setup.exe
File created	C:\Program Files\SystemInformer\plugins\DotNetTools.sig	systeminformer-3.2.25011-release-setup.exe
File created	C:\Program Files\SystemInformer\plugins\Updater.sig	systeminformer-3.2.25011-release-setup.exe
File created	C:\Program Files\SystemInformer\plugins\WindowExplorer.sig	systeminformer-3.2.25011-release-setup.exe
File created	C:\Program Files\SystemInformer\x86\SystemInformer.exe	systeminformer-3.2.25011-release-setup.exe
File created	C:\Program Files\SystemInformer\x86\plugins\ExtendedTools.sig	systeminformer-3.2.25011-release-setup.exe
File created	C:\Program Files\SystemInformer\systeminformer-setup.exe	systeminformer-3.2.25011-release-setup.exe
File created	C:\Program Files\SystemInformer\dbgcore.dll	systeminformer-3.2.25011-release-setup.exe
File created	C:\Program Files\SystemInformer\dbghelp.dll	systeminformer-3.2.25011-release-setup.exe
File created	C:\Program Files\SystemInformer\ksidyn.sig	systeminformer-3.2.25011-release-setup.exe
File created	C:\Program Files\SystemInformer\peview.exe	systeminformer-3.2.25011-release-setup.exe
File created	C:\Program Files\SystemInformer\plugins\Updater.dll	systeminformer-3.2.25011-release-setup.exe
File created	C:\Program Files\SystemInformer\plugins\WindowExplorer.dll	systeminformer-3.2.25011-release-setup.exe
File created	C:\Program Files\SystemInformer\Resources\PoolTag.txt	systeminformer-3.2.25011-release-setup.exe
File created	C:\Program Files\SystemInformer\SystemInformer.sig	systeminformer-3.2.25011-release-setup.exe
File created	C:\Program Files\SystemInformer\SystemInformer.sys	systeminformer-3.2.25011-release-setup.exe
File created	C:\Program Files\SystemInformer\plugins\ExtendedServices.dll	systeminformer-3.2.25011-release-setup.exe
File created	C:\Program Files\SystemInformer\plugins\ExtendedTools.sig	systeminformer-3.2.25011-release-setup.exe
File created	C:\Program Files\SystemInformer\x86\plugins\DotNetTools.sig	systeminformer-3.2.25011-release-setup.exe
File created	C:\Program Files\SystemInformer\ksi.dll	systeminformer-3.2.25011-release-setup.exe
File created	C:\Program Files\SystemInformer\peview.sig	systeminformer-3.2.25011-release-setup.exe
File created	C:\Program Files\SystemInformer\plugins\HardwareDevices.dll	systeminformer-3.2.25011-release-setup.exe
File created	C:\Program Files\SystemInformer\plugins\HardwareDevices.sig	systeminformer-3.2.25011-release-setup.exe
File created	C:\Program Files\SystemInformer\plugins\OnlineChecks.dll	systeminformer-3.2.25011-release-setup.exe
File created	C:\Program Files\SystemInformer\plugins\OnlineChecks.sig	systeminformer-3.2.25011-release-setup.exe
File created	C:\Program Files\SystemInformer\symsrv.dll	systeminformer-3.2.25011-release-setup.exe
File created	C:\Program Files\SystemInformer\SystemInformer.exe	systeminformer-3.2.25011-release-setup.exe
File created	C:\Program Files\SystemInformer\plugins\ToolStatus.sig	systeminformer-3.2.25011-release-setup.exe
File created	C:\Program Files\SystemInformer\plugins\UserNotes.dll	systeminformer-3.2.25011-release-setup.exe
File created	C:\Program Files\SystemInformer\Resources\EtwGuids.txt	systeminformer-3.2.25011-release-setup.exe
File created	C:\Program Files\SystemInformer\x86\plugins\DotNetTools.dll	systeminformer-3.2.25011-release-setup.exe
File created	C:\Program Files\SystemInformer\plugins\NetworkTools.sig	systeminformer-3.2.25011-release-setup.exe
File created	C:\Program Files\SystemInformer\LICENSE.txt	systeminformer-3.2.25011-release-setup.exe
File created	C:\Program Files\SystemInformer\plugins\ExtendedTools.dll	systeminformer-3.2.25011-release-setup.exe
File created	C:\Program Files\SystemInformer\plugins\NetworkTools.dll	systeminformer-3.2.25011-release-setup.exe
File created	C:\Program Files\SystemInformer\plugins\ToolStatus.dll	systeminformer-3.2.25011-release-setup.exe
File created	C:\Program Files\SystemInformer\x86\SystemInformer.sig	systeminformer-3.2.25011-release-setup.exe
File created	C:\Program Files\SystemInformer\COPYRIGHT.txt	systeminformer-3.2.25011-release-setup.exe
File created	C:\Program Files\SystemInformer\README.txt	systeminformer-3.2.25011-release-setup.exe
File created	C:\Program Files\SystemInformer\plugins\DotNetTools.dll	systeminformer-3.2.25011-release-setup.exe
File created	C:\Program Files\SystemInformer\plugins\ExtendedNotifications.dll	systeminformer-3.2.25011-release-setup.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1312_1722597236\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1312_1722597236\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1312_1722597236\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1312_1722597236\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1312_51572204\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1312_211970230\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1312_211970230\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1312_835942374\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1312_835942374\protocols.json	msedge.exe

Executes dropped EXE 1 IoCs

pid	Process
4636	SystemInformer.exe

Loads dropped DLL 11 IoCs

pid	Process
4636	SystemInformer.exe
4636	SystemInformer.exe
4636	SystemInformer.exe
4636	SystemInformer.exe
4636	SystemInformer.exe
4636	SystemInformer.exe
4636	SystemInformer.exe
4636	SystemInformer.exe
4636	SystemInformer.exe
4636	SystemInformer.exe
4636	SystemInformer.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regedit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	systeminformer-3.2.25011-release-setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MEMZ.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MEMZ.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MEMZ.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1004	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	SystemInformer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	SystemInformer.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\IdentityCRL\Immersive\production\Token\{D6D5A677-0872-4AB0-9442-BB792FCE85C5}\ApplicationFlags = "1"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134306329283454789"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\IdentityCRL\Immersive\production\Property	svchost.exe
Set value (data)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\IdentityCRL\Immersive\production\Property\00184019984336A6 = 0100000001000000d08c9ddf0115d1118c7a00c04fc297eb01000000d8401d4b82e25a448f74ef9172d16f3300000000020000000000106600000001000020000000a19f928a6a4bb1f19a07a6a818b307c4105989825580dd73c51e5ca8e7233a68000000000e80000000020000200000009796c0c8203adf4a28b4592eb2290a410c283c1a4e622fc4ea27fe2bf3d1bdbd80000000e70307c08a338dd6ef35e62202fff592aad043fec479627f0adfd76ffbd3dfc860873fc0633d149ac0395f1950b6909c253f22197fd5c2102be7a4c37b58964f5e447dee5d4e25a6a6e27529deb7e1acd5c64a5251610b769c29a80f8beabecc3d0836459823dedd98f68f47d43a5915f75ad12dfd78ee2edb483af69c7065ef40000000738f879460107d45d55d25c6fee887f574f678a5e25b8c832816cd063502ae86d4bc18c44c18ebaa579fc25c0c020d443f37626d92baf0f9448a156a98850a2b	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\IdentityCRL\Immersive\production\Token\{D6D5A677-0872-4AB0-9442-BB792FCE85C5}	svchost.exe
Set value (data)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\IdentityCRL\Immersive\production\Token\{D6D5A677-0872-4AB0-9442-BB792FCE85C5}\DeviceTicket = 0100000001000000d08c9ddf0115d1118c7a00c04fc297eb01000000d8401d4b82e25a448f74ef9172d16f330000000002000000000010660000000100002000000082328eaddd6b973ab1f7892179d793608271a9ade564becee15c3f75ebf84187000000000e800000000200002000000004c89d9232b5df6ee9d451c1d3522268beb9389e3257e2052dba5c50aa1d683c700f00003a5ef3bf1a706855550e2b973bdf427b14f93c52d3ad769b131adf602916e60c66b7b3afa832f7075a5220b9057317bfaa91683206501ab9a1ea5cd79f5ad7256c9299fc2130865018f5951cce243ef969ce001fc9848c89404a71d79e42b448995228c550c115a1de639557b295c7458fdaeac3ed901b894df86a2456f33140047b9932ccb92719bf18f30163e9c0dc7385dcd52b82514202d7d0dc8d7c18bb71daa875892b3c599e0ed79a631e4f39d89105e7c44124713cc505f1d748dca0cd705a0ed1ec65beb1398b16d099be981bdaaddea02f3792547e1a33ea41bc323da29b4737aa56b1144de1fcd8c495a88eb732392919f7153fb94c0254096e558a1d244df6bbdb4118bc2a67aca72bc7e8f99c6076fa9145f085d0de86340b9da96d692e341c487d5f86002a0df6609762934560efb8deb2f3ace7b1150972a71c65693097a8923ee2ccd26c273a235a4b3ccacd9839022241b8aff69be2a7a136b2f3b27b85a9fee59ec8355a48011a7685e3cf991b6c75ad25dbf36f202f15d766f57dbb6407c475b45bcf2207d7249a70e2d1e53efc33ab37a9494d7bfcd275cc4fa69370434d12f848569960602193fcbed199a929f2375b67898db23aff4ab334c4be3212ce430688bd939fe14d22d5de1d39faf62da87835a3d32b4ea1e82bc2abb183aa2ac0b231a4104eb0ec01a3051c8e7821264e942bbf7173081e8a6f754f06e0fe45c0b847650b6b5a147e6ceff410e5d19a70986a9c92b6c97a6c630468a9b7e54d8e1f1f686dc98931594ad03a3908c8ed3f363d448fd54061f146834fbd865f760f457902501dfe2b34c1362c9181d4eae6c290895b6997c185e349fbd66ab9c3b98c22c720ae707759730c99414c0aea52eb2a729d00d5139334f504eaeeeca18241494cebd999fa417197a381cba975b6ccb4876c936b2e8bdf2bc37c9d6c8219b49378dfa4d1f605bc0eed5cc9578c9ac10a713b8953c10d1986cf06ec11f64a91325b3d4f5059910c9487340914b97c90e8af0c0603f5539b23fbb2618206706450db47a6ec08e9b6d3de26d8de081a2d1f76e1f68d74b52b19bc0ae3b6ae86db500a6c4cc129e134b37e9d74511991dc476a400183275c26866ce3a80308dc1c170c5f4fbd96815c15a3ec7ea1c140d1cf1d1858b9e0101d26c6c12131353d7a6285eead7c1a76e3e3dcc5cd49fec124ab09196567a7fd20a2e0c917ccc637791e2c3ae4ada1a0474894cf69a9387369c202f588539f20b5295f855ac67914dcbf76de81333b3a6bb266bf96008bfd09d066973af8f4b92167e00a68252a235b6e227a78000bd311e8358db626fa9ee9189c92bc3fbaa7a6f7d635040f9b15ff769c81fc8c1ee3a02b150a654c0e75c2245815976ed870fdab823ec9fb6b030594c32d23f547b7ebf6bc0933cad101391ba50f1854543f5abac07d43dcb9fa6d40ae4864f8b7fa83901f345cf0451b6f15f81714f81344560b8f69e8e4992c38915d20339a6c6bfe18b6a44995cd0b2f65b14ee13c00cb413173e84c0c7678c641caf33bace1474085b4d2d899e5e7d27719b424e074fbdbc7be2d209504272830c2247ec5437d1e9dd675f82c0ba5e996ca2812723294f484514f90a09f5a000d775fc0dfaef849d841a4f31fb4daee7886fbfa01af812d01e96a99c34dc0c4522befcacba494e0e41218b7980d1fa6b56b832273187c92dc300a25dd6c057a1fe78b29f580134fa151674a84459feb129b7f1696a128fec9e0ac5f3b391ab467649c5cf24d5ec0770d7e34a40dbbef7a0f07814c86e7c84740635db1b076f5d84808abf9a01408fec12c7bed626a2af7fbdcfa4b0025aa6e62960754a3d1f2e598661c3fd9a5b8756ebe1085353469608ced963188d6fb45c72cfc8c9f1b72213c741129b2f837d6eb07e3d9ffc9485129a380945355d14f4e47e62c9349c67d7aac1f6e8f6b2741dc282f660bfc4b39d486a709b08c042c56d76f735a5fa1b348426c818a00bc0c871c47f8ce4ef7cf78b7da5ad0a37f158d1597671d7fc24aee9c4fcac822915ee65e34c083d562403936070b07fc8ad0a969b22a1a44d41041450c4ad83ec58860735093cb7575343313c2d997e9bad65725729da658bcab8e55e9a171bb718fd7bf2d6274a8636884e7ebe8bb9d051f71d46903fb8883c31131a36427960dcc2679f9d0ee8e14ec2268787bccb2e26b54ffd756039083c588a2a14d3ff629210dd28312e5a1f6a6bb98d16865d0feda69d0973202bb4a21cdaa386c20c67112fa1649491dedfc02db3d0ebaf0e44059179c637908c49786638932dc6b822e872273eacfbc12e6b574d4d1fe5fc3712a703f50402c983c4845434be3386f321e254c672f1e5bf5ad3006cb60eab770adda7bf8a9585fd240da3081cae1d6839da971d7b70a78cc2b2ca650ccae4132f2da2775560191629bb264062bd861aa42ee34025913f99f1a2cf3739aa5580ba84095caa660ef13a08be3385c31437be0bb73edb396a9330edbdb6cd5bea1d79be28e1d41f2fc041232b1965e7d46f25f8e3b32bc903c750bf177e90dff59e42b6d1dd1d4ec5ad3736c37696ac634f29ac54f0a173152aaf163072e8ef17ff5e6ebfd0304e3be2e66afe3d19a01662c9a51e3e63ad3fce1ba02920ee89ab212cc185ca3b5a4b9e6de80934d4793e2c146d556dc6cd56072777cbdb2ac22865c8114dad9f962f0548a84b6bd7eeb131d8fcdd7e7446476af3b14284f3db3a979d75ba7acbd5658b0ea78ddc10bfc8a6b128276c82331868cbae769a23c4c7c019f5f4dccbf651d35d57fef8063e81b080057e67a5cf6ab01f9ae12172e1e4455dd7a1cd6e65f351ccd4332e54e7fc6ef0098faf15fa9691ddb505b1a5dd6d2ecfce30b0e8c188b520700f24f82fafa14674a3cbd4adc3b14973855f9514e9ea97b949f2e5d62057800d51ae07ba43b119edf28cd1ab30d02176afd03f117077ae10ec49474a73aaf8a83836b1cfac731b7e7588446ef0bbf108ef6ba6876fe8a6512a82307a46f9c174cf14b1f6b3b52d10980f17502b2037d7ff03b3c52db1f207c98c9dd86626a0140ab784071c554e5a3a85426f5c9e3b90c7f00b948429937a1d53f4b4660a220f7e15248b9e0622f4370fa0d8e26ff768ab54987c8fac755479041af26ae57031cdc89ffb84c071793c17311bc2b8cfbcc6757dd9b30511869ebe78db430f1e89b73e00c0c49c33fbd1c4499710518930afcf2df6732b71d46829fc527a9ece11dd7d00746a127ac1de4325266f15fd9b7e164d906c1f6d4b95a8a91ffba1cb05e7fe70c1dac5f37b713cbf0624fbe1a7271885bbc041e4247e5c453f844e5b8abf19ae44e4a5dbe34d366b49ac0ed8ef7f25166876753b87480e8e1e2a2595dc17449965972d5ce864a9e57f2f539136957eee786684ab53609a02d38e85eec7a61a517a2b86e145f391abe79bb688f052b6cdd8f7a6bfd6337ff6dd991eacb2b4566c69331f7c5705337e7378ca3f493868508da9f4546a7213dc4fc8525cb0b67efa430b7633df43609875bb4a7f3e5782b70af55cb85676992b88d6be0487f2eb89cfe304a4412fcc4dee2c9465741fb5cc0e02a2ba20c955bb1d398bd5ce127b62300c7f700862bf1427eea0f207a7bd0a9b58a79fa75690bd7057b0fcadaaba8ee85abb02369d6326e95535afdaa62e9c42d0956afa0aae91b768af09bb5f6a429206d538a4d67e089a2c9531ea90511c264472a871d8218e13083d9eb3f1ad62385d2cb7385b68b26253d3bde7554443d4b927efd4e97803e7ae4425c8d70c4de74be06be2e89847882539303a3c3c1c4bceb71d07010496403bf4136e8aed4ba632a5b142b4d1ddd9bed237e1a331a98e07ebcd3079b7d6d903384eec12a969140e301666ed39ad2c53d62476063912bfb12cc39a1725a17b1330eb7ac397bf26248b57323e06107978a52d2f56e7bc05df467c4d8b4880ace51e79970787f9115a0499b0288256a38d3d3d240e0ce2a28df76e2eb439490443917bb9067dd5abc8067427fa0e70e59a89013fe89c1e5335b39bfbcdb3820141bd04eeeab0f061e0a043f845afe9d84b1cc1350a9ac0ae9ad22f7f8d0bb81c271db3e6d737473a8d2f533a2dc5efd2f95b1d4b9ff158a62e78164d26402c5180cc6d919b9847e69bd6e2af5767313b6086a8a1378eb6d532d3dbc1419480376e4e1afd12345bd123f93c1a5212b95b62116f56599423ad45f4d101e594a019e4d2845648241258648982d43122cbb527da336ce2c9b30d937e92e70be19781d13b3cc3e1493c6aac94f5efbba1b0f16ecc0bc45ce958ceae423e941dee2c8fc4dd01038a3be9f64492500a8d8da133718afaaa04a59c9affc290581c4a435df5acbc802817c65d8f63dd25eeb2992a5d2baac82d6f6e7f99b55408285a630729bde0723d2bd49ad272d0ab980b32a2c6a57a2538306ebb69f590ac9e22bf7b24c52835bd259436bc6fe4d84f17aa7a2d055467f65f4e8497e0015f66cebb045f341917597b1ed864de621c63145c03b50e27ac46667ae3b224b1ddc62a705e5fbdc6ad98f6b4816964764680e8462a4cef9748985128130f9fde9b152032ace09abeb651c97146769e32a5f6299240a44b3a896312711ab274c77a84a97c68b89a4e8d4a40b1ec4038470b63f7ddcdd60dbde9fda44ac1f9c227798791ab27ed98983b7de696d39b362022ba6da43143d50d7c17190625633a19fddb0bc8a4b133b0f4222c8824626d07fa2c349e8d7a08baea5064eea9ba27f0a7c3e3af0b0cc55eae9d3e27af8387d889d8ce11923dd784385163d2473b6a6ba831f027291dc093be26a5bcd7c3dec28b4ac0bbe6b6169701e167cc046fe46488677f2f22d8abd872b064ad05b13c63292cbc5a4b85897d0c22ea4f57582cb3eb5b320f1e052da39fb02190f4349c4ae66dd9f1a17004c3749b577002d64beeb6a08af327538a3dd8de262d8437f46d7542c22a8bcb3232a0554ed857d634ad28fdf74466eb6eab91ff652fa23b2d23ae302f90503015acd98b53a75b0d7e7dd281c5efc79467ac0ffd348848503d94de171de6613c958c59a18fde665c3259605cd6e91bcb5f5264ec15ac93a6ba7ae54ef2acea891a84ff1632da14588e96f2f5de8c07fdca628810581472dfc48d5f50524e868b9101ece2474858f9f5e7bfc8a9da692e5a670fe64a2d1b06844308e3dd13ce1dac534bdf645809303a11e7c71062b9d12e45ea37ce759717a0af179305f5f1f96df0850c03472f1daee632e4cfebce9508a8eaabb8485ede728d808f0b69beff2dbc9902bb7ca5f38ad3f95a05f0aa75c9f511a5dfb852fa19c3971e980e60dd1d488b4ae21e751f134267e723c235912414412dc9c708fc219d87f4354e46370398929806d543cfba06a47b10ea1ffeba3dc8ab65835b265eeea79dd4ea990d5ceaa449a158185a771cdfc6380bab20b92841891c921d359c68d5e9310a59d87bd852da15dd57a59b172c197e62691f5b5729c745dcd3c7748d932b11a5738c1b8c11965115d2d24f46a1c2fb65ef0b7cd55525d943bb440000000099369f398fea98d3fd470decced8667c866e2a6f86c8dd49e57d6d611b86340048191d0732994c8f79464b7d141a8c3278855088ad8c02e9ff4e6c86cce33d8	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\IdentityCRL\Immersive\production\Token\{D6D5A677-0872-4AB0-9442-BB792FCE85C5}\DeviceId = "00184019984336A6"	svchost.exe

Modifies registry class 11 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2409539145-3342400454-2096821238-1000\{6737B332-2DDD-4B34-AB8C-FEAA13021812}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\Local Settings	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\malware pack.zip:Zone.Identifier	msedge.exe

Runs regedit.exe 1 IoCs

pid	Process
3148	regedit.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4636	SystemInformer.exe
4636	SystemInformer.exe
4636	SystemInformer.exe
4636	SystemInformer.exe
4636	SystemInformer.exe
4636	SystemInformer.exe
4636	SystemInformer.exe
4636	SystemInformer.exe
4636	SystemInformer.exe
4636	SystemInformer.exe
4636	SystemInformer.exe
4636	SystemInformer.exe
4636	SystemInformer.exe
4636	SystemInformer.exe
4636	SystemInformer.exe
4636	SystemInformer.exe
4636	SystemInformer.exe
4636	SystemInformer.exe
4636	SystemInformer.exe
4636	SystemInformer.exe
4636	SystemInformer.exe
4636	SystemInformer.exe
4636	SystemInformer.exe
4636	SystemInformer.exe
4636	SystemInformer.exe
4636	SystemInformer.exe
4636	SystemInformer.exe
4636	SystemInformer.exe
4636	SystemInformer.exe
4636	SystemInformer.exe
4636	SystemInformer.exe
4636	SystemInformer.exe
4636	SystemInformer.exe
4636	SystemInformer.exe
4636	SystemInformer.exe
4636	SystemInformer.exe
4636	SystemInformer.exe
4636	SystemInformer.exe
4636	SystemInformer.exe
4636	SystemInformer.exe
4636	SystemInformer.exe
4636	SystemInformer.exe
4636	SystemInformer.exe
4636	SystemInformer.exe
4636	SystemInformer.exe
4636	SystemInformer.exe
4636	SystemInformer.exe
4636	SystemInformer.exe
4636	SystemInformer.exe
4636	SystemInformer.exe
4636	SystemInformer.exe
4636	SystemInformer.exe
4636	SystemInformer.exe
4636	SystemInformer.exe
4636	SystemInformer.exe
4636	SystemInformer.exe
4636	SystemInformer.exe
4636	SystemInformer.exe
4636	SystemInformer.exe
4636	SystemInformer.exe
4636	SystemInformer.exe
4636	SystemInformer.exe
4636	SystemInformer.exe
4636	SystemInformer.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3148	regedit.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 14 IoCs

pid	Process
1312	msedge.exe
1312	msedge.exe
1312	msedge.exe
1312	msedge.exe
1312	msedge.exe
1312	msedge.exe
1312	msedge.exe
1312	msedge.exe
1312	msedge.exe
1312	msedge.exe
1312	msedge.exe
1312	msedge.exe
1312	msedge.exe
1312	msedge.exe

Suspicious use of AdjustPrivilegeToken 10 IoCs

description	pid	Process
Token: SeDebugPrivilege	4636	SystemInformer.exe
Token: SeIncBasePriorityPrivilege	4636	SystemInformer.exe
Token: 33	4636	SystemInformer.exe
Token: SeLoadDriverPrivilege	4636	SystemInformer.exe
Token: SeProfSingleProcessPrivilege	4636	SystemInformer.exe
Token: SeBackupPrivilege	4636	SystemInformer.exe
Token: SeRestorePrivilege	4636	SystemInformer.exe
Token: SeShutdownPrivilege	4636	SystemInformer.exe
Token: SeTakeOwnershipPrivilege	4636	SystemInformer.exe
Token: SeSecurityPrivilege	4636	SystemInformer.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
1312	msedge.exe
1312	msedge.exe
1312	msedge.exe
1312	msedge.exe
1312	msedge.exe
1312	msedge.exe
1312	msedge.exe
1312	msedge.exe
1312	msedge.exe
1312	msedge.exe
1312	msedge.exe
1312	msedge.exe
1312	msedge.exe
1312	msedge.exe
1312	msedge.exe
1312	msedge.exe
1312	msedge.exe
1312	msedge.exe
1312	msedge.exe
1312	msedge.exe
1312	msedge.exe
1312	msedge.exe
1312	msedge.exe
1312	msedge.exe
1312	msedge.exe
1312	msedge.exe
1312	msedge.exe
1312	msedge.exe
1312	msedge.exe
1312	msedge.exe
1312	msedge.exe
1312	msedge.exe
1312	msedge.exe
1312	msedge.exe
1312	msedge.exe
1312	msedge.exe
1312	msedge.exe
1312	msedge.exe
1312	msedge.exe
1312	msedge.exe
1312	msedge.exe
1312	msedge.exe
1312	msedge.exe
1312	msedge.exe
1312	msedge.exe
1312	msedge.exe
1312	msedge.exe
1312	msedge.exe
1312	msedge.exe
1312	msedge.exe
1312	msedge.exe
1312	msedge.exe
1312	msedge.exe
1312	msedge.exe
1312	msedge.exe
1312	msedge.exe
1312	msedge.exe
1312	msedge.exe
1312	msedge.exe
1312	msedge.exe
1312	msedge.exe
1312	msedge.exe
1312	msedge.exe
1312	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 916 wrote to memory of 4636	916	systeminformer-3.2.25011-release-setup.exe	79
PID 1312 wrote to memory of 3624	1312	msedge.exe	81
PID 1312 wrote to memory of 2364	1312	msedge.exe	82
PID 1312 wrote to memory of 1004	1312	msedge.exe	83
PID 1312 wrote to memory of 2364	1312	msedge.exe	82
PID 1312 wrote to memory of 2364	1312	msedge.exe	82
PID 1312 wrote to memory of 2828	1312	msedge.exe	84
PID 1312 wrote to memory of 2828	1312	msedge.exe	84
PID 1312 wrote to memory of 4208	1312	msedge.exe	86
PID 1312 wrote to memory of 4208	1312	msedge.exe	86
PID 1312 wrote to memory of 4208	1312	msedge.exe	86
PID 1312 wrote to memory of 2512	1312	msedge.exe	87
PID 1312 wrote to memory of 2512	1312	msedge.exe	87
PID 1312 wrote to memory of 2512	1312	msedge.exe	87
PID 1312 wrote to memory of 3444	1312	msedge.exe	88
PID 1312 wrote to memory of 2160	1312	msedge.exe	89
PID 1312 wrote to memory of 3444	1312	msedge.exe	88
PID 1312 wrote to memory of 3444	1312	msedge.exe	88
PID 1312 wrote to memory of 2160	1312	msedge.exe	89
PID 1312 wrote to memory of 2160	1312	msedge.exe	89
PID 1312 wrote to memory of 496	1312	msedge.exe	91
PID 1312 wrote to memory of 4432	1312	msedge.exe	90
PID 1312 wrote to memory of 496	1312	msedge.exe	91
PID 1312 wrote to memory of 496	1312	msedge.exe	91
PID 1312 wrote to memory of 4432	1312	msedge.exe	90
PID 1312 wrote to memory of 4432	1312	msedge.exe	90
PID 1312 wrote to memory of 2168	1312	msedge.exe	93
PID 1312 wrote to memory of 2168	1312	msedge.exe	93
PID 1312 wrote to memory of 4604	1312	msedge.exe	95
PID 1312 wrote to memory of 4604	1312	msedge.exe	95
PID 1312 wrote to memory of 5080	1312	msedge.exe	97
PID 1312 wrote to memory of 5080	1312	msedge.exe	97
PID 1312 wrote to memory of 4016	1312	msedge.exe	96
PID 1312 wrote to memory of 4016	1312	msedge.exe	96
PID 1312 wrote to memory of 4980	1312	msedge.exe	98
PID 1312 wrote to memory of 4980	1312	msedge.exe	98
PID 1312 wrote to memory of 3128	1312	msedge.exe	100
PID 1312 wrote to memory of 2912	1312	msedge.exe	101
PID 3128 wrote to memory of 4744	3128	msedge.exe	102
PID 1312 wrote to memory of 1408	1312	msedge.exe	103
PID 1312 wrote to memory of 1408	1312	msedge.exe	103
PID 1312 wrote to memory of 2480	1312	msedge.exe	104
PID 1312 wrote to memory of 2480	1312	msedge.exe	104
PID 1312 wrote to memory of 1364	1312	msedge.exe	105
PID 1312 wrote to memory of 1364	1312	msedge.exe	105
PID 1312 wrote to memory of 3448	1312	msedge.exe	106
PID 1312 wrote to memory of 3448	1312	msedge.exe	106
PID 1312 wrote to memory of 5332	1312	msedge.exe	107
PID 1312 wrote to memory of 5332	1312	msedge.exe	107
PID 1312 wrote to memory of 5332	1312	msedge.exe	107
PID 1312 wrote to memory of 5424	1312	msedge.exe	110
PID 1312 wrote to memory of 5424	1312	msedge.exe	110
PID 1312 wrote to memory of 5424	1312	msedge.exe	110
PID 1312 wrote to memory of 5584	1312	msedge.exe	111
PID 1312 wrote to memory of 5584	1312	msedge.exe	111
PID 1312 wrote to memory of 5584	1312	msedge.exe	111
PID 1312 wrote to memory of 2440	1312	msedge.exe	112
PID 1312 wrote to memory of 2440	1312	msedge.exe	112
PID 1312 wrote to memory of 2440	1312	msedge.exe	112
PID 1312 wrote to memory of 4012	1312	msedge.exe	113
PID 1312 wrote to memory of 2248	1312	msedge.exe	114
PID 1312 wrote to memory of 4012	1312	msedge.exe	113
PID 1312 wrote to memory of 2248	1312	msedge.exe	114
PID 1312 wrote to memory of 2248	1312	msedge.exe	114

C:\Users\Admin\AppData\Local\Temp\systeminformer-3.2.25011-release-setup.exe
"C:\Users\Admin\AppData\Local\Temp\systeminformer-3.2.25011-release-setup.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:916
- C:\Program Files\SystemInformer\SystemInformer.exe
  "C:\Program Files\SystemInformer\SystemInformer.exe" -channel release
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4636

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e0,0x2e4,0x2e8,0x2dc,0x304,0x7ffbff03c188,0x7ffbff03c194,0x7ffbff03c1a0
  2⤵
  PID:3624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1676,i,10002456809245452651,5090416894185435842,262144 --field-trial-handle=2204,i,14123015877987358828,172019551895634082,262144 --variations-seed-version --mojo-platform-channel-handle=2200 /prefetch:2
  2⤵
  PID:2364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1824,i,8979436077521201670,13855978596048526500,524288 --field-trial-handle=2204,i,14123015877987358828,172019551895634082,262144 --variations-seed-version --mojo-platform-channel-handle=2240 /prefetch:11
  2⤵
  - System Time Discovery
  PID:1004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2500,i,16097828565834898950,15374041615401326699,524288 --field-trial-handle=2204,i,14123015877987358828,172019551895634082,262144 --variations-seed-version --mojo-platform-channel-handle=1864 /prefetch:13
  2⤵
  PID:2828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3520,i,618376057183624670,8404639959122717880,2097152 --field-trial-handle=2204,i,14123015877987358828,172019551895634082,262144 --variations-seed-version --mojo-platform-channel-handle=3532 /prefetch:1
  2⤵
  PID:4208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3528,i,14313453049288094819,1651447423073808447,2097152 --field-trial-handle=2204,i,14123015877987358828,172019551895634082,262144 --variations-seed-version --mojo-platform-channel-handle=3536 /prefetch:1
  2⤵
  PID:2512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4260,i,5607954572719540343,5070328547480991210,2097152 --field-trial-handle=2204,i,14123015877987358828,172019551895634082,262144 --variations-seed-version --mojo-platform-channel-handle=4280 /prefetch:1
  2⤵
  PID:3444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4324,i,12039702408841970867,11993505906042484707,2097152 --field-trial-handle=2204,i,14123015877987358828,172019551895634082,262144 --variations-seed-version --mojo-platform-channel-handle=4364 /prefetch:9
  2⤵
  PID:2160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4348,i,12308632423029382520,3942752535626645448,2097152 --field-trial-handle=2204,i,14123015877987358828,172019551895634082,262144 --variations-seed-version --mojo-platform-channel-handle=4536 /prefetch:1
  2⤵
  PID:4432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4420,i,11685495782522750458,12764215172072382114,2097152 --field-trial-handle=2204,i,14123015877987358828,172019551895634082,262144 --variations-seed-version --mojo-platform-channel-handle=4328 /prefetch:9
  2⤵
  PID:496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3568,i,16600094119567439292,5917757734510929138,524288 --field-trial-handle=2204,i,14123015877987358828,172019551895634082,262144 --variations-seed-version --mojo-platform-channel-handle=5472 /prefetch:14
  2⤵
  PID:2168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5628,i,13743830114600389719,3233411681090915060,524288 --field-trial-handle=2204,i,14123015877987358828,172019551895634082,262144 --variations-seed-version --mojo-platform-channel-handle=5624 /prefetch:14
  2⤵
  PID:4604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5856,i,4693029379054140232,7186386044751443198,524288 --field-trial-handle=2204,i,14123015877987358828,172019551895634082,262144 --variations-seed-version --mojo-platform-channel-handle=5808 /prefetch:14
  2⤵
  PID:4016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5860,i,6195950826521925356,13747311506639421385,524288 --field-trial-handle=2204,i,14123015877987358828,172019551895634082,262144 --variations-seed-version --mojo-platform-channel-handle=5908 /prefetch:14
  2⤵
  PID:5080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6388,i,10176144385699050838,11891566248371382394,524288 --field-trial-handle=2204,i,14123015877987358828,172019551895634082,262144 --variations-seed-version --mojo-platform-channel-handle=6412 /prefetch:14
  2⤵
  PID:4980
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6848,i,8456114854652240905,5608748502068341009,524288 --field-trial-handle=2204,i,14123015877987358828,172019551895634082,262144 --variations-seed-version --mojo-platform-channel-handle=6864 /prefetch:14
  2⤵
  PID:3268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6876,i,8273770570991245152,1863926468136833131,524288 --field-trial-handle=2204,i,14123015877987358828,172019551895634082,262144 --variations-seed-version --mojo-platform-channel-handle=6912 /prefetch:14
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3128
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1128
    3⤵
    PID:4744
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6848,i,8456114854652240905,5608748502068341009,524288 --field-trial-handle=2204,i,14123015877987358828,172019551895634082,262144 --variations-seed-version --mojo-platform-channel-handle=6864 /prefetch:14
  2⤵
  PID:2912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6960,i,18395163778648672574,14016380184916668658,524288 --field-trial-handle=2204,i,14123015877987358828,172019551895634082,262144 --variations-seed-version --mojo-platform-channel-handle=7032 /prefetch:14
  2⤵
  PID:1408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7144,i,18309330579754636847,5802034263152424887,524288 --field-trial-handle=2204,i,14123015877987358828,172019551895634082,262144 --variations-seed-version --mojo-platform-channel-handle=7148 /prefetch:14
  2⤵
  PID:2480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6964,i,8821805745852209335,17124339557807175882,524288 --field-trial-handle=2204,i,14123015877987358828,172019551895634082,262144 --variations-seed-version --mojo-platform-channel-handle=7172 /prefetch:14
  2⤵
  PID:1364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7212,i,16211537178383220620,3242472762010419344,524288 --field-trial-handle=2204,i,14123015877987358828,172019551895634082,262144 --variations-seed-version --mojo-platform-channel-handle=7420 /prefetch:14
  2⤵
  PID:3448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=7284,i,1907451564558238926,6446521669737253039,2097152 --field-trial-handle=2204,i,14123015877987358828,172019551895634082,262144 --variations-seed-version --mojo-platform-channel-handle=7200 /prefetch:1
  2⤵
  PID:5332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=6864,i,13168031627904268324,12992343897384354711,2097152 --field-trial-handle=2204,i,14123015877987358828,172019551895634082,262144 --variations-seed-version --mojo-platform-channel-handle=6944 /prefetch:1
  2⤵
  PID:5424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=7432,i,12543091257766317196,5530295894381346726,2097152 --field-trial-handle=2204,i,14123015877987358828,172019551895634082,262144 --variations-seed-version --mojo-platform-channel-handle=4604 /prefetch:1
  2⤵
  PID:5584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=7124,i,6562753885045688917,6294316184860917613,2097152 --field-trial-handle=2204,i,14123015877987358828,172019551895634082,262144 --variations-seed-version --mojo-platform-channel-handle=5428 /prefetch:1
  2⤵
  PID:2440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6952,i,10374223773029265003,7157588023066890965,524288 --field-trial-handle=2204,i,14123015877987358828,172019551895634082,262144 --variations-seed-version --mojo-platform-channel-handle=4408 /prefetch:14
  2⤵
  PID:4012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=4412,i,8366966058754096474,16533889520924071891,2097152 --field-trial-handle=2204,i,14123015877987358828,172019551895634082,262144 --variations-seed-version --mojo-platform-channel-handle=7440 /prefetch:1
  2⤵
  PID:2248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7696,i,4809024448220585984,6435029580511407450,524288 --field-trial-handle=2204,i,14123015877987358828,172019551895634082,262144 --variations-seed-version --mojo-platform-channel-handle=7708 /prefetch:14
  2⤵
  PID:5136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7716,i,9298669299568063443,10936939141291362187,524288 --field-trial-handle=2204,i,14123015877987358828,172019551895634082,262144 --variations-seed-version --mojo-platform-channel-handle=7668 /prefetch:14
  2⤵
  PID:1124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7720,i,9226030443832966690,13208958580033101467,524288 --field-trial-handle=2204,i,14123015877987358828,172019551895634082,262144 --variations-seed-version --mojo-platform-channel-handle=7784 /prefetch:14
  2⤵
  PID:1684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4480,i,7845005371147054470,8066671453221240247,524288 --field-trial-handle=2204,i,14123015877987358828,172019551895634082,262144 --variations-seed-version --mojo-platform-channel-handle=4508 /prefetch:14
  2⤵
  PID:3144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3680,i,16035977152044034836,3492097418427837830,524288 --field-trial-handle=2204,i,14123015877987358828,172019551895634082,262144 --variations-seed-version --mojo-platform-channel-handle=7556 /prefetch:14
  2⤵
  PID:3448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3752,i,16979493959407339580,1534227492944388798,524288 --field-trial-handle=2204,i,14123015877987358828,172019551895634082,262144 --variations-seed-version --mojo-platform-channel-handle=7084 /prefetch:14
  2⤵
  - NTFS ADS
  PID:2980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3636,i,5200037187302978949,3468252473815680082,524288 --field-trial-handle=2204,i,14123015877987358828,172019551895634082,262144 --variations-seed-version --mojo-platform-channel-handle=3668 /prefetch:14
  2⤵
  PID:5364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6760,i,1323230155550212697,8208183153058397766,262144 --field-trial-handle=2204,i,14123015877987358828,172019551895634082,262144 --variations-seed-version --mojo-platform-channel-handle=904 /prefetch:10
  2⤵
  PID:652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6744,i,15408345847260594843,6753850150099997044,524288 --field-trial-handle=2204,i,14123015877987358828,172019551895634082,262144 --variations-seed-version --mojo-platform-channel-handle=6752 /prefetch:14
  2⤵
  PID:4780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3364,i,11808340244077515818,7143730135059725422,524288 --field-trial-handle=2204,i,14123015877987358828,172019551895634082,262144 --variations-seed-version --mojo-platform-channel-handle=6764 /prefetch:14
  2⤵
  PID:3816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5756,i,283892501478843746,3630914597165103797,524288 --field-trial-handle=2204,i,14123015877987358828,172019551895634082,262144 --variations-seed-version --mojo-platform-channel-handle=6100 /prefetch:14
  2⤵
  PID:2504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6040,i,13867497324292271960,17239176071776084414,524288 --field-trial-handle=2204,i,14123015877987358828,172019551895634082,262144 --variations-seed-version --mojo-platform-channel-handle=6064 /prefetch:14
  2⤵
  PID:2480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4388,i,12751899582538249243,12121624740428458950,524288 --field-trial-handle=2204,i,14123015877987358828,172019551895634082,262144 --variations-seed-version --mojo-platform-channel-handle=3768 /prefetch:14
  2⤵
  PID:5280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --always-read-main-dll --metrics-shmem-handle=6068,i,6803559693506190023,9415852453928838759,2097152 --field-trial-handle=2204,i,14123015877987358828,172019551895634082,262144 --variations-seed-version --mojo-platform-channel-handle=4388 /prefetch:1
  2⤵
  PID:2760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --always-read-main-dll --metrics-shmem-handle=7460,i,9802903258620030457,14333820981744541767,2097152 --field-trial-handle=2204,i,14123015877987358828,172019551895634082,262144 --variations-seed-version --mojo-platform-channel-handle=5184 /prefetch:1
  2⤵
  PID:5080

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2264

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
- Modifies data under HKEY_USERS
PID:5368

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4004

C:\Users\Admin\AppData\Local\Temp\Temp1_MEMZ 3.0.zip\MEMZ 3.0\MEMZ.exe
"C:\Users\Admin\AppData\Local\Temp\Temp1_MEMZ 3.0.zip\MEMZ 3.0\MEMZ.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:5524
- C:\Users\Admin\AppData\Local\Temp\Temp1_MEMZ 3.0.zip\MEMZ 3.0\MEMZ.exe
  "C:\Users\Admin\AppData\Local\Temp\Temp1_MEMZ 3.0.zip\MEMZ 3.0\MEMZ.exe" /watchdog
  2⤵
  PID:5500
- C:\Users\Admin\AppData\Local\Temp\Temp1_MEMZ 3.0.zip\MEMZ 3.0\MEMZ.exe
  "C:\Users\Admin\AppData\Local\Temp\Temp1_MEMZ 3.0.zip\MEMZ 3.0\MEMZ.exe" /watchdog
  2⤵
  PID:2156
- C:\Users\Admin\AppData\Local\Temp\Temp1_MEMZ 3.0.zip\MEMZ 3.0\MEMZ.exe
  "C:\Users\Admin\AppData\Local\Temp\Temp1_MEMZ 3.0.zip\MEMZ 3.0\MEMZ.exe" /watchdog
  2⤵
  PID:3120
- C:\Users\Admin\AppData\Local\Temp\Temp1_MEMZ 3.0.zip\MEMZ 3.0\MEMZ.exe
  "C:\Users\Admin\AppData\Local\Temp\Temp1_MEMZ 3.0.zip\MEMZ 3.0\MEMZ.exe" /watchdog
  2⤵
  PID:5344

C:\Users\Admin\Documents\MEMZ 3.0\MEMZ 3.0\MEMZ.exe
"C:\Users\Admin\Documents\MEMZ 3.0\MEMZ 3.0\MEMZ.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:5640
- C:\Users\Admin\Documents\MEMZ 3.0\MEMZ 3.0\MEMZ.exe
  "C:\Users\Admin\Documents\MEMZ 3.0\MEMZ 3.0\MEMZ.exe" /watchdog
  2⤵
  PID:6012
- C:\Users\Admin\Documents\MEMZ 3.0\MEMZ 3.0\MEMZ.exe
  "C:\Users\Admin\Documents\MEMZ 3.0\MEMZ 3.0\MEMZ.exe" /watchdog
  2⤵
  PID:6000
- C:\Users\Admin\Documents\MEMZ 3.0\MEMZ 3.0\MEMZ.exe
  "C:\Users\Admin\Documents\MEMZ 3.0\MEMZ 3.0\MEMZ.exe" /watchdog
  2⤵
  PID:6040
- C:\Users\Admin\Documents\MEMZ 3.0\MEMZ 3.0\MEMZ.exe
  "C:\Users\Admin\Documents\MEMZ 3.0\MEMZ 3.0\MEMZ.exe" /watchdog
  2⤵
  PID:2096
- C:\Users\Admin\Documents\MEMZ 3.0\MEMZ 3.0\MEMZ.exe
  "C:\Users\Admin\Documents\MEMZ 3.0\MEMZ 3.0\MEMZ.exe" /watchdog
  2⤵
  PID:6072
- C:\Users\Admin\Documents\MEMZ 3.0\MEMZ 3.0\MEMZ.exe
  "C:\Users\Admin\Documents\MEMZ 3.0\MEMZ 3.0\MEMZ.exe" /main
  2⤵
  - Writes to the Master Boot Record (MBR)
  - System Location Discovery: System Language Discovery
  PID:6096
- - C:\Windows\SysWOW64\notepad.exe
    "C:\Windows\System32\notepad.exe" \note.txt
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4128
- - C:\Windows\SysWOW64\regedit.exe
    "C:\Windows\System32\regedit.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Runs regedit.exe
    - Suspicious behavior: GetForegroundWindowSpam
    PID:3148
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://pcoptimizerpro.com/
    3⤵
    PID:3320

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

SystemInformer.exe

Path C:\Program Files\SystemInformer\SystemInformer.exe
Size 3.3MB
SHA256 0684d5382c346850eb2378caaa73606671ca579dda624c3d4d042ad514a50b32
MD5 c21b9f52e195471f3978df692c46c714
SHA1 f64ab91451fd761b690d070a007b72c309447304
SHA512 c995a8ad39a1f77d808359554f35f7df7ce8f0382c1aa6cda731bd645bd1c46ea4ab0b56fe7818bb9249d007fb695dc40f84680cd2c5f9c26ba5ac54b34c5b22
SSDEEP 49152:VCxNI5Ruvdoogy6gebfHcQnOswgjlPBqKP1x1yeTQjDkdWj6ZkJNNosWSP3MLa+v:h31xuD8RdZv
TLSH
T156F57D03A2E740E9D4B7C2748667C522EA713C551B369BFF01A0D5692FB3EE18E39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DotNetTools.dll

Path C:\Program Files\SystemInformer\plugins\DotNetTools.dll
Size 197KB
SHA256 87ec8a69759dd320fdcab90266623593db49cb20313181553a2ecf3a1cab0715
MD5 9e7c936f72caa3b7dfae0257368a2c64
SHA1 57983264011f7b905d4cbcb401aa5a67c5b2c8a7
SHA512 a9aaf9eeead9e951a44f6af83e9e106f1dbcf1a2d211ad575d12509690555f91deda8430e5812d13b750f895ec9f6336b6a88822919e22e32cb90ecad3a6e3c8
SSDEEP 3072:6h66ffcipBAZoGibLadTn5WBEcWRO9JrvuElzq8DrNpi6tLuW:6k6fE6SqiVneE1S9DrNhyW
TLSH
T111143A4777E800AAE1B7967885634B16E773786117218BEF0364823E5F237D0BE39B61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ExtendedNotifications.dll

Path C:\Program Files\SystemInformer\plugins\ExtendedNotifications.dll
Size 148KB
SHA256 bcf2ab73e375aa67db089de7bcf49c718dd5da915c5e9d79f97ef6bc1437198f
MD5 0a13f312b2adac92056fef7e50406095
SHA1 dc1527bff0e4eb71b2396706b3c91b3604d6b9a6
SHA512 53cdcf158d43050c7e2106cb8cc1554bf3bf4e3bf81e56112f685a564ec27b90039788dfb43b3b469ddd875ccaab2c1bd89ed70e2765a6545d49efa2579d0011
SSDEEP 3072:MJ34wNCtZRthpLIMfROjk+UCEMJOtsoQINT4:MJF0TRiMfAEtm
TLSH
T151E35C57A7E400ABE5B79A38C4A34F05D775B85117609BEF03A4425A1F237C28E3EF62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ExtendedServices.dll

Path C:\Program Files\SystemInformer\plugins\ExtendedServices.dll
Size 197KB
SHA256 26c4d8447aa6e2e7eb6bc45a3ce724b12d9e9fac868b5607270440f9df41d928
MD5 ef110f47f5b2eaa7fb338d8689f0b214
SHA1 657efcd1abea5ffc4e13ab4c188277a24d87cfde
SHA512 f59940236e58d221ea68fe611a041a14b23ab7a70b67863d3db1192d26e64ca1d0d0bfbdb5225cf3e74bf1e66637b133e77dfd379540d520889ede7f1f761f9b
SSDEEP 3072:bbvnKDTNHsWLDtLQNbw3dZ3MSyVpqNLKvz:sNNdQFMdXk
TLSH
T16E14074373E9016BE5B7963888634A12A773B8515721DBEF0360C26E5F237C1BE79B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ExtendedTools.dll

Path C:\Program Files\SystemInformer\plugins\ExtendedTools.dll
Size 2.0MB
SHA256 373a7c6ad487971ba02e415f4b13d73dd94d63e6569e581f64df5d3f2e13fbf0
MD5 7ec2a164acabb32de4af0c551cdae844
SHA1 2b494bb02986a860f1b444d2738ee5f7ef239cfa
SHA512 31b256d8e087e0e1d2dda7553ba6de9af89e2459bdff4651bed3b8db214c20fd5b535ae6bb12f4d9eeb8ca645f6e95604478521947c3d2e98c078fe8eb0b6681
SSDEEP 24576:t4KPn3zWhWDeJadYwVQ2jFXDQX4zs6Z66z24VZbUDj0Qq4VRXm9qe:tZdYwVxzLZ66z24VZb7iVR29F
TLSH
T12CA56C42F3D810A8F0A6A6798B7BC6219772BDD4073549EF11A4B50F6FB3AC11536F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HardwareDevices.dll

Path C:\Program Files\SystemInformer\plugins\HardwareDevices.dll
Size 346KB
SHA256 57306fe197c9dea97b9daae7028ec048c411ebfe9d1d9e473b967ed24ca1b8a5
MD5 91c13a046afaa86c4068e4a78eb8950f
SHA1 816ae864bc592c92923c93ceb06f12582c084d2d
SHA512 1c02cf9be70990377ef508ade9510b9952f766b615e25184f200f8dc6242e98161dc0a29a347f78eae452396acfdad24804c61f7a0ad712ae6d9eb9d72ae1bdf
SSDEEP 6144:yI3R9h1N/rKU/yQhnkqqe7stuOeqP+UPOYio:yIbd/1/hbq6rOelnYio
TLSH
T16D740845A3E40068F1B786789A738A16E7B378645770DAEF1370C56D2F33BD1A938722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NetworkTools.dll

Path C:\Program Files\SystemInformer\plugins\NetworkTools.dll
Size 741KB
SHA256 3fa9007708ac969e2797072cafa1da41373fed463a56b0cef27719a9da192187
MD5 58aef8e09368bbf80395f2d47c946105
SHA1 29f245fdd68443f36fc231feb411a160b8136401
SHA512 b4a1234f3d8c332849bd6c5eece93f919702b91489605725756b3db675fffdedf38cf8e943f6a3d82e415cb5f0f5055f2f09fd6e83bc0d899a3ce1f79031752a
SSDEEP 6144:CSXVHH/7PjW0HGGol4cZd3G6ix0z6j8kFduuXKmDygv9vJCuyJLzioE85BhxyydO:CIHH/7rmv4cPOF4Uunqbv9ULzhE8hO
TLSH
T180F4C695B7E5552CF4BB8E30887705209B3A3C511E50FA8E0290B02FDD7EB98DA75F26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OnlineChecks.dll

Path C:\Program Files\SystemInformer\plugins\OnlineChecks.dll
Size 197KB
SHA256 360c36e87659d74c694a7b323ea8399d59cc892577adb5650ae34e8fae8bc4c5
MD5 7436a74c4ef6417899decc3fa315d37d
SHA1 564e70e4508023082b9b979b91f2cea4f52b9743
SHA512 bbea43456d9133da7423478e116323262a74a04d27ce4563ad435fba185106733ca49cecd6a76c33bdc2459a962fe6d0915efa659c9672915ef04485d6ed0119
SSDEEP 3072:Lv11l7fGL8y/VKefW3Ip3OHWlfPVOLDr27h+Y7ENk+p944m/+x+:pjGn/VKe+3mh18Rmb
TLSH
T119146B47B7E40076E5B7973888674A11E77378015B309ADF0364827E6F277D1AE3AB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ToolStatus.dll

Path C:\Program Files\SystemInformer\plugins\ToolStatus.dll
Size 402KB
SHA256 9faf58681a6daac5a7438b4e6960f98e3a051b0c15c7466729eceaf4acdbb2ed
MD5 4d8846a2fb261450833b504e39ed1530
SHA1 57562d69582db784982b7b7eb37fad2b8eea086a
SHA512 750b423016d76e8f34466b0585841cf098d5099d3cf6063b638be635c66e0078afd76f4773027c8c778f8d54d77c6b6b7cc77dbdd2582272ba5b9509df825040
SSDEEP 6144:zqBkavj8TwTP6ffcheepWhxyKUKKeb21wtG:zavgTd3cheepWhxrd7ZG
TLSH
T1F4948E52F2A004BAD9EB4574C1A30E025A737D510B2046EB1679B56EFF3A7C2B83DB17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Updater.dll

Path C:\Program Files\SystemInformer\plugins\Updater.dll
Size 177KB
SHA256 c18a881ec91ce13fdf69bcb7c12db2101dd7abeb62258ae9294aab24a3d4d2be
MD5 47bd5acc2a658c3d4f2479b823023e84
SHA1 14d6a6e3012ae42462f44ded048d7ac04e141355
SHA512 0ce0f17a1e771aa5b67c050d9d93601de62cd50ae3dbf7b377ab28894c762a3ba1b106acd96dff2dff8584e4045d8d1bc4eff246150a909ddc4baf0336bedfeb
SSDEEP 3072:sQu9AZD/6KUQOTtDkEcjgMR85D+q7QgKLsWbuh3v4X4ncwjdUTFAh2Yso0kPS:sb9aLUtTcjg08r2YWka
TLSH
T1EC043A1777E500ABE5B7867885B34E12EB72B81157209BEF0374862E1F237D1AD39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UserNotes.dll

Path C:\Program Files\SystemInformer\plugins\UserNotes.dll
Size 185KB
SHA256 f63accb8ebc244e1dec4451674b8f2a61261f50fc3997fc2919c5037e998afe9
MD5 d128690a552ca701bb9a81f49eee2e02
SHA1 ca40fb0c972886a157e4d188842d7e292b6482d2
SHA512 1f2df3092d25281e16bd4997a19e9db2fe0f3ddebfc41b22de5db76fa1071fab7d54df168fcd9f7eb37da0982ef20734889b0a1067c3246330f50b1fde725c60
SSDEEP 3072:BPQ4TDQg22zXrVyzuW8r1lK1KLopkehsYSqmwrQrcsgk9f2Q:xFA2bryV8rahpkqJQvtr
TLSH
T171043A57B7E500A7E077967488A30A12E77378612B319BEF036481792F337D1AE39B61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WindowExplorer.dll

Path C:\Program Files\SystemInformer\plugins\WindowExplorer.dll
Size 205KB
SHA256 3d3140e0a0d8cc188583f304465e26b2e083110781a28b6cf7c93724ffd29fa6
MD5 8f7dc18997561957256adb821e70f0d0
SHA1 4e46de5c75fb8412adedae520e4412d767465ee9
SHA512 a9f32ad0c0ee3153c9540ff21043f970efaaa30655cff29a4216ea2d8a986b0b09fe33bdbea1f0e9fed8c64b795e05021d4d2b31ade064dba2567389301fb516
SSDEEP 3072:1Efn+uG/qkheXb/ntrk4NiPI+JtrXKICsMdFLI0Bq:1TXe7tkayJxSl
TLSH
T1F3243917B3E5006AE477967489A38E12E7B3B854176097EF0324C27E5F237D1AE3A721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 acf2ca2fd979c7d8ae7b74bb0af4308e4abd3e42e1f32fd1a04b0ca1a2b166c8
MD5 80eaf72bc0ff9c89a5c23f07f38ee8f5
SHA1 cbf109666417a1db022b3f49a91481b9755a1b8e
SHA512 b21d0ebff096128eae96a603cc0e96af95cbca34e613c40faa0cc8c5c17961106d997b66011c3051ead599494bd80939479f2526a2e65ff25600b04b19065afd
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7T:fwUQC5VwBIiElEd2K57P7T
TLSH
T15EB3B931457E36BF26E93EE828CF1511B84F3912624895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

protocols.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent\1.0.0.12\protocols.json
Size 3KB
SHA256 2edf732da5fd827859e7a1a5b69a4a622cfc416f60a6ae04154d5aad3a1bccec
MD5 5e2067a92dcfcb05537479c384a89725
SHA1 eeed29b07d865ac4d46629fddadad629d0ad4e2b
SHA512 c96c5f9cb7a169ad91b070b567cf9fa8f35951ccc5aa930e97dbeccbeac27f7e9dde1379138c9ba6b0d10339f9cb053ef21f19f06d7560f97d5d23a27c8ed4f6
TLSH
T17D7184B7862088194E360AB4AA0DF10DF93702DF2AF598D3B27D455F1F712BB3946249
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 0b5dc1bf65a27f8ea20844919d7db192caf7a54fd791434a1304a7df2e9b496f
MD5 5de7bfd3f869f48e7255b6bdc532c4bc
SHA1 c26027eb70bc9887bf69c2b22be60226b685dbae
SHA512 0e6af8c455f57dc816a2c01366f46a0d069e8f41cccb1f7565e2afd873b71ffd5f135649fb4bf44d1a15a9efd68dc59696dc74a971b3483ec9d87a4323b2b4f2
TLSH
T112D08032FB5D6052E7455230D893DF10276644A12C974B41E325C84CD5B80D493C3282
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e3c932e879f8a7071362a654b47cd73c05f90d7fe66be785d811b84b86743e1b
MD5 8c92d931ed33c3d779a020ae7e111fb4
SHA1 de123f6d92bf24747affe820aaa8be3785388fae
SHA512 5be895d6a61eacf4f3117293636fb4890abbe186ddcbfbb3c8d3aa0fd1aa59519bbdd86e552732d2ded27aae5be1ffb0d6d9f6ccaac824d1b13ed03a12a438dc
TLSH
T13BD08032BB9D6452E7455230D893DF10276644A12C978B42E325C84CD5B90D493C3282
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 7KB
SHA256 570c4ae67569bbdfdb83559a270595fde0d56e9c4f1c50024c036336c2b16809
MD5 9abd432c039bc3d7ee404919c7f4412d
SHA1 ebd77091f251886cdee2efdec8c041ae02e4cbbd
SHA512 be99da91b2acbdfef82eaa7104f6280836dfadb39f8708d6e497d99f19b8316688825f7dde8fcbd35ea1e767c4793cfff2e9ed83e9d29b2d80d09dc4220a44b5
SSDEEP 96:sMd3UU9gIh3e1/a2iQKWqAq7x9aXd5duI6Yqx1j/lrKqV7YDna2pjsAkUjxOgl+o:x3UU4aixBhKdrL9AjsAFrR4sEWkIkuxb
TLSH
T1B7F15214CCD556CBFB91A533B2D09A1F3BB9B0C758434F4A82B87F34650AB9DC9A182D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe595b55.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe595b55.TMP
Size 3KB
SHA256 1fcf5d3b6d72066c399b18c535e9b326304a3e2c1870e026e77b1d728523d669
MD5 efdadaff4236555a3fe29903373d21b4
SHA1 5c673dc5a822cdd5bed2d74c86e23f79b64e8e27
SHA512 26b90350abc2ae12200e1e25c242b0c1bda86583b6625d89c0372f710260f563bd7b6494bfe17cc2c462a023d2a82ea621444f96ec195ed6c979d3be28034c95
TLSH
T19171922944D200DFF390E930F3D1463437FEA0DAAA939F2907E899756509F10D975D2D
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

128.png

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.108.1_0\128.png
Size 4KB
SHA256 41b21cd721317759a1391ec66ec4606b1f1b0a66fc6542ec3e69f9a6ba9a60d3
MD5 a6e517fba00c44d26f516d2bc473042f
SHA1 bcedbf549056bfacff8820cac38713a1eacd95b9
SHA512 8c58b58a05b60420ff187c2dc8b71e019fc36cd6bcec050257b5532f131ba50ecd00fe2ca734805753a39f6911125d2d8684286207b1d1d039e862904279a145
SSDEEP 96:4niq7dWteEb8MsIhE+bf+rgEPQCGJxc4bOdpI0xeblJpzSkLqdsQ4pXnW3P:e97kteEnJEu+rxoi4b3RJpfhQ45nGP
TLSH
T14AA1AFFA12E3DA94303E91711B20659B4D7909385624364DDBB2AC7140C7A0D9B7CF63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.108.1_0\_locales\en_US\messages.json
Size 1KB
SHA256 102b586b197ea7d6edfeb874b97f95b05d229ea6a92780ea8544c4ff1e6bc5b1
MD5 578215fbb8c12cb7e6cd73fbd16ec994
SHA1 9471d71fa6d82ce1863b74e24237ad4fd9477187
SHA512 e698b1a6a6ed6963182f7d25ac12c6de06c45d14499ddc91e81bdb35474e7ec9071cfebd869b7d129cb2cd127bc1442c75e408e21eb8e5e6906a607a3982b212
TLSH
T161210707DA04AB37827A6136BC656685F33007EE2201E86F7DBCD50C5F229A791A7798
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.108.1_0\manifest.json
Size 2KB
SHA256 bbdc79c9ab2f2514cbc298b3b7fb7506f9e746b597b132c59ad004619c7b9a87
MD5 88668a1cd61c9f5afac6c089f45d6244
SHA1 f064a4ddb0e8110f87a7fc90c9a914e98f6d4ace
SHA512 03db2f0c91ff68a9c3f9e75c728b76599cf786c6f414607601c53987d6c1f9ab42fc234c058d09cb31f00095ed6d054b201a06cc638413e2e45bf66f86f7d65b
TLSH
T10F516DFBBC10AC634BB08594991A710EF729735E45CFC4DBB2BC60734BE4CAA1D60598
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 6KB
SHA256 5047a542bd47b8cdbeed372c660a409f43ce891e94583321db06108d69d2b505
MD5 940e48cb0991e5df39cdd3e0d591f32b
SHA1 2ffbcc8aff6e5f29906babd6f9590c26c6bc8fbb
SHA512 4fea347eb396706612170358e88bcb15f80a206a333f4ef79fb4ef9043583c4d3ecfa43e861834b1c7e0ea827d5e26fa7a8b1790d702abee8047ffbd6e4e17ca
SSDEEP 192:DLvbW09isfLa7g577OcxVckThkivBigAbCJvc9w4BGT:DLvbW09isfLa7g577OcxVckThkivBigN
TLSH
T1A0E1ABF3C3E9822DC91196F0AA186F1BCE1C0956436C3D5A85D4AF5B93F28B1E151A8F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 6KB
SHA256 4d524525c1f3daec3d87c0124d3eb5b0b05d571fea4486c10bcff2783e4ce78b
MD5 0ed024f4ea472045f093e618c5a9f78f
SHA1 a05394f7af413b9c0df0634fc27ad66ea9708075
SHA512 415a7dfddfdf72e0c94f1ab92c77d81fff43980649ce032a1646a0bf08d10bb7a972fc77d7af491b53861c838704b302fa292c9ca49c43781ae978eb6001b055
SSDEEP 192:DLvbW09+fLa7g577OcxVckThkivBigAbCJvcYGwJT:DLvbW09+fLa7g577OcxVckThkivBigAQ
TLSH
T191D1ABF7C3E5822DC91196F0AA186F1FCE1C0556436C3D5A85E4AF1B93F28B1E151A8F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 209B
SHA256 d0008e446674f3caa06a56faf8552f6089b7f63b751b7a8b840f8f5bc32dbaf5
MD5 cdfcf13896d0a440eef93c1f3e17a3e9
SHA1 1529c76a23f028c75bd86bf4cb7e430bf138f41c
SHA512 be76736bf37baf39e9b100531fc562b744f26833e7945f24f1c06489902898f72ca1f133ea6e4de5daac3b4a7e5a365105cf849ca9993b323be30d546d6fc8ad
TLSH
T1AED02357510070F5599C7DD9805DAC8FC32610220441DDD525D0DC990A3745C0907241
MD5 SHA1 SHA512 TLSH

Submit Download

Sdch Dictionaries~RFe5908e0.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries~RFe5908e0.TMP
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 18KB
SHA256 6cac4c53631d0c1d569256bd0c8ad85d209e12e9a9d76f860b3fe681d2473261
MD5 06ed8c8788fdd3219e15ece91beabe5f
SHA1 f17eb1f3ba8ebdbf0e7178b26929bd21b36bdcd5
SHA512 b760a49b902337405f93c1f6314aa6dc1271ea2c9c33dcc895485c29d63c92d4aa83bbdc3a43defcd9928f7c9398687d28283b53fab49a26327e32b23fb90654
SSDEEP 384:sxZGyn2a8m18W/f5gsNi45c/bRs/o9AMxkIY:sh2Dm1N/f3i5/boIN3Y
TLSH
T1199209526A248977CCDBC219FD257F93D6F8042399804E9CA9FCD91C04EB6ED2213C5B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 fd66289904c48efec93ef4e0013b2e21d40452c65b9da7bc1a81e37cd4ad0617
MD5 70ed36fbe5b920858a2f178f208fc673
SHA1 4a81dcd4ee78e2e9c991e66baa29ee019ad7556e
SHA512 d6b49b0772d385c6a6550d42c989da383337b1740b9b5dc87da04cf851ee1ca3f5dea4d515b79475b52e064344ad5e126c8f051021563ef13d39bbaf3c857798
SSDEEP 192:sxZGMQUnpRUyM/jK1Ml8Mc8W/f5gsDpY0bjadpja/W6+WNBqB/ovR20oXlyjIg4J:sxZGynpaU8W/f5gsDiKq2/bq/o9Xc
TLSH
T16162F8126A34597B9CDBC21AF9057B93D6F80563D5900E58E9FCDA1C08E6ADD2213C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 19KB
SHA256 627efe95ac425539611732035e5341a069bb8a13a3ea142ba9800f36bd206d77
MD5 7ae482646a18c7ebc608346f6b31b7e2
SHA1 cf3d3e7b3feca7dab2108f59f533a82f1d301722
SHA512 015527013286034984d0be6e16d97b7a87d9354e762af37871b1c02b82c841a0e79b638dbd19ce66e55704dfd00b842ae7d2b2460bc9bafe2455376fb6614f54
SSDEEP 384:sxZGyn2aqLm48W/f5gsN8H5//bRs/o9mCxkIY:sh2lLm4N/f38h/boIN3Y
TLSH
T1ED920A5269248977CCDBC219FD267FA3D6F8046399804E9CA9FCD91C04EB6ED2213C5B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 19KB
SHA256 8201460fb069344a7855000a55926db80e2d5704b3c83ef385de782e7efe8c68
MD5 46226b7c1836ec23f6b16ee07e7710f8
SHA1 496dcfbc93cea193865167de2b94c36d3b08a8e6
SHA512 ca32481280a93c2b6132afe39c05b182d2256b13e0fcdfd4261268b8b3068587932cd0a8cd3410c418a88558623cdb1b659991925e9901e821ac4bfa322587dc
SSDEEP 384:sxZGyn2aom48W/f5gsN8H5//bRs/o9mCxkIY:sh2vm4N/f38h/boIN3Y
TLSH
T1AF92F9526A248977CCDBC219FD257FA3D6F8046399804E9CA9FCD91C04EB6ED2213C5B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 33KB
SHA256 265254ddbff38a1ea2ecb5968c703e7fc5707d67830baaf54a83576ede255461
MD5 dab26b88f31488ab39fc55e714274c5b
SHA1 09fae275716d99041e803cdaf7390edfcfe0a389
SHA512 33e0114d300e7962188c2eda22e585f6a6d4c0b5bfed49bd840694ac9e2262df2746f194d481591a07566cbe80b9294710a4c748c3f84e4ffccbd9d600c1efe2
SSDEEP 768:bFc0s8Ww2BfWRm/JQg18F1+UoAYDCx9Tuqh0VfUC9xbog/OV3Nw6OLl/TB0OUEr0:bFc0s8Ww2BfWRm/JQg1u1jaKNw6OLpTM
TLSH
T1CFF2093B284CC77E4F840E9DEC26AF966EE8018BA658495447FA484C03C77EA521B49F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\07ccfa36-fc55-427a-a85a-bf08386ae058\index-dir\the-real-index
Size 72B
SHA256 e60aa80bafeaf7f41784c1ff87ab290d232fbef07d7e128ebf0c2b04d21b4e3e
MD5 50eca271e40490cb77a943a5c0ac2bb2
SHA1 9dbee08b9e12f6d6f749b9fa60026392fcef4b38
SHA512 6a564b06e5a5919b42ef076467379a53708b940e67943e61cdd8ab62b93df0085580c5c762955e426171bc5c1768b93a93ba79e25c9e4b80212d07521af9ece7
TLSH
T12CA0021A02840141C05223F975DE0689A3366D2812211305D3A0419FC8955894D5510C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\07ccfa36-fc55-427a-a85a-bf08386ae058\index-dir\the-real-index
Size 72B
SHA256 4ba6658c075224726e6877de563abab546e85952fb71113026f9f70de7456ad9
MD5 c78df8d25c649778d1b266a8f17112f0
SHA1 8bc5dc6ee03a6996d139851e36191bef34e4c8e0
SHA512 50e3fa3a71d5bfbead9c9694ba213f56111844b4a5b2650567d62745cc042af1b8aab633ed7807437a0b4676c72722e579230893dda9749e2f75091ebbfc9d22
TLSH
T171A002118F86011FD11261F1669303911744CCA41100971B41A10044CC55C414D8141C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\4468336c-582f-4524-a120-26f9d90c9063\index-dir\the-real-index
Size 3KB
SHA256 715ba5dc731935dd274218d37beb08033691946a4b3254d65e3a9853454c2bad
MD5 d4fe775902ef56fdb84cccbd2c265551
SHA1 7dee7e8aa49e484a04ad5580493ade809cdfb476
SHA512 1485e0b5f6f768310939916f8f09e6a9dd75ebf073deb391fdd7958f415832893b8a8242a7afcfe07eacd3ee097cf2f22fc9dcf15f8b1cf025ed1c5abc53a428
TLSH
T14F51B70E4C832B59F9AC257218F604543B75B4FD66949A17B5EC5834BDC336A28A9328
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\4468336c-582f-4524-a120-26f9d90c9063\index-dir\the-real-index
Size 1KB
SHA256 cb4f1614db4c2c67a6d2db821f80376400cd700f58360035cadef9ec57d0e5f9
MD5 31e86551e7b4ec40b1ebeb705635b0d1
SHA1 2a6070414a67c2f1ceb79d572cf2fc76dc74a0b0
SHA512 f2c24be3e609b6312a6e778eb12fb6a58ff3091bb6c2851dd5a55a23ae6947ea4b4a763b2ed957f68382349bfee8ccaf142bf5ab7982d30f5edea3c3d1d22928
TLSH
T13041B64E4DA4995FF854447315B374A83B70CADC4B11E62358BC11327D0336E0A9B2EC
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe589bed.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\4468336c-582f-4524-a120-26f9d90c9063\index-dir\the-real-index~RFe589bed.TMP
Size 1KB
SHA256 a3106b16e43d17bbd915bfabe991e67f360f3082fcc15d4fd86a7b0f6c311f7b
MD5 ef79dc4b6b290104ef39df831144cdef
SHA1 5ec4b70235d388aef138c2f510a58b67b44d9f6f
SHA512 65dcef01cfef013fe2c64372e800fdbf8340a229d62e759e1fa7abd719fb81afb0a36ccc920e81678cb8bb171d2683b364d44ca4377e6dc0c6d1905275fb9926
TLSH
T1D241A8464D908A1FF8C440770DE3B4B87339A40047127B4774BC5136BCA17BE2E4E0E8
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 80d85253976ce912167c040911e316c7fe63ebb4334e721716f58c55d90141e0
MD5 818c4ac4bc9de985f806ebbafb5d614d
SHA1 f29320ab56c8bf8fbc7fb3089daa91e24e614ccd
SHA512 075530d0337db3f0b2e43bbbfb2cfa844ac27eb01f33e997043b7f5257c807bcea5779d63f592f3643912da6775753dc88a9ad23d94a635cf140d524d9a4983d
TLSH
T19DE068FB2EB31864E8ABE3C614B184A409013858C480EE1F506A918710B1364288BC52
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 afecb71125fcd83f5b5641ccb85b2c1aafd981d30260319418ef567f241a40b3
MD5 0bff1cb81ce869eeb9d64e95b03df718
SHA1 5b7809e80a7ff8dca0c284c36012e0cd03abdf2a
SHA512 ec25b0bc3d45f73221f1b37882ee36cf3386d4262fe9f5b29e1eeb9f4172f75b5ad791dbdc8edba23f09f5f9ce989841bd22bc2e19e1cf93240db8705e25547a
TLSH
T194A0021D8F5C8141D0141275D2A592CC7A54C8D91606233EC8FD925889535449192164
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58f49c.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58f49c.TMP
Size 48B
SHA256 e9b55d43fd292176a01e8ea8fa5643686645a174f7d65c8cc12b0908d9ffbbe0
MD5 6bb7fde850d4aad1e0340c93542bd85a
SHA1 9bf4fb502cf95bd9fbe4e37c50cc33523b907cc6
SHA512 e51544f96968ff26ba4ac7c85fddbcc2982a462b7a525c756dcd20e7aa4b0f584876599476c290ffe075c8c939c06d86b9269bbe7a29095dcd0ded028d94c125
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 baa4d76ce7743cf891dd2c408c37bc9a29f88fd4a4c24e7044c6c90a89ed8ab9
MD5 6c4ae77ad6c36c125689ac28ad2fb922
SHA1 8ffc01c0b9b34f28016f6aa18cde8d9139d1fe59
SHA512 a757e21a1e7f56357246ea5c2b9b079fee17362f282b853c1efef8cfeb3e56decc2dd71a035cffe41f062223714f92783b0b6ad5b57fbc55c2e75d76561cdf23
SSDEEP 96:KUgAK12CBJ4/7JvPBWbWcgDBKYogJBsxZeDvCBobcYa2KgWedzgggKY1gSgsQgts:6DvTJ0
TLSH
T14A91274776BF02023D7E29099295DB964B41B1A770B8742B7BA900BA4D6FF100DFE8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe598591.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe598591.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

office_endpoints_list.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Data Protection Lists\2026.6.5.1\office_endpoints_list.json
Size 9KB
SHA256 f0c77aaacfc571e0bc3f51387febe134d991bf3c7f1941af303ed901f288dcd6
MD5 30719122f9edf4e23019a3b74e4f4325
SHA1 6707d64052797b9c5f1a5ccf016e5859c8ef898b
SHA512 ec2e1a33fcd1301f282512ffafb611ea705dc5df09d9aee014276909c1b62b0c73600121d94e9b6d9e160296672b41f2cb8c3ba23f121244ad2ea6521680723c
SSDEEP 96:DdQ/JJvwjyUsrdfsysVsnQfbJNZidYusysXYs2sFsdv12XvlRT07s/DkhcrHPglW:D7d7mfgiIWRcV4sobxezQd1Y
TLSH
T11512BB3BC4B49F229AB060659705E244F13C43BF5600C6FF76B9829C1F366ECA58E1E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 f43228235a61b1d5a2e2f31075b08f8fd571650ff69505dda0487a250b6bbadf
MD5 c824eee599d9d99a87d873343ec692f2
SHA1 a4d93d82e38a9aff4b730c3d205cc3077aa767f3
SHA512 f1fa20ebf8bcc42f8fe16b5364aa229c2cc4750079fee6cf11927a3ae5e0810e47d75eaed45ffe03f3c54d21b9a126b2b6c04a5161cb91a2a98fd3d73eb151bf
SSDEEP 384:nsZcIh8N4YTxJksWWUu8YEus8W1uKYoLnXK9Li6Uq58bhP+XjhpBuL:6hxfCE1D1BTnwLwYjfBuL
TLSH
T155927DB41879AC375DABA14AF94A3357CFF8503799C46F48D9E85F0D009A1A8271AC37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 cc2c7a0992250735746ff5c1fd23c7c5d68365355f8d15248b34941f4d8a093f
MD5 03f0bbe46a516879929e9035aadd3bc2
SHA1 99d7fccf9c92ea0f3fad3a307535a8ccb2aea0e1
SHA512 80c8e0201d6fcc6af5a9ae27b5f54a7a16c384bc0225c7a504c8897d9b7566f143b208869cdf20d63ad84462d2c83dd472b3d86f2b03da896cc08a1d2025dbb5
SSDEEP 384:nFZcIh8N4PTxJkswX2Uu8YEus8W1uKYoLnXK9Li6Uq58bhP+XjhpBuL:9hyX/CE1D1BTnwLwYjfBuL
TLSH
T17E927CB41879AC275DABB14AF94A3367CFF4503799C46F48D9F85F0D009A1A8271AC37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 30KB
SHA256 7265c10197db4fd65c58424df5ec630eeacaaceb008afe0f6db6a3fef50c9475
MD5 9832c828f4587806bb7e0a7b6a82819e
SHA1 721c501464c00c78d2526e38de76f27abc3efc1a
SHA512 f4e3db11dcb57e4b022aceba136bf1ac30cbab042f07abcd1838f912feee0b4d2e16145f2c21b229bf51730786e4bc9e62d3efaa7ee7a66e9d77739f1903a6ae
SSDEEP 384:nKiFTZcI/8NT8TUNTUlIlzTxJk14X2qDfh/u8YEus8W1uKYoknXK9Li6Uq58bhPL:BFL/gwgvXz/CE1D1BcnwLwYjfBuL
TLSH
T134E2C5F588D79936E8AE5387A73E3E568EBCC06375885984B7D81D0CCC861BFD30A815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 c128171ade842ab48a425ff8077bd01fa99f3397480738b20eae3dcc47eee8ca
MD5 19950fedfd331e40899c62fde315fd9f
SHA1 d1135dbc0fb13f64276e5658da858c96fc9700a7
SHA512 25e6d37c7d2e0897550e16d533a7047f53fcc9cc81cb0172b1c388415ef12a8a894c5381334b53d6e6d815458c8938c5cb04dfed2d9d46d2d1967129c1d28160
SSDEEP 192:XGNV6jCQmiUyIILf4SufoPxzY5Sus6l1okSnZsTfU6:XGNV6qb8fju8YEus8WxSTfU6
TLSH
T18802C9356C68787B9EB36E45FA8737139FA4112BE9852F44DAF82F1C00D769C2346836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 30KB
SHA256 536d79197e80f5d7497837b6a22bf58c8a23bff92175f7bb23923bd7aace7b24
MD5 93b67c059893a3dc5d283bded821beb7
SHA1 aca5f90d5a4f911da3dcfb1ba71ca1df8645e9ec
SHA512 e7ba4b32bd980f6f2cf83a909a08f720e923139d84b63bdbaed143d615ce63b944bdbf36765767306bcfd3a13853f68c952c22b934d0481be61c05a9a0a3d4bc
SSDEEP 384:nKiFiZcIe8No8TUNTUlIlPTxJks4X2qDf4/u8YEus8W1uKYoaHnXK9Li6Uq58bhD:BFQehwg0XS/CE1D1BunwLwYjfBuL
TLSH
T14CE2C5F588D79936E8AE5387A73E3E568EBCC06375885984B7D85D0CCC861BFD30A811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 31KB
SHA256 9ac023e38f763660fa2376ee714ba27cad9e5c6680a1c52a33a80307daa7d8c3
MD5 68ee43c45262e63370faf4d5feeb2347
SHA1 70f457e230926abe7b3131cd31b0b6ad9b2cc57f
SHA512 127b008120c4fe9e0ee555a8dc7a0017f74952b156a3a95f2eb7015e9893bae2557a8632365d1ca0f8c3405ce085d964d7473b0d682d54ccf8d669ccf2ede0f2
SSDEEP 384:nKiFPZcI/8N88TUNTUlIRzTeJkJ/KqffO/u8YEus8W1uKYo+nXK9Li6Uq58bhP+8:BFH/lwgBo/CE1D1BWnwLwYjfBuL
TLSH
T1D4E2C5F598D79937E8AE5387A73E3E568ABCC02375885984B7D81D0CCC861BFD30A815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 c9dbcfe15505303d6c61a4a17c8ddf0aa5805ba20b615949054dac719d8fd071
MD5 6e3ddf00b7bf95081eacdf25eda157ee
SHA1 88fb2ffb1a24cea56b430f7ecb99e6b0c6761d6f
SHA512 3e33b1b0d9dbb7b11c0641303d59f7c55366143ddea95968ed2390f4bcaabd57f28b13759f6d02f45c9a5fe637cff9f42afa58da0a4b34d828e0d43a1e250852
SSDEEP 192:eGN56jrQmiUyZLC4SufoPxzY5Sus6l1oaSuKPwollOM1q9YU6:eGN5654Cju8YEus8W1uKYojnU6
TLSH
T138121A74686DFC27AEA37659F68732A39FA42037DC856F44D5F82E1C00D728C230A826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 cbcd40790fd64b9739f7c8465c919c2bcf139c7f738f7dfd9b5bdf79b2f5beba
MD5 3a03937574b582414441b4ae668f74e4
SHA1 422681973cddd7fb3c7068cd7d021bb4958c2f61
SHA512 8bf0eb947997d71e20189a9e5b96c28da603663f4278758b23eedc4f290aeeb6aa8b916d566b339f8d5096d4c6f98a16fc0a15787455e8ae04a9fe6d0538a53d
TLSH
T12CE00207D70304E9C02C017010871B206763C02205D04317CE6501782D423201D30C40
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 6bb87834524738b6618f3b294b9604f975f9ce11b82f5588406add52c07f579b
MD5 05cf8415c800616feb4c84fec4850aca
SHA1 36054574f8e5e78a0c7ac0dd4fdf3d63d8aefa16
SHA512 8377ff66fc61e91d23ffce0e621556f97d618dad2513d6d847687b5c893f3f695e83a6931d15b24042c94f3d45d679352456b694a4ec96ec3d2543763eb69637
MD5 SHA1 SHA512

Submit Download

RevisitationBloomfilter~RFe58f141.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe58f141.TMP
Size 392B
SHA256 07b2b45d83a315eb128519952484eb6de218d414697f8bf50ffa2288d8ad0b26
MD5 dce5ed6f42f4d5045a0dcda5b0221b95
SHA1 02582bbe577f34b6b1bba4755b4ddc710b63dafe
SHA512 0089e29701657d45b62e7df91b93c1c6d77307f60d21053bfd1baba754d3a42bcf0fe5c5f234a551cb305a9461786654244ac6a4792db946c6ea8556359a0dc1
MD5 SHA1 SHA512

Submit Download

nav_config.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\WorkspacesNavigationComponent\1.0.0.5\nav_config.json
Size 2KB
SHA256 98252dc9f9e81167e893f2c32f08ee60e9a6c43fadb454400ed3bff3a68fbf0d
MD5 499d9e568b96e759959dc69635470211
SHA1 2462a315342e0c09fd6c5fbd7f1e7ff6914c17e6
SHA512 3a5922697b5356fd29ccf8dcc2e5e0e8c1fd955046a5bacf11b8ac5b7c147625d31ade6ff17be86e79c2c613104b2d2aebb11557399084d422e304f287d8b905
TLSH
T16B51DB73D5988C4B9BF4A29CE919A309F11107CF75D48C0B76BE010C1F7757AB5C6588
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
MD5 80c2dfaf9affc09798a4976ae70f1b0b
SHA1 80daf1112206b189525aa4f5b380fbbba97b583a
SHA512 be5ed753856621e4dc5b64324872539291704bf5d2a415ac993b5f475db90e958544f281ac36d3e17af93c554895ceeaccf6fa9b0839d21c60a38443b2081876
TLSH
T15FE06880883D0EC2EBB60A5FE40706FC40C8491AB498187804CEF899A03B0973115C7D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 492B
SHA256 55aa4ab756834699189543863036551542c61249184224f927d1681ef15164dd
MD5 c1bec3bc77db46888e279f8b3eeb18fc
SHA1 c2d14f387c796193ddc6378267768745c10dae14
SHA512 8d41fbab8134eec1a95a53d4d56d1d2edb1edced5b2f4987278e5b8f6ac9b169c9928a0c52ebe7a66393caddfa5a29e001890386b54105a8e69958661b40ec35
TLSH
T134F09E808C3E1AC5D6B90F6FE40716FC40D8591670D9287844CEE4A8A47B05B311586D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

53b76bda-fbae-493c-896c-1928bab4cf92.tmp

Path C:\Users\Admin\AppData\Local\Temp\53b76bda-fbae-493c-896c-1928bab4cf92.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

694957b2-ce73-415a-85ea-91769881f6a8.tmp

Path C:\Users\Admin\AppData\Local\Temp\694957b2-ce73-415a-85ea-91769881f6a8.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

46e7c7f7-c0f2-4863-9c43-ed1f8535a05f.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1312_1017271502\46e7c7f7-c0f2-4863-9c43-ed1f8535a05f.tmp
Size 153KB
SHA256 299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
MD5 c4a20d073fe58488935da829aae6fa17
SHA1 dbd31aa3dcd1abd3d554d29a9bca83bab02709d5
SHA512 61f74480d3471180f14e2171be6f5e33ab0a03a7a4837334695556a9484da1a862cc059969834d4950a038ec97f192805e5e718cd2a280aba675bdc9cee5d976
SSDEEP 3072:C0qfZ9r+hy+exmKhRts8o7SYbyqNDri8EBalnQt9RaBoAkaX2Ns:C0qfZ9r5msvoOGi8QQQbRwxmNs
TLSH
T126F3E02D6EDEC956CC0F61F96F29724BC50A4F0B818B648B624E881958F434E17E29FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1312_1017271502\CRX_INSTALL\_locales\en_CA\messages.json
Size 851B
SHA256 6895648577286002f1dc9c3366f558484eb7020d52bbf64a296406e61d09599c
MD5 07ffbe5f24ca348723ff8c6c488abfb8
SHA1 6dc2851e39b2ee38f88cf5c35a90171dbea5b690
SHA512 7ed2c8db851a84f614d5daf1d5fe633bd70301fd7ff8a6723430f05f642ceb3b1ad0a40de65b224661c782ffcec69d996ebe3e5bb6b2f478181e9a07d8cd41f6
TLSH
T175012506E2516A2B03B2A12775613641F57045EA1200DCBB7A7CD41C9FB6DAB918BBD8
MD5 SHA1 SHA512 TLSH

Submit Download

dasherSettingSchema.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1312_1017271502\CRX_INSTALL\dasherSettingSchema.json
Size 854B
SHA256 6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6
MD5 4ec1df2da46182103d2ffc3b92d20ca5
SHA1 fb9d1ba3710cf31a87165317c6edc110e98994ce
SHA512 939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d
TLSH
T1B1014C25C354799B04C7627ABCA95001E630818B027665707DDE4D7C6F2E8A700BF37E
MD5 SHA1 SHA512 TLSH

Submit Download

service_worker_bin_prod.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1312_1017271502\CRX_INSTALL\service_worker_bin_prod.js
Size 131KB
SHA256 5b83ed539c1e9c2769e4e3cd4aa397a66bdd6cfa763e230414c0a885a350903a
MD5 8b795eb263421a7d53c5d4a95646bc45
SHA1 4e48ea3d490b84aa4260a74217ed414bef6b6ad8
SHA512 fb78511b7a274d3c280da40341f19fcd3c2455f6132c41f3e46696e458126a3cec6b27d41b28b2398c622c435a3bb93a2f731fe3e8ed453d365c042b71b8b0dc
SSDEEP 3072:JXNTunelO5KQOpZgLJqVPgbcBJptE/ml/3y7:JAPJOrgmptE/mlP0
TLSH
T17AD3DACCB7A5B4224363A5F5002F010BB23AB8AAE44C85A8F188D9E97D7546D4737F7D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1312_1857015462\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

malware pack.zip:Zone.Identifier

Path C:\Users\Admin\Downloads\malware pack.zip:Zone.Identifier
Size 162B
SHA256 2182fa25678a3df61b01b5c37a59ad8481b5d99d651cc059de9c240c66b1167d
MD5 f5c33f8ec31092e30e90057efd5b83f3
SHA1 605fcc175d71cb602f8ab270b7f02b464c867fcc
SHA512 c4381cb12c40ba425d2bd3e96ab3bd175a4e0e9ccf5af48d0b028710bb5eb2b5e5b7be17c857cba731198f062041f2c0cfee4e98b460a217e607208bdd0263cb
TLSH
T1D0C08C42B91B02A81A01A28E085DEA2CA23F30F86FD40580DE0049A2F880DBEC3B2812
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1312_1722597236\manifest.json
Size 165B
SHA256 fc5dd0f6692cb24ec676b53527dabff28114c905dd08f72c97ac54a22c1bffae
MD5 1bfafb8c67c4ae6cf99faf6f1fcbe9e3
SHA1 77fc3483a895f1f429e6c6bb0f294a8fdc69dd08
SHA512 7237c88400ae032f4e745d8f0e5a869c29a76f0151b61ad2aed2ae1be7fd0b759d81c5e6b47535586533c0ab25291a25822174173f1bf6dbaab0298366aaea73
TLSH
T115C012229844793A12A183840A31CA82B2A0020B34E129023A79408C4F350749101619
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1312_211970230\manifest.json
Size 160B
SHA256 31952875f8bb2e71f49231c95349945ffc0c1dd975f06309a0d138f002cfd23d
MD5 c3911ceb35539db42e5654bdd60ac956
SHA1 71be0751e5fc583b119730dbceb2c723f2389f6c
SHA512 d8b2c7c5b7105a6f0c4bc9c79c05b1202bc8deb90e60a037fec59429c04fc688a745ee1a0d06a8311466b4d14e2921dfb4476104432178c01df1e99deb48b331
TLSH
T1F1C08C73CC08AE7911B14B371B214642E3B8030B600039093A32084C0BA47B00262328
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1312_51572204\manifest.json
Size 43B
SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
MD5 af3a9104ca46f35bb5f6123d89c25966
SHA1 1ffb1b0aa9f44bdbc57bdf4b98d26d3be0207ee8
SHA512 6a7a543fa2d1ead3574b4897d2fc714bb218c60a04a70a7e92ecfd2ea59d67028f91b6a2094313f606560087336c619093f1d38d66a3c63a1d1d235ca03d36d1
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1312_835942374\manifest.json
Size 135B
SHA256 bf066a2cf10074e847bef7c066a9c84deada6586412e181cb417c6426a5d60a4
MD5 616eb6b585f16811dc5db5063e088cd7
SHA1 fc50aa7b747f9367d2b177eab7ab12cdafdeea85
SHA512 cdaf55640f0279c1cee06338912a07bc8bc8cb3780f70202363e25b327eb94a524c0acdd25cc2b22fbb1895d32af888857b17b3f0d7a2064f51ccdf1bab57f79
TLSH
T1BFC04C668D41DEAB00A647A56B295315E23B4B4B5044400A7AB5429C1A285964271844
MD5 SHA1 SHA512 TLSH

Submit Download

note.txt

Path C:\note.txt
Size 218B
SHA256 8e9f20f6864c66576536c0b866c6ffdcf11397db67fe120e972e244c3c022270
MD5 afa6955439b8d516721231029fb9ca1b
SHA1 087a043cc123c0c0df2ffadcf8e71e3ac86bbae9
SHA512 5da21a31fbc4e8250dffed30f66b896bdf007ac91948140334fe36a3f010e1bac3e70a07e9f3eb9da8633189091fd5cadcabbaacd3e01da0fe7ae28a11b3dddf
TLSH
T1C3D0A719040784251C7052D17145A5A09B70562D77F626EB74DC690C212700F0B37C9A
MD5 SHA1 SHA512 TLSH

Submit Download