3872c12d31fc9825e8661ac01ecee2572460677afbc7093f920a8436a42e28ff

user interaction
yes
max time kernel
143s
max time network
140s
platform
windows11-21h2_x64
resource
win11-20260911-en
resource tags

arch:x64arch:x86image:win11-20260911-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
30/10/2026, 22:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
MEMZ-virus-main/MEMZ.exe
Size 16KB
Sample261030-148caafv3x
SHA256 3872c12d31fc9825e8661ac01ecee2572460677afbc7093f920a8436a42e28ff
MD5 1d5ad9c8d3fee874d0feb8bfac220a11
SHA1 ca6d3f7e6c784155f664a9179ca64e4034df9595
SHA512 c8246f4137416be33b6d1ac89f2428b7c44d9376ac8489a9fbf65ef128a6c53fb50479e1e400c8e201c8611992ab1d6c1bd3d6cece89013edb4d35cdd22305b1
SSDEEP 192:M2WgyvSW8gRc6olcIEiwqZKBkDFR43xWTM3LHf26gFrcx3sNq:JWgnSmFlcIqq3agmLH+6gF23sN
TLSH
T10F725CCFFAA00457E4F0C93030656634EF7E9A7A0B968EDF6CF52E829AC0D472517295
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

bootkit discovery persistence

Malware Config

Signatures

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	MEMZ.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MEMZ.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MEMZ.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MEMZ.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe

System Time Discovery 1 TTPs 4 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4812	msedge.exe
2824	msedge.exe
6040	msedge.exe
5092	msedge.exe

Enumerates system info in registry 2 TTPs 12 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4077919521-2131189092-3796306753-1000\{AE29C749-F15C-4D25-92DE-6C3D1ED360F7}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4077919521-2131189092-3796306753-1000\{95510CDF-A340-4E1D-AB9A-881DE5042034}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4077919521-2131189092-3796306753-1000\{95BDE2DD-73CD-46E1-987D-0DBBA7BF0E00}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4077919521-2131189092-3796306753-1000\{8DBF82D9-6B0D-4301-84D5-3D97BCDD0EB3}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2372	MEMZ.exe
2372	MEMZ.exe
2372	MEMZ.exe
2372	MEMZ.exe
4484	MEMZ.exe
4484	MEMZ.exe
2372	MEMZ.exe
4944	MEMZ.exe
4944	MEMZ.exe
2372	MEMZ.exe
4712	MEMZ.exe
2176	MEMZ.exe
4712	MEMZ.exe
2176	MEMZ.exe
4484	MEMZ.exe
4484	MEMZ.exe
2372	MEMZ.exe
4484	MEMZ.exe
2372	MEMZ.exe
4484	MEMZ.exe
2176	MEMZ.exe
2176	MEMZ.exe
4712	MEMZ.exe
4712	MEMZ.exe
4944	MEMZ.exe
4944	MEMZ.exe
2372	MEMZ.exe
2372	MEMZ.exe
4944	MEMZ.exe
4944	MEMZ.exe
4712	MEMZ.exe
4712	MEMZ.exe
2176	MEMZ.exe
2176	MEMZ.exe
4484	MEMZ.exe
4484	MEMZ.exe
2372	MEMZ.exe
2372	MEMZ.exe
4484	MEMZ.exe
4484	MEMZ.exe
2176	MEMZ.exe
2176	MEMZ.exe
4712	MEMZ.exe
4712	MEMZ.exe
4944	MEMZ.exe
4944	MEMZ.exe
2372	MEMZ.exe
2372	MEMZ.exe
4944	MEMZ.exe
4944	MEMZ.exe
4712	MEMZ.exe
4712	MEMZ.exe
2176	MEMZ.exe
2176	MEMZ.exe
4484	MEMZ.exe
4484	MEMZ.exe
2372	MEMZ.exe
2372	MEMZ.exe
4712	MEMZ.exe
4712	MEMZ.exe
4944	MEMZ.exe
4944	MEMZ.exe
2372	MEMZ.exe
2372	MEMZ.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 16 IoCs

pid	Process
1896	msedge.exe
1896	msedge.exe
1896	msedge.exe
1896	msedge.exe
1896	msedge.exe
1896	msedge.exe
1896	msedge.exe
1896	msedge.exe
1896	msedge.exe
5948	msedge.exe
5948	msedge.exe
5948	msedge.exe
5948	msedge.exe
5764	msedge.exe
5764	msedge.exe
5764	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	5964	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	5964	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 7 IoCs

pid	Process
1896	msedge.exe
1896	msedge.exe
1896	msedge.exe
5948	msedge.exe
5948	msedge.exe
5764	msedge.exe
5764	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4140	Calculator.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4432 wrote to memory of 2372	4432	MEMZ.exe	82
PID 4432 wrote to memory of 4484	4432	MEMZ.exe	83
PID 4432 wrote to memory of 4944	4432	MEMZ.exe	84
PID 4432 wrote to memory of 2176	4432	MEMZ.exe	85
PID 4432 wrote to memory of 4712	4432	MEMZ.exe	86
PID 4432 wrote to memory of 2152	4432	MEMZ.exe	87
PID 2152 wrote to memory of 1192	2152	MEMZ.exe	88
PID 2152 wrote to memory of 4456	2152	MEMZ.exe	89
PID 2152 wrote to memory of 1896	2152	MEMZ.exe	91
PID 1896 wrote to memory of 3984	1896	msedge.exe	92
PID 1896 wrote to memory of 4812	1896	msedge.exe	93
PID 1896 wrote to memory of 3308	1896	msedge.exe	96
PID 1896 wrote to memory of 3308	1896	msedge.exe	96
PID 1896 wrote to memory of 4272	1896	msedge.exe	95
PID 1896 wrote to memory of 4272	1896	msedge.exe	95
PID 1896 wrote to memory of 4272	1896	msedge.exe	95
PID 1896 wrote to memory of 4444	1896	msedge.exe	108
PID 1896 wrote to memory of 4444	1896	msedge.exe	108
PID 1896 wrote to memory of 4444	1896	msedge.exe	108
PID 1896 wrote to memory of 3272	1896	msedge.exe	98
PID 1896 wrote to memory of 3272	1896	msedge.exe	98
PID 1896 wrote to memory of 3272	1896	msedge.exe	98
PID 1896 wrote to memory of 2136	1896	msedge.exe	100
PID 1896 wrote to memory of 2136	1896	msedge.exe	100
PID 1896 wrote to memory of 2136	1896	msedge.exe	100
PID 1896 wrote to memory of 3260	1896	msedge.exe	101
PID 1896 wrote to memory of 2060	1896	msedge.exe	102
PID 1896 wrote to memory of 3260	1896	msedge.exe	101
PID 1896 wrote to memory of 3260	1896	msedge.exe	101
PID 1896 wrote to memory of 2060	1896	msedge.exe	102
PID 1896 wrote to memory of 2060	1896	msedge.exe	102
PID 1896 wrote to memory of 560	1896	msedge.exe	103
PID 1896 wrote to memory of 560	1896	msedge.exe	103
PID 1896 wrote to memory of 560	1896	msedge.exe	103
PID 1896 wrote to memory of 3840	1896	msedge.exe	104
PID 1896 wrote to memory of 3840	1896	msedge.exe	104
PID 1896 wrote to memory of 3568	1896	msedge.exe	105
PID 1896 wrote to memory of 3568	1896	msedge.exe	105
PID 1896 wrote to memory of 3568	1896	msedge.exe	105
PID 1896 wrote to memory of 1144	1896	msedge.exe	107
PID 1896 wrote to memory of 1144	1896	msedge.exe	107
PID 1896 wrote to memory of 1144	1896	msedge.exe	107
PID 1896 wrote to memory of 540	1896	msedge.exe	109
PID 1896 wrote to memory of 4292	1896	msedge.exe	110
PID 1896 wrote to memory of 4620	1896	msedge.exe	111
PID 1896 wrote to memory of 3812	1896	msedge.exe	112
PID 1896 wrote to memory of 4292	1896	msedge.exe	110
PID 1896 wrote to memory of 3180	1896	msedge.exe	113
PID 1896 wrote to memory of 3812	1896	msedge.exe	112
PID 1896 wrote to memory of 3180	1896	msedge.exe	113
PID 1896 wrote to memory of 752	1896	msedge.exe	114
PID 1896 wrote to memory of 752	1896	msedge.exe	114
PID 4620 wrote to memory of 3836	4620	msedge.exe	115
PID 1896 wrote to memory of 2132	1896	msedge.exe	116
PID 1896 wrote to memory of 2132	1896	msedge.exe	116
PID 1896 wrote to memory of 5424	1896	msedge.exe	117
PID 1896 wrote to memory of 5424	1896	msedge.exe	117
PID 1896 wrote to memory of 5484	1896	msedge.exe	118
PID 1896 wrote to memory of 5484	1896	msedge.exe	118
PID 1896 wrote to memory of 5184	1896	msedge.exe	119
PID 1896 wrote to memory of 5184	1896	msedge.exe	119
PID 1896 wrote to memory of 5184	1896	msedge.exe	119
PID 2152 wrote to memory of 5948	2152	MEMZ.exe	120
PID 5948 wrote to memory of 5956	5948	msedge.exe	121

C:\Users\Admin\AppData\Local\Temp\MEMZ-virus-main\MEMZ.exe
"C:\Users\Admin\AppData\Local\Temp\MEMZ-virus-main\MEMZ.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4432
- C:\Users\Admin\AppData\Local\Temp\MEMZ-virus-main\MEMZ.exe
  "C:\Users\Admin\AppData\Local\Temp\MEMZ-virus-main\MEMZ.exe" /watchdog
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2372
- C:\Users\Admin\AppData\Local\Temp\MEMZ-virus-main\MEMZ.exe
  "C:\Users\Admin\AppData\Local\Temp\MEMZ-virus-main\MEMZ.exe" /watchdog
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4484
- C:\Users\Admin\AppData\Local\Temp\MEMZ-virus-main\MEMZ.exe
  "C:\Users\Admin\AppData\Local\Temp\MEMZ-virus-main\MEMZ.exe" /watchdog
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4944
- C:\Users\Admin\AppData\Local\Temp\MEMZ-virus-main\MEMZ.exe
  "C:\Users\Admin\AppData\Local\Temp\MEMZ-virus-main\MEMZ.exe" /watchdog
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2176
- C:\Users\Admin\AppData\Local\Temp\MEMZ-virus-main\MEMZ.exe
  "C:\Users\Admin\AppData\Local\Temp\MEMZ-virus-main\MEMZ.exe" /watchdog
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4712
- C:\Users\Admin\AppData\Local\Temp\MEMZ-virus-main\MEMZ.exe
  "C:\Users\Admin\AppData\Local\Temp\MEMZ-virus-main\MEMZ.exe" /main
  2⤵
  - Writes to the Master Boot Record (MBR)
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2152
- - C:\Windows\SysWOW64\notepad.exe
    "C:\Windows\System32\notepad.exe" \note.txt
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1192
- - C:\Windows\SysWOW64\notepad.exe
    "C:\Windows\System32\notepad.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4456
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://motherboard.vice.com/read/watch-this-malware-turn-a-computer-into-a-digital-hellscape
    3⤵
    - Enumerates system info in registry
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:1896
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e4,0x2e8,0x2ec,0x2dc,0x2e0,0x7ff9c67fc188,0x7ff9c67fc194,0x7ff9c67fc1a0
      4⤵
      PID:3984
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1800,i,15749592682022812229,2143709610618015044,524288 --field-trial-handle=2272,i,12551589357055766530,16523023103680075444,262144 --variations-seed-version --mojo-platform-channel-handle=2312 /prefetch:11
      4⤵
      System Time Discovery
      PID:4812
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1636,i,12391684380378860580,11696015036669502684,262144 --field-trial-handle=2272,i,12551589357055766530,16523023103680075444,262144 --variations-seed-version --mojo-platform-channel-handle=2268 /prefetch:2
      4⤵
      PID:4272
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2336,i,11563345227913867170,7072236571284453187,524288 --field-trial-handle=2272,i,12551589357055766530,16523023103680075444,262144 --variations-seed-version --mojo-platform-channel-handle=2472 /prefetch:13
      4⤵
      PID:3308
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3496,i,4817081618311697301,1129873691859293130,2097152 --field-trial-handle=2272,i,12551589357055766530,16523023103680075444,262144 --variations-seed-version --mojo-platform-channel-handle=3428 /prefetch:1
      4⤵
      PID:4444
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3500,i,17126468123286921872,14676498569520644762,2097152 --field-trial-handle=2272,i,12551589357055766530,16523023103680075444,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:1
      4⤵
      PID:3272
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4204,i,15316055229269490668,6709949140549075077,2097152 --field-trial-handle=2272,i,12551589357055766530,16523023103680075444,262144 --variations-seed-version --mojo-platform-channel-handle=4212 /prefetch:1
      4⤵
      PID:2136
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4264,i,6452896039183042761,10525618285404036565,2097152 --field-trial-handle=2272,i,12551589357055766530,16523023103680075444,262144 --variations-seed-version --mojo-platform-channel-handle=4240 /prefetch:9
      4⤵
      PID:3260
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4292,i,5412747723323949628,16356427220948646426,2097152 --field-trial-handle=2272,i,12551589357055766530,16523023103680075444,262144 --variations-seed-version --mojo-platform-channel-handle=4380 /prefetch:1
      4⤵
      PID:2060
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4392,i,6059186839100160701,18215599372980644337,2097152 --field-trial-handle=2272,i,12551589357055766530,16523023103680075444,262144 --variations-seed-version --mojo-platform-channel-handle=4468 /prefetch:9
      4⤵
      PID:560
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4336,i,2168135179877178900,3764569016717242263,524288 --field-trial-handle=2272,i,12551589357055766530,16523023103680075444,262144 --variations-seed-version --mojo-platform-channel-handle=4200 /prefetch:14
      4⤵
      PID:3840
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=3428,i,2742064474036114882,8534756606677867863,2097152 --field-trial-handle=2272,i,12551589357055766530,16523023103680075444,262144 --variations-seed-version --mojo-platform-channel-handle=5452 /prefetch:1
      4⤵
      PID:3568
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=5352,i,16124750873058757564,15405912030997410739,2097152 --field-trial-handle=2272,i,12551589357055766530,16523023103680075444,262144 --variations-seed-version --mojo-platform-channel-handle=3548 /prefetch:1
      4⤵
      PID:1144
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5472,i,3444771369018515582,14283613689531893848,524288 --field-trial-handle=2272,i,12551589357055766530,16523023103680075444,262144 --variations-seed-version --mojo-platform-channel-handle=5948 /prefetch:14
      4⤵
      PID:4444
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5472,i,3444771369018515582,14283613689531893848,524288 --field-trial-handle=2272,i,12551589357055766530,16523023103680075444,262144 --variations-seed-version --mojo-platform-channel-handle=5948 /prefetch:14
      4⤵
      PID:540
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5664,i,14498415812425278266,8420814723705245428,524288 --field-trial-handle=2272,i,12551589357055766530,16523023103680075444,262144 --variations-seed-version --mojo-platform-channel-handle=6288 /prefetch:14
      4⤵
      PID:4292
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6032,i,3639557313955273294,9885984142086769847,524288 --field-trial-handle=2272,i,12551589357055766530,16523023103680075444,262144 --variations-seed-version --mojo-platform-channel-handle=6328 /prefetch:14
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4620
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
        
        cookie_exporter.exe --cookie-json=1140
        5⤵
        
        PID:3836
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5660,i,10349899597257365718,3498649397245499223,524288 --field-trial-handle=2272,i,12551589357055766530,16523023103680075444,262144 --variations-seed-version --mojo-platform-channel-handle=6308 /prefetch:14
      4⤵
      PID:3812
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6160,i,4791737199126345268,11597348292116931645,524288 --field-trial-handle=2272,i,12551589357055766530,16523023103680075444,262144 --variations-seed-version --mojo-platform-channel-handle=6400 /prefetch:14
      4⤵
      PID:3180
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6156,i,2617930169101457531,10584657755821021763,524288 --field-trial-handle=2272,i,12551589357055766530,16523023103680075444,262144 --variations-seed-version --mojo-platform-channel-handle=6224 /prefetch:14
      4⤵
      PID:752
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6996,i,14431164690121408857,8182057130303251749,524288 --field-trial-handle=2272,i,12551589357055766530,16523023103680075444,262144 --variations-seed-version --mojo-platform-channel-handle=6992 /prefetch:14
      4⤵
      PID:2132
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7152,i,5167652328514478265,6408215025682070134,524288 --field-trial-handle=2272,i,12551589357055766530,16523023103680075444,262144 --variations-seed-version --mojo-platform-channel-handle=7156 /prefetch:14
      4⤵
      PID:5424
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7312,i,13738550766334296686,7380376840059832725,524288 --field-trial-handle=2272,i,12551589357055766530,16523023103680075444,262144 --variations-seed-version --mojo-platform-channel-handle=7324 /prefetch:14
      4⤵
      PID:5484
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=7276,i,14558579544217960458,8487158865317251937,2097152 --field-trial-handle=2272,i,12551589357055766530,16523023103680075444,262144 --variations-seed-version --mojo-platform-channel-handle=7252 /prefetch:1
      4⤵
      PID:5184
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=half+life+3+release+date
    3⤵
    - Enumerates system info in registry
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:5948
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e0,0x2e4,0x2e8,0x2dc,0x2fc,0x7ff9c67fc188,0x7ff9c67fc194,0x7ff9c67fc1a0
      4⤵
      PID:5956
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1756,i,14584236320004186663,3872804740379512378,524288 --field-trial-handle=2116,i,4870496758479246091,6606694688988771174,262144 --variations-seed-version --mojo-platform-channel-handle=2144 /prefetch:11
      4⤵
      System Time Discovery
      PID:2824
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1556,i,8034738353887644783,671539255989143869,262144 --field-trial-handle=2116,i,4870496758479246091,6606694688988771174,262144 --variations-seed-version --mojo-platform-channel-handle=2112 /prefetch:2
      4⤵
      PID:4404
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2368,i,2907964234527773008,5283297557817995805,524288 --field-trial-handle=2116,i,4870496758479246091,6606694688988771174,262144 --variations-seed-version --mojo-platform-channel-handle=3084 /prefetch:13
      4⤵
      PID:5236
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3456,i,2528349737190840129,15397419994266773496,2097152 --field-trial-handle=2116,i,4870496758479246091,6606694688988771174,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:1
      4⤵
      PID:5340
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3460,i,3273156842840050205,16151834173342600012,2097152 --field-trial-handle=2116,i,4870496758479246091,6606694688988771174,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:1
      4⤵
      PID:5348
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4828,i,1500646984492399034,3365849276208860656,2097152 --field-trial-handle=2116,i,4870496758479246091,6606694688988771174,262144 --variations-seed-version --mojo-platform-channel-handle=4804 /prefetch:1
      4⤵
      PID:2132
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=3700,i,5308612683383697048,9508508014518647551,2097152 --field-trial-handle=2116,i,4870496758479246091,6606694688988771174,262144 --variations-seed-version --mojo-platform-channel-handle=4980 /prefetch:1
      4⤵
      PID:424
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3532,i,9758450458251234459,16587231204722101282,524288 --field-trial-handle=2116,i,4870496758479246091,6606694688988771174,262144 --variations-seed-version --mojo-platform-channel-handle=3612 /prefetch:14
      4⤵
      PID:2000
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3456,i,5767905342181905936,2794629808453895842,524288 --field-trial-handle=2116,i,4870496758479246091,6606694688988771174,262144 --variations-seed-version --mojo-platform-channel-handle=3588 /prefetch:14
      4⤵
      PID:3976
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5616,i,4381313466564543941,15779175845296411688,524288 --field-trial-handle=2116,i,4870496758479246091,6606694688988771174,262144 --variations-seed-version --mojo-platform-channel-handle=5632 /prefetch:14
      4⤵
      PID:3432
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5616,i,4381313466564543941,15779175845296411688,524288 --field-trial-handle=2116,i,4870496758479246091,6606694688988771174,262144 --variations-seed-version --mojo-platform-channel-handle=5632 /prefetch:14
      4⤵
      PID:2428
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6188,i,2344820581881926783,3828390864476477871,524288 --field-trial-handle=2116,i,4870496758479246091,6606694688988771174,262144 --variations-seed-version --mojo-platform-channel-handle=6192 /prefetch:14
      4⤵
      PID:1900
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6160,i,4624334508988951656,14441374357494538605,524288 --field-trial-handle=2116,i,4870496758479246091,6606694688988771174,262144 --variations-seed-version --mojo-platform-channel-handle=6208 /prefetch:14
      4⤵
      PID:1884
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6176,i,10813283018303196190,17861781512452306169,524288 --field-trial-handle=2116,i,4870496758479246091,6606694688988771174,262144 --variations-seed-version --mojo-platform-channel-handle=6040 /prefetch:14
      4⤵
      PID:4868
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
      4⤵
      Enumerates system info in registry
      Modifies registry class
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of FindShellTrayWindow
      PID:5764
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x2f0,0x7ff9c67fc188,0x7ff9c67fc194,0x7ff9c67fc1a0
        5⤵
        
        PID:5716
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1612,i,9175797577419761343,8920841399380315178,262144 --field-trial-handle=1992,i,6035596881338883880,7613782078641693021,262144 --variations-seed-version --mojo-platform-channel-handle=2104 /prefetch:2
        5⤵
        
        PID:6044
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1816,i,11085104240761814341,14555587482375406549,524288 --field-trial-handle=1992,i,6035596881338883880,7613782078641693021,262144 --variations-seed-version --mojo-platform-channel-handle=2164 /prefetch:11
        5⤵
        System Time Discovery
        
        PID:6040
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2300,i,16817634219273188003,5287555656605182704,524288 --field-trial-handle=1992,i,6035596881338883880,7613782078641693021,262144 --variations-seed-version --mojo-platform-channel-handle=2576 /prefetch:13
        5⤵
        
        PID:3648
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4376,i,7555138204190283518,13230068851129845778,524288 --field-trial-handle=1992,i,6035596881338883880,7613782078641693021,262144 --variations-seed-version --mojo-platform-channel-handle=4392 /prefetch:14
        5⤵
        
        PID:5224
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4376,i,7555138204190283518,13230068851129845778,524288 --field-trial-handle=1992,i,6035596881338883880,7613782078641693021,262144 --variations-seed-version --mojo-platform-channel-handle=4392 /prefetch:14
        5⤵
        
        PID:3168
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4916,i,6527242439672187136,13755051066269341256,2097152 --field-trial-handle=1992,i,6035596881338883880,7613782078641693021,262144 --variations-seed-version --mojo-platform-channel-handle=4972 /prefetch:1
        5⤵
        
        PID:3900
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=4920,i,4974793893192498682,8053802252693240375,2097152 --field-trial-handle=1992,i,6035596881338883880,7613782078641693021,262144 --variations-seed-version --mojo-platform-channel-handle=4976 /prefetch:1
        5⤵
        
        PID:5464
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5448,i,2838651735299649130,5141062105408426924,524288 --field-trial-handle=1992,i,6035596881338883880,7613782078641693021,262144 --variations-seed-version --mojo-platform-channel-handle=5504 /prefetch:14
        5⤵
        
        PID:3136
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5452,i,13798674750989806235,2471858625819912085,524288 --field-trial-handle=1992,i,6035596881338883880,7613782078641693021,262144 --variations-seed-version --mojo-platform-channel-handle=5524 /prefetch:14
        5⤵
        
        PID:3088
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5912,i,5609073529084088926,2011716963402068206,2097152 --field-trial-handle=1992,i,6035596881338883880,7613782078641693021,262144 --variations-seed-version --mojo-platform-channel-handle=5804 /prefetch:1
        5⤵
        
        PID:5196
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
        5⤵
        Enumerates system info in registry
        Modifies registry class
        
        PID:4704
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x250,0x7ff9c67fc188,0x7ff9c67fc194,0x7ff9c67fc1a0
        6⤵
        
        PID:3896
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1768,i,11354857094598906736,2700817448487783903,524288 --field-trial-handle=2160,i,9891717370862939696,5924493238659562016,262144 --variations-seed-version --mojo-platform-channel-handle=2212 /prefetch:11
        6⤵
        System Time Discovery
        
        PID:5092
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1660,i,14651100946753969302,4342962322339879545,262144 --field-trial-handle=2160,i,9891717370862939696,5924493238659562016,262144 --variations-seed-version --mojo-platform-channel-handle=2156 /prefetch:2
        6⤵
        
        PID:3052
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2380,i,2019956810535725172,10969434263231891837,524288 --field-trial-handle=2160,i,9891717370862939696,5924493238659562016,262144 --variations-seed-version --mojo-platform-channel-handle=2700 /prefetch:13
        6⤵
        
        PID:1220
      - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4492,i,11259516890925445423,4262697347597221003,524288 --field-trial-handle=2160,i,9891717370862939696,5924493238659562016,262144 --variations-seed-version --mojo-platform-channel-handle=4508 /prefetch:14
        6⤵
        
        PID:1400
      - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4492,i,11259516890925445423,4262697347597221003,524288 --field-trial-handle=2160,i,9891717370862939696,5924493238659562016,262144 --variations-seed-version --mojo-platform-channel-handle=4508 /prefetch:14
        6⤵
        
        PID:3912
- - C:\Windows\SysWOW64\calc.exe
    "C:\Windows\System32\calc.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5504
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=the+memz+are+real
    3⤵
    PID:3836

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2000

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5208

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3764

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:72

C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.2012.21.0_x64__8wekyb3d8bbwe\Calculator.exe
"C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.2012.21.0_x64__8wekyb3d8bbwe\Calculator.exe" -ServerName:App.AppXsm3pg4n7er43kdh1qp4e79f1j7am68r8.mca
1⤵
- Suspicious use of SetWindowsHookEx
PID:4140

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:3548

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4296

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004CC 0x00000000000004DC
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5964

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5248

C:\Users\Admin\AppData\Local\Temp\MEMZ-virus-main\MEMZ.exe
"C:\Users\Admin\AppData\Local\Temp\MEMZ-virus-main\MEMZ.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:4956
- C:\Users\Admin\AppData\Local\Temp\MEMZ-virus-main\MEMZ.exe
  "C:\Users\Admin\AppData\Local\Temp\MEMZ-virus-main\MEMZ.exe" /watchdog
  2⤵
  PID:5708
- C:\Users\Admin\AppData\Local\Temp\MEMZ-virus-main\MEMZ.exe
  "C:\Users\Admin\AppData\Local\Temp\MEMZ-virus-main\MEMZ.exe" /watchdog
  2⤵
  PID:4412
- C:\Users\Admin\AppData\Local\Temp\MEMZ-virus-main\MEMZ.exe
  "C:\Users\Admin\AppData\Local\Temp\MEMZ-virus-main\MEMZ.exe" /watchdog
  2⤵
  PID:2172
- C:\Users\Admin\AppData\Local\Temp\MEMZ-virus-main\MEMZ.exe
  "C:\Users\Admin\AppData\Local\Temp\MEMZ-virus-main\MEMZ.exe" /watchdog
  2⤵
  PID:5604
- C:\Users\Admin\AppData\Local\Temp\MEMZ-virus-main\MEMZ.exe
  "C:\Users\Admin\AppData\Local\Temp\MEMZ-virus-main\MEMZ.exe" /watchdog
  2⤵
  PID:6044
- C:\Users\Admin\AppData\Local\Temp\MEMZ-virus-main\MEMZ.exe
  "C:\Users\Admin\AppData\Local\Temp\MEMZ-virus-main\MEMZ.exe" /main
  2⤵
  PID:5444
- - C:\Windows\SysWOW64\notepad.exe
    "C:\Windows\System32\notepad.exe" \note.txt
    3⤵
    PID:2864

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

0978bd82-2305-4ee9-bb75-e16fecf0d4e0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\0978bd82-2305-4ee9-bb75-e16fecf0d4e0.tmp
Size 23KB
SHA256 7431ab5ccbbe12ab8ebb2a56f24f51bc6caf0b1027f0290dd69baccd33ab8d91
MD5 39e09220edd57686ba1bee766a8ede06
SHA1 4c847ecba3a305dfd83e1ace96e476cd73fa1323
SHA512 3c80a389d23f33a72aa64b8954b8e00831735fe02877ca0099b6f0b3cc6033a47ffb03318d54a022856e980e45587106bd9a69371389eaafed1f01cd19e7005e
SSDEEP 384:nrQkUSvP8NMtJLSMRzIZ/5tinEYopyvldf9+02IzI/7IzeIIlo:lPV98Z/5lhQF9+05yLG
TLSH
T171B26C3CAC646C7F8AFEBB05624D3A17AE98423BD5B45968D7D81B1DC0B628CF303521
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3b9b7e4c-45f2-426d-bd69-b3ed43bdf7d7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\3b9b7e4c-45f2-426d-bd69-b3ed43bdf7d7.tmp
Size 22KB
SHA256 d9a203d04dd7d6752b318e202cef8801d91c85386ddf9c6b2a232f3005bcc223
MD5 cb167b992373c670b2187a87c2be50eb
SHA1 f0db5a80801761a916160a47aacd372d4480d308
SHA512 994d26a954f936d794e132064aeae9dad646c11a1b7444fd4cf93feda90cb19a36e7e0b9bc7ebc82043f2f4a6d1a3fc2ef73076571491b62d3701b5aeeb9f363
SSDEEP 384:nGQkUSv08NeFJLSUMzIZ/5tinEYoYGvg/SO9+W2INIIlc:m01o8Z/5lgJ/D9+W5NLW
TLSH
T121A25C3C9C646C3F89BEB745614E35275E58823BD6B45AA8D7C82B1CC1FA29CF307921
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

678cc8df-701b-453f-bd00-5d754cb8d026.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\678cc8df-701b-453f-bd00-5d754cb8d026.tmp
Size 8KB
SHA256 0ff0eccb913229e9cb7676e66a562930d50206f059bfeabefda2f15a9f7c2fc3
MD5 51a79d893fd497466461f6664ed6b88f
SHA1 f6691dc4883cd0769f98aa0ab53a2c0f8ad28fce
SHA512 29dc516a39e5739211e1fee011a4502733abee85f140812d126ca944dfea8f8ee6695f77ee3aa87db2a6ca6c9404c79df98437843ac08cb2ef0b1161656a2628
SSDEEP 192:VGNE6QhLFQmiUyv3HzVZ/5P1t0DOE3byU6:VGNE68LjkXzVZ/5tiNLyU6
TLSH
T18002C834B8A87C7B8EF3AD46B58737139FE5116BA9942F44D9E81E1D01D725C1306932
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8b2779e6-5948-4782-a2a6-bb77022db90a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\8b2779e6-5948-4782-a2a6-bb77022db90a.tmp
Size 8KB
SHA256 a019882354d2dc10a69385b29a4d9ba14479ad9911e00c07077b957dc4b8286a
MD5 253795d8d8ec559c2470cc979aaeafcf
SHA1 1448cb617e0097b36b21b3e4278261e2ada3c5c2
SHA512 165b4347e086cf34627e66a8f408e8924a2b0a08ca0454f9c8c198f6f59a29886102ad36745b79639d401a32698cf51c03f57ebd44ab3c863e8482f083926804
SSDEEP 192:dGNn6QhLsQmiUyiHhVZ/5P1t0n8bXPwoOj6/wqSvrU6:dGNn68L8ZhVZ/5tinEYoXQrU6
TLSH
T1FB121930B868AC3B4EE7B499B4C737539E952177DE846F54D8E81B1D00D739C270B522
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c9ffa5510bd8eaf647858e337946c3d8551cbdca3d5f58e2d47ed03bf6e04f43
MD5 e2b553a32003f2a232e334c2a7862a8e
SHA1 cac2df4649aee9c08574409d20cc837c1704412b
SHA512 fbd8879ece0c87ceb91747877c9eac2e13992e2df5094b3111703cdd532dce0e6df3dc8256243b2dd5219343938dad7b5cf8c47bc1e74c37ca7dc731914ba4a7
TLSH
T143D02230E3820C80C8C0303A2F338AB300E0FC20C0AB0F000CE8A00CACCCACB0A38300
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 3112d73e14cee9e8d1c5a8b47c39471fa2e7cc3b5ab3ec14c64e906f8e579bc6
MD5 a46aa3a55ad2f0b841474c6bf5f143c2
SHA1 9a78d824e74c234e6403205f8bc37607ea35a5e3
SHA512 7e338efe54bca05a8e90ca8dd6af1f6ebf86dcadeed4ce6d8bbcd56150c691925a0f7061b238c1736b453d69a0b2a590796a5f8caef12d0d4c5cae1891b923bd
TLSH
T1FFD08C31A55B7EEDC2AE31791A21899255D0FE63C6660A001E4A5D2C9EEC6C71CB0FE8
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 aa16d5a31a8ec193749e9e4c7cbc5275fce7a936b47fdce85623272bbe616a6f
MD5 51ac8892640dce890f8ee190d17949a4
SHA1 0eb21d78a81aa3c82e45059f06a55be04e17e68f
SHA512 df13d4a7dfb5c6191eb891dd9b7ac64cdd81b559e090b82f3df76d5247b52fc231d7fefc25b6a4e75ff3a17fb14fa6a95ced1d1f71eba08c3de4e0de01e333f6
TLSH
T174D08035724B3D4CCF8A31752B1585A25581FE16C5574E101C475D1C59CC6DF0E642E8
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 3c01d94d3734e8fb5f4bb91a8dc992b5eb1fbb82af4e04f4d13fe2c1ed2072c4
MD5 4fd24b3e7c3fd506d6e7509f5afb94c8
SHA1 c5280c59e0c33084d855ccad5cfecc8bae5dabd4
SHA512 e10c5c1757834f183b73565f1130bbed28672d23803c6a6afd64e08be1991744398086f2ce3346f4c36a2d15dfcf4c85972603b803b98a317599479831591c56
TLSH
T130D08035724B7D4CCF8A31752F1485A25581FE56C5574E101C4B5D1C49CC6DF0EA42E8
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 6ddfb263c192f12ad316454ee1c617fe2afde1239c1d68dc9e5bf0d864f9cbf2
MD5 925e9d1b6623e8176bdf3f18aa051198
SHA1 d96ce372c5b1b00e786b8b194f0b192ccf5283e0
SHA512 c3f57164fd3f5ccf0bc39a9f6b7e92d801c6e506910373630207eabe860dd8726adad51c883190b5638515adc6c3ca5c456072eff9fcf7751b6f73effcb3c08c
TLSH
T14ED02230A3C20C80CCC0303A2F328AB300E0FC20C0AB0F000CE8A00C8CCCACB0A38300
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 782360625acbb949ca309272c1372035fcaab39324a71a32e508c0abb6848293
MD5 bfd64c9ed707a72b9d8bd31356932cdf
SHA1 f0b83438b711db3906c9b18434c5edfd0d1f271c
SHA512 92291c4e93c9a10521261f35b097efe132be241d7e89352f15f817f2623b260a1304eedb9dfbed597d63a21346792cda24c700c2fa0bef3d723c5a3eb32172c7
TLSH
T1E2D08035725B3D4CCF8A31752B1585A25581FE16C5574E101D476D2C49CC6DF0E642E8
MD5 SHA1 SHA512 TLSH

Submit Download

069075eb-ced6-41c6-bea4-cd8d80bbba0e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\069075eb-ced6-41c6-bea4-cd8d80bbba0e.tmp
Size 14KB
SHA256 2ad177aabf7a1b60bf288f1fb402a1ed9e504ca8849664129726b9eff25ffbda
MD5 3f578e56fff9cde5af72d20840a4bae2
SHA1 92958afb283d8d1f18baaed50123b3f34e41eaf6
SHA512 258cd4bc1ab394374024b6be57acf2fc6920ee8c810b1b9dbabaeebe2fa4f33ad8624405a3788f85f40ff14e3fc483e7750ebd6489a5b2838cbb92ebcefccdb6
SSDEEP 192:sxZ8RhcO5/f3sJWpVLl2Nd9jiKzodpu/70o/bB6+WNaBFGO+5+/Y0Rt/f2IgbYdJ:sxZ8UO5/f3sJWvBy7uxy/Gwh/5ysn
TLSH
T14F62E856A924987B8CDBD31AFA15BB13D7FE112290C15E44EAFC8A1C01E7BDD620781B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1044f8d1-760c-4117-8e7b-102b61355033.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\1044f8d1-760c-4117-8e7b-102b61355033.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1c377045-b989-4036-bbaf-ef5f307f3ece.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\1c377045-b989-4036-bbaf-ef5f307f3ece.tmp
Size 13KB
SHA256 625aa9f00b53828c41a027f851ca4de8ffd869d848955ffeac9902ce78e690da
MD5 eb2e79fad3f03e8936e7165d2ac1a52d
SHA1 31eecb33f74bf0db5bb2095ad768a2c0e59fca1b
SHA512 ca8bd1d6093e9f0dd8eda2f132463c754285edb039ea950f9882b92ae160b79a9c321ded1b0f49e107c7ca6e50af93a2ac28e47641eede4190cfafef6e53bbef
SSDEEP 192:sxZ8R/cO5/f3sUWpVLl2Nd9jTKzodpu/70t/bB6+WNaniGO/Y0RsVG2IgbYdJ:sxZ8WO5/f3sUWvBy7Pxj/GB/5Ysn
TLSH
T19452E846A924987B8CDBD319FB15BB13D7FE112291C15E44EAFC9A1C01E7ADD220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5e1aa235-a1de-40fe-a62f-351f7953bffd.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\5e1aa235-a1de-40fe-a62f-351f7953bffd.tmp
Size 414B
SHA256 f6ff0cb5c3169ae2b70682bd284ff7d7b052e4ce4645d7cf8e68321e65b7596d
MD5 0dfbc1c8991617adca1aeeca811eaa34
SHA1 8441196e225545ac29566953f1fe346a0d634260
SHA512 80e10ed72a1656402ee77dfdce98cf24aaae0abef094be5b9d178557cfcfafe3822aca340539c7b22a279dd8ca85a9ae6073a729f5f8416e03be221a6bfc539a
TLSH
T1B5E02BD9C931E82718FD4769E0554746D75123573B40994B7B3CD11D8FF063A0186C5C
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 2KB
SHA256 6e7d15f07859373fe6ada9a1a1772a0ce3131ee69cabe3d0219acf9fe5c4650b
MD5 8e9db0d8f8227cf77171b0443d5d242a
SHA1 1675d3e38d7c7936312b9b45f142a426258480ce
SHA512 24ec3fcc57e26d494be3ee6409ba63ac3ad834f314c93540aff1e5eed3fe215ac70e55c93b0ac6757736b25c574c72da4adb48c044baf76eebab9070eda6cc23
TLSH
T12B5186EBC46013D8CBAA5478A2C6B3C736B0A64079CF4DA60D84DCBD8C7A78B21454F3
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 7d47887c0151ea2d6d8e871a8bac84f98a8a8e771877a615c0bd1bbcc5a7d18d
MD5 1c3071e2b156f4a4ffc2e29693b75b53
SHA1 e13a51b2ee2db4024d74d2ef01aea6b23748b98e
SHA512 c80dd0d379ac851013691ec17002f7b8156c8d9ab2fc1176abb678e5a7ba6af0472425a76a47bc34a2cf178eb04cf657a8b42bfe6c89835def5073b9795b9187
TLSH
T1165186EBC46057D8CBAA5478A2C6B3C736B0A64079CF4DA60D84DCBD8C7A78B21454F3
MD5 SHA1 SHA512 TLSH

Submit Download

6a7202e1-c91f-49a0-8de0-b568d3725e56.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\6a7202e1-c91f-49a0-8de0-b568d3725e56.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log
Size 798B
SHA256 a2f4765271e0a5f8bec5e07531a57e188e857beba530a95151277a5ef7ae0e51
MD5 c6bda62773da4630dda4c9a8d59c7eaf
SHA1 3a052395933147b638f3fc0065bb3091dbe04870
SHA512 a7c65d02572b4c418043e605978386e87ed62546b4ee5189ad32e2687932945e5b28c4c3346cc4f0190c60a5e2064ee36a0d2727f15fbf81611556abc2465567
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG
Size 319B
SHA256 9c8abc5f3b1e836297aae0d8da8b779df4fc71d6247927229b01058cea79f1b4
MD5 eac93ea8982295e5d4a324dd48b9142e
SHA1 0ceff5a0baec96091fd6ee9a36d7458684bbb80d
SHA512 fa365ac5964a3e9e0e8a49ca0dc1dbabecb4a9e4008143d04daefaaf307ae1e5bd64cd29fb14675a9ab452a110764b865108c9c6c2c9bef9bb63dfb509cb1e4a
TLSH
T1BAE0268444CBC339D8286C9702B86B088BD0B81BEAC039873B08E9846142249F38B2E1
MD5 SHA1 SHA512 TLSH

Submit Download

dasherSettingSchema.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.111.1_0\dasherSettingSchema.json
Size 854B
SHA256 6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6
MD5 4ec1df2da46182103d2ffc3b92d20ca5
SHA1 fb9d1ba3710cf31a87165317c6edc110e98994ce
SHA512 939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d
TLSH
T1B1014C25C354799B04C7627ABCA95001E630818B027665707DDE4D7C6F2E8A700BF37E
MD5 SHA1 SHA512 TLSH

Submit Download

computed_hashes.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\_metadata\computed_hashes.json
Size 429B
SHA256 b829b0df7e3f2391bfba70090eb4ce2ba6a978ccd665eebf1073849bdd4b8fb9
MD5 5d1d9020ccefd76ca661902e0c229087
SHA1 dcf2aa4a1c626ec7ffd9abd284d29b269d78fcb6
SHA512 5f6e72720e64a7ac19f191f0179992745d5136d41dcdc13c5c3c2e35a71eb227570bd47c7b376658ef670b75929abeebd8ef470d1e24b595a11d320ec1479e3c
TLSH
T10AE055170A1A50B79BB8DB90EE525CA2E8A0A6B1C50438D63E608234B68A11F738347D
MD5 SHA1 SHA512 TLSH

Submit Download

verified_contents.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\_metadata\verified_contents.json
Size 1KB
SHA256 d23b2ba94ba22bbb681e6362ae5870acd8a3280fa9e7241b86a9e12982968947
MD5 738e757b92939b24cdbbd0efc2601315
SHA1 77058cbafa625aafbea867052136c11ad3332143
SHA512 dca3e12dd5a9f1802db6d11b009fce2b787e79b9f730094367c9f26d1d87af1ea072ff5b10888648fb1231dd83475cf45594bb0c9915b655ee363a3127a5ffc2
TLSH
T12B317466C8683D56267A63348E2D0602EB57C2BB0050640EB5AC558D4F7115FE242FAF
MD5 SHA1 SHA512 TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

History

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History
Size 204KB
SHA256 bc67fe338fd715054e5ddb61bed2aaf765a57f93f3230e873a82dece8475fbc0
MD5 6f7da690d349c5717a8ca9e8fb75c9e7
SHA1 48849ba3e8693906a441481c51825b3bc7b9137d
SHA512 d4224a3c2982a81dd6e02e33b3bcad59227e2fafc91951eec7f2b7cf3f2937fff4f604576f18d5ec0e5cdc91fc3630d974f42b2f74bbc1f79a774e2487621ca5
SSDEEP 96:x8NHU+bGz83uxDLjGQLBK31NfR4J+MCXkFr+MFcjtk4Q9/2jPEbjBHMsDETbiIqA:x8N0+G83uxXBBK31GkSJKEJH7DNspUk
TLSH
T1AD14E00E5F343722CDBD813669E644A35D6CF03FCB5366DA686114B4CEE3652A02C8BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG
Size 334B
SHA256 df05af623fca7b9bc049aa13c2b4a7aa7dd4527b773846d1bc9483d7640c3ce8
MD5 0c169d0ea4d6cfc14b9a0c51e82a3308
SHA1 99a8b27eece2debb481158f9f964b9b0d101ad28
SHA512 5d945f911702ed16327ed3ac2f4dc03bc1852bade7578ef9eb5c50421a5903723184f80028e8fed3fc20454e807f142a263797a02f931069961bd9ac9e2a70f2
TLSH
T195E0D8A184CFC6399258204F422C7708CFF12427D6C52A057F04EA95F006004A3B51E5
MD5 SHA1 SHA512 TLSH

Submit Download

04355de3-8e16-41ef-8943-179d4d6dfb21.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\04355de3-8e16-41ef-8943-179d4d6dfb21.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

7b8f94ac-4c06-419a-a144-4ff9e2d305aa.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\7b8f94ac-4c06-419a-a144-4ff9e2d305aa.tmp
Size 356B
SHA256 13d127c28bebb66cbfd726a669274f67db4c6065b760912b2fc23d1b91b04692
MD5 995245dda34260e2a20b1f964ad05049
SHA1 7ed9e3f15e2301d17c640d80c81540d046f49ff4
SHA512 b277c21795deecedb7a08c3376da67ee8e58f124eeee20b0299563a7f30d1303397b11a25f6946bbf14ac6251070336a79ccbe0f5db167864bc29c9d8287688b
TLSH
T19FE0DF9688FDB4AA1038097E2A85B880FA76F8360221A0F4C996937EB0810FA5A11036
MD5 SHA1 SHA512 TLSH

Submit Download

7e54d432-fce3-40b6-babb-e4374a52dd40.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\7e54d432-fce3-40b6-babb-e4374a52dd40.tmp
Size 3KB
SHA256 c1d42f132f3057f3802c9fd9a0496e68d9b47a49dfc04e4694e677f3aab322f4
MD5 480ed1893f6504a43c461aa605d117d9
SHA1 9d33150528f9ae115618bca1ff04637ec6398bea
SHA512 52df3e1eb83c7251ceeb1c88258c1163f388ac18d9f5035bf97fc6b60f92d4cde7a1232d4398b6d1b7e2f9d089a1ac02f0a36c367848337b1f9da0408d1aaf8f
TLSH
T1AB518BF7C6D8866ECC5156F4AB246F2FCE1D0918422C3D5A84E4AF1B93E2871D24155F
MD5 SHA1 SHA512 TLSH

Submit Download

9211f37a-1e02-4e17-97a1-f2d9d059575b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\9211f37a-1e02-4e17-97a1-f2d9d059575b.tmp
Size 1KB
SHA256 6a0782000d794b6f1c1c7e87fa02800cd658d5fed7e68d49a5316e6d86e29da1
MD5 4bf0c8df4fb2dbf277f9e359f19f901e
SHA1 a4c4d2eac802e8a21bc1d3bda4a60d1951efd87f
SHA512 f8e692ce61559764f9b87d1db56583facbe0480569a0c701170e5c2f7949552a404c6887ffbfa4d547648093c528882269cecee2cb3d1ed65835b9b005f42ef5
TLSH
T13831BEF3C3E8856E890156F0AA18AE1FCE2E0915432C3D5AC9E4AF1BA3F34B1D14195F
MD5 SHA1 SHA512 TLSH

Submit Download

b9c9499d-afed-47e0-a55b-4520c5260bd7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\b9c9499d-afed-47e0-a55b-4520c5260bd7.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

bad64da5-c128-436a-99cd-ae0a06bf716e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\bad64da5-c128-436a-99cd-ae0a06bf716e.tmp
Size 3KB
SHA256 b0d574a9c79334f4a3d86295a28624d0749cfc97d309936027bffc65110d429c
MD5 6ce744c6499980c291c14d89d560bcc8
SHA1 7c7c0f41e1b6ce8b7be9288db60983df3fade007
SHA512 cd2cff929f868130ab5e9cbc4483c4bfaf61f88c3a3271767a508358ba121c0a3b71f8d288aaeb64ad33c476306055234d27332f5e394bc2b9fcf75c9fb2e490
TLSH
T167519CF7C6D8866EC85156F4AB246F2FCE1E0918432C3D5A88D8AF1B93E28B1D10155E
MD5 SHA1 SHA512 TLSH

Submit Download

e8c13f89-1051-4c43-805c-bb5256f9a873.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\e8c13f89-1051-4c43-805c-bb5256f9a873.tmp
Size 356B
SHA256 cdca7cf85e9f41f69f58acbd2e3375efa1b2e929735a914e934490cede6f8aaf
MD5 4ed8c4107f4d37ab14c208f144352341
SHA1 dc1235419ae7f72086c9a28d6814d3f06773cc74
SHA512 aa65c1d5e4b98f6060fa9f32e9fa9a8ba50f7735e4e19ae10278f9b893946881c5ba88b94a92ddc7ef3edb0fd456d0dcb5ae9d37b33651019ba2b504b2dc9505
TLSH
T137E0205688F9F0B71038057E59857440B97AF836512150F1C956C37DB0C00F74B16037
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG
Size 335B
SHA256 2d0ef22e7e858715612b559ff4505fc5146df43406d98516e19940b8104a5865
MD5 68bdfcf3bea622269ed04f89c19b4a40
SHA1 145d5d5c47910a90446f17e7e7f277fddda26439
SHA512 0371b3763b2aeea61f90de0f44cec06d35c39067d3aa3db34c82686a632fa2e1e954e3d05b6f146f6c248b50798e174f90e6ecc6f878088c6ff10b114f42603b
TLSH
T14BE026904DCBDA7DA02A204702F4A708CFE4B467D2C43E063F02EBC46547984F3B61E0
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\000003.log
Size 716B
SHA256 792ab366fdb84655c33a832e27ddfef0e9246dadb605a4aa3f1d81fb8f84b82a
MD5 9a0791a15c6ca9762fb1dd944b043d29
SHA1 a13520ce9b20dd7b566e4ae05d958b43b5372a62
SHA512 574aef2ec45722b71073586733ebf4ad76c60b6a7dd42270661e1c55ce6fe1bf226375eaced1ca366eb71aaa788fc69464859dbae3431a270f921fc5bcf482d5
TLSH
T160012DF31A1C581ECD9E42B11CA4B7F4936E84DD06898FD68BCD51C31441231240EC5B
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG
Size 322B
SHA256 dd9c8e2468191d938559fc8fcd6f8845fbe75ab7f6a5ae8fda4108e938e44879
MD5 5e76ff2c0867a01c60ddb06660ff86f6
SHA1 05def4328a7e19ac0b3cc5a041fe1dd1091d31ca
SHA512 9dcfa1b43e03fcbfd9f951ca9c04a87a7a5fc69471e0e02170e2f187287189716e18651c8c5b54650bc17b46b7c6beb411805ff3907bf43a39e149d2bce75049
TLSH
T131E026A48ACBCA399168645F0238A70C8BE27423E3C82D066F00DAA8720A101F3861F5
MD5 SHA1 SHA512 TLSH

Submit Download

Tabs_13437872078513095

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sessions\Tabs_13437872078513095
Size 1KB
SHA256 d7c2218cfb5e8cad0b0bf05dfb61e5b16c95592e3e5e5a0a3459ba74b064a83d
MD5 bcfc9e77ee98a614c0d72ec9ed8053e7
SHA1 14f094f842629314bd91ed6511ac21b709b0fe62
SHA512 7b199e62b4e1a8927b74b9213989ee6a31a7c808caa7d7de13c852b45cff5df17253b2fbafdf1f721cf610fa79d04795906d9e9a950fb67f61206617464c4aff
TLSH
T150212885FAEB4135F2BF847E483301F59F79F8527240CF4F81A6A0144962B410EA8F5D
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\000003.log
Size 112B
SHA256 e51d0ca30a747b021aa3f7e6bfbf0e2a9e70e25b68c9a5b16df672ad603bca43
MD5 99f604c9f93969f88579c879ed99e3fb
SHA1 da3d588078e4ac5afc0e5f4a65f0634149841403
SHA512 4d82b340b85c1f3b66c3b8b6cb7aa71798f2af4c6ed95184f344c30b643df1075d93bfed796717553ec4fb136723264711d67beb25060c1b640e2c95ddbecc98
TLSH
T13CB012447721471ED8DC8832CA8C47D1E720F44340C0041B4A189F208D045EC2FC2CCC
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG
Size 350B
SHA256 a55e313f13bab0458f068a19ab8c062e352bda74286d72721fafbce7453f31ee
MD5 f0cc623ee7735376c69d9e5b0a329f5a
SHA1 1ab43da1c4a337f668890f1ccca093bd17852767
SHA512 13e05b6faa0401f51672b93b7e58e5980447f2a30d17af56e829cf35c232e8367ae87c7aa34b25107f7464aa210a17449ea0cb685277d79c907c11d4c9b087f7
TLSH
T165E09260D5CFC73AA15A60860228E7088BE2A416D6C42A193F18EA84620A14072765E1
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\000003.log
Size 175B
SHA256 80d1388b9a7150eb0291175fe693dd7b6bce910c3e4fff51e94841d31d771dbe
MD5 cb63c64828a27af7253afb7c7d986654
SHA1 8a54aeb86f79cc69e6f11278d874cebd328ae466
SHA512 e0dbdd6931c9272e0b52bb2ef7895121f6324379f584899343342a057737a9837cc476842ea781a1de5c17a20c06e0a7d24c0ed6ea41fdd95bb99296e8810f9a
TLSH
T135C09BD55F903023FDCA5D3D0DAB53041720C4752F74CF57D28430901C0A285FF61145
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG
Size 323B
SHA256 8cb659c265397f10f4d23ace47a30ed958441dda307c2a04696c9f8b6980db92
MD5 98711285ecdbc16a08bae78a0953b68a
SHA1 0ea0c6386d9478cb3cff927c37e9e527d076a1a6
SHA512 e1ad17f28df7049d4767f9fbbc2bec7fddcf43836ca64033a586de17b7651d40c229636ddc31ad8e04f72cd43d2783f8bbc3d35bcdbf1acee5a69c7bd4da5003
TLSH
T1BAE086B0C5DBCB79A128608302B8AB0CCBF0A857D7C53E4E6B08A995A146144F3BA5E1
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 9ddb1e56b55fd08a81ae5b9f983b8ddba0b3afb1c4e786a7222cd6876379528c
MD5 7d97612914a54deb95ba77a7a2968e23
SHA1 984d445e435d90c47da715c2892b7fe0607d9a96
SHA512 965df232adfa8cae49eae87102af4cac0850000e42e4814ebc136a7259e0a3749837d6e6f5749db8eb8af7ce514a655fe4f4d9f554ec673ad7eb8088e2ed71b0
SSDEEP 96:KU4QKFq7j+KgMSuTKKIwqD8fwcGue2ku59ec2KWTea2q08xKb:CPt95D8fwcGuelu5ccsTeap08xKb
TLSH
T154A16240326B469078BE2A0845B8952E579675B33008F52F7FBD93E64E6BE000FFD8D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data
Size 224KB
SHA256 df6444431eee58213f3d8ef6ced07ba3cff402dbc959646d1bd1c1fae17c67e0
MD5 20024db3e01df8e254a3fd0ebfe65a7c
SHA1 763e69573a9906ff372a9aab76efb9d175ca8263
SHA512 de9365f10ce4e2047fdd0f464a4b7cec37fbc904097cf32dd1ee0cfb85bb5b647a051bbc10636c6e1564d77b79979493ebb27f2b0ac76f9ab6662b6755dc00b9
SSDEEP 192:FvoWBGpfT8wRJQnGL11HLfzNSivuvTNN+u/egddCeyv/hVRdbsCEV:atfQ0JQn6lLfzAivuvBN+wtP2s
TLSH
T12C24640A7B747001DDE7E9725CB080771A3CB16ECF22A6915DA254698DF3853A23D8EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Web Data-journal

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data-journal
Size 6KB
SHA256 d794e89cfad9c58fc5480ba3b84e1b06cb6fc9c793bcc5dd077ce0ca97ff8c3d
MD5 58652b5767128bdc531b1019913a8161
SHA1 697b4d2abeed1695e1b4bb559c181ae7b967eedc
SHA512 e7a24608503f07bc1d93fa51142f9017d46219fddfa1a4798096407fcc27b223dd6d1e94a7591f5c916f3564035b0b989f5918322c32fb0080a013fcce221ccb
SSDEEP 12:7+tZUHiN8aPhe7eNI/nVxbL15h1xw1dz5cYjyBt/R4KhutJfN0n:7+tZUHgLheayVxVRxw1dz2UyLVm0
TLSH
T150D1594B879519F3E927573EA9F5833BB7B7B70FAA02401D52FB866D038098C062C068
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b11d3a6c-80d5-4ebd-b37a-c4fb47f1a3f6.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\b11d3a6c-80d5-4ebd-b37a-c4fb47f1a3f6.tmp
Size 13KB
SHA256 015f78d49b4eeb6546a13ef0278134fde08b3f45961ae8fb5e9de36dbc42f37d
MD5 802a5f1ef33e9f8ae80ed8b3e7dd3035
SHA1 87027ff3f1d1303cd3aca66b4fec2337fbbc9310
SHA512 4cbf49352a49f7bf7c8a8dfdfc54d9e8ef3323d1bfc44b3ce4a8ce46e4a9756fcd61f17e10d88927041a68ddbf3effb3f610d8e1ee81a6c7b9958912b39b4c31
SSDEEP 192:sxZ8R/cO5/f3sCWpVLl2Nd9jTKzodpu/70t/bB6+WNaniGO/Y0RsVtIIgbYdJ:sxZ8WO5/f3sCWvBy7Pxj/GB/5Fsn
TLSH
T15452E856A924A87B8CDBD319FB15BB13D7FE112291C15E44EAFC8A1C01E7ADD220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bb9bd4f0-9dc3-407f-bc2e-e2f43abd43f7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\bb9bd4f0-9dc3-407f-bc2e-e2f43abd43f7.tmp
Size 12KB
SHA256 4389081d340a15139a97aa58659c5c1550f04b045fc3e736a813e4db38f3dced
MD5 f588c65f8f271233b3efb03dac9506ac
SHA1 bd2cb29dd28dcdbea14f99686916151b73a511c6
SHA512 763afa16705771582b187b29da1704fb03336505251dbc8f774cdc84a6bbdc04915b500fec6db3e30843cf7d2d08b4a554488815bcf8810dba09d905da8893fc
SSDEEP 192:sxZ8RjcO5/f3sCWpVd+Nd9j+Kzodpu/70t/bB6+WNaeGO/Y0RE6I2IgbdJ:sxZ8aO5/f3sCWvdq7ixj/GR/51j
TLSH
T1ED52E802A924A87B4CCBD31ABA15BB13D7FE113691D15E44EAFC9A1C01E7ADD220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e0306c06-2119-493a-b337-7f00ea54add6.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\e0306c06-2119-493a-b337-7f00ea54add6.tmp
Size 33KB
SHA256 aa7ca0b7e52545f6f8431bd0bb7d5d278ebc9594b3903376752eca61e8e57450
MD5 6a9bf9faadd3de098dd85177ff7bf91e
SHA1 f3ad7df7b98b1fcf5c5741079e459c209fb926bf
SHA512 86ad904ffab472d43493b34848d07454c6673116081810b92f9daa78be0e639948594a5f5b405e6d7105340c4ed978b1fbdd90ec8f68fb1053647ef84896371e
SSDEEP 768:webN98wh2DI7pLuLj8YWRmYQQOs8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3H0AHLls:webN98wh2D0Ej8YWRmYQQOsu1jaKH0Ai
TLSH
T1C8F2EA3B680CCA7E4FC04ADDDD267F9B6EA8029B9698C94447FD845C02C77EE51260DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e3696658-f9b4-4b56-b83a-2ea5bf57ceed.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\e3696658-f9b4-4b56-b83a-2ea5bf57ceed.tmp
Size 11KB
SHA256 3a862f4417b50c73bb3550b2b43fdc4453c980f09c586bb4f6b903fe8993c873
MD5 6094b1ff798113368f6350f4c65d6bff
SHA1 950ef99c3b8a7e6ae41d7529af582ad677171183
SHA512 458f8cff63fb973b3d64edba79e00a4fe49520e46c574dcc7d23d6897584fc0b7e54c7762e646557e72d803c3e8da9eecf7e99cf2aaafb66f168f28c04dd4379
SSDEEP 192:sxZ8RjCO5/f3s7WpVY+SKIdpnC/bB6+WNGY0RbJaIIgyJ:sxZ8EO5/f3s7WvYBDC/GG5ZO
TLSH
T13632D815AE28A83B8CCBE319BB65BF13D6F9143691D15E44EAFC861C01E76DD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ed7cd021-fc31-4350-8766-8c8b0a3dd2f7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\ed7cd021-fc31-4350-8766-8c8b0a3dd2f7.tmp
Size 12KB
SHA256 08423c2f676f870759f16b18826b5d182fac04730faa9b9b45d2549a7ff96b80
MD5 0f21d5b702aa2d0bcf5b07ce25844b0d
SHA1 8eeb4b0a43bde8e816f7485b3869e9db3687046f
SHA512 a4e9f02e2c0006a358db8d3a9f8976a7cab5e00454b97feecbc726aa6574e8339f4c468a52a882bc709130ec132964b0600a139f8512927509bae014dafe01b2
SSDEEP 192:sxZ8RjcO5/f3sCWpVd+Nd9j+Kzodpu/70t/bB6+WNaeGO/Y0RE6I2IgyJ:sxZ8aO5/f3sCWvdq7ixj/GR/51O
TLSH
T11242E802AD24A87B8CCBD31ABA15BB13D7FD153691D15E44EAFC9A1C01E7ADD220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f9caf82a-564c-4a76-837d-8bcf7ac24272.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\f9caf82a-564c-4a76-837d-8bcf7ac24272.tmp
Size 14KB
SHA256 6a4c352cfda23407634ff07e75d8f9391be9b5eafd3414466e340ba8b94714e2
MD5 3feffae288f20bf5f49506d3703d2ce5
SHA1 61f6f4bd9396803ea22059c3ee7a53d207c5bf6b
SHA512 17a84ecd55d5a8e196d4eae6a6313aa8004efea3aff2848eeb62925adaa082dc884424f975475c73b23ac58adb617b4a9a6eeab7f18a64c8af34e4dbdb47e501
SSDEEP 192:sxZ8RhcO5/f3sUWpVLl2Nd9jiKzodpu/70o/bB6+WNaBFGO+5+/Y0Rt/0IIgbYdJ:sxZ8UO5/f3sUWvBy7uxy/Gwh/5Tsn
TLSH
T12652E846A924997B4CDBD71AFB15BB13D7FE112290C15E44EAFC8A1C01E7BDE220781B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

load_statistics.db

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db
Size 92KB
SHA256 3be82bf544b2bdde363d0dd8abcd4e6bf2ab090cb787dbc7edc4fd32959f3cf1
MD5 7ec7dd939144eb63236975476f6bad46
SHA1 ad37c4c69c24312f4479dd7df212ab9f8fa46909
SHA512 3d9cdc3b73f5a8522387e08f128c33a86b25986402c1495db34115533a97b9a9f4d90ceeaa46f36cc818b214c8c3eb5bad926f86c5e527e4104cc32685078458
SSDEEP 768:jLJQ5CDc8k1nKqZM9Znofrpxch8QsMRdRfrY9ZdJl6TdHVUjwiihtVHYfRGcwNBH:aE19mcPhjl9
TLSH
T11893DAF7BC09A2A6DDCD95789407FF44557342628628D8D4FE3D08D33B79A023CB9A85
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log
Size 12KB
SHA256 5865606c5eda9c17d55c09a37ce53b86f6d55854d58b869fc2d81a8282bf31cf
MD5 b8137eba13b0799f5ed3e60391df5e03
SHA1 167f7f754257126ed8d0924e0ffda1fc7442c651
SHA512 b885c0060c9bb1c139eca267fee3e9567d1a7fff6e3e931d018f3aa8630f0e7b0cd769ab5b616995af4a42c26c8435eb5882e4f105ed590929f2bd62f32fc3b4
SSDEEP 192:wOvQKIIIlb5MIMP2YcY5hbOzgAsKlrhTssQn:BQKIIIlb5MIMOBtzpsgys
TLSH
T10F4262AA16053B77E15E6F76325785845AD988820070252D72A51C2F8FF3E9F8BC12F6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG
Size 319B
SHA256 d83516ba75f4203a52345e03cadad09db28829d9eecb92ffd47b3718764a3418
MD5 416eb3a57b9134752137da698f2556fa
SHA1 994d7b0e8b9b80f1b92eeadc6e80d04e361df017
SHA512 d944d36af0e36492fca6fcc44369dbda3bf1c3ec905a13a564368658414c75a109c9c53f4826bf36f3b8b8020a076f7f8c00c9b4e520cb717fb543ebfa9cff14
TLSH
T1F0E02690EDCBE23EF029208B1134670C8BC02813EAC82E0B3F01C5C9A20A580F79A1E1
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log
Size 1KB
SHA256 2e8ac6aec88925884ef6081a11e101824d5a6e2308b8e5bf94814ab7cbc5f2fe
MD5 7f41518ef752ff16812c972b79415b71
SHA1 58ae5ac00f95c5f499044f239e108f383c1e36be
SHA512 c7cd4ed5d5f5fa45ffdd7860f1099fd1c94a7b2eba1032af86f36f2cb5fa2251d2dd8be16101bbdc140bbcfffc861836f3b65972b49f68ff6901a08b3676aaaa
TLSH
T1EF214556F330C148D249467A502DAB251334E8129FB8EC0F05BA20653FB6A540E476E5
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG
Size 337B
SHA256 47a48f03f6d712ca10853ae800b51979917f832117aa01c7c0ac65ad7bc59b3f
MD5 f553128f4d615ad457124b969c8d6c38
SHA1 41da0b94af232c6b1dfc804526f4a2762f6f7f25
SHA512 03e6dfcbda55fa6dd06a3f9b595f3885b8045860d9ba5199ef8a79682a99ec1ad3e7366c15db5091858d59c40896eadc8002ce54116c61e90173e0076a73899b
TLSH
T1AFE0D850A8C6D23FE03560870174A74D87D13853EAC42F053F01CAC8520A581F34E1E1
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

Last Browser

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Browser
Size 120B
SHA256 9c70f766d3b84fc2bb298efa37cc9191f28bec336329cc11468cfadbc3b137f4
MD5 a397e5983d4a1619e36143b4d804b870
SHA1 aa135a8cc2469cfd1ef2d7955f027d95be5dfbd4
SHA512 4159ea654152d2810c95648694dd71957c84ea825fcca87b36f7e3282a72b30ef741805c610c5fa847ca186e34bde9c289aaa7b6931c5b257f1d11255cd2a816
TLSH
T1E0B012203BF9062CF3F74D00AA73AA3428BFF4080A14811D505102080C33E19C478FA3
MD5 SHA1 SHA512 TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Size 14B
SHA256 ee1367d356a136a11664001cd90e05ba08dbaa85f496584158f5e42be8e836fd
MD5 8297da058a737611abcc3a0ede9ffc24
SHA1 e532552672ecffbe3509fb4c334833a67f16d05b
SHA512 fefc70ebe486693310a00beb5ae125abb1569c4455538124d897566f2e44f2b3854ad4451196607137301a811ac7f96f1d488a36eb6d6cd566f2f7cdc7c7568f
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 22KB
SHA256 b26872f9f0dd4c3a661468599f844aa66477ca4c93b4c0f0d97ef6a978dc47e6
MD5 1f1750e215fcf93c3f83fc9613aa92e7
SHA1 3d539c65b990b5f9bff21739b38c10ed1356fbd1
SHA512 d44dc8b3eba60cab56af54024e94c2824fa25a5920b55aa629aab03ebeb6219a7b29f4fe5a6dacb655f82ff1dcb4164228f71f3f473b1b5754ff55131d768056
SSDEEP 384:nGQkUSv08NeFJLSU/zIZ/5tinEYoYGvg/SO9+W2INIIlc:m01L8Z/5lgJ/D9+W5NLW
TLSH
T153A25C3C9C646C3F89BEB745614E35275E58823BD6B45AA8D7C82B1CC1FA29CF307921
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations
Size 86B
SHA256 f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed
MD5 961e3604f228b0d10541ebf921500c86
SHA1 6e00570d9f78d9cfebe67d4da5efe546543949a7
SHA512 535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472
TLSH
T196A02407C473C00FF4144051C45C034114FCC447011DD0015074D31314D40CF03F5435
MD5 SHA1 SHA512 TLSH

Submit Download

a44c97f8-1c1d-43ab-90c7-03269b54976b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\a44c97f8-1c1d-43ab-90c7-03269b54976b.tmp
Size 19KB
SHA256 1294ec378b173a293ade392be9e5af70483ac7999ef86ae30a5b8608f3968794
MD5 d0812a78f7a01f6323d2f77234d17cbf
SHA1 7e33f303be27ddca5ebbd750fed21b329327ec82
SHA512 914eed5544b42089d8fde77c9bd5e9ad571fa4c183b07c5f40105126606eedb3c8ef07cd0ae95908e7fb2b83ec347cbdb668633cb28fa19f4c7ca97a527fc7ee
SSDEEP 384:noQkUSv138NoaJLSguzIZ/5tinEYoAx2IzI/7IzeIIlo:g13s+8Z/5l4x5yLG
TLSH
T1AC927D3868687C778EB7DA46B25E3B03AFE4522BD6D42E54D9D86F2D00C739D2307522
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7616b96e-d34e-4aaa-a4c1-d8ab42b19d7d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\7616b96e-d34e-4aaa-a4c1-d8ab42b19d7d.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

f8730803-feca-4428-8ff5-b738dd3ba67d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\f8730803-feca-4428-8ff5-b738dd3ba67d.tmp
Size 24KB
SHA256 d96535dd46d1cf0912b0c5f2353dd53975c0a7f933cdb1d7d9f5806d4655d66f
MD5 ac117f58ac600f1de70095ae025d94a7
SHA1 612f7f3ead25df4bc2b4030cc14e9ee1ddd1cd73
SHA512 8d1cd7a8c7684647d7b6508f6e562737c9406c8ddfebd0e429c37c4edd5297c5a301094f2477d4b6f92e723afb0896e6daf487127c394d53ff15519d83993ff5
SSDEEP 384:nsQkUSvH38NJtJLSgJzIZ/5tinEYou0JUvh30zxTuvGg2IzI/7IzeIIlo:sH3058Z/5lmAWEzxTuvZ5yLG
TLSH
T14AB27D3CAC54AC3F4CAEB745624D2B27ADA85237C5B85E68D7D86B0DC0B218CFB07525
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2b6e7b2c-f985-46c8-bcd0-bc55cdf40d27.tmp

Path C:\Users\Admin\AppData\Local\Temp\2b6e7b2c-f985-46c8-bcd0-bc55cdf40d27.tmp
Size 158KB
SHA256 3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272
MD5 9c18c4721b560ec55f0d5de055144d5c
SHA1 6af37a3bda916cac276ad5879c9f61262d9ae523
SHA512 51466928eb8d3cf7b917919c98bd8168453583d2c3dc5836036d87ffd0d2c732ab8450212a880fc6de199ea569a96993ba0d250a5012160d2d72211880695f92
SSDEEP 3072:5ZwEurOxn8zXnHc2qHNYEU/rUHCVJWGdi0Ha5HnXk9TFzBsuht7yGik:5ZwPOx8D85UIHEI0HaZ09JzKStjik
TLSH
T1CFF3E13E7EDE891AD80B10BB7F16B18BD80D8E0B460AB44B769D80155B3668D1BD1CFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b8c2c9ec-23d7-4895-91ca-075f96aac5ee.tmp

Path C:\Users\Admin\AppData\Local\Temp\b8c2c9ec-23d7-4895-91ca-075f96aac5ee.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

901d228c-c215-4516-bd47-20a54ee9e009.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1896_1009228240\901d228c-c215-4516-bd47-20a54ee9e009.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1896_1009228240\CRX_INSTALL\content.js
Size 9KB
SHA256 0d40a5153cb66b5bde64906ca3ae750494098f68ad0b4d091256939eea243643
MD5 3d20584f7f6c8eac79e17cca4207fb79
SHA1 3c16dcc27ae52431c8cdd92fbaab0341524d3092
SHA512 315d1b4cc2e70c72d7eb7d51e0f304f6e64ac13ae301fd2e46d585243a6c936b2ad35a0964745d291ae9b317c316a29760b9b9782c88cc6a68599db531f87d59
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
TLSH
T16212B58DA568ED7D1980C952E10EA62E5D342435E6E7A303108B8D88026CFBAD955FFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1896_454319946\CRX_INSTALL\_locales\en_CA\messages.json
Size 711B
SHA256 2445cad863be47bb1c15b57a4960b7b0d01864e63cdfde6395f3b2689dc1444b
MD5 558659936250e03cc14b60ebf648aa09
SHA1 32f1ce0361bbfdff11e2ffd53d3ae88a8b81a825
SHA512 1632f5a3cd71887774bf3cb8a4d8b787ea6278271657b0f1d113dbe1a7fd42c4daa717cc449f157ce8972037572b882dc946a7dc2c0e549d71982dcdee89f727
TLSH
T1460197136240AF18470BF05BB9023442A0B44AC62384E0B775EC982C6656DAFB20B3B0
MD5 SHA1 SHA512 TLSH

Submit Download

note.txt

Path C:\note.txt
Size 218B
SHA256 8e9f20f6864c66576536c0b866c6ffdcf11397db67fe120e972e244c3c022270
MD5 afa6955439b8d516721231029fb9ca1b
SHA1 087a043cc123c0c0df2ffadcf8e71e3ac86bbae9
SHA512 5da21a31fbc4e8250dffed30f66b896bdf007ac91948140334fe36a3f010e1bac3e70a07e9f3eb9da8633189091fd5cadcabbaacd3e01da0fe7ae28a11b3dddf
TLSH
T1C3D0A719040784251C7052D17145A5A09B70562D77F626EB74DC690C212700F0B37C9A
MD5 SHA1 SHA512 TLSH

Submit Download