hxxps://github[.]com/hilutea/MEMZ_Destructive_Clean[.]git

Analysis

user interaction
yes
max time kernel
239s
max time network
241s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
19/08/2026, 14:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

Reason

Machine shutdown

General

Target
https://github.com/hilutea/MEMZ_Destructive_Clean.git
Sample260819-rsclssfe99

Score

6^/10

bootkit discovery persistence

Malware Config

Signatures

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	MEMZ-Destructive.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MEMZ-Destructive.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MEMZ-Destructive.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MEMZ-Destructive.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MEMZ-Destructive.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MEMZ-Destructive.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MEMZ-Destructive.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MEMZ-Destructive.exe

System Time Discovery 1 TTPs 4 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
776	msedge.exe
2852	msedge.exe
5676	msedge.exe
1220	msedge.exe

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 12 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 20 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "206"	LogonUI.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134316232314924170"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271"	LogonUI.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040"	LogonUI.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe

Modifies registry class 13 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-204488895-2999877624-296153668-1000\{DD629A41-0B4C-49FC-85F7-7D72B27ED81E}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-204488895-2999877624-296153668-1000\{9F1DD7B1-95C7-416E-818F-5EDA097D1E74}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-204488895-2999877624-296153668-1000\{AE55AAC1-0E95-4C81-859C-7102DB09072F}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-204488895-2999877624-296153668-1000\{E687A2AE-3BB4-4730-A60D-15B8DB3781CB}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4524	MEMZ-Destructive.exe
3220	MEMZ-Destructive.exe
4524	MEMZ-Destructive.exe
3220	MEMZ-Destructive.exe
4524	MEMZ-Destructive.exe
3220	MEMZ-Destructive.exe
3220	MEMZ-Destructive.exe
4524	MEMZ-Destructive.exe
2256	MEMZ-Destructive.exe
2256	MEMZ-Destructive.exe
3220	MEMZ-Destructive.exe
4524	MEMZ-Destructive.exe
3220	MEMZ-Destructive.exe
4524	MEMZ-Destructive.exe
1896	MEMZ-Destructive.exe
1896	MEMZ-Destructive.exe
1896	MEMZ-Destructive.exe
4524	MEMZ-Destructive.exe
4524	MEMZ-Destructive.exe
1896	MEMZ-Destructive.exe
3220	MEMZ-Destructive.exe
2256	MEMZ-Destructive.exe
3220	MEMZ-Destructive.exe
2256	MEMZ-Destructive.exe
1112	MEMZ-Destructive.exe
2256	MEMZ-Destructive.exe
1112	MEMZ-Destructive.exe
2256	MEMZ-Destructive.exe
3220	MEMZ-Destructive.exe
3220	MEMZ-Destructive.exe
1896	MEMZ-Destructive.exe
1896	MEMZ-Destructive.exe
4524	MEMZ-Destructive.exe
4524	MEMZ-Destructive.exe
3220	MEMZ-Destructive.exe
2256	MEMZ-Destructive.exe
2256	MEMZ-Destructive.exe
3220	MEMZ-Destructive.exe
1112	MEMZ-Destructive.exe
1112	MEMZ-Destructive.exe
1112	MEMZ-Destructive.exe
2256	MEMZ-Destructive.exe
2256	MEMZ-Destructive.exe
1112	MEMZ-Destructive.exe
3220	MEMZ-Destructive.exe
3220	MEMZ-Destructive.exe
4524	MEMZ-Destructive.exe
4524	MEMZ-Destructive.exe
1896	MEMZ-Destructive.exe
1896	MEMZ-Destructive.exe
4524	MEMZ-Destructive.exe
3220	MEMZ-Destructive.exe
3220	MEMZ-Destructive.exe
4524	MEMZ-Destructive.exe
1112	MEMZ-Destructive.exe
1112	MEMZ-Destructive.exe
2256	MEMZ-Destructive.exe
2256	MEMZ-Destructive.exe
2256	MEMZ-Destructive.exe
1112	MEMZ-Destructive.exe
1112	MEMZ-Destructive.exe
2256	MEMZ-Destructive.exe
3220	MEMZ-Destructive.exe
4524	MEMZ-Destructive.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 21 IoCs

pid	Process
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
3268	msedge.exe
3268	msedge.exe
3268	msedge.exe
4120	msedge.exe
4120	msedge.exe
4120	msedge.exe
4120	msedge.exe
4120	msedge.exe
4120	msedge.exe
4120	msedge.exe
4120	msedge.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3220	MEMZ-Destructive.exe
Token: SeShutdownPrivilege	1896	MEMZ-Destructive.exe
Token: SeShutdownPrivilege	1112	MEMZ-Destructive.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
5016	notepad.exe
4880	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
760	MEMZ-Destructive.exe
3220	MEMZ-Destructive.exe
4524	MEMZ-Destructive.exe
2256	MEMZ-Destructive.exe
1896	MEMZ-Destructive.exe
1112	MEMZ-Destructive.exe
2496	MEMZ-Destructive.exe
228	LogonUI.exe
3220	MEMZ-Destructive.exe
1896	MEMZ-Destructive.exe
2256	MEMZ-Destructive.exe
3220	MEMZ-Destructive.exe
1896	MEMZ-Destructive.exe
1112	MEMZ-Destructive.exe
4524	MEMZ-Destructive.exe
2256	MEMZ-Destructive.exe
1112	MEMZ-Destructive.exe
4524	MEMZ-Destructive.exe
1896	MEMZ-Destructive.exe
1112	MEMZ-Destructive.exe
3220	MEMZ-Destructive.exe
4524	MEMZ-Destructive.exe
2256	MEMZ-Destructive.exe
2256	MEMZ-Destructive.exe
3220	MEMZ-Destructive.exe
1896	MEMZ-Destructive.exe
1112	MEMZ-Destructive.exe
4524	MEMZ-Destructive.exe
3220	MEMZ-Destructive.exe
2256	MEMZ-Destructive.exe
1896	MEMZ-Destructive.exe
1112	MEMZ-Destructive.exe
4524	MEMZ-Destructive.exe
2256	MEMZ-Destructive.exe
3220	MEMZ-Destructive.exe
1112	MEMZ-Destructive.exe
1896	MEMZ-Destructive.exe
4524	MEMZ-Destructive.exe
1112	MEMZ-Destructive.exe
2256	MEMZ-Destructive.exe
4524	MEMZ-Destructive.exe
1896	MEMZ-Destructive.exe
3220	MEMZ-Destructive.exe
3220	MEMZ-Destructive.exe
1112	MEMZ-Destructive.exe
1896	MEMZ-Destructive.exe
2256	MEMZ-Destructive.exe
4524	MEMZ-Destructive.exe
1112	MEMZ-Destructive.exe
2256	MEMZ-Destructive.exe
3220	MEMZ-Destructive.exe
1896	MEMZ-Destructive.exe
4524	MEMZ-Destructive.exe
1112	MEMZ-Destructive.exe
1896	MEMZ-Destructive.exe
2256	MEMZ-Destructive.exe
3220	MEMZ-Destructive.exe
4524	MEMZ-Destructive.exe
1896	MEMZ-Destructive.exe
3220	MEMZ-Destructive.exe
1112	MEMZ-Destructive.exe
4524	MEMZ-Destructive.exe
2256	MEMZ-Destructive.exe
3220	MEMZ-Destructive.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4880 wrote to memory of 1116	4880	msedge.exe	88
PID 4880 wrote to memory of 776	4880	msedge.exe	89
PID 4880 wrote to memory of 5116	4880	msedge.exe	90
PID 4880 wrote to memory of 4568	4880	msedge.exe	91
PID 4880 wrote to memory of 5116	4880	msedge.exe	90
PID 4880 wrote to memory of 5116	4880	msedge.exe	90
PID 4880 wrote to memory of 4568	4880	msedge.exe	91
PID 4880 wrote to memory of 4664	4880	msedge.exe	92
PID 4880 wrote to memory of 2280	4880	msedge.exe	93
PID 4880 wrote to memory of 4664	4880	msedge.exe	92
PID 4880 wrote to memory of 4664	4880	msedge.exe	92
PID 4880 wrote to memory of 2280	4880	msedge.exe	93
PID 4880 wrote to memory of 2280	4880	msedge.exe	93
PID 4880 wrote to memory of 924	4880	msedge.exe	96
PID 4880 wrote to memory of 924	4880	msedge.exe	96
PID 4880 wrote to memory of 924	4880	msedge.exe	96
PID 4880 wrote to memory of 992	4880	msedge.exe	95
PID 4880 wrote to memory of 992	4880	msedge.exe	95
PID 4880 wrote to memory of 992	4880	msedge.exe	95
PID 4880 wrote to memory of 4560	4880	msedge.exe	99
PID 4880 wrote to memory of 4524	4880	msedge.exe	100
PID 4880 wrote to memory of 4560	4880	msedge.exe	99
PID 4880 wrote to memory of 4524	4880	msedge.exe	100
PID 4880 wrote to memory of 3312	4880	msedge.exe	102
PID 4880 wrote to memory of 4164	4880	msedge.exe	104
PID 4880 wrote to memory of 4164	4880	msedge.exe	104
PID 4880 wrote to memory of 4164	4880	msedge.exe	104
PID 4880 wrote to memory of 2248	4880	msedge.exe	105
PID 4880 wrote to memory of 2248	4880	msedge.exe	105
PID 4880 wrote to memory of 1204	4880	msedge.exe	106
PID 4880 wrote to memory of 4812	4880	msedge.exe	115
PID 4880 wrote to memory of 3312	4880	msedge.exe	116
PID 4880 wrote to memory of 3220	4880	msedge.exe	117
PID 4880 wrote to memory of 4360	4880	msedge.exe	123
PID 4880 wrote to memory of 4360	4880	msedge.exe	123
PID 4880 wrote to memory of 3836	4880	msedge.exe	126
PID 4880 wrote to memory of 3836	4880	msedge.exe	126
PID 760 wrote to memory of 3220	760	MEMZ-Destructive.exe	130
PID 760 wrote to memory of 4524	760	MEMZ-Destructive.exe	131
PID 760 wrote to memory of 2256	760	MEMZ-Destructive.exe	132
PID 760 wrote to memory of 1896	760	MEMZ-Destructive.exe	133
PID 760 wrote to memory of 1112	760	MEMZ-Destructive.exe	134
PID 760 wrote to memory of 2496	760	MEMZ-Destructive.exe	135
PID 2496 wrote to memory of 5016	2496	MEMZ-Destructive.exe	136
PID 2496 wrote to memory of 2428	2496	MEMZ-Destructive.exe	140
PID 2428 wrote to memory of 2692	2428	msedge.exe	141
PID 2692 wrote to memory of 1956	2692	msedge.exe	142
PID 2692 wrote to memory of 2852	2692	msedge.exe	143
PID 2692 wrote to memory of 3252	2692	msedge.exe	144
PID 2692 wrote to memory of 3252	2692	msedge.exe	144
PID 2692 wrote to memory of 3252	2692	msedge.exe	144
PID 2692 wrote to memory of 3868	2692	msedge.exe	145
PID 2692 wrote to memory of 3868	2692	msedge.exe	145
PID 2692 wrote to memory of 1576	2692	msedge.exe	147
PID 2692 wrote to memory of 3316	2692	msedge.exe	148
PID 2692 wrote to memory of 1576	2692	msedge.exe	147
PID 2692 wrote to memory of 1576	2692	msedge.exe	147
PID 2692 wrote to memory of 3316	2692	msedge.exe	148
PID 2692 wrote to memory of 3316	2692	msedge.exe	148
PID 2692 wrote to memory of 4788	2692	msedge.exe	151
PID 2692 wrote to memory of 4788	2692	msedge.exe	151
PID 2692 wrote to memory of 4080	2692	msedge.exe	153
PID 2692 wrote to memory of 4080	2692	msedge.exe	153
PID 2692 wrote to memory of 4080	2692	msedge.exe	153

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://github.com/hilutea/MEMZ_Destructive_Clean.git
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffbf87ec188,0x7ffbf87ec194,0x7ffbf87ec1a0
  2⤵
  PID:1116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1920,i,17982651984877527779,5711162351398727645,524288 --field-trial-handle=2944,i,5940147204536964170,18227591140647368502,262144 --variations-seed-version --mojo-platform-channel-handle=3004 /prefetch:3
  2⤵
  - System Time Discovery
  PID:776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1764,i,3565894575139622613,7445172528190408239,262144 --field-trial-handle=2944,i,5940147204536964170,18227591140647368502,262144 --variations-seed-version --mojo-platform-channel-handle=2936 /prefetch:2
  2⤵
  PID:5116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2276,i,16052984444810676985,1267366227508139059,524288 --field-trial-handle=2944,i,5940147204536964170,18227591140647368502,262144 --variations-seed-version --mojo-platform-channel-handle=3048 /prefetch:8
  2⤵
  PID:4568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3468,i,12337258104868048276,6429043069877811354,2097152 --field-trial-handle=2944,i,5940147204536964170,18227591140647368502,262144 --variations-seed-version --mojo-platform-channel-handle=3476 /prefetch:1
  2⤵
  PID:4664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3484,i,17740063613908901213,1274883712356101177,2097152 --field-trial-handle=2944,i,5940147204536964170,18227591140647368502,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:1
  2⤵
  PID:2280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4192,i,13982486994357836243,13860032559754793483,2097152 --field-trial-handle=2944,i,5940147204536964170,18227591140647368502,262144 --variations-seed-version --mojo-platform-channel-handle=4216 /prefetch:1
  2⤵
  PID:992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4268,i,12495916498718649127,661495731490967131,2097152 --field-trial-handle=2944,i,5940147204536964170,18227591140647368502,262144 --variations-seed-version --mojo-platform-channel-handle=4252 /prefetch:2
  2⤵
  PID:924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5012,i,150960087881922841,4851779582589326000,524288 --field-trial-handle=2944,i,5940147204536964170,18227591140647368502,262144 --variations-seed-version --mojo-platform-channel-handle=5144 /prefetch:8
  2⤵
  PID:4560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5028,i,4297455552690009366,1293394812451202040,524288 --field-trial-handle=2944,i,5940147204536964170,18227591140647368502,262144 --variations-seed-version --mojo-platform-channel-handle=5172 /prefetch:8
  2⤵
  PID:4524
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5956,i,6645481792315645165,17642568290115912359,524288 --field-trial-handle=2944,i,5940147204536964170,18227591140647368502,262144 --variations-seed-version --mojo-platform-channel-handle=5972 /prefetch:8
  2⤵
  PID:1328
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5956,i,6645481792315645165,17642568290115912359,524288 --field-trial-handle=2944,i,5940147204536964170,18227591140647368502,262144 --variations-seed-version --mojo-platform-channel-handle=5972 /prefetch:8
  2⤵
  PID:3312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6364,i,10116792493453127702,11548418901416886328,2097152 --field-trial-handle=2944,i,5940147204536964170,18227591140647368502,262144 --variations-seed-version --mojo-platform-channel-handle=6380 /prefetch:1
  2⤵
  PID:4164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6304,i,17085039478536813536,12752165456263642201,524288 --field-trial-handle=2944,i,5940147204536964170,18227591140647368502,262144 --variations-seed-version --mojo-platform-channel-handle=6152 /prefetch:8
  2⤵
  PID:2248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6612,i,13486432789929808447,4631075029221374058,524288 --field-trial-handle=2944,i,5940147204536964170,18227591140647368502,262144 --variations-seed-version --mojo-platform-channel-handle=6660 /prefetch:8
  2⤵
  PID:1204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6968,i,5567572756058938560,9872996421385876509,524288 --field-trial-handle=2944,i,5940147204536964170,18227591140647368502,262144 --variations-seed-version --mojo-platform-channel-handle=6984 /prefetch:8
  2⤵
  PID:4812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7120,i,5646049079262018646,3626505728601841664,524288 --field-trial-handle=2944,i,5940147204536964170,18227591140647368502,262144 --variations-seed-version --mojo-platform-channel-handle=3612 /prefetch:8
  2⤵
  PID:3312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6976,i,14754892621758549626,12988127212148031475,524288 --field-trial-handle=2944,i,5940147204536964170,18227591140647368502,262144 --variations-seed-version --mojo-platform-channel-handle=1532 /prefetch:8
  2⤵
  PID:3220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5000,i,15452946259504123969,9601679770599670822,524288 --field-trial-handle=2944,i,5940147204536964170,18227591140647368502,262144 --variations-seed-version --mojo-platform-channel-handle=7112 /prefetch:8
  2⤵
  PID:4360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6276,i,3449057755433367460,5780186923667918447,524288 --field-trial-handle=2944,i,5940147204536964170,18227591140647368502,262144 --variations-seed-version --mojo-platform-channel-handle=2116 /prefetch:8
  2⤵
  PID:3836

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4480

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4936

C:\Users\Admin\Downloads\MEMZ_Destructive_Clean-main\MEMZ_Destructive_Clean-main\MEMZ.exe\MEMZ-Destructive.exe
"C:\Users\Admin\Downloads\MEMZ_Destructive_Clean-main\MEMZ_Destructive_Clean-main\MEMZ.exe\MEMZ-Destructive.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:760
- C:\Users\Admin\Downloads\MEMZ_Destructive_Clean-main\MEMZ_Destructive_Clean-main\MEMZ.exe\MEMZ-Destructive.exe
  "C:\Users\Admin\Downloads\MEMZ_Destructive_Clean-main\MEMZ_Destructive_Clean-main\MEMZ.exe\MEMZ-Destructive.exe" /watchdog
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:3220
- C:\Users\Admin\Downloads\MEMZ_Destructive_Clean-main\MEMZ_Destructive_Clean-main\MEMZ.exe\MEMZ-Destructive.exe
  "C:\Users\Admin\Downloads\MEMZ_Destructive_Clean-main\MEMZ_Destructive_Clean-main\MEMZ.exe\MEMZ-Destructive.exe" /watchdog
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:4524
- C:\Users\Admin\Downloads\MEMZ_Destructive_Clean-main\MEMZ_Destructive_Clean-main\MEMZ.exe\MEMZ-Destructive.exe
  "C:\Users\Admin\Downloads\MEMZ_Destructive_Clean-main\MEMZ_Destructive_Clean-main\MEMZ.exe\MEMZ-Destructive.exe" /watchdog
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:2256
- C:\Users\Admin\Downloads\MEMZ_Destructive_Clean-main\MEMZ_Destructive_Clean-main\MEMZ.exe\MEMZ-Destructive.exe
  "C:\Users\Admin\Downloads\MEMZ_Destructive_Clean-main\MEMZ_Destructive_Clean-main\MEMZ.exe\MEMZ-Destructive.exe" /watchdog
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:1896
- C:\Users\Admin\Downloads\MEMZ_Destructive_Clean-main\MEMZ_Destructive_Clean-main\MEMZ.exe\MEMZ-Destructive.exe
  "C:\Users\Admin\Downloads\MEMZ_Destructive_Clean-main\MEMZ_Destructive_Clean-main\MEMZ.exe\MEMZ-Destructive.exe" /watchdog
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:1112
- C:\Users\Admin\Downloads\MEMZ_Destructive_Clean-main\MEMZ_Destructive_Clean-main\MEMZ.exe\MEMZ-Destructive.exe
  "C:\Users\Admin\Downloads\MEMZ_Destructive_Clean-main\MEMZ_Destructive_Clean-main\MEMZ.exe\MEMZ-Destructive.exe" /main
  2⤵
  - Writes to the Master Boot Record (MBR)
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2496
- - C:\Windows\SysWOW64\notepad.exe
    "C:\Windows\System32\notepad.exe" \note.txt
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of FindShellTrayWindow
    PID:5016
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=virus+builder+legit+free+download
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2428
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument http://google.co.ck/search?q=virus+builder+legit+free+download
      4⤵
      Checks processor information in registry
      Enumerates system info in registry
      Modifies data under HKEY_USERS
      Modifies registry class
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of WriteProcessMemory
      PID:2692
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x234,0x238,0x23c,0x230,0x25c,0x7ffbf87ec188,0x7ffbf87ec194,0x7ffbf87ec1a0
        5⤵
        
        PID:1956
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1844,i,4859083376514169423,3565853334499837282,524288 --field-trial-handle=2164,i,3843218714574069284,9803274518030984161,262144 --variations-seed-version --mojo-platform-channel-handle=2192 /prefetch:3
        5⤵
        System Time Discovery
        
        PID:2852
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1624,i,7828087043413349992,14026921323750819974,262144 --field-trial-handle=2164,i,3843218714574069284,9803274518030984161,262144 --variations-seed-version --mojo-platform-channel-handle=2160 /prefetch:2
        5⤵
        
        PID:3252
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2516,i,17415777451069548291,8346543973622959687,524288 --field-trial-handle=2164,i,3843218714574069284,9803274518030984161,262144 --variations-seed-version --mojo-platform-channel-handle=2528 /prefetch:8
        5⤵
        
        PID:3868
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3416,i,1400710529279308122,8543076313035346576,2097152 --field-trial-handle=2164,i,3843218714574069284,9803274518030984161,262144 --variations-seed-version --mojo-platform-channel-handle=3452 /prefetch:1
        5⤵
        
        PID:1576
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3424,i,12842043271656278457,9284009535905383582,2097152 --field-trial-handle=2164,i,3843218714574069284,9803274518030984161,262144 --variations-seed-version --mojo-platform-channel-handle=3464 /prefetch:1
        5⤵
        
        PID:3316
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4752,i,370594052193475537,8999449385302993507,524288 --field-trial-handle=2164,i,3843218714574069284,9803274518030984161,262144 --variations-seed-version --mojo-platform-channel-handle=4736 /prefetch:8
        5⤵
        
        PID:4788
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4936,i,2058623986800701882,18254002701001538362,2097152 --field-trial-handle=2164,i,3843218714574069284,9803274518030984161,262144 --variations-seed-version --mojo-platform-channel-handle=4948 /prefetch:1
        5⤵
        
        PID:4080
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4884,i,15415927209341648895,4618200664418165273,524288 --field-trial-handle=2164,i,3843218714574069284,9803274518030984161,262144 --variations-seed-version --mojo-platform-channel-handle=4772 /prefetch:8
        5⤵
        
        PID:228
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5108,i,646349873722743748,10744662542489326251,2097152 --field-trial-handle=2164,i,3843218714574069284,9803274518030984161,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:1
        5⤵
        
        PID:4776
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4860,i,6700404979887259960,2642314575542910272,524288 --field-trial-handle=2164,i,3843218714574069284,9803274518030984161,262144 --variations-seed-version --mojo-platform-channel-handle=3544 /prefetch:8
        5⤵
        
        PID:936
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4176,i,421401627664322425,13438658444032223814,524288 --field-trial-handle=2164,i,3843218714574069284,9803274518030984161,262144 --variations-seed-version --mojo-platform-channel-handle=3572 /prefetch:8
        5⤵
        
        PID:4508
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5628,i,4187193541023794089,10341927849648536703,524288 --field-trial-handle=2164,i,3843218714574069284,9803274518030984161,262144 --variations-seed-version --mojo-platform-channel-handle=5644 /prefetch:8
        5⤵
        
        PID:1652
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5628,i,4187193541023794089,10341927849648536703,524288 --field-trial-handle=2164,i,3843218714574069284,9803274518030984161,262144 --variations-seed-version --mojo-platform-channel-handle=5644 /prefetch:8
        5⤵
        
        PID:4992
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5836,i,15800852489321549195,8149448345023527447,524288 --field-trial-handle=2164,i,3843218714574069284,9803274518030984161,262144 --variations-seed-version --mojo-platform-channel-handle=5832 /prefetch:8
        5⤵
        
        PID:4892
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5996,i,3415506795024865889,10994952716614150646,524288 --field-trial-handle=2164,i,3843218714574069284,9803274518030984161,262144 --variations-seed-version --mojo-platform-channel-handle=6000 /prefetch:8
        5⤵
        
        PID:3268
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5884,i,17595858640138841096,16198923522376601673,524288 --field-trial-handle=2164,i,3843218714574069284,9803274518030984161,262144 --variations-seed-version --mojo-platform-channel-handle=5944 /prefetch:8
        5⤵
        
        PID:5076
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6280,i,9030748515882088938,9977017183014393449,524288 --field-trial-handle=2164,i,3843218714574069284,9803274518030984161,262144 --variations-seed-version --mojo-platform-channel-handle=6284 /prefetch:8
        5⤵
        
        PID:4000
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6300,i,1210475414956341026,3944879805026603982,524288 --field-trial-handle=2164,i,3843218714574069284,9803274518030984161,262144 --variations-seed-version --mojo-platform-channel-handle=6156 /prefetch:8
        5⤵
        
        PID:5352
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
        5⤵
        Checks processor information in registry
        Enumerates system info in registry
        Modifies data under HKEY_USERS
        Modifies registry class
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        
        PID:3268
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffbf87ec188,0x7ffbf87ec194,0x7ffbf87ec1a0
        6⤵
        
        PID:5388
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1928,i,3230730932664107388,17137229054757803121,524288 --field-trial-handle=2344,i,2833532951104567142,16504963560597319486,262144 --variations-seed-version --mojo-platform-channel-handle=2768 /prefetch:3
        6⤵
        System Time Discovery
        
        PID:5676
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2336,i,7299143912758422692,13653742931694304803,524288 --field-trial-handle=2344,i,2833532951104567142,16504963560597319486,262144 --variations-seed-version --mojo-platform-channel-handle=3264 /prefetch:8
        6⤵
        
        PID:5684
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1712,i,2562516221745132573,8144459450467321797,262144 --field-trial-handle=2344,i,2833532951104567142,16504963560597319486,262144 --variations-seed-version --mojo-platform-channel-handle=2340 /prefetch:2
        6⤵
        
        PID:5692
      - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4544,i,6189584362678650907,380872664788736898,524288 --field-trial-handle=2344,i,2833532951104567142,16504963560597319486,262144 --variations-seed-version --mojo-platform-channel-handle=4560 /prefetch:8
        6⤵
        
        PID:5356
      - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4544,i,6189584362678650907,380872664788736898,524288 --field-trial-handle=2344,i,2833532951104567142,16504963560597319486,262144 --variations-seed-version --mojo-platform-channel-handle=4560 /prefetch:8
        6⤵
        
        PID:6116
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4940,i,7466102462262880771,15173841044213972866,2097152 --field-trial-handle=2344,i,2833532951104567142,16504963560597319486,262144 --variations-seed-version --mojo-platform-channel-handle=4988 /prefetch:1
        6⤵
        
        PID:3080
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=4944,i,9436769232535913539,16169990832443636306,2097152 --field-trial-handle=2344,i,2833532951104567142,16504963560597319486,262144 --variations-seed-version --mojo-platform-channel-handle=4992 /prefetch:1
        6⤵
        
        PID:5124
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5496,i,4623559701484761791,13924132337522165545,524288 --field-trial-handle=2344,i,2833532951104567142,16504963560597319486,262144 --variations-seed-version --mojo-platform-channel-handle=5532 /prefetch:8
        6⤵
        
        PID:1056
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5456,i,443419196170926651,6308418329216214687,524288 --field-trial-handle=2344,i,2833532951104567142,16504963560597319486,262144 --variations-seed-version --mojo-platform-channel-handle=5552 /prefetch:8
        6⤵
        
        PID:4480
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5904,i,15860407124969343538,15573723645670721101,2097152 --field-trial-handle=2344,i,2833532951104567142,16504963560597319486,262144 --variations-seed-version --mojo-platform-channel-handle=5912 /prefetch:1
        6⤵
        
        PID:1824
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
        6⤵
        Checks processor information in registry
        Enumerates system info in registry
        Modifies data under HKEY_USERS
        Modifies registry class
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        
        PID:4120
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x210,0x7ffbf87ec188,0x7ffbf87ec194,0x7ffbf87ec1a0
        7⤵
        
        PID:4964
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1968,i,4444988615108417332,17281519326228309375,524288 --field-trial-handle=2308,i,13106281647643899368,4171497211118919242,262144 --variations-seed-version --mojo-platform-channel-handle=2344 /prefetch:3
        7⤵
        System Time Discovery
        
        PID:1220
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1732,i,11004807564402276861,15997970906604956451,262144 --field-trial-handle=2308,i,13106281647643899368,4171497211118919242,262144 --variations-seed-version --mojo-platform-channel-handle=2304 /prefetch:2
        7⤵
        
        PID:3496
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2592,i,7589372341514823225,1952644193357405085,524288 --field-trial-handle=2308,i,13106281647643899368,4171497211118919242,262144 --variations-seed-version --mojo-platform-channel-handle=2604 /prefetch:8
        7⤵
        
        PID:4676
        
        C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4484,i,1273641432233921295,17939608525207320730,524288 --field-trial-handle=2308,i,13106281647643899368,4171497211118919242,262144 --variations-seed-version --mojo-platform-channel-handle=4500 /prefetch:8
        7⤵
        
        PID:3348
        
        C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4484,i,1273641432233921295,17939608525207320730,524288 --field-trial-handle=2308,i,13106281647643899368,4171497211118919242,262144 --variations-seed-version --mojo-platform-channel-handle=4500 /prefetch:8
        7⤵
        
        PID:4292
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4904,i,5241046153753558950,13711585222680119910,2097152 --field-trial-handle=2308,i,13106281647643899368,4171497211118919242,262144 --variations-seed-version --mojo-platform-channel-handle=4948 /prefetch:1
        7⤵
        
        PID:5620
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=4908,i,6293548487671630282,13197567700391271100,2097152 --field-trial-handle=2308,i,13106281647643899368,4171497211118919242,262144 --variations-seed-version --mojo-platform-channel-handle=5004 /prefetch:1
        7⤵
        
        PID:5944
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5440,i,3031293945856473861,12913949007751631628,524288 --field-trial-handle=2308,i,13106281647643899368,4171497211118919242,262144 --variations-seed-version --mojo-platform-channel-handle=5484 /prefetch:8
        7⤵
        
        PID:3332
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5444,i,7302948665626826091,3309158382018924145,524288 --field-trial-handle=2308,i,13106281647643899368,4171497211118919242,262144 --variations-seed-version --mojo-platform-channel-handle=5408 /prefetch:8
        7⤵
        
        PID:5372
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5928,i,17117811290069886144,4247469372856504575,2097152 --field-trial-handle=2308,i,13106281647643899368,4171497211118919242,262144 --variations-seed-version --mojo-platform-channel-handle=5908 /prefetch:1
        7⤵
        
        PID:5776
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5460,i,11166780569955344110,14264169793197162136,524288 --field-trial-handle=2308,i,13106281647643899368,4171497211118919242,262144 --variations-seed-version --mojo-platform-channel-handle=6092 /prefetch:8
        7⤵
        
        PID:5864
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5184,i,7858452718760200164,779872686732057669,524288 --field-trial-handle=2308,i,13106281647643899368,4171497211118919242,262144 --variations-seed-version --mojo-platform-channel-handle=5172 /prefetch:8
        7⤵
        
        PID:5860
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5136,i,4588498662026833833,1561598658213296856,524288 --field-trial-handle=2308,i,13106281647643899368,4171497211118919242,262144 --variations-seed-version --mojo-platform-channel-handle=6156 /prefetch:8
        7⤵
        
        PID:4804
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=4200,i,790248802763633411,16015528535284875478,2097152 --field-trial-handle=2308,i,13106281647643899368,4171497211118919242,262144 --variations-seed-version --mojo-platform-channel-handle=4204 /prefetch:1
        7⤵
        
        PID:5516
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=5420,i,13271170251611780945,11690280739077574129,2097152 --field-trial-handle=2308,i,13106281647643899368,4171497211118919242,262144 --variations-seed-version --mojo-platform-channel-handle=5136 /prefetch:1
        7⤵
        
        PID:5760
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6468,i,17013762022499183498,17795933697319826998,2097152 --field-trial-handle=2308,i,13106281647643899368,4171497211118919242,262144 --variations-seed-version --mojo-platform-channel-handle=6460 /prefetch:1
        7⤵
        
        PID:4272
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=6148,i,194937622649657799,7882026581021338866,2097152 --field-trial-handle=2308,i,13106281647643899368,4171497211118919242,262144 --variations-seed-version --mojo-platform-channel-handle=5932 /prefetch:1
        7⤵
        
        PID:3964
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3484,i,8436475620088254947,3469903697174362290,524288 --field-trial-handle=2308,i,13106281647643899368,4171497211118919242,262144 --variations-seed-version --mojo-platform-channel-handle=3180 /prefetch:8
        7⤵
        
        PID:5380
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=how+to+remove+memz+trojan+virus
    3⤵
    PID:5340
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument http://google.co.ck/search?q=how+to+remove+memz+trojan+virus
      4⤵
      PID:3860
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=virus+builder+legit+free+download
    3⤵
    PID:4928
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument http://google.co.ck/search?q=virus+builder+legit+free+download
      4⤵
      PID:5648
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://softonic.com/
    3⤵
    PID:5440
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument http://softonic.com/
      4⤵
      PID:5480
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=what+happens+if+you+delete+system32
    3⤵
    PID:2672
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument http://google.co.ck/search?q=what+happens+if+you+delete+system32
      4⤵
      PID:2300

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1372

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5768

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5808

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4824

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x454 0x31c
1⤵
PID:3028

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa38a3055 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:228

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ce3dbaf9858648687f7f182d773a20a58749edc532456ceb12c11339dcc59d11
MD5 bf937b8f78d01ba15f0501f98849f70b
SHA1 351ccd3819979592cf52dcf17a076cc294fe16f2
SHA512 0963b2e021b1c2fc0b4ad3ddd9b83e6c34cf11f76c3361fad1cc99812e5f7da2d58776dd41e0ade18da3f5452d66d0b94c57233ce808a7cd7d05abafe23d79be
TLSH
T17FD0A77577376800C60F4031E8116A51236F85B1209A86565196640D5D6B084E2DF586
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7aa51b3bde61db7236b0a4c66a1ca6765208b9fc900c07f6f5c64f12a1e870aa
MD5 f0b8af83913fa0cdac4b1ccf14ea9dbc
SHA1 2c4c4fd9ba02668a320250a547d34f267b0c5129
SHA512 2e1ea9b6faade6c80a8aee5b34ec1f7b084bf99ec698cac15f76c08d30b9ebf160f76ca43e20140802073c726c663654aa029d7fea3e131b6bb955d57eaf662d
TLSH
T153D0A77577376900C60F4031E8116A51236F85B1349A86565196640D5D6B084E2DF59A
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ab98da7535c8de464335204ae97fd672936e639269325c3a388b3039d8396b83
MD5 1656a3560c7aeae221756f3891b89fd3
SHA1 e48441fe2b843ba3bd0bb7799c07b22a27db8eb7
SHA512 c06d7152d11e33601716d4c5c33c7373ac4e0c16571e80ac4a8ffb9cabb52fae51d4fe8d808fc75be943287b55a320e90a186d71a5f06e9db006f6ab89266400
TLSH
T1CFD09B307B597042D3074031E8074790169E84B5249B86066554410D7D5A485E3DF547
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 03c9714ceda41208919b91db8014de24ae37606ed2abc96a2531b3653937df48
MD5 8c2296de8b61220530f453b2f30415dd
SHA1 2c66c88bc6a0f8267af3c1881fe9195ca1582177
SHA512 c741a1ee72d19a8af3a3823ca6df21b2e3afeeede73da7c80eb421ce9f7370fb162d00a8565078ba3856a8ccf78493a4b12f92955afe287b59ec5f2dc6911402
TLSH
T1E7D023307A3671C0C21E0030E4110B40236E40B230CF43476194440DADB40C1D2DFEC7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ec6419a915c6f94199df67c6cf1d67bc666c22ef160c8377d6792913a6518679
MD5 a8d0099e5966b86c13c6997282a63770
SHA1 df541b93a0caebe364906ec90c768bb625495f4c
SHA512 a2093c42c3f547b910f560ee7a58cb187cef96045e8e335276c7bde87fdc5e9894b670421e94170d0878e86a2bea8125d914e11181882004f966732f9670a693
TLSH
T135D09B303B597442D7074031E8064790169E84B5249BC7076554410D7D5B4C5E3DF547
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2c3a54ef9770ea473f4cbd48bd2643aa3fc242d62f30b6c7e49840eb2bea86dd
MD5 a95b0f742848f8b72f1298ee73e41bec
SHA1 07647b904fb93cb55b50e2458b011520b93699e6
SHA512 884de592670c80936c35df7a07188751d6f5928c4e36980dd37e15bec700334e106a08687a798506dd50bcf8732f3d8037536b2e985abb6c7beb217fb7b1bcae
TLSH
T115D0A77577376800C60F4031E8116A51236F85B1209A86565196540D6D6B084E2DF586
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b3b264ca9b24e6b6f04f746ce72a4f89836105338443ee3cf14e28996beba902
MD5 9568e18b48fbf5236aac6c8fb7b0d9d4
SHA1 1e076c379231afeb024985fe0d19dfc3373f1502
SHA512 67b4ac9a7872d951117b5cff79afbebff42642fdb72d680630e661c89d90024c29e9d5fbcb634fe2dce16ec65d08f423084ee811d116dbac1d07e756647966cf
TLSH
T189D0A77577376800C60F4031EC216A51336F85B5209A8656519A540D5D6B084E2DF586
MD5 SHA1 SHA512 TLSH

Submit Download

6d615c75-4e03-4c85-9641-287502559260.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\6d615c75-4e03-4c85-9641-287502559260.tmp
Size 10KB
SHA256 a0d09197783f3d96671607b02f869e8a8920a54d06e3e832e0517f516f07a56c
MD5 1b288a9c4f792fd8ba2f45b9c0e1ac45
SHA1 c6babefb496c4f86e4b7ca106ea189eed3188b38
SHA512 ebf3c13ef3a0fc5f493a1138495896cbb9a91ba43e5e8625e58f5865be72586554555d2b0c36e1a44c6cd46627c5361b07ddce903add440b8df6921163c0ddff
SSDEEP 192:sxZ4RLkD/fDs4BofOIdp9TFHW6+WNYaY/YzyrcTIgrJ:sxZ4GD/fDs4Bon7Hby/i9
TLSH
T1E022B7526E38697B8CC7E259BF15BF13D7F5543291901E48AAFC861C04E7ADD220B80F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000001.dbtmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\000001.dbtmp
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_0
Size 44KB
SHA256 aa8d32f02f8e10eb3b0141ce2c54e91c2e0593f1358e765567557c8164f44416
MD5 c598c39967bc209f859a58c17602cb09
SHA1 1c5a8ca1898a9cd99ac8ffa3f1be5992b85f927a
SHA512 98dfd5ee39a2f7385afd93d7674b0a174773c14ab93c6fff5bf0f5bd1c1b0d3447ff9f846ce1c28b6470f6d0dedb2d246a455a22ed63f14a1a8163082045f933
SSDEEP 384:GqJeTRUctjc9zShsQkuy/JUtu9eGYLRQrBbqMK/aKLMgs05Lx3y:N2RXV4zSuQku8pYLRQrBcaSMh0x3
TLSH
T13213C73E678CCF92DAD7407F495F1A357338C8B0F2A0564B7732366AAA6331E051E225
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_1
Size 264KB
SHA256 3b419fb3e8b24752a2bedb7086e07f13b0a5fa4124a37e3c30665a19eec89cb1
MD5 85901602ed07f3afc4624d9f08e3790a
SHA1 ce7e314cef211b67c657d1bb6d8124cb1d876960
SHA512 ee7d9f886567b9b74b054305bb8ec1cee1023707e09a5148f270ea33b37cf1a306fc5086a179f33aa37c54122c09ee58bb9540ed9b7ffaa635a2c1f8e3c72b71
SSDEEP 6144:HL/0L/fc78Bj/L/hL/ApC6RdPn1RW1DcM:HL/0L/fxxL/hL/
TLSH
T1C1444FF30950A05ACFA816F6D6023A3DE177015CBCD1EDE9E6390CD16826F32A6FDA54
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_2
Size 1.0MB
SHA256 1bea843a0632e0eeee52ffd22cd4c595d954fb3052a066463e48aeb3843d67d9
MD5 91ee5070d58083643268091880f7c790
SHA1 6ac2369a98a8cceb15ee1b580d5e44eaedeee543
SHA512 ff4b04a998b575b363de4244bcd12e6a0e8101e97cc6c17327807870d67e7dcb6cf3f1ac5aa15e37cfc52e24d93d7f6afdd9a117b846031c005684effa1d971e
SSDEEP 6144:HkKfsYIb85hIjqCBm5cdfwh5cqSqY1Kp3PSxxKY:Hj8caqsm5cdfwDcqSqT32xB
TLSH
T16D253AEECB682C82CA6B8774B0E0D9077E712183B68DC0D39944C5D997D6B8175F82BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 5KB
SHA256 726654b671c80ca46b7c2bd52bc17b8c1c0b1accff71ae0dd8c98f3a04a91fea
MD5 d89c3c9e27912601ccb3343a49272f16
SHA1 9c851540adf1ef3ea440670e4e3f939add1b5651
SHA512 ad2329b785453e33debfb0c01d9e29e4fcb2c3f4081e0ccff3e0898b7348e5353d370d22dfc37474d8bdfc3e0f4d06c75e1e3eee121aba9209c97cc8b72e0c28
SSDEEP 96:roymlLnlJ/cD4GOAP9JMTZMfas2pjIij3f3d+Mk:roymlblJEWAFOsqjIqfgL
TLSH
T1ACC13B3F073EC769DF6E06B364F102163973ABDBF5936D55A3947EB018123C28A0A098
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 5KB
SHA256 d11f198adc5bc786956c6479da4f4ae6da212c3c886dece51da9685583be6f93
MD5 2c33e1828055b309a26fa6dcb1f7b968
SHA1 a7078e6234b5658721c47f1881ecdd6493ab8055
SHA512 bebe2a973a9313ccc1075f1482dd33a9d0ef108a8158c959a421b5ddf9d5b000b1cdae90ae4fc580af410bfcb622941bc602bcbb8ce0736eea8b2bdacde8d6da
SSDEEP 96:iw2x+FESYwJpnRh1Z3B5N0zlzPq/iwp/szT5qxOv:iwCgiwDnRh112c/3pUhIG
TLSH
T168C13C3F073EC769DF6E06B364F106063973ABDBF5935D55A3947EB018023C2890A098
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 5KB
SHA256 144d772c3fa288865125a42da572e894bdea5cc5b75bd8e7a053a8f23e3da5a6
MD5 a312209eef64fad4b1d015e3abbc1c00
SHA1 b107781890f7ed3e0cbdb2f065b46b3fd8b0f2e2
SHA512 c2e952f89441cc525ac09a51805402b89425e22a2e76f3db2d3bfe9fb299c97f513ab51be5e38fb5a4413addcc455477f862565914c4c084eb9c867512cc6248
SSDEEP 96:p7Jgh4yNeRe2txq2wvez+QEtDPIh9BXSCBglO3Gk:p7e2YeRebBvelEtjIhpjGk
TLSH
T1EEC13C3F073EC769DF6E06B364F1061A3973ABDBF5935D55A3947EB018067C28A0A098
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe589aa5.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe589aa5.TMP
Size 3KB
SHA256 52ea2f291c90322af668085eebdc4a201797dfe46a73c59726da9109fab892a3
MD5 144248f23dd8f23be8cd5fea92e71134
SHA1 efa40efc771c77fca28ca2bb94a18f85c939180e
SHA512 3c5fb974361a0ba1c1133015cb94f136983bd45425cea5cdbe7e3c5a8fa8ff20e3158f0f9852c2050f9721621a66d6f235787d95dc4621a9978803f4c535b817
TLSH
T1A071C83D044E4469D3AA03F364F117167D71BBDBF5D32E957194AAF028053D68E4F1A8
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 325435eca454c0e2d522654e2d1a127c93a5ece79943789b0e639751681abe15
MD5 6ae44440d9995bf951fbc12991d09c33
SHA1 6e6ac5cb4617411ef144069471e82c1c9ce1b79a
SHA512 91ee48d4ff0e42f01c4d97940c281efe061689860ed6bcaf2804bb024071eb6c13f8e34205d474667f23f6b76eac4e5135905c7051ef1e9cf580e1a2e0c7f5d8
SSDEEP 3:MsEllllkEthXllkl2zEqZClX:/M/xT02zFClX
TLSH
T1F344040C7FD00D05CD0531314031C3501370DC511753D75334510C135CC77C04C00040
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fc1f16a1-44f6-4d83-9d43-ea86736a2ec3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\fc1f16a1-44f6-4d83-9d43-ea86736a2ec3.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log
Size 456B
SHA256 c5ce9aaf8ffdcb8a00463a7bf24001885e0a792f110c8db74a1e2f4392cb0e31
MD5 f23d2df21a39aa8d814cade6c37856c8
SHA1 233e65707015a53f83a0d53db03a4af8fab21ea6
SHA512 a7b50b8cafba80f6baca44b260f8379852c4176f3dd57168812f3b4b811d2ff340f09f8ce625cc2adecab2851cc33725cb729548a3da98b041387c7952077918
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG
Size 319B
SHA256 42eaeddfb0ae19eb21ab64c8a8b031e80be89631d224b929b949a411914186d0
MD5 c733d106de244fee5638f254bbe4342f
SHA1 60bd4da7205bcd88b675c214d2bc4b6105ba49cb
SHA512 dedc5285b06d770beed8f3c93a04d2130fdf04a2125959a96f3c84abd82c0ad8ab8836a9eccfc1b4ba9ebf56e19dfb7e4e1fcd2f8057cecc3046ef3379a46fff
TLSH
T1B0E0869815CDCA6ABC567CF3837D6708C2F13C9AA78CB9431B4ECC41610B646A6E7295
MD5 SHA1 SHA512 TLSH

Submit Download

verified_contents.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\Temp\scoped_dir2692_1279192535\CRX_INSTALL\_metadata\verified_contents.json
Size 1KB
SHA256 d23b2ba94ba22bbb681e6362ae5870acd8a3280fa9e7241b86a9e12982968947
MD5 738e757b92939b24cdbbd0efc2601315
SHA1 77058cbafa625aafbea867052136c11ad3332143
SHA512 dca3e12dd5a9f1802db6d11b009fce2b787e79b9f730094367c9f26d1d87af1ea072ff5b10888648fb1231dd83475cf45594bb0c9915b655ee363a3127a5ffc2
TLSH
T12B317466C8683D56267A63348E2D0602EB57C2BB0050640EB5AC558D4F7115FE242FAF
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\Temp\scoped_dir2692_1279192535\CRX_INSTALL\manifest.json
Size 962B
SHA256 5694c91f7d165c6f25daf0825c18b373b0a81ea122c89da60438cd487455fd6a
MD5 e805e9e69fd6ecdca65136957b1fb3be
SHA1 2356f60884130c86a45d4b232a26062c7830e622
SHA512 049662ef470d2b9e030a06006894041ae6f787449e4ab1fbf4959adcb88c6bb87a957490212697815bb3627763c01b7b243cf4e3c4620173a95795884d998a75
TLSH
T1661121366E2FC4260AE00698DC51308AF92453ADD380850E35BCE42E5B744FA430631E
MD5 SHA1 SHA512 TLSH

Submit Download

Favicons

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Favicons
Size 24KB
SHA256 069cf7a19b559420bcb3d0f4c35b80e8e6d396ff8831270a0986539b9e266606
MD5 873a5334ad994b96a1684c04141c5d1a
SHA1 95350cecd2debfae2a60e93869c24cfd042bff91
SHA512 9a953c09fc755ea0728b3c8a72155c8b33ee62ad1fe669c9096b73c2c3a6f3d99f355b50ab9cffbb88859f42f6da4d05949738883e721e1f3419f2ab336b23db
SSDEEP 96:UBCxf4yqGOJsUYlTCWad2bybsq1pW4EM0j:GaQyqGtUoTCdIIhEM0j
TLSH
T1C6B219976E31740ACB452E7F11196DB28E37D15CEFE5EC4474308432D9BCA9680719BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

History

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History
Size 204KB
SHA256 358406499bf808b441d941fb8d79dd4598374c253e3ff0fc17b69737f0ca3a07
MD5 303bdbd91b95db6bc79c5d7828754d2d
SHA1 b1980c95493e1b34c603ac4643b43b9b14fa0d11
SHA512 bf5f8565dcedbf009ebf2f691e6009181c1e3cb38bbb8be3904af473b42de1ed61fc992b1adbdb77a4f2cf187a8754919602412ba7e687eb55179ba63cac41a9
SSDEEP 96:2nBvua1KIU+bGz83uy3+u4tgp4DLjGQLBze9z3+OjBHMsDEuspU0wbtqrOQpPfRn:2nBvUf+G83uy3Ct7XBBKrH7DXspU3iD
TLSH
T18014304E5B303711CEBD917669F644E35D6DF03BCB1266CA6C6104B0CEE6B52A02D8BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log
Size 445B
SHA256 9e64c1f2bbf975c343699f458ced40ed75af3d15931e995224fb958d85a005e5
MD5 a8902d91e7f79acc95918d603ee3f08a
SHA1 906e5b44e62264be651a44346115ea6bc3991285
SHA512 faf14202f048c428f3b72f937f7988625d65c876c180eb983b5eb220ebb1620f77b2cd0c0d60e61ebcd8c3847ec07d92d9865448f47ec1b731fee45e3cd29341
TLSH
T1A5F0E5F35614E4AAEF2878F88D9A3498977195FEDFC0C7E9C9B26A055840A2013CB405
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG
Size 331B
SHA256 7df634a84c9715f4d0bd813ff6532834f38be97a97d547e2cf325e429cc161fa
MD5 400d3fa9c4a8af55a3b1a54f7aa1c1d5
SHA1 d62378cadbd97ae7ac9025c9da1209dd40779b6f
SHA512 ce6855a191ab96a346837f5353e4f2c18e2cdca0d3dd18362c14e99d860a5b437036d40eef81f0d6e820d566388a0340312495eb380cc41cd7571582302d311b
TLSH
T153E0D8A854CEC21A5D84304B523CF70CC3B0381FD78CBE425B45D881B007404A7C21C5
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 0d24f5fe62d93f297fc55c5fda6b4ba9b86104c591eefa342ab64dba26f84354
MD5 a215ce7e87e6722211f71c8152d3fee5
SHA1 dee20d813e495c2dd875231029d92114cc60e0c2
SHA512 fcd4b180b6f0e97cf705c8923b34fb5b9c7d9c166f73147af3bafc01e7ad572cacab862e29d76f96c834bf2faca3126c0bb2b2983536b6ef58b7bee293455939
TLSH
T1794159F787F1956D9A1259F0AA18EE1BCE2C0511831C7C6989E0BE56D3E3871E10165F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 c07faf21555f20f7ecb87d1364dba3841f8f8818586881708d28ec797c196d8b
MD5 48d334066a79bc35bd512ffd2c25b8d8
SHA1 de4e05f8aa59d5ba0e9cef7250a413d405ffc9e4
SHA512 7d234ae57130a163ed16ae9e3a4c1d7a507eee81873ec87a35e0c08cab9a3903679a8201bbfca919ba7d88d4334a3721f7b82bed2da0301dc3f86c02429422ac
TLSH
T1D24159F787F1956D9A1259F0AA18EE1BCE2C0511831C7C6989E0BE56D3E3871E10165F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 957df719220eb3c755a7bad9db9f71feebe7fbcb171376718a8fdd48aec1a83e
MD5 ffd238d5bc05eb63bfe7580b6ca167a5
SHA1 35fbda9cef6194677ebd0909e66643b63a2b5f25
SHA512 15330e9275421d2b5281970df09030c4ecc564d48d4482ae25693618c0d796e998079e09f6ee072fbf4557bf7556a491dd1ccb07413b761ef0b08ca3eeef89ff
SSDEEP 96:DtOmupxWrzBmtmDmnBmtmemO+mgP0AggRbNweJU:DAmupxWr1mtmDmBmtmemzmgpggRbNPJU
TLSH
T1A7917AF7C7E5856DC91156F0AA14AE1FCE2D0914832C3D6A88E5AF1BD3E3871E10165F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631
MD5 807419ca9a4734feaf8d8563a003b048
SHA1 a723c7d60a65886ffa068711f1e900ccc85922a6
SHA512 f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c
TLSH
T18DB01269E5507CFF074A83A41428B463C3FF0047421C8ABEEA3873AD42A21FE0828C57
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 7KB
SHA256 b5d208aae5e093fb8bb2ad0621cdb460a6cdf8cfb563a791a0dd56f7d9397490
MD5 44af72e7c9c676dc44f7929e5ece5a93
SHA1 e0424c64522659d40809897f7234409c7dda6d76
SHA512 39b0f95566446ba7027fbfda7ceb78a45d14554199a914320a3fbe99240ac0d1d1a34e3ee8ae2a3d5416b8cf1782f927047b9aade3a24e4ba2f06fa5fa6d18fb
SSDEEP 192:DAmupxW1OyONitq1mtmDmBmtmemzm2gCalG/WP5NFyl1Xq:DAmupxW1OyONitq1mtmDmBmtmemzm2gb
TLSH
T1FBF1ADF7C3D4852DCC5156F4AB256F1FCE2D0918832C3D6A88E5AF5B93E2871E10165E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity
Size 1KB
SHA256 e170d3d7d929ba500565ebbfd01fe2e520b8c20918469890ec6fa89bff2cd241
MD5 491c48bb6cd6b122b388bcb40b70f0fd
SHA1 6d13db9c996de1b1a4f33d1a34d8b01599f0cf77
SHA512 3b3357b6d3e8fbfcd5446817d3cb8663e212318f70f850530add588ba440329d833180d0929ef9ab03b85e924ffbe5e23416f35ce75fa57620d0d39d8cab2c35
TLSH
T195315F97C5BBB41710BD0ABA1D0EFC0529BDA8361291A8F1DF5AD27CB0A25F74F1103A
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity
Size 1KB
SHA256 115916f69a7818c085bd8357f972d6c24ea7783ec6906edec4f299189d99c598
MD5 376b12f4c0295577338246a7844dd1fe
SHA1 ab0af81d9f1f2c82579a065e0d99720e68065929
SHA512 2a27b64daa009531e7dbba5aa0c746cc105065c2b00ef4682d77d089c77ced43c220d2e51921b491f9c45d03f8543ca17564e56d5fc68262ab5b10d457118d0e
TLSH
T1A4213C97C5BBB46710BD09BB1D0EFC0529BDAC361291ACF1DF5AD26CB0A25F74E11029
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 7c8fd8e070f5abf905e7230d7899735dc8c85cc3c498eabaf8e8fe7d24e07589
MD5 4194f39cbc39d1f286e8021941475a8d
SHA1 d13b7cb1e56f38e8df79059a74c0b0aba28241a0
SHA512 5a84117b739e2985c1a6a136def93e4e8f089836997a57acac9682b5334cfdc8521b4378bb5e0fb910465cbff59ef430983163a98e2f2c8fe6c99d301f9dcf2c
SSDEEP 192:sxZ4Ry9D/fDsXWpVhBJYOIdpvTFHW6+WNoSaY/YTEC3RIgbkJ:sxZ4OD/fDsXWvhBJsRHbd/+s
TLSH
T1D04294526E38697B8CC7E25DBB55BF13E7F9143291901E48AAFC862C01E7ADD231740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 2d03c315c944cabba09569a5b7eb66fbff201a937747aa8bf0166e7d010cb32e
MD5 c6944ac3ec1e8ce959f921ae8243cd97
SHA1 c4510259362bea2b2024b2ea5d9854076930ce48
SHA512 bcecb1d751a12c01d14e12660b3f8b7a5f3e1bcb55b89479abeb19a487b62103ba1a1bb7fb3f24b7f2652dfcaf3f7872e34ff4cca537d569430f6c0419d3e59b
SSDEEP 192:sxZ4RL9D/fDsqBofOIdp9TFHW6+WNYaY/YzyrcTIg56J:sxZ43D/fDsqBon7Hby/iM
TLSH
T17432A5526E38697B8CC7E219BB15BB53D7F9103290D01E48EAFC862C04E7ADD231B40B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 cfc360d83877ba06777da25a4fb054cd4f8f754ff7ea6d481d9b8b1d70cd77ae
MD5 46388bb8363cb53110772b52a087ac63
SHA1 e47f22b14b07d1f5c5e4197bc6d43e45afbfc909
SHA512 a83fa6cf1e32f3449fc0344f60e33868f32e5a8de6b8b2b2f8efa1a5787f09a457d80db17d13206276df8a45df30e3726463bced065e9f8d9f67f3a9301303f3
SSDEEP 192:sxZ4RL9D/fDsqBJfOIdp9TFHW6+WNYaY/YzphcTIg5kJ:sxZ43D/fDsqBJn7Hby/pi
TLSH
T1FD32A5526E38697B8CC7E219BB55BF53E7F9503290D01E48AAFC861C05E7ADD231B40B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 c5ecbc6eabb6b06a0c38cc0fbeb209eec6b7a7413ded6c37d95e82a07d043ebb
MD5 4ad6351fee37e5fcaa2bd8f349b02a21
SHA1 8114c054eb32af70c5b56748f2784b2cf8689d87
SHA512 e99d366290af18b405f1137ff01438f1c78c88864e641094d391d91a40fdfc9d187aadecd76a2264de2f3f6e5aed3462205d7c251508e9dd87213631e85df76e
SSDEEP 192:sxZ4RX9D/fDsPtWpVn/P2a/EDFGwOzodpvlxu+wFHW6+WNo2mxO9daYZ2aZ3bqTe:sxZ4zD/fDsPtWvn/Pz8J4Hb1TpZ2p7A
TLSH
T1BC72C752AD34597B4DC7E669FA15BB23E3F9147294C04E44AEFC8A2C10E7BDD221780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 392d4978ca243c923fd4a12690dd720ed21886241464d335fa7bb303ce196074
MD5 b1484bd4dc4a3201d3acc39aa471b0bc
SHA1 041be01670b71522b5798a4505348d670ed463e3
SHA512 c74a882347c4accdf75b2c5e713fcb78cee31032218ee8456e17f5e3e72b57d0526d70e362b8724b7c7b174c2af1daf4bc41bc585c39268949e6d2cf835343d5
SSDEEP 192:sxZ4RX9D/fDsoVWpVn/PUa/EDFGiOzodpvl3uTQHW6+WNo2m8aYZ0ZI9fYM0onGo:sxZ4zD/fDsKWvn/PF8XFHbLZfl91
TLSH
T11D62D752AD34A97B8DC7E668FA15BB13D7F9143290C05E44AEFC8A2C10E7BDD221740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 08cdcc0864fedb552d3d83ae23e10c22ae293f8087ca035222c4988fab4668a5
MD5 76017a5fb217dce5a07a3cf72a2786a9
SHA1 f77b789a9e045da38922d6c3ceded3dc4b9b892b
SHA512 a51d4362ce8d44839bfb2d8c25f302b2aefab2ef49614bc768c9bf4755cecce629ce487a27ccd9a36c608f5c30414f0a567355b5952e0d6fce3c71f4ded2d0ed
SSDEEP 192:sxZ4RX9D/fDsPtWpVn/PUa/EDFGiOzodpvl3uTQHW6+WNo2m8aYZ0ZI9fYM0onG1:sxZ4zD/fDsPtWvn/PF8XFHbLZfly1
TLSH
T11762D752AD34A97B8DC7E659FA15BB23D7F9143290C04E44AEFC8A2C11E7BDD221740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 37c872fb1c79c5fb22c21bdc770a7f500318b620e5543b9ad9bd729ce764860a
MD5 bbe29f628afd6d6b676c603e18a0e764
SHA1 1e0bc52433ff22dfc6aaecce0d93bc08b7b9509a
SHA512 e573f632fb60d3da4fd9c51fe0d96bd79745826a5fca90f8e2cf945188b754c97983a3cc98c650bf386a269ac7ed8c875e34a11fd3b5617e48ac4d01b03acf21
SSDEEP 192:sxZ4RI9D/fDsTWpVn/JUa/xOzodpvlHuVQHW6+WNoFi8aYZ/U/YT5CpRIgb3J:sxZ48D/fDsTWvn/JFTXHbau/b1
TLSH
T11B62B652AD34A97B8CC7E659FA15BB13E7F9146290C01E44AEFC892C11E7BED220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 c85369c29463ed0498a1217ba53102fb6aa7b8821bd465b0b809079cfc7fc36f
MD5 76612663a218d4b358a22da2fe74cbdd
SHA1 1a6fe6faddd0c0c15c12c06e4fce2f4d07b3401c
SHA512 f797fb86b496b2464a7217c0e2e1134dc2fd103de2f2da02bc46683212c36b14c307d9ea2acaa2dc5e50451a0847574debff00cbd404eb3148f6ffd8d1e28af4
SSDEEP 192:sxZ4RI9D/fDsoVWpVn/PUa/EDFGcOzodpvlHuVQHW6+WNoFi8aYZ/U/YT5CyTIg1:sxZ48D/fDsKWvn/PF8dXHbau/c1
TLSH
T1C762D7526D34997B8CC7E658FA15BB13E7F9147290C01E44AEFC8A2C11E7BED221780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 7efd36f4922c5a3b1a204b6ee9edb553b8588479147f56cde79c22a3c0d93b8b
MD5 ea966ec69b2c1fc5d8288d671c15b603
SHA1 3681aef7923c9fcde4f7e44a5efc86403654f6f2
SHA512 8b977a26d4158f267c2615e7550fe3b634011366d04683c7589b9ab31955299fa389829159d950a1e71bdb9daf067bfdbf6593e18a4edc6263a50a513dcfe844
SSDEEP 192:sxZ4Ry9D/fDsTWpVn/JUa/ROzodpvlHuVQHW6+WNoFJaYZ/U/YTYomTIgb3J:sxZ4OD/fDsTWvn/JFzXHbQu/j1
TLSH
T15152B752AD34A97B8DC7E659BA15BB13E7F9143290C01E44AEFC8A2C11E7BDD221740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 3657f1e1cae7f37f5913ed396f79990b6e1f2c2498785245a083272bcb83a6a3
MD5 4b81b7df1d60a8e332e2ef5d5f8be70c
SHA1 66ee833af5d807bafb5f608ae07fa71f447a5952
SHA512 37b10479b5044a8dcbf70174fef2773e5c9e6ed7aac715cbcc3a6dc2dad09ea67330aaa06c249eba54ae1c29016c192df0f6c5b6629957c8dcbe43a707bdd538
SSDEEP 768:Wsk7u70WvqiEa8F1+UoAYDCx9Tuqh0VfUC9xbog/OV35LlWYSBxroyDYy:Wsk7u70WvqiEau1jai5LA3BK7y
TLSH
T1E7C2E93B740CCB7E4F801E9DED566F963E9802C7A6988D4087FA994C02C77EA51264DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG
Size 335B
SHA256 97112985db4384ba4db8d64c541d7790c7b03a530bf54cfb8bc9befccf1dd059
MD5 a4014e17bdff88e07e19eac99a889155
SHA1 c0e1b3d9e88eda0de3c40b7f685f41f1a32305c2
SHA512 280148521f43710d13c33daf9d35a1fff19e704e40fd732c99842cd2ab1fcefadeeba667c8cee5a47d0b65776b90041407e0557f6cf908b0f85edeb133713bb5
TLSH
T1A0E0DF9815C8D17D795A3057023C974CC2B4786BD3ECB9422F80C846654B504B1E3180
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\000003.log
Size 1KB
SHA256 f99f9418163394f9bee62fc04ab06ef3185dba6fc6556aadfa189b7af415c0fb
MD5 8e5262de94968896b606a9311c232c73
SHA1 cffff468ef9fed5cce4959c200e0f40e7428dd49
SHA512 1f0d883ccad480894bafb94e614e0cd4efbcb2a44e80c32bc08b1ece68b9e1ec1bb1eb1068ef361a62f6fccaa19f57587e00e00f9d4ebc290d16629d93ede77d
TLSH
T19221EBF70A081419DEAE8AF42CE6B7A4F337DACD0A49CED6477D83D750016B1AC27481
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG
Size 319B
SHA256 5596c2ec367030c02d277a69cec005ddb4923176b93e01772bdf890d29678753
MD5 9d51d380d5af47ca55ad9fbe2964ec55
SHA1 d5ef440b02f63406a67278f49afd910a51f7a7ae
SHA512 392beb2b4a6a070cb5ed3bdf256203314029074ea40c7a6659513720fe095e009f754cf354439ececbd86d15a11849467ddf9a1d9cf55b04f70c7b9bfea0a18a
TLSH
T1B9E086A814CAC76A5E95B4971278A30CC3F1389FF78CBD431B06C4C46207596B7E3195
MD5 SHA1 SHA512 TLSH

Submit Download

Tabs_13431623341325144

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sessions\Tabs_13431623341325144
Size 1KB
SHA256 59543712d6584e45f4e9ca0ef0c99ccc48e3d88f8e70db779d3a51d39df9cb3d
MD5 ba819741270303fe72df1eccbc76787a
SHA1 6b5fcd76f2c2edb612da457f7bb28ac826d4a881
SHA512 c1697b61f8e57e88572d4e22b0e60f7f86417a13e5831b358c5b47aa3f1325e794176d98631d8a24e02ef0534f40eaa219f169592d35f7d7d5abb448498d7959
TLSH
T1EC31E10397D555BDEEBF997044F902B02736B8A5AED5C55F01A212080DB72616F70F94
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 96B
SHA256 c56d7c0b00606ffc526f3a6c2009dc4bca979d7c6c16d67d6979d042e248dd1c
MD5 df1d7c81005c30214f0eaacb7d223c09
SHA1 ba04048603f0eb63ebcd048d9b3f9facee8ad817
SHA512 d72e35dc5aeccfe7ef92591e2774b4beb7327f85c20b9fe3c5cc5748753439834223c737a029c2965f16f944ef7e43f3fdcf9b40de7a522f0940cf89bdb1e689
TLSH
T172B002295819E132C06413725DCA00827A5C1D94839B3AA181E401B9E4352834152491
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\000003.log
Size 112B
SHA256 30c83d244ba48b1243c92daab64992016f85dcc478c23e1ab0b8bbea7466f148
MD5 1dcee87714d0acf6c7abe9255c17a655
SHA1 493f5e721787f591abf58253657daed6184f61a3
SHA512 276d4e3e312a1a6f99e0323ab22ee6a9efefd3dd6d8e648fc97dbb8e9dd9518e847baae28582b1b57100503fc8f7a7f36d0089a3a566fee5ffd24684b7e0abaa
TLSH
T10BB012643B005267C9CA043907954B809F04E443A0415907CE8ACF394E046982F44EB4
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG
Size 350B
SHA256 b5d7aaf70c48d7110545ef31665576edd0021ee9bebd689a9bbe7a1c8bdcd013
MD5 81888435701b72e5d3bcb73a6ef2611f
SHA1 6c2cf398f79ea7e9cb3b418e4127faf7edce20e0
SHA512 d607deb11cc3d530fbe1e5f5559cf3e532a1f409d9fc2187abdadf495753c16435aa565e680e2b54d2dd0611c7381b76da4c72b2664b864dbb0c62a54a7176da
TLSH
T1E0E0D8A826CDD62A658A309B523DE748C1B3B816D7CDB9522B08D944720F140B6D3140
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\000003.log
Size 175B
SHA256 80d1388b9a7150eb0291175fe693dd7b6bce910c3e4fff51e94841d31d771dbe
MD5 cb63c64828a27af7253afb7c7d986654
SHA1 8a54aeb86f79cc69e6f11278d874cebd328ae466
SHA512 e0dbdd6931c9272e0b52bb2ef7895121f6324379f584899343342a057737a9837cc476842ea781a1de5c17a20c06e0a7d24c0ed6ea41fdd95bb99296e8810f9a
TLSH
T135C09BD55F903023FDCA5D3D0DAB53041720C4752F74CF57D28430901C0A285FF61145
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG
Size 326B
SHA256 1e73557ecde201844340fe3fbd24c022e39d3a361d6b728f334cd52d1b139abc
MD5 f6561c828cd594840a54927130ab8a51
SHA1 a3476ced575e72584be361c6461cebb034a45661
SHA512 662b99515545338876b47c83c4c2af84ea288339734535913d7da9fea537e99835f9226d63bc0e2c503a5b4baba0b32d734a41f107b4b39fa6bb11d7b6901909
TLSH
T174E086B866C9D63958857087437CAB0CC6F5BC1E97CCBA875B0C8941B10B144F6F7584
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 fe2b3df687bf33c541f6f22a99c894cb9b4fa8479e66c506c816dfa0a1270bbe
MD5 912be316469cdee4adfcf4685a9e5610
SHA1 e29db6102e4d5a9ad8932545e881bbada4df3a38
SHA512 fbe5bbf2eb35a62cff974a0c5fae38e923721acdd2d61457a97bfeaec924eca2f516a9cb56058ac1207b117cc7516ad10df66fc8f19b29e0f92ce1d1510f22ac
SSDEEP 48:KfSVOyIQA2aQL9IZy2KYTfTINKIsgPyZAI7KdqcLyBaIPKh:KIbCKcfTWKIsSqAgKdqKCa4Kh
TLSH
T1FA913205757B0A453CBE784DA1BEC6278B423167391CA4AF7FA900621EABE110DFD8DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c53f0a9c-4455-457a-86c5-22a3b6d19809.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\c53f0a9c-4455-457a-86c5-22a3b6d19809.tmp
Size 414B
SHA256 22e5b149ec4d1151f635899e30ef2f0024c064555d7537fd40b9309e45cdafac
MD5 46ecc324a9d6b94da4dc003252b484f4
SHA1 14ed6badc6070d254d408583d219a9a7a95f9221
SHA512 f1edfd5f4bb198aabe39882016731dc9f61b6227cc8fd3bb9d155a110384f56dcdf8bf75f63b882ed19fbd403393e57fe40e9fe4e1e27b133f15dff5a70f9320
TLSH
T169E02BBDCE21EC3748FD175868500B06E71113AB2A508C4F7F3C81088FB5A7B428581C
MD5 SHA1 SHA512 TLSH

Submit Download

default_cloud_config.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\default_cloud_config.json
Size 13KB
SHA256 f9e4da319fe1f5a7d497c452421f4648a24ec7588f309ebea0f0cd61a6251eef
MD5 256c40bace492c4e28451ce149d2f9ac
SHA1 b48b0eaf986b9efc91d5c8dd394dccb6d82e2adc
SHA512 33b38d1ced015798722180fc8c8ce6daedb18cd5d0e4b3db27d6176c13cf3ccb1bd79f2e68ca390d6eb43ac508c29067e8f1a3ee9f0167cabe37ebbddf6b0ec0
SSDEEP 384:l7BJeojewj9mg1IZyvASoIL5QJwTcoEnE0YU/VwTcoEnE0GU58:l7BJeojewjcg1IZyvASos5FEnE0YREnA
TLSH
T12452007AD2211C7719B8636858BC4692F524137F8281C81F78BC656C8F7FA79A089FDC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

load_statistics.db

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db
Size 156KB
SHA256 2c0383da2a5a13e26274e9d53466fd21f3ce40bafa1cff7239fec0b4f19d021b
MD5 f73e53a8a353364d1efa707e4c1a8647
SHA1 a649b88b3d41e87518d8106b7f3c77e29a1cbb3b
SHA512 b27fba97b46d5d6800c1b52be7d9ac2ade94ebfe3367332ffd6b5a9ea8e4127c8f6a406e862988a5d503af222f7acb2ee51342d073839e05de166426c616e4fe
SSDEEP 1536:PgWbv/UdBiE5bWUBt02B6qtrgFVMuQv+eHQ:PJbM+1Nsrgmv+CQ
TLSH
T1DAF33EFB682541AACFCE6C75D54BED8442738320C124DAED5E3E4482BB385027EFA59D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log
Size 15KB
SHA256 bde7eb299d1063e3910da256ba578fa98cb67e739e1ad750442689b95b19f6a4
MD5 95e5edf44f42798cafd848adfc0da766
SHA1 f86b9471b95e6ee730a0b5ca4ee767894dfeaf85
SHA512 433963ed82399bedb726d25d7380f6b7db7f0224db9c56c8e1fe793dc2d18ed7353bab779096e49ed95df0df3ce51dcde5b13a2a9176ab11c29500cd3d17002c
SSDEEP 384:hQtFIIIibSMIMiBKzcH/q5zbsiosC3letVtrt2E:hQboiNC3letVtrt2E
TLSH
T11D62C5D663087B77E79FAFBA077186401AE59CC18D21124C7556240F8EF7B6782E22F1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG
Size 322B
SHA256 bceaa7f5a7c306558293799c7e62bb3013f7b72519824660cb6b45d5a0c3e1be
MD5 b54a42ad9ff9cb5537345505425c15ba
SHA1 38140d7df382c37c17e88ec58b8bb5ffd0440126
SHA512 948ffcf1f99bb14ca942a9066c7ade444b011666bd21d59a742a1cc5864015d05cbbedfbf15a487f59d0b5bb696dd8b30794f834ee86d72c2ecf781b426880df
TLSH
T18EE02698B8CAC26FBC5834CB1138630CC3A23C5BEB8CFA871F01C444A44B900BBC7581
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log
Size 1KB
SHA256 2909e508b106a3b565e4b2c41c8f530d417f735707630a2d1ef72480a4c8c14c
MD5 7c9168d1f92a33451abbc2b8d65cb30d
SHA1 ed2785adc4de2eb4691fa7cf2a8e50f75319de54
SHA512 f48cab8a7eb3f13774a05ed18335f0645d79351611537c3cf47c50c4b7090bdd9491d494cd722486d4ad2f880666a906081db0715f970b338bd847fab0030f9f
TLSH
T17C219761F334C52AC1494679143FAB222338D8168FF8EC0F05BA20692EB6E400E4B2E6
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG
Size 340B
SHA256 a60b3dc6f0ab2937263064aa44e5f2039dfe1d7a4d5395c99531c5755612e543
MD5 99cce677a3246babfe0f49d5e36a33e3
SHA1 660da5beb3774a11ec8a6237d7f183812105ef17
SHA512 04e04b1863c95b266430b2fa7c9569e4925f05b1f0c57de91b1da199fd36a2c7f437d01455bb35187ad27526fa2745894f4ad0a7295ed4139ea218d530d705c5
TLSH
T1BBE0D85874C5C25F685434C70178A34CC3A23C56EB8CBF421F01C844554B9417BC7541
MD5 SHA1 SHA512 TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe592b3c.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe592b3c.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_1
Size 264KB
SHA256 9d3cabe5e2adf1ecb32c1fbee363c6dce6f1c6cd21b99490ad839e74202176a3
MD5 e58a1937e8bcea453cf64d3ac0bea4d0
SHA1 0433e3519e7e8b7fd1fb10ac3a72f2b279ed70c4
SHA512 a2979dc5d3a252301e45e2258d6206f2cb1460a518c7b3d786baa9541506dbe7d1c79dc1cc14219033bceefa58475c74f3c7ebd419476d898afb01355912888c
SSDEEP 3:MsEllllkEthXllkl2zELCYz/:/M/xT02zsCYr
TLSH
T1DB4404047FD00D05CD4130304031C3501370D4500513D7473C55CC135CC75C00C440C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Size 14B
SHA256 ee1367d356a136a11664001cd90e05ba08dbaa85f496584158f5e42be8e836fd
MD5 8297da058a737611abcc3a0ede9ffc24
SHA1 e532552672ecffbe3509fb4c334833a67f16d05b
SHA512 fefc70ebe486693310a00beb5ae125abb1569c4455538124d897566f2e44f2b3854ad4451196607137301a811ac7f96f1d488a36eb6d6cd566f2f7cdc7c7568f
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 31KB
SHA256 65f59892dd0f04432e97a3bb10264a1c71043db23a7ab976e825ca3d6d24c569
MD5 1eef121415f6157fdbb71dcdccedb2db
SHA1 6f997255f31eb404b96f647f590531c6a4d94568
SHA512 005e38a68e160fc3f47a5bc263e11fa28426ff545ebeed6b3452635610126f6c6da3e4ec866d3c4fc1fc68420fa0ae8467d4ea6cdf1de9c62a457355ce8a5093
SSDEEP 384:eiFSZcImsNe8TUNTUlIlGDao79kdbl95QYQd0mEM2+8vKASBjwds59aXEivn3J:1Fgmnwgs9kdb5QdkM2rtSN59a0iv5
TLSH
T192E27EF188E758B6D56D9BC3A77DAD065ABCC077B4845908B3E4A62CEC5B0BFC312811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 31KB
SHA256 6ffba3445b8e0f9c332758dd04d53c59ca0c0e4e8856399b988d127b1846dc09
MD5 a76c24e0c13d927189bf3dda5acc7b3b
SHA1 495b80b076bee8acc646f088948a02e8fb6fdd98
SHA512 7dd57b64a06b1079c7c36eef6ea0dd048390270b3bbd76f8e85a867a2210ba4ee2f484ec8a51b701fce99d8b317714997b8105cd962552670641ce8ee47b6019
SSDEEP 384:eiFSZcImsNe8TUNTUlIlGDao79kdbl98QYQd0mEM2+8vKASBjwds59aXEivn3J:1Fgmnwgs9kdb8QdkM2rtSN59a0iv5
TLSH
T17DE27EF188E758B6D56D9BC3A77DAD065ABCC077B4845908B3E4A62CEC5B0BFC312811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 9347bc31b0795c5f112cee752c36b41612e49bf6969110396a5907f85a3e5a77
MD5 2cb05dfff7142880c261e06c53f4efd2
SHA1 ae1368020362117445865e763e9501ae7fc047ca
SHA512 e264a21ee21b0d77a3e37f0eb79dbcde1d2898e1492d38db410c04de69169ce9199fa1a9952392e46ad69243d13e453cc5707e9109eae6b125d929da19c3c765
SSDEEP 384:fZcIhsNunDao79kdbhaSmYQd0mEMMFivn3J:3hv9kdcSmdkMMFiv5
TLSH
T119829E305C74AC371EA6F281F4863A175FF88077E7C86F84A5EDAB1C00EE698131B816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 31KB
SHA256 705d4c073b6bad6b8155b0f51c0cb3c16dcb2a3b410845794939c2fe7288657f
MD5 193a355d9205cbda8eb1e50795e727cf
SHA1 58d0f5d5378fa36326d336345f45d309271a54ee
SHA512 88618cf3edfaa21fb778ae1ae1e5eeae26ef1e81c6d29c0f4c8dbbfaf0540d8037e9a299c3144aae23fa92b218a02e0c26d8fea7ad93b3bf5e0d00c64e95b52b
SSDEEP 384:n9iFIZcI43sNl8TUNTUlIl0Dao79kdbn9UkYQd0mEM+xVASFLAL9Vgivn3RJ8/7C:0F243wwge9kdhUkdkM+ISaL9VgivZ
TLSH
T194E290F158E758B6D5AD9BC3977CAD062EBCC077B1845948B3E4A62CEC1A0BFC316811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 7283aff865981a7f97bf9165638c704be2f2434050b337f596234312dbab50d1
MD5 9df6a8281947d800f8921facade5eb4c
SHA1 eb452e7791db46cc85da2eeb0e189c6f843b80d6
SHA512 5b4ff42129af8d6ac88b6e1be44014d23785cdd04ce4ba2857047a23e3671834cfeb4133e142c31ca20f19fbd02454aa5a0820e19e0da3b48c071fbd121da56b
SSDEEP 192:7ONf64BTQmiUy4+4Vo5GBPKcl+FdGuom1YKEMgWwoq3nU6:7ONf6eFx9Vozd0mEMGFU6
TLSH
T13E121B31AC78AC6B5EA2B545F48737135FE4412BEAC96F84E6DC3B1C05EF69C130A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 30KB
SHA256 9da70bbaff8c3ccbbe34cdb756ce45c5131aa9bbd5c4bbfea8f89cffcdbefbe8
MD5 e75d9b9f796475f2296d3cb7ff7ad79f
SHA1 e0e3f72c160d6e51f8cb6b2c9425102428617c40
SHA512 08df9560a2919bf01313f47068caf000bbeecebd45028803290d84840286cbd84e5a907e80cb6642771a65417e14af9196bddfaf63e96922d76191662a378297
SSDEEP 384:n8iF7ZcI8sND8TUNTUlIlLDao79kdbDaLyEZDfwMd0mEMncZivn3RJ8/7IzN:nFj8Wwgf9kdyLyFMkMncZivZ
TLSH
T14DE2A3F598E39937E8AE9383A77D6E469EBCC063B5885984B7D45D0CCC421BFD30A805
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 31KB
SHA256 17850f0d8304616474965f0342f20d8e9d6304691629095af4587fa73eb1aacb
MD5 820cff7190f69f2ee1b1a09c659482cf
SHA1 351c4d8676ec588e37a9f1ee1a5941a30002cead
SHA512 998c8462df54e2d4243c797ad264a634b2098c11352301e14bd0efe085703416053031a74479b9c07a7fed8d31edb6fb5f5cadf13d56a07f66e2a18d50bf0a9e
SSDEEP 384:n9iFBZcIEsNT8TUNTUlIltDao79kdbt9ZGYQd0mEMfZaASFLAP9Vlivn3RJ8/7IZ:0FJEGwgZ9kdLZGdkMfvSaP9VlivZ
TLSH
T15FE290F198E758B6D56D9BC3977CAD062EBCC077B1845908B3E4A62CEC1A0BFC316811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 c47688d88273e0286e786d207333ea0a930522d9209c49e73f277962847b2891
MD5 92f28b9e324bc954a1dac547f1dd2614
SHA1 579db742f8bda51ece698bc874d7a90ad696e151
SHA512 0d944341826a3f57b9be96124ece7889082251c233cc4e6d800c0cc8291d53134eee928a904a8ac29fe33324599aed5fdf10bca9d5f3adb19ec2198d9ffc2630
SSDEEP 384:eiFDZcImsN+8TUNTUlIlGDao79kdboaHmYQd0mEMbFivn3J:1Fbmbwgs9kdbHmdkMbFiv5
TLSH
T1BDC21AF24CE79836D96DA743E77D2E024EBCC067B5846A50B3D8961CCC5A1BFD306811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 5854ab813bf25edd199868ef3bc0b0aa4a1796a976b448f1a305a1e3502e2ab0
MD5 32e22c23e38c5f361f99cf5c6a02928c
SHA1 7ae187cd8c01ccc27965a173fb3c887576424641
SHA512 ce76528a9f384e8c8fe9db53daec9db51ed772db494475859b30f9da6bd377a7f8f350557432ead1e9530ff51dc7d21afad64f6034f1698d6c26f43f22bb23fd
SSDEEP 384:n9iFSZcIT3sNl8TUNTUlIl0Dao79kdbnam6YQd0mEMUt+ivn3RJ8/7IzN:0FgT3wwge9kdWm6dkMUUivZ
TLSH
T1BBD227F158E79836D9AEA747A77D2E025EFCC0A7B5845A50B3D88A1CCC461BFD30A811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 88660f74983309c63f3ab94c96466f3732754173bc5685dde4e24c355f21f896
MD5 68f89305da09c4f91d6117ef058825de
SHA1 a085c825e9ae58bb9dc07355cc859219ab7dd2f1
SHA512 bd1368af0db0a08fb265e635b32c497a5412beedd3611625981931ff8bf4cea398d9185ec0955f5a306bc38853c8972385e57036efacd042dbf158fa15f604a8
SSDEEP 384:n9iFPZcI43sNT8TUNTUlIltDao79kdbtaOgYQd0mEMfTivn3RJ8/7IzN:0FH43GwgZ9kdwOgdkMfTivZ
TLSH
T142D217F158E79837D9AEA747A77D2E025EFCC0A7B4845A54B3D88A1CCC461BFD30A811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 8b4a95333e449e7c1937fd5c8ca4dbff8435b0d0edac002ec6a1cb6308a679eb
MD5 69bb91d59ac757432fc7172e30d6aa96
SHA1 e7236f718fc6ebbb4c04481f1341e8cab1696ff2
SHA512 8af7483a5bc7f06c5cdabf450a0f2c88d420641ae17af28cf367f398047c35aa05fa94c01e5fcff8af529e17d35483610d9146c839a60623e4a79834eda61499
SSDEEP 384:n9iFRZcIKsND8TUNTUlIlLDao79kdb6agyp2Qd0mEM4Zivn3RJ8/7IzN:0F5KWwgf9kd5gypbkM4ZivZ
TLSH
T1DAD217F158E79837D9AEA747A77D2E025EFCC067B4849A44B3D88A1CCC561BFD30A811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 6655ce9e29a14da4320c0689327ba3a9c9b56efafc6086ac0f26089f0e7a3216
MD5 0f12ced7c83d1936fa367a078d238f8f
SHA1 4ca8109a7287e505863848eeee66158bba841f05
SHA512 0299b57ab498e81e3249fce016d8e505838fd7509194eee8f849f955c730d4cbc9c9ac2fdc5336f69e6dece2d22578b34e15d08102f44b99af97cb70e14c7c42
SSDEEP 384:cZcIrsNujDao79kdboaSmYQd0mEMMFivn3J:Kr/9kdbSmdkMMFiv5
TLSH
T120829E315C74AC371DA6F281F4863A175FF89077E7C86F84A5EDAB2C01EE698131B816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 c03d7d47c0bff0ebee0906beaf62eec5fe2214e3ae9fb96f9c42e98e07997b0c
MD5 76127402fe9e07879aab0d214c724fd7
SHA1 6dd56192d5aebfecf00c54c3ab15ad5ca9fbfb9d
SHA512 d0b55fad2743c30b360a1a9d29febaa7eb4d38fbf5d14205fa6ab31351c9265b086bd036a269bfacbece30848d24f8848dc0efb161151a7aca08c4d989b19c74
SSDEEP 192:MONf64BAQmiUy4a14VW5GBPKcl+FdGuom1baDm5U6:MONf6eAxaSVWzd0mSqU6
TLSH
T1B4020B34AC756C7B9EB2BE45F9863B175FD8103BA6D45F44EAD81B1C00D764C234682B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 5641965853db526461b3d938d875f0fb02afe7f87247a01dfb561fa842dfc9ba
MD5 20382442c31e72e6f61484911489b57a
SHA1 e9b6f15015fafb8e8da7ad432ff8262fbffec9df
SHA512 a10268118017017eac5e065792ed55ebd6d7aea979fd2f2c117679db17178c0d72f92b904aef2c95aae73bec6d8c177cc2a1bb4eb6de558b1752be7f63e86b81
SSDEEP 384:8ZcIrsNuGDao79kdboaSmYQd0mEMMFivn3J:qrw9kdbSmdkMMFiv5
TLSH
T1F3829E705C74AC371DA6F281F4853A175FF89077E7C86F84A5EDAB1C01EE698131B816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 48bd0e494cbdf7d458e52bd755222d187f9513e113703d1f2cff972b8857f7d3
MD5 9abbbcdc46a7cb47b0221e71cc7e7a3d
SHA1 b64b99dc4568af3f47645361b2ebb042e1ec1cfb
SHA512 82494254b05b7e10cfae5a65331438202935da3d441acd01fb6232ea01cb2bf2988b630369f82990e379731756d5dfd1390f35ee173f34fe8e615d78860dc740
MD5 SHA1 SHA512

Submit Download

RevisitationBloomfilter~RFe5baf76.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe5baf76.TMP
Size 392B
SHA256 3f207943023e7f9c28d7c35490321046cd712d47392e86b6110cc3144bb46cb5
MD5 735fb7a694bc8d31a5ad024a7d736331
SHA1 f5272d8ff13d9cfa9f0948732b2d2f22791fe1e0
SHA512 00717dcf41d354e5f39696a8d3edce32a8334497b7be4fb147759bb866b9071ab67be495a5516d5b2d74e00e32da7d1c1e625935d39afa06006a999fdf61d002
MD5 SHA1 SHA512

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 19054d0d664fa8c1bb2dde7ffd9bb2a770c521a988197e2f42cc4df651566125
MD5 2638dc94fa435f37c25da75298cb938d
SHA1 bbd1a0d5c3579593030b41bafe352132150ff84e
SHA512 81f32dc8b4644f99ecf3f5b3a097a844f3ebc21c005ec38b27f9e8a8f651f45f373fe43a08ffeadcf3bc3586ecb41dcb58836ef20ef40a7e796660b5344567e7
SSDEEP 3:MsEllllkEthXllkl2zEver:/M/xT02zII
TLSH
T1584404047FD00D05DF01103C4031C3501370DD500711D74334550C135CC75C04C34000
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations
Size 86B
SHA256 f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed
MD5 961e3604f228b0d10541ebf921500c86
SHA1 6e00570d9f78d9cfebe67d4da5efe546543949a7
SHA512 535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472
TLSH
T196A02407C473C00FF4144051C45C034114FCC447011DD0015074D31314D40CF03F5435
MD5 SHA1 SHA512 TLSH

Submit Download

c9179887-5cfe-46c4-a872-d86945659d15.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\c9179887-5cfe-46c4-a872-d86945659d15.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 3b93827db627766c3120ad08da6a1996597f7fdedc5af91e20b3c34ee28e8a54
MD5 0c9064fe9f52f4274689cfe8e7949b83
SHA1 e718f780060b12db4240826147202eb57cc7d2b8
SHA512 e1189e46a725055930b8352b14eae8c4d1e7744bd5a173e41c66c2277095b2c7ae92368e356de6eeac9450a41b2a6fbedc7896dd2ce101a8c8e40277908e62e0
TLSH
T11B412A5CA6FA1148B3B77E5A9BF769AD487B7C772E06D45E00110E4F0622B40D871737
MD5 SHA1 SHA512 TLSH

Submit Download

0913341b-93f4-4bf4-957f-7c75c8f0a82e.tmp

Path C:\Users\Admin\AppData\Local\Temp\0913341b-93f4-4bf4-957f-7c75c8f0a82e.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a88ca71b-08ec-4947-8685-e51e53ea0a21.tmp

Path C:\Users\Admin\AppData\Local\Temp\a88ca71b-08ec-4947-8685-e51e53ea0a21.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

76b380cf-6c8a-4d28-a3d3-4386ee58bcfa.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2692_2043869446\76b380cf-6c8a-4d28-a3d3-4386ee58bcfa.tmp
Size 154KB
SHA256 e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000
MD5 a922bd2071b7aa9f2154c991d41885c7
SHA1 c88b22d16c951cbb0bfdab367232cf830e0464d1
SHA512 d8ed2d6b1c3a421a9771e3a5109eaea839bf64be7b7e672ed7b8aa47590ff35c6e78aa79712ce37801cedc56db552fc6a7c3ca55004295a438219ce4a8f007a0
SSDEEP 3072:Aj0amyoD1f5NQQHyR5nYbGnkBEGsvsq5UBkUM4RIJ+37HVeCsKkwQuBp/Z:AoHBD15HEYbQkovswoM4RIIzvXkwtBpB
TLSH
T12BF3F11D7EDAC952C40B92BD3C1AB18BC94B8F0A431674CF264D90248EA578E07E5EFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2692_355888654\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MEMZ_Destructive_Clean-main.zip.crdownload

Path C:\Users\Admin\Downloads\MEMZ_Destructive_Clean-main.zip.crdownload
Size 31KB
SHA256 8586419ef0155f019c41a676b156e7e4a224f9430268bf88aceea2559b0fdb6b
MD5 1c57afd51a4f62c8b23282386e696454
SHA1 1bbc13686da469f996863bdb78f91fbd7bd09fed
SHA512 d8d77ebb81b75aee434b51e2ff90564e4bbb60e09619353f2d2605403bd62b870ba637921ae54f140333871e2a2493471a249bb7bea50e2f5d33e418535e861e
SSDEEP 768:CKYtpP6T6S2Onw3pcot1gILXVJ3+0qornFXoXEKyuZSA/:r95EXLlHqornIENA/
TLSH
T157E2D1C2777EE242C34D86B720680ED0254A79E5EB1FA3519F20C5B25F7937A339846B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

note.txt

Path C:\note.txt
Size 218B
SHA256 8e9f20f6864c66576536c0b866c6ffdcf11397db67fe120e972e244c3c022270
MD5 afa6955439b8d516721231029fb9ca1b
SHA1 087a043cc123c0c0df2ffadcf8e71e3ac86bbae9
SHA512 5da21a31fbc4e8250dffed30f66b896bdf007ac91948140334fe36a3f010e1bac3e70a07e9f3eb9da8633189091fd5cadcabbaacd3e01da0fe7ae28a11b3dddf
TLSH
T1C3D0A719040784251C7052D17145A5A09B70562D77F626EB74DC690C212700F0B37C9A
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads