a3d5715a81f2fbeb5f76c88c9c21eeee87142909716472f911ff6950c790c24d

Analysis

user interaction
yes
max time kernel
166s
max time network
169s
platform
windows10-2004_x64
resource
win10v2004-20260911-es
resource tags

arch:x64arch:x86image:win10v2004-20260911-eslocale:es-esos:windows10-2004-x64systemwindows
submitted
20/09/2026, 22:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

Reason

Machine shutdown

General

Target
MEMZ-Destructive.exe
Size 14KB
Sample260920-2f8htade72
SHA256 a3d5715a81f2fbeb5f76c88c9c21eeee87142909716472f911ff6950c790c24d
MD5 19dbec50735b5f2a72d4199c4e184960
SHA1 6fed7732f7cb6f59743795b2ab154a3676f4c822
SHA512 aa8a6bbb1ec516d5d5acf8be6863a4c6c5d754cee12b3d374c3a6acb393376806edc422f0ffb661c210e5b9485da88521e4a0956a4b7b08a5467cfaacd90591d
SSDEEP 192:sIvxdXSQeWSg9JJS/lcIEiwqZKBkDFR43xWTM3LHn8f26gyr6yfFCj3r:sMVSaSEglcIqq3agmLc+6gyWqFCj
TLSH
T180624BCFBE204417D8F0C57530659234DFBACABA1B968EDF9CF91E529AC4C072823265
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

bootkit discovery persistence

Malware Config

Signatures

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\Control Panel\International\Geo\Nation	MEMZ-Destructive.exe
Key value queried	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\Control Panel\International\Geo\Nation	MEMZ-Destructive.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	MEMZ-Destructive.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mspaint.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MEMZ-Destructive.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MEMZ-Destructive.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe

System Time Discovery 1 TTPs 5 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
6024	msedge.exe
1096	msedge.exe
5148	msedge.exe
4032	msedge.exe
5436	msedge.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 15 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134344172185467303"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 12 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-895009113-1202185046-1686627690-1000\{1B954CFA-27FF-4BB6-9589-F0533E5E9EAA}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-895009113-1202185046-1686627690-1000\{6F7F0D82-692A-4634-B09C-8EDC037716D8}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-895009113-1202185046-1686627690-1000\{282D508B-CB2C-4B27-BEAF-32067E25F689}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-895009113-1202185046-1686627690-1000\{49CC2765-6A24-4CB7-AFCD-BF183123B60B}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4300	MEMZ-Destructive.exe
4300	MEMZ-Destructive.exe
1592	MEMZ-Destructive.exe
1592	MEMZ-Destructive.exe
1592	MEMZ-Destructive.exe
4300	MEMZ-Destructive.exe
4300	MEMZ-Destructive.exe
1592	MEMZ-Destructive.exe
3624	MEMZ-Destructive.exe
4540	MEMZ-Destructive.exe
3624	MEMZ-Destructive.exe
4540	MEMZ-Destructive.exe
3624	MEMZ-Destructive.exe
4540	MEMZ-Destructive.exe
3624	MEMZ-Destructive.exe
4540	MEMZ-Destructive.exe
4300	MEMZ-Destructive.exe
1592	MEMZ-Destructive.exe
4300	MEMZ-Destructive.exe
1592	MEMZ-Destructive.exe
2920	MEMZ-Destructive.exe
2920	MEMZ-Destructive.exe
4300	MEMZ-Destructive.exe
1592	MEMZ-Destructive.exe
1592	MEMZ-Destructive.exe
4300	MEMZ-Destructive.exe
4540	MEMZ-Destructive.exe
3624	MEMZ-Destructive.exe
4540	MEMZ-Destructive.exe
3624	MEMZ-Destructive.exe
4540	MEMZ-Destructive.exe
4540	MEMZ-Destructive.exe
1592	MEMZ-Destructive.exe
1592	MEMZ-Destructive.exe
4300	MEMZ-Destructive.exe
4300	MEMZ-Destructive.exe
2920	MEMZ-Destructive.exe
2920	MEMZ-Destructive.exe
2920	MEMZ-Destructive.exe
2920	MEMZ-Destructive.exe
4300	MEMZ-Destructive.exe
4300	MEMZ-Destructive.exe
1592	MEMZ-Destructive.exe
1592	MEMZ-Destructive.exe
4540	MEMZ-Destructive.exe
4540	MEMZ-Destructive.exe
3624	MEMZ-Destructive.exe
3624	MEMZ-Destructive.exe
4540	MEMZ-Destructive.exe
4540	MEMZ-Destructive.exe
1592	MEMZ-Destructive.exe
1592	MEMZ-Destructive.exe
4300	MEMZ-Destructive.exe
4300	MEMZ-Destructive.exe
2920	MEMZ-Destructive.exe
2920	MEMZ-Destructive.exe
2920	MEMZ-Destructive.exe
2920	MEMZ-Destructive.exe
4300	MEMZ-Destructive.exe
4300	MEMZ-Destructive.exe
1592	MEMZ-Destructive.exe
1592	MEMZ-Destructive.exe
4540	MEMZ-Destructive.exe
4540	MEMZ-Destructive.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs

pid	Process
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
6128	msedge.exe
6128	msedge.exe
6128	msedge.exe
4196	msedge.exe
4196	msedge.exe
4196	msedge.exe
5228	msedge.exe
5228	msedge.exe
5228	msedge.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	932	taskmgr.exe
Token: SeSystemProfilePrivilege	932	taskmgr.exe
Token: SeCreateGlobalPrivilege	932	taskmgr.exe

Suspicious use of FindShellTrayWindow 43 IoCs

pid	Process
2168	notepad.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
6128	msedge.exe
6128	msedge.exe
4196	msedge.exe
4196	msedge.exe
5228	msedge.exe
932	taskmgr.exe
932	taskmgr.exe
932	taskmgr.exe
932	taskmgr.exe
932	taskmgr.exe
932	taskmgr.exe
932	taskmgr.exe
932	taskmgr.exe
932	taskmgr.exe
932	taskmgr.exe
932	taskmgr.exe
932	taskmgr.exe
932	taskmgr.exe
932	taskmgr.exe
932	taskmgr.exe
932	taskmgr.exe
932	taskmgr.exe
5228	msedge.exe
932	taskmgr.exe
932	taskmgr.exe
932	taskmgr.exe
932	taskmgr.exe
932	taskmgr.exe
932	taskmgr.exe
932	taskmgr.exe
932	taskmgr.exe
932	taskmgr.exe
932	taskmgr.exe
932	taskmgr.exe
932	taskmgr.exe
932	taskmgr.exe
932	taskmgr.exe
932	taskmgr.exe
932	taskmgr.exe

Suspicious use of SendNotifyMessage 33 IoCs

pid	Process
932	taskmgr.exe
932	taskmgr.exe
932	taskmgr.exe
932	taskmgr.exe
932	taskmgr.exe
932	taskmgr.exe
932	taskmgr.exe
932	taskmgr.exe
932	taskmgr.exe
932	taskmgr.exe
932	taskmgr.exe
932	taskmgr.exe
932	taskmgr.exe
932	taskmgr.exe
932	taskmgr.exe
932	taskmgr.exe
932	taskmgr.exe
932	taskmgr.exe
932	taskmgr.exe
932	taskmgr.exe
932	taskmgr.exe
932	taskmgr.exe
932	taskmgr.exe
932	taskmgr.exe
932	taskmgr.exe
932	taskmgr.exe
932	taskmgr.exe
932	taskmgr.exe
932	taskmgr.exe
932	taskmgr.exe
932	taskmgr.exe
932	taskmgr.exe
932	taskmgr.exe

Suspicious use of SetWindowsHookEx 57 IoCs

pid	Process
3156	MEMZ-Destructive.exe
5676	mspaint.exe
5676	mspaint.exe
5676	mspaint.exe
5676	mspaint.exe
3624	MEMZ-Destructive.exe
1592	MEMZ-Destructive.exe
4540	MEMZ-Destructive.exe
4300	MEMZ-Destructive.exe
3624	MEMZ-Destructive.exe
1592	MEMZ-Destructive.exe
4300	MEMZ-Destructive.exe
4540	MEMZ-Destructive.exe
1592	MEMZ-Destructive.exe
3624	MEMZ-Destructive.exe
4540	MEMZ-Destructive.exe
4300	MEMZ-Destructive.exe
1592	MEMZ-Destructive.exe
4300	MEMZ-Destructive.exe
4540	MEMZ-Destructive.exe
3624	MEMZ-Destructive.exe
1592	MEMZ-Destructive.exe
4540	MEMZ-Destructive.exe
3624	MEMZ-Destructive.exe
4300	MEMZ-Destructive.exe
4540	MEMZ-Destructive.exe
3624	MEMZ-Destructive.exe
1592	MEMZ-Destructive.exe
4300	MEMZ-Destructive.exe
4540	MEMZ-Destructive.exe
1592	MEMZ-Destructive.exe
4300	MEMZ-Destructive.exe
3624	MEMZ-Destructive.exe
4540	MEMZ-Destructive.exe
3624	MEMZ-Destructive.exe
4300	MEMZ-Destructive.exe
1592	MEMZ-Destructive.exe
4300	MEMZ-Destructive.exe
1592	MEMZ-Destructive.exe
3624	MEMZ-Destructive.exe
4540	MEMZ-Destructive.exe
4300	MEMZ-Destructive.exe
4540	MEMZ-Destructive.exe
3624	MEMZ-Destructive.exe
1592	MEMZ-Destructive.exe
3624	MEMZ-Destructive.exe
1592	MEMZ-Destructive.exe
4300	MEMZ-Destructive.exe
4540	MEMZ-Destructive.exe
4300	MEMZ-Destructive.exe
4540	MEMZ-Destructive.exe
1592	MEMZ-Destructive.exe
3624	MEMZ-Destructive.exe
4300	MEMZ-Destructive.exe
1592	MEMZ-Destructive.exe
3624	MEMZ-Destructive.exe
4540	MEMZ-Destructive.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4128 wrote to memory of 4300	4128	MEMZ-Destructive.exe	95
PID 4128 wrote to memory of 1592	4128	MEMZ-Destructive.exe	96
PID 4128 wrote to memory of 4540	4128	MEMZ-Destructive.exe	97
PID 4128 wrote to memory of 3624	4128	MEMZ-Destructive.exe	98
PID 4128 wrote to memory of 2920	4128	MEMZ-Destructive.exe	99
PID 4128 wrote to memory of 3156	4128	MEMZ-Destructive.exe	100
PID 3156 wrote to memory of 2168	3156	MEMZ-Destructive.exe	102
PID 3156 wrote to memory of 2528	3156	MEMZ-Destructive.exe	111
PID 2528 wrote to memory of 3952	2528	msedge.exe	112
PID 3952 wrote to memory of 4624	3952	msedge.exe	113
PID 3952 wrote to memory of 4032	3952	msedge.exe	114
PID 3952 wrote to memory of 3900	3952	msedge.exe	115
PID 3952 wrote to memory of 3900	3952	msedge.exe	115
PID 3952 wrote to memory of 3900	3952	msedge.exe	115
PID 3952 wrote to memory of 640	3952	msedge.exe	117
PID 3952 wrote to memory of 640	3952	msedge.exe	117
PID 3952 wrote to memory of 4700	3952	msedge.exe	118
PID 3952 wrote to memory of 4700	3952	msedge.exe	118
PID 3952 wrote to memory of 4700	3952	msedge.exe	118
PID 3952 wrote to memory of 2112	3952	msedge.exe	119
PID 3952 wrote to memory of 2112	3952	msedge.exe	119
PID 3952 wrote to memory of 2112	3952	msedge.exe	119
PID 3952 wrote to memory of 1056	3952	msedge.exe	120
PID 3952 wrote to memory of 5000	3952	msedge.exe	121
PID 3952 wrote to memory of 1056	3952	msedge.exe	120
PID 3952 wrote to memory of 1056	3952	msedge.exe	120
PID 3952 wrote to memory of 5000	3952	msedge.exe	121
PID 3952 wrote to memory of 5000	3952	msedge.exe	121
PID 3952 wrote to memory of 5272	3952	msedge.exe	123
PID 3952 wrote to memory of 5272	3952	msedge.exe	123
PID 3952 wrote to memory of 5320	3952	msedge.exe	124
PID 3952 wrote to memory of 5320	3952	msedge.exe	124
PID 3952 wrote to memory of 6128	3952	msedge.exe	126
PID 6128 wrote to memory of 4576	6128	msedge.exe	127
PID 6128 wrote to memory of 5436	6128	msedge.exe	128
PID 6128 wrote to memory of 5452	6128	msedge.exe	129
PID 6128 wrote to memory of 5460	6128	msedge.exe	130
PID 6128 wrote to memory of 5452	6128	msedge.exe	129
PID 6128 wrote to memory of 5452	6128	msedge.exe	129
PID 6128 wrote to memory of 5460	6128	msedge.exe	130
PID 6128 wrote to memory of 5996	6128	msedge.exe	133
PID 6128 wrote to memory of 6084	6128	msedge.exe	136
PID 6128 wrote to memory of 6084	6128	msedge.exe	136
PID 6128 wrote to memory of 2908	6128	msedge.exe	137
PID 6128 wrote to memory of 2908	6128	msedge.exe	137
PID 6128 wrote to memory of 924	6128	msedge.exe	138
PID 6128 wrote to memory of 924	6128	msedge.exe	138
PID 6128 wrote to memory of 1320	6128	msedge.exe	139
PID 6128 wrote to memory of 1320	6128	msedge.exe	139
PID 6128 wrote to memory of 5972	6128	msedge.exe	140
PID 6128 wrote to memory of 5972	6128	msedge.exe	140
PID 6128 wrote to memory of 5604	6128	msedge.exe	141
PID 6128 wrote to memory of 5604	6128	msedge.exe	141
PID 6128 wrote to memory of 5444	6128	msedge.exe	143
PID 6128 wrote to memory of 5444	6128	msedge.exe	143
PID 3156 wrote to memory of 4208	3156	MEMZ-Destructive.exe	144
PID 4208 wrote to memory of 3296	4208	msedge.exe	145
PID 6128 wrote to memory of 3236	6128	msedge.exe	146
PID 6128 wrote to memory of 3236	6128	msedge.exe	146
PID 6128 wrote to memory of 3236	6128	msedge.exe	146
PID 6128 wrote to memory of 5924	6128	msedge.exe	147
PID 6128 wrote to memory of 5924	6128	msedge.exe	147
PID 6128 wrote to memory of 5924	6128	msedge.exe	147
PID 6128 wrote to memory of 5728	6128	msedge.exe	148

C:\Users\Admin\AppData\Local\Temp\MEMZ-Destructive.exe
"C:\Users\Admin\AppData\Local\Temp\MEMZ-Destructive.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4128
- C:\Users\Admin\AppData\Local\Temp\MEMZ-Destructive.exe
  "C:\Users\Admin\AppData\Local\Temp\MEMZ-Destructive.exe" /watchdog
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:4300
- C:\Users\Admin\AppData\Local\Temp\MEMZ-Destructive.exe
  "C:\Users\Admin\AppData\Local\Temp\MEMZ-Destructive.exe" /watchdog
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:1592
- C:\Users\Admin\AppData\Local\Temp\MEMZ-Destructive.exe
  "C:\Users\Admin\AppData\Local\Temp\MEMZ-Destructive.exe" /watchdog
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:4540
- C:\Users\Admin\AppData\Local\Temp\MEMZ-Destructive.exe
  "C:\Users\Admin\AppData\Local\Temp\MEMZ-Destructive.exe" /watchdog
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:3624
- C:\Users\Admin\AppData\Local\Temp\MEMZ-Destructive.exe
  "C:\Users\Admin\AppData\Local\Temp\MEMZ-Destructive.exe" /watchdog
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2920
- C:\Users\Admin\AppData\Local\Temp\MEMZ-Destructive.exe
  "C:\Users\Admin\AppData\Local\Temp\MEMZ-Destructive.exe" /main
  2⤵
  - Checks computer location settings
  - Writes to the Master Boot Record (MBR)
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3156
- - C:\Windows\SysWOW64\notepad.exe
    "C:\Windows\System32\notepad.exe" \note.txt
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of FindShellTrayWindow
    PID:2168
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=minecraft+hax+download+no+virus
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2528
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument http://google.co.ck/search?q=minecraft+hax+download+no+virus
      4⤵
      Enumerates system info in registry
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:3952
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7fffa0dac188,0x7fffa0dac194,0x7fffa0dac1a0
        5⤵
        
        PID:4624
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=es --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1812,i,7542580022642109733,13539916018868816281,524288 --field-trial-handle=2308,i,3006134244790700698,9642121793578779123,262144 --variations-seed-version --mojo-platform-channel-handle=2352 /prefetch:3
        5⤵
        System Time Discovery
        
        PID:4032
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1708,i,4174447029745207365,9924779092152161265,262144 --field-trial-handle=2308,i,3006134244790700698,9642121793578779123,262144 --variations-seed-version --mojo-platform-channel-handle=2304 /prefetch:2
        5⤵
        
        PID:3900
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=es --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2668,i,15966023329849072327,14842611883563816905,524288 --field-trial-handle=2308,i,3006134244790700698,9642121793578779123,262144 --variations-seed-version --mojo-platform-channel-handle=2788 /prefetch:8
        5⤵
        
        PID:640
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3524,i,229446200261717363,308495143310087023,2097152 --field-trial-handle=2308,i,3006134244790700698,9642121793578779123,262144 --variations-seed-version --mojo-platform-channel-handle=3568 /prefetch:1
        5⤵
        
        PID:4700
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3528,i,12088102718845142757,6459827935245825305,2097152 --field-trial-handle=2308,i,3006134244790700698,9642121793578779123,262144 --variations-seed-version --mojo-platform-channel-handle=3580 /prefetch:1
        5⤵
        
        PID:2112
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4168,i,12196527211497810923,5707097044942927234,2097152 --field-trial-handle=2308,i,3006134244790700698,9642121793578779123,262144 --variations-seed-version --mojo-platform-channel-handle=4592 /prefetch:1
        5⤵
        
        PID:1056
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4180,i,2093895087253184928,4981435988119516709,2097152 --field-trial-handle=2308,i,3006134244790700698,9642121793578779123,262144 --variations-seed-version --mojo-platform-channel-handle=4596 /prefetch:2
        5⤵
        
        PID:5000
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=es --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5080,i,14866703911311220894,15513859738543796002,524288 --field-trial-handle=2308,i,3006134244790700698,9642121793578779123,262144 --variations-seed-version --mojo-platform-channel-handle=3704 /prefetch:8
        5⤵
        
        PID:5272
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=es --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5140,i,2887102495484349946,15090647833143436731,524288 --field-trial-handle=2308,i,3006134244790700698,9642121793578779123,262144 --variations-seed-version --mojo-platform-channel-handle=5136 /prefetch:8
        5⤵
        
        PID:5320
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
        5⤵
        Checks processor information in registry
        Enumerates system info in registry
        Modifies data under HKEY_USERS
        Modifies registry class
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of FindShellTrayWindow
        Suspicious use of WriteProcessMemory
        
        PID:6128
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2f0,0x7fffa0dac188,0x7fffa0dac194,0x7fffa0dac1a0
        6⤵
        
        PID:4576
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=es --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1936,i,8129804325544439341,16106759655073039956,524288 --field-trial-handle=2464,i,17777624980041457058,8405717422277523084,262144 --variations-seed-version --mojo-platform-channel-handle=2492 /prefetch:3
        6⤵
        System Time Discovery
        
        PID:5436
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1628,i,10941584367085551367,9917993849807128518,262144 --field-trial-handle=2464,i,17777624980041457058,8405717422277523084,262144 --variations-seed-version --mojo-platform-channel-handle=2460 /prefetch:2
        6⤵
        
        PID:5452
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=es --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2216,i,178240406770155930,1162486639769947211,524288 --field-trial-handle=2464,i,17777624980041457058,8405717422277523084,262144 --variations-seed-version --mojo-platform-channel-handle=2500 /prefetch:8
        6⤵
        
        PID:5460
      - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=es --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4252,i,10533815412344202168,2544548503437438778,524288 --field-trial-handle=2464,i,17777624980041457058,8405717422277523084,262144 --variations-seed-version --mojo-platform-channel-handle=4260 /prefetch:8
        6⤵
        
        PID:5892
      - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=es --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4252,i,10533815412344202168,2544548503437438778,524288 --field-trial-handle=2464,i,17777624980041457058,8405717422277523084,262144 --variations-seed-version --mojo-platform-channel-handle=4260 /prefetch:8
        6⤵
        
        PID:5996
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=es --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4512,i,13655419569484358766,5662066261974774104,524288 --field-trial-handle=2464,i,17777624980041457058,8405717422277523084,262144 --variations-seed-version --mojo-platform-channel-handle=4524 /prefetch:8
        6⤵
        
        PID:6084
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=es --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4652,i,14194480315103320517,16255747001929862142,524288 --field-trial-handle=2464,i,17777624980041457058,8405717422277523084,262144 --variations-seed-version --mojo-platform-channel-handle=4404 /prefetch:8
        6⤵
        
        PID:2908
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=es --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4616,i,8081843618390936515,11780966347390536001,524288 --field-trial-handle=2464,i,17777624980041457058,8405717422277523084,262144 --variations-seed-version --mojo-platform-channel-handle=4612 /prefetch:8
        6⤵
        
        PID:924
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=es --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4880,i,4446192096578327072,12937175336484320803,524288 --field-trial-handle=2464,i,17777624980041457058,8405717422277523084,262144 --variations-seed-version --mojo-platform-channel-handle=4984 /prefetch:8
        6⤵
        
        PID:1320
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=es --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4536,i,5359006496967479491,9902217906666743815,524288 --field-trial-handle=2464,i,17777624980041457058,8405717422277523084,262144 --variations-seed-version --mojo-platform-channel-handle=4916 /prefetch:8
        6⤵
        
        PID:5972
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=es --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4612,i,4465841171402273801,35946175786755352,524288 --field-trial-handle=2464,i,17777624980041457058,8405717422277523084,262144 --variations-seed-version --mojo-platform-channel-handle=5080 /prefetch:8
        6⤵
        
        PID:5604
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=es --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4972,i,267065428176487441,10724961652151825373,524288 --field-trial-handle=2464,i,17777624980041457058,8405717422277523084,262144 --variations-seed-version --mojo-platform-channel-handle=4624 /prefetch:8
        6⤵
        
        PID:5444
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=4964,i,16952600696388949011,3905627555370272904,2097152 --field-trial-handle=2464,i,17777624980041457058,8405717422277523084,262144 --variations-seed-version --mojo-platform-channel-handle=4572 /prefetch:1
        6⤵
        
        PID:3236
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=4508,i,17218867835049055474,10786908359327859282,2097152 --field-trial-handle=2464,i,17777624980041457058,8405717422277523084,262144 --variations-seed-version --mojo-platform-channel-handle=4916 /prefetch:1
        6⤵
        
        PID:5924
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=es --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5512,i,6398778333736879200,16379118600154846175,524288 --field-trial-handle=2464,i,17777624980041457058,8405717422277523084,262144 --variations-seed-version --mojo-platform-channel-handle=5564 /prefetch:8
        6⤵
        
        PID:5728
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=es --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5516,i,2606646048445069248,16821819832339412599,524288 --field-trial-handle=2464,i,17777624980041457058,8405717422277523084,262144 --variations-seed-version --mojo-platform-channel-handle=5584 /prefetch:8
        6⤵
        
        PID:5104
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=5524,i,15730043182770322380,10388280802407856012,2097152 --field-trial-handle=2464,i,17777624980041457058,8405717422277523084,262144 --variations-seed-version --mojo-platform-channel-handle=5968 /prefetch:1
        6⤵
        
        PID:640
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
        6⤵
        Checks processor information in registry
        Enumerates system info in registry
        Modifies data under HKEY_USERS
        Modifies registry class
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of FindShellTrayWindow
        
        PID:4196
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x248,0x7fffa0dac188,0x7fffa0dac194,0x7fffa0dac1a0
        7⤵
        
        PID:4176
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=es --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1824,i,7258145379731013185,95405684165265247,524288 --field-trial-handle=2328,i,2405555216502433626,454120926065835684,262144 --variations-seed-version --mojo-platform-channel-handle=2416 /prefetch:3
        7⤵
        System Time Discovery
        
        PID:6024
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1684,i,9398130947884182597,6200784171833396205,262144 --field-trial-handle=2328,i,2405555216502433626,454120926065835684,262144 --variations-seed-version --mojo-platform-channel-handle=2316 /prefetch:2
        7⤵
        
        PID:6020
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=es --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2608,i,16343227536531563251,1539630543573846062,524288 --field-trial-handle=2328,i,2405555216502433626,454120926065835684,262144 --variations-seed-version --mojo-platform-channel-handle=2616 /prefetch:8
        7⤵
        
        PID:204
        
        C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=es --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4564,i,6788752045538536650,15364852101584723843,524288 --field-trial-handle=2328,i,2405555216502433626,454120926065835684,262144 --variations-seed-version --mojo-platform-channel-handle=4580 /prefetch:8
        7⤵
        
        PID:6036
        
        C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=es --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4564,i,6788752045538536650,15364852101584723843,524288 --field-trial-handle=2328,i,2405555216502433626,454120926065835684,262144 --variations-seed-version --mojo-platform-channel-handle=4580 /prefetch:8
        7⤵
        
        PID:5448
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=es --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4588,i,8210707954583951000,14836425859569123852,524288 --field-trial-handle=2328,i,2405555216502433626,454120926065835684,262144 --variations-seed-version --mojo-platform-channel-handle=4796 /prefetch:8
        7⤵
        
        PID:5288
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=es --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4504,i,7756329538996996568,5399680875606528305,524288 --field-trial-handle=2328,i,2405555216502433626,454120926065835684,262144 --variations-seed-version --mojo-platform-channel-handle=4840 /prefetch:8
        7⤵
        
        PID:5364
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=es --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4596,i,808761237283222678,5247219982006061876,524288 --field-trial-handle=2328,i,2405555216502433626,454120926065835684,262144 --variations-seed-version --mojo-platform-channel-handle=4584 /prefetch:8
        7⤵
        
        PID:5312
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4876,i,15766157243553698109,891504068117262820,2097152 --field-trial-handle=2328,i,2405555216502433626,454120926065835684,262144 --variations-seed-version --mojo-platform-channel-handle=4952 /prefetch:1
        7⤵
        
        PID:5468
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4872,i,4578605896655031722,6320839410271846040,2097152 --field-trial-handle=2328,i,2405555216502433626,454120926065835684,262144 --variations-seed-version --mojo-platform-channel-handle=4932 /prefetch:1
        7⤵
        
        PID:5956
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=es --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5428,i,4220071026445612440,11392946391859153913,524288 --field-trial-handle=2328,i,2405555216502433626,454120926065835684,262144 --variations-seed-version --mojo-platform-channel-handle=5484 /prefetch:8
        7⤵
        
        PID:5476
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=es --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5432,i,12730011222749238051,11470747011974523813,524288 --field-trial-handle=2328,i,2405555216502433626,454120926065835684,262144 --variations-seed-version --mojo-platform-channel-handle=5504 /prefetch:8
        7⤵
        
        PID:5484
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=5788,i,9103215993434998275,16843922625829672530,2097152 --field-trial-handle=2328,i,2405555216502433626,454120926065835684,262144 --variations-seed-version --mojo-platform-channel-handle=5772 /prefetch:1
        7⤵
        
        PID:2112
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
        7⤵
        Checks processor information in registry
        Enumerates system info in registry
        Modifies data under HKEY_USERS
        Modifies registry class
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of FindShellTrayWindow
        
        PID:5228
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7fffa0dac188,0x7fffa0dac194,0x7fffa0dac1a0
        8⤵
        
        PID:5340
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=es --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1964,i,9646207750568399884,2746154733166638324,524288 --field-trial-handle=2256,i,6762295194817936572,12339672673519134327,262144 --variations-seed-version --mojo-platform-channel-handle=2284 /prefetch:3
        8⤵
        System Time Discovery
        
        PID:1096
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1724,i,8854682042225699151,12623573914635493035,262144 --field-trial-handle=2256,i,6762295194817936572,12339672673519134327,262144 --variations-seed-version --mojo-platform-channel-handle=2252 /prefetch:2
        8⤵
        
        PID:2556
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=es --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2564,i,124302446459828154,7511470720683299555,524288 --field-trial-handle=2256,i,6762295194817936572,12339672673519134327,262144 --variations-seed-version --mojo-platform-channel-handle=2576 /prefetch:8
        8⤵
        
        PID:2656
        
        C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=es --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4512,i,2892167716810927667,18179354974245803277,524288 --field-trial-handle=2256,i,6762295194817936572,12339672673519134327,262144 --variations-seed-version --mojo-platform-channel-handle=4528 /prefetch:8
        8⤵
        
        PID:5468
        
        C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=es --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4512,i,2892167716810927667,18179354974245803277,524288 --field-trial-handle=2256,i,6762295194817936572,12339672673519134327,262144 --variations-seed-version --mojo-platform-channel-handle=4528 /prefetch:8
        8⤵
        
        PID:2728
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4880,i,4111864321681830702,9269645775708353778,2097152 --field-trial-handle=2256,i,6762295194817936572,12339672673519134327,262144 --variations-seed-version --mojo-platform-channel-handle=4924 /prefetch:1
        8⤵
        
        PID:1392
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=4888,i,3072813110815195830,8804963907596695955,2097152 --field-trial-handle=2256,i,6762295194817936572,12339672673519134327,262144 --variations-seed-version --mojo-platform-channel-handle=4936 /prefetch:1
        8⤵
        
        PID:1872
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=es --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5412,i,6922995998442917045,8567235812003803856,524288 --field-trial-handle=2256,i,6762295194817936572,12339672673519134327,262144 --variations-seed-version --mojo-platform-channel-handle=5472 /prefetch:8
        8⤵
        
        PID:4332
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=es --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5420,i,9118666905133181684,2520304878343678701,524288 --field-trial-handle=2256,i,6762295194817936572,12339672673519134327,262144 --variations-seed-version --mojo-platform-channel-handle=5496 /prefetch:8
        8⤵
        
        PID:204
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5832,i,16279506629014179213,6638556138466163140,2097152 --field-trial-handle=2256,i,6762295194817936572,12339672673519134327,262144 --variations-seed-version --mojo-platform-channel-handle=5860 /prefetch:1
        8⤵
        
        PID:5780
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
        8⤵
        Checks processor information in registry
        Enumerates system info in registry
        Modifies data under HKEY_USERS
        Modifies registry class
        
        PID:3256
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7fffa0dac188,0x7fffa0dac194,0x7fffa0dac1a0
        9⤵
        
        PID:5440
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=es --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1944,i,2915463875979860829,11768885442178686398,524288 --field-trial-handle=3284,i,9714255567897762810,1995703527153636122,262144 --variations-seed-version --mojo-platform-channel-handle=3296 /prefetch:3
        9⤵
        System Time Discovery
        
        PID:5148
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1720,i,17814146093008992720,15049101744544950957,262144 --field-trial-handle=3284,i,9714255567897762810,1995703527153636122,262144 --variations-seed-version --mojo-platform-channel-handle=3280 /prefetch:2
        9⤵
        
        PID:1056
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=es --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2228,i,11961978786269480126,7082743700637485321,524288 --field-trial-handle=3284,i,9714255567897762810,1995703527153636122,262144 --variations-seed-version --mojo-platform-channel-handle=3288 /prefetch:8
        9⤵
        
        PID:2076
        
        C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=es --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4544,i,9234854967104445507,4459377714366428126,524288 --field-trial-handle=3284,i,9714255567897762810,1995703527153636122,262144 --variations-seed-version --mojo-platform-channel-handle=4564 /prefetch:8
        9⤵
        
        PID:1264
        
        C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=es --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4544,i,9234854967104445507,4459377714366428126,524288 --field-trial-handle=3284,i,9714255567897762810,1995703527153636122,262144 --variations-seed-version --mojo-platform-channel-handle=4564 /prefetch:8
        9⤵
        
        PID:2928
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4632,i,4973466839866351467,8537404274818508546,2097152 --field-trial-handle=3284,i,9714255567897762810,1995703527153636122,262144 --variations-seed-version --mojo-platform-channel-handle=4952 /prefetch:1
        9⤵
        
        PID:2040
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=4924,i,2365168172702732460,15395769191387575375,2097152 --field-trial-handle=3284,i,9714255567897762810,1995703527153636122,262144 --variations-seed-version --mojo-platform-channel-handle=5040 /prefetch:1
        9⤵
        
        PID:4876
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=what+happens+if+you+delete+system32
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4208
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument http://google.co.ck/search?q=what+happens+if+you+delete+system32
      4⤵
      PID:3296
- - C:\Windows\SysWOW64\mspaint.exe
    "C:\Windows\System32\mspaint.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:5676
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=my+computer+is+doing+weird+things+wtf+is+happenin+plz+halp
    3⤵
    PID:5408
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument http://google.co.ck/search?q=my+computer+is+doing+weird+things+wtf+is+happenin+plz+halp
      4⤵
      PID:5600
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=how+to+download+memz
    3⤵
    PID:6080
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument http://google.co.ck/search?q=how+to+download+memz
      4⤵
      PID:5580
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=the+memz+are+real
    3⤵
    PID:3968
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument http://google.co.ck/search?q=the+memz+are+real
      4⤵
      PID:568

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4216

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5352

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:6012

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4488

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService
1⤵
PID:5608

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:6068

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x244 0x4a0
1⤵
PID:2020

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:932

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5636

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 bc76d3920b4918830f79ac7dc8dc0deb9cbae8083ccd438ddb63ad87fe26972e
MD5 54111336988259858454d1bacaf2380d
SHA1 a1448039894d2a47e9a4ebb65d85748d03161a95
SHA512 cea8d2eca8be7f339579834404e02dc774bac81f94441f285e5c106f2dcb3ad8a1eb4c858a0a7126d412821ee6bfc3555ab43546f16daee442c2cb69f77d03d3
TLSH
T142D080A853E83ADEF725143A12654356769D84927977D111C860624B078E57742D34E4
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 46b5e02f92d6d514d91841a6f31548feec16f43f11936dd840d11eee29e2c91b
MD5 4ac204f2862b2c7209622570e3617fe7
SHA1 3f6f8be015648a24178d09c20f39377105dc863a
SHA512 b64d9395cbc603d3bd9b3bdf9549558dd600dcbf779534259404a80707b321f15096b5961b04a8ef9b4957cb669056d3254bf8d23a8aaa23080974c51164183d
TLSH
T105D080A453E839DEF735143A12654366768D84926577D111C860524B078E57743D24D0
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 928eda824fe964cd23927cf06086d7d24e20a3a5092daf1acee5b632c76c962a
MD5 4ac43ee6512ba8635b7ba6bd015c291b
SHA1 5f9e2474b00ec0e2a9472c049fbea550e26309aa
SHA512 e5ebf9e92458f66e31e080121135313e828b8ebade0bc0e085221ae0d4f5afe0d2035c566590cbfb5902d96f17befe7b24310b4fb9e647b999113175af800ebc
TLSH
T17BD022B2B3A038CFE300083302A083BA2C0A80F300FAE2208C30E08C0BCC02AC283880
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f3ebbee38e0dd4dbb8cd53db507f7b492d5a638dfd7a6e523b9378ff82f64b53
MD5 9418895f796a6c7772c5ca0809c097fb
SHA1 e6f7a7121053a674c14f13914ce1c5b147f55829
SHA512 b8a119b822e576387d245d012ef297d5368a5f2ff773587d7ba9982a6b1f3e256af25810a177177178d0b43be21276efa6858b36bd8e9f659adc3a118ae574c8
TLSH
T167D022A023A038CFF328003302A203AA2A0A888320BAC200C820A00A0B8E03A82830C0
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 6bd92ac2b9fc60e90ea12f43bc1a91b6be544cf0b4fe41ea2bbdeab8a49bf27b
MD5 05b75acc681630870a11c450a7727455
SHA1 47124446bb1c9f46becfaf8b7fbdc4db257c99c7
SHA512 2e1dfd07052b0ba27729bf9b5f4e1df34ce4ed88e7a3a236ed05d60bd0f9654461aeb0038656ebb9a1c95a323202e9e1f68ff8a4bfea529f2995e3492953acf1
TLSH
T1D7D0C0A453E839CEF325103A02310356328D84C22477D100C860124B078E17342C20D0
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 48641e8ea0b2d07b8b9445d0193c101a76701cfa9ac71d0ac5df73371324530d
MD5 11b39e05fd3e3ea6e8c2743ecf934355
SHA1 404085fd7e65bb50824382fa54327eaf8546265a
SHA512 f69b769076dd806a37c4f419aca924be62a153eef9edeef55670cfbafdb238a51a651e02fe8dbcbcf8ea7b3975d41d5091d7584d862f45e8dff935119a90a067
TLSH
T19ED080A453F839DEF725143E12664356768D84926577D111C860625B078E57742D24D0
MD5 SHA1 SHA512 TLSH

Submit Download

0d081a92-1eb7-446f-90d2-6a03f6bf68d8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\0d081a92-1eb7-446f-90d2-6a03f6bf68d8.tmp
Size 414B
SHA256 12aefad1073f49fda9e21a635c4b84d276e9e22341acc64c7836cd288ea43651
MD5 538515991f3f4e00d6544a6cd22cc0e9
SHA1 4d410c98773ec6f7648a081453b0bf30663cc223
SHA512 63be0a92b6b8c3d03ddeae96520c3a877ed1be46f5b2b1efc5069e68c914d5f7d73a613c4895e11f232957dff359748b810e3b651790d4d0d16c5248abf3d41c
TLSH
T1ACE02BA6C820AC3709FD1B5D54810B47F755131B26409A4F3B3C95098FF5A7A564685C
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_0
Size 44KB
SHA256 6a66415e6bdf66dcd55f0fd4e0c46ef40844c1e72f76222ac4aa430824c1b707
MD5 45433aedd9bfa948530dc4a0435aa791
SHA1 aa9147a66c67b33dbfe429c76dbc5e40ee20a69f
SHA512 cf0ec042fa03f3e6a790856c8006d4da43b5819deb0efe7edffd3b1853220be2e4fe13fd9e9b573b22ab103fad1e576db33fd0fb104b61e3f41afe5bc20d11e6
SSDEEP 96:TqZ4xJm0l8GUwRmfVm6qafm2lyi4rBsLYxbuB5ifLgbylABiz3fwYMNHl:THj6BV2Zi4rBWYOyLogA8bzMNHl
TLSH
T13F13F93D56215E66FBE1667CACA78F33537BB861E8858527B03CFC533A22318AD5E044
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_1
Size 264KB
SHA256 50b3fe730e42dc6b578fb41bf8e6b5e0e72144d9a3d8724edc863aa9895c7a4c
MD5 bc6f31cff27474383f08620b0c591538
SHA1 21cfd9c2f55e7fc533af198ec96be77c79dec306
SHA512 be205acd9c10e02e18dc9c220b27cb987002730031b933a54f542e12c3cef349723a138ecd5948701f9c9795e109ee43f7f941deacc473742cbbbc54466148a3
SSDEEP 768:2La4hNlvbND2L/JFyL/jNnirigbbFgsxJ9baVbHmGk4oNdg:QaQF2L/JQL/jrgbV0bHm14
TLSH
T1C3444FF71A51601ADBA852F6D2033A3EC17B454E6CC6F898E57C8CC22825F31B2BDA55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_2
Size 1.0MB
SHA256 bf0cb8a756c818caf718afb3da6f8d040b5bd172752d5ff1428f85b174d6ed49
MD5 5fa021961a8293403d8a3dbf8aaac6b2
SHA1 ee6da4255802bd06e5beae08b58957753e9fc799
SHA512 f3686436f51a8dc8ed8e4981294e3b869054fb330ae511ec7c6042f8267707fcdfebac550ec53358fc60515a3271305a7d3fc61ea9dd8e8c08305107c606e8e6
SSDEEP 1536:VQMWWkuC7FOY7U7o7W787GLP7s7+7j7LHVnR777vm7EU7K7J7l7d74x7Z7DQNcqM:gWXLxHVnKD7DZE5K
TLSH
T1E7252AEEC7682C83DB6B8770B0E0D90B7E312082B69DC0D39944C5D997D6B8175E92BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000025

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000025
Size 346KB
SHA256 32a94764836eaecbc7623c301e81ed80dee2c1d2e08152d1737f75ab37f4a8a3
MD5 2dec6e0f4d4448c66ceff758ea3322d9
SHA1 8c1fffe216f0171ab9205f9fd8b2c3c2caa11ea1
SHA512 e7a89548baf82953102493da3a84c3163c4b33a6400b36794f3b9058d13e7a791edc661e12922b99b4ffc590e8eb61803b7a10bd08c2952f3fee960d3470e6ca
SSDEEP 6144:y6dZCa7g2GKh8oodOFC/1LumVhWBBRjC9THkeu99t4GmFl/D8aS/5OP98SXvGN:/tgTKqOFC/1LuQnTH4p2//D83g98S/8
TLSH
T10F7423B77A1712DB7395D6DA1BE8E8296CF673B15515D925003BC13ECF9C22C88F22A0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 af8cd8d061be485cec3e15b0ccd51bce7022ca0748e7350ad0073cc3f55e9cda
MD5 c8419b087e78bd0610e871cb29c520ad
SHA1 c112bd106f1c7650e0263ff86ad76b5746e0f594
SHA512 c04f692c1c14f8bf2da71cf6c58da1dd18dbd7af8637e10ed98f7aae44a5878d0b5631df3bfc3acd409bc45225b775c4827cab70fc749338afe2b3f74f651f69
TLSH
T11B41965E4AE500D1FBBC95B069C51A43323FDAA533637E0137B9CCBB4A1E7514225960
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 cf312a56d11762d29deaae603cf5dc8e35d1f3dbb8aebf4b17d6850af1000334
MD5 ed4dfa006359e2d77baaf8c8c6c325e6
SHA1 3e71f53d53d7e4897c072a290cb0b8aa691c526b
SHA512 37aa2baaa8d6f8875292bfa715181f9fb789e66c5c0673a0d9e62b20362da9174ea9bebfd7fdbdd07746dc80c6f9c49691b093c6f6bdcaa6cbeccf4c8e43952a
TLSH
T14841D89E4EE544C1FBBC907069C91A83363FDAA533A37E0237B9CCBB4A1E7404224D60
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 ea871ea333d2366f83ec574e7b2cd6706313d0a69c8f1284178c05648700897e
MD5 b712a9f2e36763b79634e2ca3dd9a54b
SHA1 1b51ebf6ba7d62b9c11247844eb2998cf187f9d7
SHA512 8dcff1e651af0542c47d4047e82775bcade96353b45c1c57d0a03506db620d348abb41a8f0cd50e16706ed9a39ffb7adc1c7281fc34ca81e15736030fd071ef1
TLSH
T1E341C79E4AE444C1FBBC907069C51A83363FDAA533A37E0237B9CCBB4A1E7414224960
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 69ec57d968d2ce6b4c8b47ba7040ed76c2de2cf0e713f248bc131ce4d659bf92
MD5 61b751c5f69c8f74d9d52a941b69d27b
SHA1 6123f031240bef3e8d2a48b69b81619394053867
SHA512 d0cbd75d2a8cbf08a7d0102fd98b9cc4fce1adb10a9a17d56acc6fee4edb9b75b86c1423e6af103f60f9b816bce3966fd080c5802b3ae193a9838d59533ca8cf
TLSH
T1BD41C79E4AE444D1FBBC907069C91A83363FDAA533A37E0237B9CCBB4B1E7414224960
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG
Size 346B
SHA256 40de2c63822b80fa7f8fa801659d67eb5bd0e1d3d7ff10f2daf7b5c510cfb5d1
MD5 be5fb4def619cccf948c3d066aa9d940
SHA1 bf3a7d28511623940213b04af0da223cfd08f684
SHA512 06e32354da11233dab797aa36e567eed4a88bdfecfd5b6eb60bd2d4a9c127ce711be5424aaeeca404a8c46290fdbae0b621165ad06dc44820c835d2675c9d945
TLSH
T183E0D8AC55C7C12EA95534D261787B0C82C03947E789AF0317048CC47A43111BA42D47
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\LOG
Size 319B
SHA256 f583721383cf9fd2fb291df9cfc1bc63a414a2b6c4738af5fd74a41dc4f6b34f
MD5 218b1749d78eb8f0e69a3338b71a3fa6
SHA1 fd22d9f143ef60751a5835ac52508b8c964f2144
SHA512 63981eec671eb6fa51a1621d517846f9e77a73677a58701e057fa43e71706611d2300cf619c7f254570cbbe8d5742f73677ae2090f8f2b38f59bacbbc96e556c
TLSH
T1CCE0268C15CAC1AA901474C3C3F8F70CC2D0394BFB8E3B02270E88467042188B686681
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\000003.log
Size 171B
SHA256 14f92b911f9fe774720461eec5bb4761ae6bfc9445c67e30bf624a8694b4b1da
MD5 e952942b492db39a75dd2669b98ebe74
SHA1 f6c4def325dca0dfec01759d7d8610837a370176
SHA512 9193e7bbe7eb633367b39513b48efed11fd457dced070a8708f8572d0ab248cbff37254599a6bfb469637e0dccbcd986347c6b6075c06fae2af08387b560dea0
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\LOG
Size 323B
SHA256 bff09c8d5fa3529bd6794eda84d31bac55ea42ea389611250ad07ea915dfd777
MD5 005bd4ddd97ed30ccad331ff4bbff6c4
SHA1 be813c6fd2993b826a4fe162d79ce2bb6f764abb
SHA512 9edd2c3f2cf0cefcf1b8d4f01e5e716dbeff34ddb0e2f234776f1cb59224f0aa2180d374aa4d6662ba8b93e7ecb93421e1a7820cc2a85c11790ab3f54e2f256f
TLSH
T17FE0805C09C9C1AA941564D343B9F70C86D13947B68DBB01274ECC456552254BA51581
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log
Size 456B
SHA256 c5ce9aaf8ffdcb8a00463a7bf24001885e0a792f110c8db74a1e2f4392cb0e31
MD5 f23d2df21a39aa8d814cade6c37856c8
SHA1 233e65707015a53f83a0d53db03a4af8fab21ea6
SHA512 a7b50b8cafba80f6baca44b260f8379852c4176f3dd57168812f3b4b811d2ff340f09f8ce625cc2adecab2851cc33725cb729548a3da98b041387c7952077918
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG
Size 319B
SHA256 2be3475dce4aaa2e34c3567f5f3a03f2f83964bc6529f591a0d2272ec322318f
MD5 d27753b5a6624cd02491f80cd190a400
SHA1 6a1a6254a43fade4df0a2f3e0e8efcef94f145f9
SHA512 7ddd52839f7be560f69f1d3ee51d9c4767f8a0b17a13f80eb259db508c03c557d7e61854990136f9486a9ab8f6a49c25d2feb021d751e24a1371ce6fe71b8cdf
TLSH
T1BCE0200C0ECFC219E515669746ADBB0CDAF13D43B28C3A035B4C8C476102145E255141
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG
Size 331B
SHA256 163e63388a040cddd3e568105cb7303fa66d8fb74d5e7bd9f848efa170601dee
MD5 324c06e38610994ac3b468c07660b421
SHA1 251517f3ed8690da1934201fa54bc2a011409759
SHA512 1a782172b9f4e2e060aacb01d48ae7c30bfa8a333fcefe1b7af3ce30e6dcfa03473882247927cbb9249d675a53db2ba19a7c8576d58c8c9200829f0f40eaa896
TLSH
T195E0D86447CEC1199505205B525EBF0CC7E03947E68CAB055B049845FD42108E7A76C3
MD5 SHA1 SHA512 TLSH

Submit Download

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
Size 20KB
SHA256 d326ca6f8f72585c9e6a8a219a7222c518632cb5e407f703e91fc0c1ec8eafde
MD5 592d603c129360ac092043614264f110
SHA1 8487ba34e344ac8667a591574a6472722123ca46
SHA512 051b1e2ecb5fd09a2eb778f078ccc2b9bb6792bde8cdf4ac42df07b7e91b587ebcb466c2aa0e4534db60da835a430e4dd00e6c48a1313a5ac0a173120ffe723a
SSDEEP 48:TtLopFMatSaw/auUOt8B0fbtwS/oyF75gONHNE/vofJZQ0Ai:9eMatUaAK0RgOJZQ0N
TLSH
T18E92614E2F246212C0EE4A32D9D14A3B2D7C121DA3A72B8A691550B3CDE1D9FA6001F6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 e95d491ba98d37bbe1bb62ad5f2ab28a3dbd7ca991eb9f8c5ab65541fbb8d26a
MD5 8ace6cdeb5c106df0c52374171cfc983
SHA1 4b061ce89a9e06467976777a7a5afd60eaa2abd9
SHA512 acf4479c43031cb94568f69cb83bdfadcdb2447119da5a467325e1f54dfbb4bec578212ee56f6d62b709e9916013680b1adae9a09c9cd2191fe8a4e844516696
TLSH
T12B516CF7C3E8862D894196F4EB256F1BCE1E0A14532C3D5BC8ECAE1B93E2871D14055E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 f539a2c4ba4b0de37d4f63bd77cc69598b6d539c239fe338cf834f82fcc74d07
MD5 b692efa2ae378bd6ebc32013eef06980
SHA1 3730e7ddb1dde7590c152d33314663dcfb304d1a
SHA512 aeab9338c476c232c724da68c405cd3c030eca7337668b4d5d22522c1e70d5108ae371b201be83ea472b28a3240968dc8a6caea8d1bc74524e6b86dec2092cf7
TLSH
T1B6217BF7C3E4A53E894186F4A7156F1BCE2D0A14521C3D5BC9E8AE2B93E28B5E20055F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 f49ef57dabfc26cea6044a6a81b0bb9bd28f8b7cec043121e23929114339acb7
MD5 3d7770508368d43ebd7fcf91e1893e8e
SHA1 1a9387d5c4126b639245d360cb87ece40c90bb77
SHA512 b45543c494db414aa88ca79075ddc92dcfa49c8ff8e0f491968dbe8650923940bcacc6ef1d60c8a2eb927ede0c5a0ec3769ef89871cbade27c8b8a1c6226e7ea
TLSH
T140618EF7C3E8862D894196F4EB256F1BCE1E0914532C3D5BC8ECAE1B93E2871D24155E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 a2c2a03913ba8c40fe6d0f54e4b85dc14b9f481b0e20bfa1a690f40fa278cc66
MD5 5e0877412e0898056a686751305b645b
SHA1 1bd6268162100c8acb68aa0b721345d4c3ab5cb4
SHA512 39745b4a7e552f82d23d6489d70a936168bce353b183d69d2c2bf1703d46ff94c6f73c3e7acf63feba66dd4b0714b9b6357f30a613eeb1787a1e496b7cd209e2
TLSH
T12D616DF7C3E8862DC94196F4A7257F1BCE1E0914532C3D5BC8E8AE1B93E2871E24165E
MD5 SHA1 SHA512 TLSH

Submit Download

Reporting and NEL

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Reporting and NEL
Size 36KB
SHA256 122767155ac26b2a00c3779c1f105c5dda6f6b80cddfd33d1a433686b4040bed
MD5 62180e1354df4030c09a301a0e0ccad7
SHA1 55d0f49b4b787066e043b6dbac80637f8a69e64c
SHA512 33222d3b2a2b62c056631ab6002beaf67227bf99d2294162e9cd14e0bddc8decbfebde9f977c56990aab64e422b9531e1cf613f01e898c4ce5952df046fac654
SSDEEP 96:i/IEumQv8m1ccnvS6yLoD6DQJxkfEMinF9eWaK/4g:i/IEumQv8m1ccnvS6yQCA+k9
TLSH
T189F2F0FB16276106D9C444B0E1015B8FAF1A010B47B6B7DC66D84BF3F3924E2B57879A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity
Size 189B
SHA256 593713135019b2fbb80f70b18ae8cd47a3e966e88b32d210593314b296ed8e54
MD5 38e528126c5ca5c6c8d5a5d2de01ac17
SHA1 65b953cf0e349d7afc52e7b8ad8bc24fb1a8ffc0
SHA512 7699a2b9a650f7b4ebe925b9ba3d9e8a170a95b7cf11a51b4c0300f9bd1d5e8e5af37a7bf83f1f9b1844bb1c58720ac31a7360493c66dbba5ece43c31a44de5a
TLSH
T1C7C0805F485DE733B46D07377507704171727C765463D4F1C5D6C17DD1405F90115061
MD5 SHA1 SHA512 TLSH

Submit Download

e8154dc6-1669-4f2d-b65c-f13801c76402.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\e8154dc6-1669-4f2d-b65c-f13801c76402.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 f796c0d62ae7a874d6b5e0ca619283641e542d8985c7bb308a055e41db91363d
MD5 764d4caceb8c832df680b21609ccc775
SHA1 84efb446afde993d59740712a46e9b2f333cec7c
SHA512 299151ce1b137b7ef0bb18c0bc6cdf3be218a62ff5cd7a96eaec4777456dfa9cbf21e229b310598113514b760a7fccf652f7c1ac093b4cfb856464196cd7ef6e
SSDEEP 192:sxZeVZs/fRsWNWpVLiYEupMHW6+WNGY36ruCIgEJ:sxZeLs/fRsWNWv2WMHbGXlI
TLSH
T11312A5566E28A97B4CCBD20DFB257F13D6FA1022A5D51E48EAFC862C05E76CD121780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 f810dd1c9a4529415681cd49bd2a3e37f30aa121d01cef42b3a5414a0431ac94
MD5 ca756092d90545716cf91fa331d553ee
SHA1 7d358f820cdfd3d79ea82a5b5aacaa7b081f62f3
SHA512 3b621cada7579fd765fa6cae49d63e3e0c0b3aa8f65d562cf950dc24139f4cb13f009b419f28696109081fcd596b537d29e6fa5d49efcc0c0c6048e08977b502
SSDEEP 192:sxZedZs/fRsRWpV5utZclezkup7SHW6+WN8LTCXj0/Y36PkYIgyJ:sxZejs/fRsRWvkDWKeHb8vCg/7JO
TLSH
T12D42C756AD28A93B4CC7D21DFB157F13D6FE552294D01E48AAFC8B1C01E76DD220781B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 5fddc9ef05d9dff400f3962b57af39d923a8d0420319dd1aaa2bafb8b3301300
MD5 b7290103984214b6892cdc9a384d2ba7
SHA1 a5855a2220839667346a9eab883dd9cc85735e1f
SHA512 cb147e989bad3977e7450f527e73ffa17d6ccc73bd15ea1b6a30bb7394150e643cab43126f16cf8be9caac7263c9bf8de4a54c9801de848bd75060f09e67bde8
SSDEEP 192:sxZedZs/fRsRWpV5UWZclezkup7SHW6+WN8LTCXj0/Y36VkYIgZKJ:sxZejs/fRsRWvqgWKeHb8vCg/7vZG
TLSH
T1FB42D75AAD28A93B4CC7D619FB157F13D7FA512294C01E48AAFC8B1C01EB6DD220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 18e73ab4cdb78578b0315a5e172a3fc77eaf34fc5f859f1d1ee0eaf572312a04
MD5 42b9c40e41e2086e91a74dd67a9f11ff
SHA1 d019512463d419182cb12382045305cb3e7b3d1b
SHA512 5141779b88be6957b411f74b9fcff0b00cf610b212a936511c1c6af67ed9dfdcaae6e4b9bb0318097c9ff72ae1910da08672e347914bf9fe4c203d95fa112fa7
SSDEEP 192:sxZeVZs/fRsgWpV5itZcqEupJHW6+WNGY36GLYIgyJ:sxZeLs/fRsgWvsD7JHbGXrO
TLSH
T18B22C7556E28A93B4CCBD21DFB257F13D6FA1422A4D51E48EAFC861C05EB6DD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 9b9075b532b013817d9d1531f7f00f1d059c0fbeb8d8d98bdee31ad685332924
MD5 686b931f88147c9531509e23060e8006
SHA1 1338c99f55d7edf0a985fbb9dac2af5fa9372f28
SHA512 91feece18766553fb2ea7dc78a63785ce2a98a737334c28d1997c986bd59f5c1dc760032d1f44087955f0e11cede1b1bfe2d74013e991a195de08edeb70f7629
SSDEEP 192:sxZedZs/fRsxwWpV5UWZclRzkup7qHW6+WNAF5WfYMIC6Mc+YIgZKJ:sxZejs/fRsxwWvqgWdmHbffA3j7ZG
TLSH
T1D642D75AAD24A93B4CC7D619FB157F13D7FA112294C14E48AAFC8B2C01E76DD221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 4983d49fbc303df63b0ac4b8ea03451f9fd3a20c5cd0ae2c4052bf1f8b3576fb
MD5 4e2691e220185f48857ff5c4c5fb8217
SHA1 9fdac04ae630f5e1757c13756f2c0b7c22cc5270
SHA512 e3a117a0a6f187a4a6a596fc8545bf4f88172d6cdc4fdd25f565254ea0727d15da9ce83b00d44d29a30c78e748822dec35ebe2b7786118be660f0c1f1a30c736
SSDEEP 192:sxZedZs/fRsyWpV5itZcezkup7SHW6+WN8LTCXj0/Y36PDCIgyJ:sxZejs/fRsyWvsD1eHb8vCg/7uO
TLSH
T1FE32D756AD28A93B4CCBD21DFB257F13D6FE112294D41E48AAFC8A1C01E77DD220781B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 4a5059f1a60fd4daa9cc14b43751700672e742ccb9bd49695f905a2ccab187bc
MD5 d98ab42ade6be842a97e796410789458
SHA1 85f365e71f83dcb912e19d5b51e0c90194c35dbd
SHA512 71371ec32128d3c098778b1a0a2cff496d090ff1d0e9c095a88ecc26a8a94ab5e527b16ba3836dbaf292776c5670926eac3caf7812ba80b71b160b4036180fa2
SSDEEP 192:sxZeVZs/fRsyWpV5itZcqEupJHW6+WNGY36GLYIgyJ:sxZeLs/fRsyWvsD7JHbGXrO
TLSH
T16A22E715AE28A93B4CCBD21DFB157F13D6FA1022A4D51E48EAFC861C05EB6CD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 69743ba8fb35ccd2f9c4f5ad918448d31318487e4bd1fa30b51c5aa00aa32a94
MD5 0b9b2bb49276ffa0528b9319f05bc668
SHA1 6836e0ee8b1d66279f587e91ee60e91150ee13b6
SHA512 177ce8491cddc05f6f0934d5f3de74a4dfb0e56922ec7d761d821ff88149a3a6f284b44814af53346f533f9788678d923f225539cf59f4e2028ab6d684999cf2
SSDEEP 192:sxZedZs/fRsRWpV5UWZclRzkup7qHW6+WNAF5WfYMIC6MbCIgZKJ:sxZejs/fRsRWvqgWdmHbffA3bZG
TLSH
T17742D75AAD28A93B4CC7D61DFB157F13D6FA112294C14E48AAFC8B2C01E76DD221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 b694a66bbe55f2c2a05d9e72d82f27b58c12753cf985cb586ef555d0e1d6c38a
MD5 6270a9c1ad2e33087f8f52212393c4af
SHA1 36978ade213b75d3165ff43d27e2ee5360bb807b
SHA512 6bf0a6584b5ac698cb7e6f7ae55ddf450a70a2433ed14c66d03f3b217625cad07f306c45c1589e6d51957e9587cb559e9b084de7025b39be89cb503e9c9b349b
SSDEEP 192:sxZebZs/fRsxwWpV5UWZclvzkup7OHW6+WN9tw/ZYMIC6eclCIgZKJ:sxZeNs/fRsxwWvqgW7CHbYZA3JEZG
TLSH
T12F52D65AAD24A93B4CC7D61DFB157F13D6FA112294C05E49AAFC8A2C01EB6DD220781B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 03ff5945d29516c82e434022146ace8ddf081e4ff40abc2e72b43c3628fb88fd
MD5 d5bf147bb4154d5a7d2c5186083d9c1d
SHA1 88c64cb36a96702c26e912d7a29ae89d29fa4c35
SHA512 e8214296dbf50f543e35227ac9a78e72e603d45d0bddd580d5977d1b209fc8d0775dcd3237745163acef3f0ef5420ff75ed51ead9d0121ebf089b2ee1339c8c4
SSDEEP 192:sxZebZs/fRslWpV5UWZclvzkup7OHW6+WN9tw/ZYMIC6echYIgZKJ:sxZeNs/fRslWvqgW7CHbYZA3JmZG
TLSH
T1BF52D65AAD24A93F4CC7D61DFB157F13D7FA112294C05E49AAFC8A2C01EB6DD220781B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 5f9682620f5dafdfe9c13263f3fa9e5e181d326d01165ad104d8196b3bf42928
MD5 254b58ce6c8f966ce575c5ee25b68b7c
SHA1 a4e960caae94b1be43279697c539f85173797bd7
SHA512 1c7bfe3fae15220f3d6dc7b8839b9a0599390cbe5b4cd3132bb0e0952f420ec4cd7dccc2cecbccd5bf3f248e2855299884f8e0d6f76e6519c22d12bcfdfa00e1
SSDEEP 768:PHKlm+QWvUYe08F1+UoAYDCx9Tuqh0VfUC9xbog/OVh/LlpPs/AroySQ:PHKlm+QWvUYe0u1ja8/L/E/Lyz
TLSH
T1EEC20A3B740CCB7E4FC05A9DDC5A6F972EA802C7A6588D4047FA984C02C77EA91264DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG
Size 335B
SHA256 93c0b8d522e5718890f4c44bf4554f7c8181191b483d8add95d8e81e6e13c1de
MD5 9fd8caa713f92d2a13992809fe6a4b6f
SHA1 5d8edb8e24681106fcd0f8b6622d6b8e3fbe6ffe
SHA512 31809bdf548bb4825672e671a964ad58052b40f793bb59dc5863c126e948bbd9924e04ed159531de743b2e2b37c5db4a3b9cd6feadd03438b644d05ba41338d7
TLSH
T1C6E0269807CAC1BDB127204707A9FB0CA2F47947EACC3E426F80C846658750CF1A2582
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG
Size 347B
SHA256 be752daf173e04065e0d86d61580617838279dfd66e86725e3e2195442996c27
MD5 910be04b7cadc213d6e7e3d7794c8bc7
SHA1 51902d226d1ad5252c9b6fb3a341b36e6e089356
SHA512 321e47329a6c4b1f2889e989b2d2c885dfaf9c2b39d95d9acd698393dd0ca78ecdd4c5dde4d423c6ece9a6e12da4d9f482d3198963e77a61360e9399226a605d
TLSH
T14CE0486416CBC32AA54621D7667DF70C85F27D07E6CC6F212B1C994566071447653581
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\000003.log
Size 175B
SHA256 80d1388b9a7150eb0291175fe693dd7b6bce910c3e4fff51e94841d31d771dbe
MD5 cb63c64828a27af7253afb7c7d986654
SHA1 8a54aeb86f79cc69e6f11278d874cebd328ae466
SHA512 e0dbdd6931c9272e0b52bb2ef7895121f6324379f584899343342a057737a9837cc476842ea781a1de5c17a20c06e0a7d24c0ed6ea41fdd95bb99296e8810f9a
TLSH
T135C09BD55F903023FDCA5D3D0DAB53041720C4752F74CF57D28430901C0A285FF61145
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG
Size 323B
SHA256 fd9a2bfc011da14a3c174272a2e0f6783b89b700a793dfc89bc8279a9dbf1a97
MD5 4f7a1f8156a4dce25101f20b9fd16a72
SHA1 21afa3e867fe6452e6418fcc5bfc2e4415f49f8e
SHA512 25a34bed6f286708be6cb1b8cc49d799a2079992f2eced234e08bffe15a6d2108462db6567464dc3c99522fd2002b0cb92a0c7d0544dbf500c2c6f95b9aab6c4
TLSH
T18CE086B846CBC2799405B09343B9FB0CC6F07D07ABCDBB86970C4485A942148B6A79C1
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 10fceb74cdd24d32c3950cd706146a7758f0f965ba4a27b33cfbd60cbcc71a57
MD5 1b64eac7953a2e426e145c5737fba031
SHA1 eab948cf1ded1d74a3118b15e939e9fdc94d448b
SHA512 627fb4986262e1f3728bab29d769b1e09c83b179d7226d6b895dffdc0ca504bfbcb575d6acf2cfe147df598084fa7e5950b25bd1186af7d548e2b4fd927ca0c1
SSDEEP 24:K6ZmUZWZPZ7vZo6Z5ZlZkVZ5ZozZPIIZzZkKXZHhvZFZk1hZ7Z0S7ZapZrZZ7Z5f:K8aIPKbCIvyp2IPKnKcfpIJKysUjy5
TLSH
T1A391260572BB02607CBE641E82E1965F855236A73618EB3B3FAC50925F67D082CFCDD9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data
Size 224KB
SHA256 d3233c0ddb6320eaaba519aac590c3ba13f4ec15213f7916e77b66d45ed2d700
MD5 c09b2bfe4937427f72bdb6361619524c
SHA1 5848a7d0495d3b421f78467b827f12d0f83ca7a4
SHA512 c021e38dac790c07d8d34fb19f506b0ae9020558be1086220fbec2bcf77a87dc69c572f86a8584f1dcd816c9db7cb114de02248224143c5181b8e1fd28bbbf06
SSDEEP 192:P+xg7twx9vfT8w0QQnG2IMW1hPJubRd6vPtcdCewdbsc7V1VJ:mx2+vfQ9QQn7IMW1hPJuVd6vPkxW
TLSH
T17324740A7B747001EDE6D9721CB080771E3CB16ECF22A6916DB654694DB2853A23D8FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

load_statistics.db

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db
Size 52KB
SHA256 7d4eeae3ad731e29eb8e769b44d9feec8ea8ec29974b20120ebe07980426c034
MD5 2d976106e121d1bf5396b378aa1893db
SHA1 fa7b87d4fc57171a2b93f82df7bc5da17014b2da
SHA512 b7c2a5e8ae0431fe14cd31b3195943caf28fea1be020e6a3a2f75198986cea019c8ab8418ace27aca6ab5d55cf9176482e412e0a75f0e8d6053852dbed16d588
SSDEEP 384:AP068lGtXHb00HkWOUEO/OIOBOJVWOSO0wmROwOTsO7OQBOmOXGe:APN86XI0Y6WhIJFz07Y55aQIvXz
TLSH
T17B33CBF7AD05A15BE9C99138D49BFF15543746618724C8D8AE3C4CC37F39A023C7A6A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log
Size 12KB
SHA256 a60033665a3b1540e16cd77b9c37b31d8ec404f43746510f5de2318afef21e09
MD5 5f14bbfb22c665f515961bec1832fc19
SHA1 356257349aed81e743f263c97eb516459d67b75f
SHA512 7236677b3f5be8004238e687808b6e555947a4c37157ab5b87a7ba9f501793c8b94f4b344e49477e50ab2c46162fb5873bca0c1a7d7a50bcafb0398b56043453
SSDEEP 192:j95QkIIIbbLMIMNsYcYe5bOiIAsglrNKrsir:j95QkIIIbbLMIM2B8ixsC8s
TLSH
T12142732E16052B77C19F6F3A135B82955AD88C83C176612C31923C0F8DF3E9782DA6F2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG
Size 319B
SHA256 4dd4916e30fbe903d670a3e45c5912d5146be768d78ee09fd3ed358addac8827
MD5 293b3c0042210ea88837449aba36dbfb
SHA1 768b0c82259750ad63cdd0d70d2a0018de29d2a7
SHA512 62a09659f37be57e0e6a5c598d14462231a113a38daaed79673426d9ec931e4993d41073f88a95661c09e393084ee300d9deda3eb62e106b875debd3d66c1302
TLSH
T190E08668EBCBC36EE51521C711BDB74CD6E13E07FACC6E561F08C859A502148BAA65C2
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log
Size 1KB
SHA256 387ff8d58bfa4a360fc9601970dbf1fe071d5312234892c28af99def5b5e93e1
MD5 7a4ea08516a5b69a0a8495353a5c4c69
SHA1 3d71c28d9f0fa5c01acd389e1c50a7d1a5b4ca77
SHA512 5ef78493ee12c2e400fd52c8f0b0360146cf498ed541900bbd2cbbd2f92f5839e85472197ee1a5bdad02f1de0b26ce043e69d17b3dcb8a19a03891bf20bc5e69
TLSH
T18F214052F334C109D2494A7A946D576A1734F4058FFCEC0F05B920647FB6E451E476E6
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG
Size 337B
SHA256 fe0b820a974fc331aaac8000cdb1d4227167934a32be149721b754ade3cecc79
MD5 028d0b1f14711dd5e3dc2e0b30a8e7be
SHA1 f9b3e28ed5b9c5df8220a76918f91e281646d2ac
SHA512 5cc67e69d652b770116ce2b231335fb0add90491113dc6ce973ffd6efa6381c0e5337c000e348a85c5a82cf42cbf803e47ae59328e4973c4ed5d92e6b4833380
TLSH
T18CE02618EACBC2AFD111318301BDF78CC2E13D03FACC2F021F08CC49A902149B6AA1C2
MD5 SHA1 SHA512 TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Size 14B
SHA256 ee1367d356a136a11664001cd90e05ba08dbaa85f496584158f5e42be8e836fd
MD5 8297da058a737611abcc3a0ede9ffc24
SHA1 e532552672ecffbe3509fb4c334833a67f16d05b
SHA512 fefc70ebe486693310a00beb5ae125abb1569c4455538124d897566f2e44f2b3854ad4451196607137301a811ac7f96f1d488a36eb6d6cd566f2f7cdc7c7568f
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 15KB
SHA256 4429280262be03cf4cfdb51c938f72622cc9c6e3a8626c3583c657ed7d976c23
MD5 372f1cd98daa3909f2f6ae98a1686f35
SHA1 b18469d96db9ccf7a8ed2a9e07c74334e263cc01
SHA512 d19e7c50240add7b343a2c0a3d0f0cdc45c3662a4361d53594bd520981b6f0c30788a5e330aa7de8497237e0b0e2ad3ee7e9da1073f334b6412bbf14dcdabf6c
SSDEEP 384:zssN0f6Ob1K9h//pAFDA8397AJkLD8TrqyV:wOdj/Gu8qJkLD8p
TLSH
T157721974D8A06CEB4CA6E4D5A446F6136EB41177C6892E4CD6F8BB3E309F4F84302D26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 15KB
SHA256 046ac6a8e85d2c315c4266449f15e796a0eae5055efdc55461df96e69a562743
MD5 489721ff69bbd766b30aa0ef8768e35f
SHA1 157798527761b5e8ca70b48a449b8554f23540c7
SHA512 e2382d56db0e5f1975c555a6a1b469bf7ab8b7779b1a93984664c7e47f8363ea9f19fd953c0260592ebf08726fa11a308a8e10a60273c948f3fc47c21833cd3f
SSDEEP 384:zssN0f6Ob1z9h//pAFDA8397AJkLD8TrqyV:wOYj/Gu8qJkLD8p
TLSH
T196721874D8A06CEB4CA6E4D5A446F6136EA41177C6892E4CD6F8BB3E309F4F84302D26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 17KB
SHA256 0b56bb1ec5856d84b0d45964e300a39e248b7318f1da3bd278e34bc7aa06128c
MD5 45c84390d8c0d87effb0db6c14078245
SHA1 c73a8f3ff042a0703cfa9d20d003d8f1316e69fe
SHA512 b8428d5ff5541af8982435ea8fcc124d8ff96760e4fd98f7cca5bff9ae951093779a2452d1d5c15c23816d223cffba503e263110dbe10942a5b5768566bfd2bc
SSDEEP 384:nfZcIW3sN3B6ObuW8h//pN+8TrqO/Izshe8:3W3P4Q/v+8x
TLSH
T101826BB06CB5FC775CB7E1A5F6467A138EB850B7C9D44E40E5E8EB1F00966980B0BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 e076a3c58a8283f6fe5cc8bd518cb986e26f3c45a0e14abfeec5007b85565764
MD5 040d75bb913d75c22b1707c12e854c83
SHA1 48db0f2fbe9c8f52cb3c30d400f96ec5092c2cd0
SHA512 06c1b0b9105e17b38ecdbd14d20348b59a65291169992576f7eb4ddd7587b2226b613fdccba773a30d4ada210ddc209ef0f774d2a3fb0387d1d0648e2904df8e
SSDEEP 96:KqONkoQsjpfbUmjH5ih/cIPURHl8h4otop5faDXBKP4v+Y1xf//ojdHvTeYhy7nU:BONk6JUm0QmiUy0Rso//AyTBC3JHU6
TLSH
T17C02D738BC68B87B9EE39E45B5877B239FA4106B96911E80D6D85B1D01DB15C1302826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 21KB
SHA256 6163692eb78b17cb3f13073713c5b2331237b72093e0bfdf556ecfbcd49fb76a
MD5 a7d9c2efd4a16043d6d94201cb45999b
SHA1 3daa895de3f3fbba33de68c581fca6a564230eb4
SHA512 015d93b8e2b34da33cd4c927844da915ab4cfcea924d83c1695966a8345499d3eb61009d4e2d8caacdfadb4b4fae5acfa19eebac1502976131324638f9a5d5cb
SSDEEP 384:noZcIW3sN1a6Obu88h//pAjXASpLkgMKWcnv8TrqO/Izshe8:WW3QOQ/2sSO9KWcnv8x
TLSH
T101A24AB498A1ACE708A6E4C5B542FA139EB81177CA985E0CD5F8FB3E309F5F40713816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 bead9a44cfbb967e2c77fa0ddf7bb5fcb78f2aad103ff3924f16335c4ce24484
MD5 352653bbf8074aef36133a6aa4647ad1
SHA1 780c555af244a532088a7df7d2df511867034b9b
SHA512 de1d669ed38ede13340acc97268272e5a6d325c76a9f15e27dc5f14a6ef04697de27ebc8f84b7566cc05089e186f76e735add082a98398a873a1dc6b6089a84a
SSDEEP 192:zBEsNXNQzu2UbYYQmiU2mbz4h//Ayt1eSzZDZ+/m8TxlqO/IzssD:zGsNXN6Ob178h//pbp8TrqO/Izse
TLSH
T154422A386878BC779DB3E995F10B7B139FB410BBC9D51E54DAE99B1E01CB2980303926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 ff8ed6eed801a6a1bad01710a8968fd56e94f92e71298301e298dd48d24e3521
MD5 79ddc10a0d19adb4d68435f821a19573
SHA1 38a3277e3bcf9ce225b342f087d4ac5e795bc8ea
SHA512 89e10e263437438a394faf738476d86408eb1e19a2bd4480adfccfdd1466a864d8a220cfab101ee667f63e3b419e6b5a34f42dbdb124f05a738206c0137f9e51
SSDEEP 192:BON96JUKQmiUyCRso//Ayt1eSzZNxj/5U6:BON96+Gvso//pZVU6
TLSH
T114122A35B868BC7B5DE395A4F08376139E64016BDB896F80DADC6B2D02EF19C5307C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 21KB
SHA256 7d435b796685af2d10039ef81baa65960c69ca754ccfdcf396d6e668624ba037
MD5 42a0c5dab4651e6aebe250785c585de2
SHA1 dc88dae957d1988834dbe3c0c6ea75558a57caf3
SHA512 0d01b8c47945bb4fd3de37a2be26236aaac0bc109f9c649b8234e2cc13e7150ebaad4a30e48ccf0742cbf9325ac6c397101cfddfb4ba271fd0573452fdfa47b3
SSDEEP 384:nyZcI7sN3B6ObiB8h//pHicAStLki9GF8TrqO/Izshe8:A7PzQ/Z0Sii9GF8x
TLSH
T106A24BB098A07CE748B6E9C6B546FA076EA81177C5985D4CD5F8FB3E309F4F80312822
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 17KB
SHA256 e222c19c005eaafbf36f7846d9b499cb42d9bd3b95c8d63379e4d1cf57794c7b
MD5 4251e7ca9f8545c0263d11e255a74dcc
SHA1 1ad8884c3e12df8a08206747b95fe979cd40a810
SHA512 e604b3a583aa209fe234dc689aee0ce562ade179ca5d69a9aed90bb38b7da34261b2456e04674a749ab885e46062c2d803cb8988709465a9bb45515d6d98303e
SSDEEP 384:nCZcIisNXa6Ob1T8h//pbp8TrqO/Izshe8:wiuuQ/1p8x
TLSH
T1A6726C7468B4BC779DB7E9A6F5467A138FB850B786E51E40E9E8AB1F00871980303C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 5001d8bc0cd573e3a6651028fda89d4f50e4b6023588e378c8d01e2ff9fd80c7
MD5 1b5a0d9a3f82ecbb071ae1d0a470d26a
SHA1 c93a1705ab76552350b6d8e7f64b431af1b83b79
SHA512 bf029e56c8652f19b8408e07a511d6b64167dda5a11b75a20ece05f3e932fdc072cad23846bfb5fff03cad089949e6ddd4d22e48ebf85ace61a481c2bbdcd1b7
SSDEEP 192:zssNXfQzu2UbYYQmiU2mbzZh//Ayt1eSzZEZ+/m8TxlqO/IzsBD:zssNXf6Ob179h//pip8TrqO/IzsV
TLSH
T1BA423A386878BC779DB7E9A5F10B7B139FB410BBC9951E54E9D9AB1E01CB1980303827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 21KB
SHA256 fe6b1c45d47e190d3c9bbdfe6e06a989e4bef0e9774710c0b5c0019c491fee35
MD5 36dcdf201dee43b2b209d1b6859b62f6
SHA1 fd5d5284a7b9a76447a6fe63feb5b91f9e2ab761
SHA512 3f0c9da78686b1b0ab531fefc6ad06eb80a8372c12a1efedfb837ca52b59d63d7a4f004dd03d1f4052953fb1ae145db0b054eef2f07301338c6c4bbcbe6ebad3
SSDEEP 384:nzZcIGsNtUB6Obvl8h//pdXXAStLkgMKWcnO8TrqO/Izshe8:rGyqQ/nASi9KWcnO8x
TLSH
T131A24AF498A5ACE708A6E0C5B542FA13AEB81077C9985E0CD1F8FB3E309F4B40717816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations
Size 86B
SHA256 f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed
MD5 961e3604f228b0d10541ebf921500c86
SHA1 6e00570d9f78d9cfebe67d4da5efe546543949a7
SHA512 535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472
TLSH
T196A02407C473C00FF4144051C45C034114FCC447011DD0015074D31314D40CF03F5435
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 bd83ae4f43709c22809d66dc36f2fdd163d0cc648620410c7250481a6ff86999
MD5 cda5c7ff5c1a3246d55ec7089913c74a
SHA1 545ebd3c71527bf017394a6d6da609ac834c63a7
SHA512 4248e9e17504b0e3b2456af850319053981a5ce3ffc78e7a2891995121d88cca561b2a1edb867c7dc8053485087d52d1d6ff8900a087ba8af8cfc8000a26a976
TLSH
T115411858A6F91118B3B76F16ABF6586D587F78372F06D46D10110D8E0636B41CC72737
MD5 SHA1 SHA512 TLSH

Submit Download

8b0d4544beb97a69dbb9583fca5575a9aba6e37d.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\8b0d4544beb97a69dbb9583fca5575a9aba6e37d.tbres
Size 2KB
SHA256 721612481a7ab1c2a406b21c3edf8e9644d12ef16925de956068108e0f234ea9
MD5 a1d05fe769cbf6a70d9b2dda8f735071
SHA1 5594ea33b0ac7e8ba11b48c4632c703ca258d6b9
SHA512 050fb0c3d76d09fef4d8667326ab887906410ceedbf4860d7522512d61266532b38a72e91bd5553ae667d6d9ec231f076674e75a43010652464cc03194efe435
TLSH
T115512C68A6ED100873776F1A9FF2B85E597FB9733A06945E10200E4F0673A41CD91737
MD5 SHA1 SHA512 TLSH

Submit Download

1ed12fe0-0b05-4244-acad-77322f0361be.tmp

Path C:\Users\Admin\AppData\Local\Temp\1ed12fe0-0b05-4244-acad-77322f0361be.tmp
Size 157KB
SHA256 e03138d37406c2bedec93e5a7c44a457a6b19cf4fee5dfe5a46450fcea1bf85e
MD5 088d09e1a5cd1db2f55a4f5131b75b3b
SHA1 4e017079555c92f2f9419a53ab89aae7c5425550
SHA512 f8e7a1652d20778af9e0aefef0f24bb477260eefd5c6cecd3b4e17276b7d6c8d79554e850b9a9fdd9c65095ae16dad8868df304ee7a057ec7cea5a35b9e526ad
SSDEEP 3072:sA30KAb7L7nAnBPxnb8b4HpQgHY15vClaH4d6r1tx:sAkKAb7L0Qb4HpQgoq8tx
TLSH
T182F3E1AD2FEE891ACD0B50BD3B04B38BC90A8F07820A655F735F8015997475D17A2DFA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9c4c4f5b-74d1-4885-9dab-e9fcfbff1374.tmp

Path C:\Users\Admin\AppData\Local\Temp\9c4c4f5b-74d1-4885-9dab-e9fcfbff1374.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

e0adab0b-2717-4cc3-ab36-757fe0b676ad.tmp

Path C:\Users\Admin\AppData\Local\Temp\e0adab0b-2717-4cc3-ab36-757fe0b676ad.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir6128_918256465\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

note.txt

Path C:\note.txt
Size 218B
SHA256 8e9f20f6864c66576536c0b866c6ffdcf11397db67fe120e972e244c3c022270
MD5 afa6955439b8d516721231029fb9ca1b
SHA1 087a043cc123c0c0df2ffadcf8e71e3ac86bbae9
SHA512 5da21a31fbc4e8250dffed30f66b896bdf007ac91948140334fe36a3f010e1bac3e70a07e9f3eb9da8633189091fd5cadcabbaacd3e01da0fe7ae28a11b3dddf
TLSH
T1C3D0A719040784251C7052D17145A5A09B70562D77F626EB74DC690C212700F0B37C9A
MD5 SHA1 SHA512 TLSH

Submit Download

memory/932-1118-0x000001E4456C0000-0x000001E4456C1000-memory.dmp

Download

memory/932-1125-0x000001E4456C0000-0x000001E4456C1000-memory.dmp

Download

memory/932-1124-0x000001E4456C0000-0x000001E4456C1000-memory.dmp

Download

memory/932-1123-0x000001E4456C0000-0x000001E4456C1000-memory.dmp

Download

memory/932-1126-0x000001E4456C0000-0x000001E4456C1000-memory.dmp

Download

memory/932-1127-0x000001E4456C0000-0x000001E4456C1000-memory.dmp

Download

memory/932-1128-0x000001E4456C0000-0x000001E4456C1000-memory.dmp

Download

memory/932-1122-0x000001E4456C0000-0x000001E4456C1000-memory.dmp

Download

memory/932-1117-0x000001E4456C0000-0x000001E4456C1000-memory.dmp

Download

memory/932-1116-0x000001E4456C0000-0x000001E4456C1000-memory.dmp

Download

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads