a9cd3d966d453afd424d9ac54df414b80073bb51d249f4089185976fb316e254

Resubmissions

07-04-2023 07:32

230407-jdb3qaad5w 7

07-04-2023 07:29

230407-jbkbbaad5t 7

07-04-2023 07:26

230407-h9vz2age59 7

Analysis

max time kernel
485s
max time network
1050s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
07-04-2023 07:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

MEMZ 3.0/MEMZ.bat
Size

12KB
MD5

13a43c26bb98449fd82d2a552877013a
SHA1

71eb7dc393ac1f204488e11f5c1eef56f1e746af
SHA256

5f52365accb76d679b2b3946870439a62eb8936b9a0595f0fb0198138106b513
SHA512

602518b238d80010fa88c2c88699f70645513963ef4f148a0345675738cf9b0c23b9aeb899d9f7830cc1e5c7e9c7147b2dc4a9222770b4a052ee0c879062cd5a
SSDEEP

384:nnLhRNiqt0kCH2LR0GPXxGiZgCz+KG/yKhLdW79HOli+lz3:nLhRN9t0SR4iZtzlREBWhuF

Score

7^/10

bootkit persistence

Malware Config

Signatures

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

MEMZ.exeMEMZ.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\Control Panel\International\Geo\Nation	MEMZ.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\Control Panel\International\Geo\Nation	MEMZ.exe

Executes dropped EXE 7 IoCs

Processes:

MEMZ.exeMEMZ.exeMEMZ.exeMEMZ.exeMEMZ.exeMEMZ.exeMEMZ.exe

pid process

3492 MEMZ.exe
2248 MEMZ.exe
912 MEMZ.exe
3164 MEMZ.exe
556 MEMZ.exe
2272 MEMZ.exe
2520 MEMZ.exe
Adds Run key to start application 2 TTPs 1 IoCs
persistence

Registry Run Keys / Startup Folder
T1060

Modify Registry
T1112

Processes:

chrome.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\Software\Microsoft\Windows\CurrentVersion\Run chrome.exe
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
bootkit persistence

Bootkit
T1067

Processes:

MEMZ.exe

description ioc process

File opened for modification \??\PhysicalDrive0 MEMZ.exe
Drops file in System32 directory 1 IoCs

Processes:

mmc.exe

description ioc process

File opened for modification C:\Windows\System32\devmgmt.msc mmc.exe

pid	process
3492	MEMZ.exe
2248	MEMZ.exe
912	MEMZ.exe
3164	MEMZ.exe
556	MEMZ.exe
2272	MEMZ.exe
2520	MEMZ.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\Software\Microsoft\Windows\CurrentVersion\Run	chrome.exe

description	ioc	process
File opened for modification	\??\PhysicalDrive0	MEMZ.exe

description	ioc	process
File opened for modification	C:\Windows\System32\devmgmt.msc	mmc.exe

Drops file in Program Files directory 2 IoCs

Processes:

setup.exe

description	ioc	process
File created	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\e7c7478a-2794-493c-ac32-97d4828bc053.tmp	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20230407093522.pma	setup.exe

Drops file in Windows directory 57 IoCs

Processes:

mmc.exe

description	ioc	process
File created	C:\Windows\INF\c_fssystemrecovery.PNF	mmc.exe
File created	C:\Windows\INF\c_processor.PNF	mmc.exe
File created	C:\Windows\INF\c_scmvolume.PNF	mmc.exe
File created	C:\Windows\INF\c_fsactivitymonitor.PNF	mmc.exe
File created	C:\Windows\INF\xusb22.PNF	mmc.exe
File created	C:\Windows\INF\digitalmediadevice.PNF	mmc.exe
File created	C:\Windows\INF\c_monitor.PNF	mmc.exe
File created	C:\Windows\INF\oposdrv.PNF	mmc.exe
File created	C:\Windows\INF\c_fscontinuousbackup.PNF	mmc.exe
File created	C:\Windows\INF\c_holographic.PNF	mmc.exe
File created	C:\Windows\INF\c_fscontentscreener.PNF	mmc.exe
File created	C:\Windows\INF\c_media.PNF	mmc.exe
File created	C:\Windows\INF\c_fssystem.PNF	mmc.exe
File created	C:\Windows\INF\c_firmware.PNF	mmc.exe
File created	C:\Windows\INF\c_swcomponent.PNF	mmc.exe
File created	C:\Windows\INF\c_fssecurityenhancer.PNF	mmc.exe
File created	C:\Windows\INF\dc1-controller.PNF	mmc.exe
File created	C:\Windows\INF\c_magneticstripereader.PNF	mmc.exe
File created	C:\Windows\INF\c_scmdisk.PNF	mmc.exe
File created	C:\Windows\INF\c_volume.PNF	mmc.exe
File created	C:\Windows\INF\c_fscopyprotection.PNF	mmc.exe
File created	C:\Windows\INF\c_receiptprinter.PNF	mmc.exe
File created	C:\Windows\INF\remoteposdrv.PNF	mmc.exe
File created	C:\Windows\INF\c_sslaccel.PNF	mmc.exe
File created	C:\Windows\INF\c_barcodescanner.PNF	mmc.exe
File created	C:\Windows\INF\c_display.PNF	mmc.exe
File created	C:\Windows\INF\rawsilo.PNF	mmc.exe
File created	C:\Windows\INF\rdcameradriver.PNF	mmc.exe
File created	C:\Windows\INF\c_camera.PNF	mmc.exe
File created	C:\Windows\INF\c_fsinfrastructure.PNF	mmc.exe
File created	C:\Windows\INF\c_linedisplay.PNF	mmc.exe
File created	C:\Windows\INF\c_fsphysicalquotamgmt.PNF	mmc.exe
File created	C:\Windows\INF\ts_generic.PNF	mmc.exe
File created	C:\Windows\INF\c_fsencryption.PNF	mmc.exe
File created	C:\Windows\INF\c_fscompression.PNF	mmc.exe
File created	C:\Windows\INF\c_fsquotamgmt.PNF	mmc.exe
File created	C:\Windows\INF\wsdprint.PNF	mmc.exe
File created	C:\Windows\INF\c_fsvirtualization.PNF	mmc.exe
File created	C:\Windows\INF\c_mcx.PNF	mmc.exe
File created	C:\Windows\INF\c_fsreplication.PNF	mmc.exe
File created	C:\Windows\INF\c_cashdrawer.PNF	mmc.exe
File created	C:\Windows\INF\c_fshsm.PNF	mmc.exe
File created	C:\Windows\INF\c_fsantivirus.PNF	mmc.exe
File created	C:\Windows\INF\c_apo.PNF	mmc.exe
File created	C:\Windows\INF\c_diskdrive.PNF	mmc.exe
File created	C:\Windows\INF\c_smrdisk.PNF	mmc.exe
File created	C:\Windows\INF\PerceptionSimulationSixDof.PNF	mmc.exe
File created	C:\Windows\INF\c_ucm.PNF	mmc.exe
File created	C:\Windows\INF\c_fsundelete.PNF	mmc.exe
File created	C:\Windows\INF\c_smrvolume.PNF	mmc.exe
File created	C:\Windows\INF\c_proximity.PNF	mmc.exe
File created	C:\Windows\INF\miradisp.PNF	mmc.exe
File created	C:\Windows\INF\c_computeaccelerator.PNF	mmc.exe
File created	C:\Windows\INF\c_netdriver.PNF	mmc.exe
File created	C:\Windows\INF\c_fscfsmetadataserver.PNF	mmc.exe
File created	C:\Windows\INF\c_extension.PNF	mmc.exe
File created	C:\Windows\INF\c_fsopenfilebackup.PNF	mmc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 20 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

mmc.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	mmc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	mmc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A	mmc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	mmc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000	mmc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	mmc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	mmc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	mmc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A\	mmc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\ConfigFlags	mmc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	mmc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	mmc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName	mmc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A	mmc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom	mmc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	mmc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	mmc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags	mmc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	mmc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A\	mmc.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

AcroRd32.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe

Enumerates system info in registry 2 TTPs 18 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

chrome.exemsedge.exemsedge.exemsedge.exemsedge.exemsedge.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

Processes:

AcroRd32.exeexplorer.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe
Key created	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe

Modifies data under HKEY_USERS 2 IoCs

Processes:

chrome.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133253336330435520"	chrome.exe

Modifies registry class 64 IoCs

Processes:

explorer.exechrome.exeexplorer.exeMEMZ.exemsedge.exeexplorer.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\FirewallControlPanel.dll,-12123#immutable1 = "Set firewall security options to help protect your computer from hackers and malicious software."	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\intl.cpl,-2#immutable1 = "Customize settings for the display of languages, numbers, times, and dates."	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\srchadmin.dll,-601#immutable1 = "Indexing Options"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\netcenter.dll,-2#immutable1 = "Check network status, change network settings and set preferences for sharing files and printers."	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\timedate.cpl,-51#immutable1 = "Date and Time"	explorer.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4238149048-355649189-894321705-1000\{55BC810F-CA6B-4C11-8091-8522566C76B9}	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\devmgr.dll,-4#immutable1 = "Device Manager"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\SyncCenter.dll,-3001#immutable1 = "Sync files between your computer and network folders"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\inetcpl.cpl,-4312#immutable1 = "Internet Options"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\RADCUI.dll,-15300#immutable1 = "RemoteApp and Desktop Connections"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\main.cpl,-100#immutable1 = "Mouse"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\SyncCenter.dll,-3000#immutable1 = "Sync Center"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\fhcpl.dll,-2#immutable1 = "Keep a history of your files"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\system32\DeviceCenter.dll,-1000#immutable1 = "Devices and Printers"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\sdcpl.dll,-101#immutable1 = "Backup and Restore (Windows 7)"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\DiagCpl.dll,-1#immutable1 = "Troubleshooting"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000_Classes\Local Settings	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\sud.dll,-10#immutable1 = "Choose which programs you want Windows to use for activities like web browsing, editing photos, sending e-mail, and playing music."	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\RADCUI.dll,-15301#immutable1 = "Manage your RemoteApp and Desktop Connections"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\intl.cpl,-3#immutable1 = "Region"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\powercpl.dll,-2#immutable1 = "Conserve energy or maximize performance by choosing how your computer manages power."	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\devmgr.dll,-5#immutable1 = "View and update your device hardware settings and driver software."	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\system32\appwiz.cpl,-160#immutable1 = "Uninstall or change programs on your computer."	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000_Classes\Local Settings	MEMZ.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\Speech\SpeechUX\speechuxcpl.dll,-1#immutable1 = "Speech Recognition"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\system32\appwiz.cpl,-159#immutable1 = "Programs and Features"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\mmsys.cpl,-300#immutable1 = "Sound"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\usercpl.dll,-2#immutable1 = "Change user account settings and passwords for people who share this computer."	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\main.cpl,-103#immutable1 = "Customize your keyboard settings, such as the cursor blink rate and the character repeat rate."	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\netcenter.dll,-1#immutable1 = "Network and Sharing Center"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\FirewallControlPanel.dll,-12122#immutable1 = "Windows Defender Firewall"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\recovery.dll,-2#immutable1 = "Recovery"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\inetcpl.cpl,-4313#immutable1 = "Configure your Internet display and connection settings."	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\timedate.cpl,-52#immutable1 = "Set the date, time, and time zone for your computer."	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\telephon.cpl,-2#immutable1 = "Configure your telephone dialing rules and modem settings."	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\Speech\SpeechUX\speechuxcpl.dll,-2#immutable1 = "Configure how speech recognition works on your computer."	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\recovery.dll,-101#immutable1 = "Recovery"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\DiagCpl.dll,-15#immutable1 = "Troubleshoot and fix common computer problems."	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\fvecpl.dll,-1#immutable1 = "BitLocker Drive Encryption"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\sud.dll,-1#immutable1 = "Default Programs"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\telephon.cpl,-1#immutable1 = "Phone and Modem"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\main.cpl,-102#immutable1 = "Keyboard"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\autoplay.dll,-2#immutable1 = "Change default settings for CDs, DVDs, and devices so that you can automatically play music, view pictures, install software, and play games."	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\accessibilitycpl.dll,-10#immutable1 = "Ease of Access Center"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\accessibilitycpl.dll,-45#immutable1 = "Make your computer easier to use."	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\fhcpl.dll,-52#immutable1 = "File History"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\sdcpl.dll,-100#immutable1 = "Recover copies of your files backed up in Windows 7"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\fvecpl.dll,-2#immutable1 = "Protect your PC using BitLocker Drive Encryption."	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\mmsys.cpl,-301#immutable1 = "Configure your audio devices or change the sound scheme for your computer."	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000_Classes\Local Settings	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\powercpl.dll,-1#immutable1 = "Power Options"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\main.cpl,-101#immutable1 = "Customize your mouse settings, such as the button configuration, double-click speed, mouse pointers, and motion speed."	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\autoplay.dll,-1#immutable1 = "AutoPlay"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\system32\DeviceCenter.dll,-2000#immutable1 = "View and manage devices, printers, and print jobs"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\system32\colorcpl.exe,-6#immutable1 = "Color Management"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\systemcpl.dll,-1#immutable1 = "System"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\systemcpl.dll,-2#immutable1 = "View information about your computer, and change settings for hardware, performance, and remote connections."	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\system32\Vault.dll,-1#immutable1 = "Credential Manager"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\usercpl.dll,-1#immutable1 = "User Accounts"	explorer.exe

Runs regedit.exe 6 IoCs

Processes:

regedit.exeregedit.exeregedit.exeregedit.exeregedit.exeregedit.exe

pid process

1952 regedit.exe
5308 regedit.exe
6592 regedit.exe
2196 regedit.exe
8292 regedit.exe
6280 regedit.exe
Suspicious behavior: AddClipboardFormatListener 2 IoCs

Processes:

vlc.exeexplorer.exe

pid process

3784 vlc.exe
1476 explorer.exe

pid	process
1952	regedit.exe
5308	regedit.exe
6592	regedit.exe
2196	regedit.exe
8292	regedit.exe
6280	regedit.exe

pid	process
3784	vlc.exe
1476	explorer.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

MEMZ.exeMEMZ.exeMEMZ.exeMEMZ.exeMEMZ.exe

pid	process
2248	MEMZ.exe
2248	MEMZ.exe
912	MEMZ.exe
912	MEMZ.exe
2248	MEMZ.exe
2248	MEMZ.exe
3164	MEMZ.exe
3164	MEMZ.exe
912	MEMZ.exe
912	MEMZ.exe
3164	MEMZ.exe
3164	MEMZ.exe
2248	MEMZ.exe
2248	MEMZ.exe
912	MEMZ.exe
912	MEMZ.exe
3164	MEMZ.exe
3164	MEMZ.exe
912	MEMZ.exe
912	MEMZ.exe
2248	MEMZ.exe
2248	MEMZ.exe
912	MEMZ.exe
912	MEMZ.exe
3164	MEMZ.exe
3164	MEMZ.exe
2248	MEMZ.exe
2248	MEMZ.exe
3164	MEMZ.exe
3164	MEMZ.exe
912	MEMZ.exe
912	MEMZ.exe
556	MEMZ.exe
2272	MEMZ.exe
556	MEMZ.exe
2272	MEMZ.exe
2248	MEMZ.exe
912	MEMZ.exe
2248	MEMZ.exe
912	MEMZ.exe
3164	MEMZ.exe
3164	MEMZ.exe
556	MEMZ.exe
556	MEMZ.exe
2272	MEMZ.exe
2272	MEMZ.exe
912	MEMZ.exe
912	MEMZ.exe
2248	MEMZ.exe
2248	MEMZ.exe
556	MEMZ.exe
556	MEMZ.exe
3164	MEMZ.exe
3164	MEMZ.exe
912	MEMZ.exe
912	MEMZ.exe
2272	MEMZ.exe
2272	MEMZ.exe
2248	MEMZ.exe
2248	MEMZ.exe
556	MEMZ.exe
556	MEMZ.exe
3164	MEMZ.exe
3164	MEMZ.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

Processes:

vlc.exeregedit.exe

pid process

3784 vlc.exe
1952 regedit.exe

pid	process
3784	vlc.exe
1952	regedit.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 64 IoCs

Processes:

chrome.exemsedge.exemsedge.exemsedge.exemsedge.exemsedge.exe

pid	process
3116	chrome.exe
3116	chrome.exe
3116	chrome.exe
3116	chrome.exe
3116	chrome.exe
3116	chrome.exe
5384	msedge.exe
5384	msedge.exe
5384	msedge.exe
5384	msedge.exe
5384	msedge.exe
5384	msedge.exe
5384	msedge.exe
5384	msedge.exe
5384	msedge.exe
5384	msedge.exe
5384	msedge.exe
5384	msedge.exe
5384	msedge.exe
5384	msedge.exe
5384	msedge.exe
5384	msedge.exe
5384	msedge.exe
5384	msedge.exe
5384	msedge.exe
5384	msedge.exe
5384	msedge.exe
5384	msedge.exe
5340	msedge.exe
5340	msedge.exe
5340	msedge.exe
5340	msedge.exe
5340	msedge.exe
5340	msedge.exe
5340	msedge.exe
5340	msedge.exe
5340	msedge.exe
5340	msedge.exe
5340	msedge.exe
5340	msedge.exe
5340	msedge.exe
5340	msedge.exe
5340	msedge.exe
5340	msedge.exe
5340	msedge.exe
5340	msedge.exe
5340	msedge.exe
5340	msedge.exe
5340	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
6188	msedge.exe
6188	msedge.exe
6188	msedge.exe
6188	msedge.exe
6188	msedge.exe
6188	msedge.exe
6188	msedge.exe
6188	msedge.exe
6912	msedge.exe
6912	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

chrome.exeAUDIODG.EXE

description	pid	process
Token: SeShutdownPrivilege	3116	chrome.exe
Token: SeCreatePagefilePrivilege	3116	chrome.exe
Token: SeShutdownPrivilege	3116	chrome.exe
Token: SeCreatePagefilePrivilege	3116	chrome.exe
Token: SeShutdownPrivilege	3116	chrome.exe
Token: SeCreatePagefilePrivilege	3116	chrome.exe
Token: SeShutdownPrivilege	3116	chrome.exe
Token: SeCreatePagefilePrivilege	3116	chrome.exe
Token: SeShutdownPrivilege	3116	chrome.exe
Token: SeCreatePagefilePrivilege	3116	chrome.exe
Token: SeShutdownPrivilege	3116	chrome.exe
Token: SeCreatePagefilePrivilege	3116	chrome.exe
Token: SeShutdownPrivilege	3116	chrome.exe
Token: SeCreatePagefilePrivilege	3116	chrome.exe
Token: SeShutdownPrivilege	3116	chrome.exe
Token: SeCreatePagefilePrivilege	3116	chrome.exe
Token: SeShutdownPrivilege	3116	chrome.exe
Token: SeCreatePagefilePrivilege	3116	chrome.exe
Token: SeShutdownPrivilege	3116	chrome.exe
Token: SeCreatePagefilePrivilege	3116	chrome.exe
Token: SeShutdownPrivilege	3116	chrome.exe
Token: SeCreatePagefilePrivilege	3116	chrome.exe
Token: SeShutdownPrivilege	3116	chrome.exe
Token: SeCreatePagefilePrivilege	3116	chrome.exe
Token: SeShutdownPrivilege	3116	chrome.exe
Token: SeCreatePagefilePrivilege	3116	chrome.exe
Token: SeShutdownPrivilege	3116	chrome.exe
Token: SeCreatePagefilePrivilege	3116	chrome.exe
Token: SeShutdownPrivilege	3116	chrome.exe
Token: SeCreatePagefilePrivilege	3116	chrome.exe
Token: SeShutdownPrivilege	3116	chrome.exe
Token: SeCreatePagefilePrivilege	3116	chrome.exe
Token: SeShutdownPrivilege	3116	chrome.exe
Token: SeCreatePagefilePrivilege	3116	chrome.exe
Token: SeShutdownPrivilege	3116	chrome.exe
Token: SeCreatePagefilePrivilege	3116	chrome.exe
Token: SeShutdownPrivilege	3116	chrome.exe
Token: SeCreatePagefilePrivilege	3116	chrome.exe
Token: SeShutdownPrivilege	3116	chrome.exe
Token: SeCreatePagefilePrivilege	3116	chrome.exe
Token: SeShutdownPrivilege	3116	chrome.exe
Token: SeCreatePagefilePrivilege	3116	chrome.exe
Token: SeShutdownPrivilege	3116	chrome.exe
Token: SeCreatePagefilePrivilege	3116	chrome.exe
Token: SeShutdownPrivilege	3116	chrome.exe
Token: SeCreatePagefilePrivilege	3116	chrome.exe
Token: SeShutdownPrivilege	3116	chrome.exe
Token: SeCreatePagefilePrivilege	3116	chrome.exe
Token: SeShutdownPrivilege	3116	chrome.exe
Token: SeCreatePagefilePrivilege	3116	chrome.exe
Token: SeShutdownPrivilege	3116	chrome.exe
Token: SeCreatePagefilePrivilege	3116	chrome.exe
Token: SeShutdownPrivilege	3116	chrome.exe
Token: SeCreatePagefilePrivilege	3116	chrome.exe
Token: SeShutdownPrivilege	3116	chrome.exe
Token: SeCreatePagefilePrivilege	3116	chrome.exe
Token: SeShutdownPrivilege	3116	chrome.exe
Token: SeCreatePagefilePrivilege	3116	chrome.exe
Token: 33	4776	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	4776	AUDIODG.EXE
Token: SeShutdownPrivilege	3116	chrome.exe
Token: SeCreatePagefilePrivilege	3116	chrome.exe
Token: SeShutdownPrivilege	3116	chrome.exe
Token: SeCreatePagefilePrivilege	3116	chrome.exe

Suspicious use of FindShellTrayWindow 48 IoCs

Processes:

cscript.exechrome.exevlc.exemsedge.exeregedit.exemsedge.exemsedge.exemsedge.exemsedge.exeexplorer.exeMEMZ.exe

pid	process
4860	cscript.exe
3116	chrome.exe
3116	chrome.exe
3116	chrome.exe
3116	chrome.exe
3116	chrome.exe
3116	chrome.exe
3116	chrome.exe
3116	chrome.exe
3116	chrome.exe
3116	chrome.exe
3116	chrome.exe
3116	chrome.exe
3116	chrome.exe
3116	chrome.exe
3116	chrome.exe
3116	chrome.exe
3116	chrome.exe
3116	chrome.exe
3116	chrome.exe
3116	chrome.exe
3116	chrome.exe
3116	chrome.exe
3116	chrome.exe
3116	chrome.exe
3116	chrome.exe
3116	chrome.exe
3784	vlc.exe
3784	vlc.exe
3784	vlc.exe
5384	msedge.exe
5384	msedge.exe
1952	regedit.exe
3784	vlc.exe
3116	chrome.exe
5384	msedge.exe
5340	msedge.exe
5340	msedge.exe
4368	msedge.exe
4368	msedge.exe
6188	msedge.exe
6188	msedge.exe
6188	msedge.exe
6912	msedge.exe
1476	explorer.exe
6912	msedge.exe
6912	msedge.exe
2520	MEMZ.exe

Suspicious use of SendNotifyMessage 41 IoCs

Processes:

chrome.exevlc.exemsedge.exeMEMZ.exe

pid	process
3116	chrome.exe
3116	chrome.exe
3116	chrome.exe
3116	chrome.exe
3116	chrome.exe
3116	chrome.exe
3116	chrome.exe
3116	chrome.exe
3116	chrome.exe
3116	chrome.exe
3116	chrome.exe
3116	chrome.exe
3116	chrome.exe
3116	chrome.exe
3116	chrome.exe
3116	chrome.exe
3116	chrome.exe
3116	chrome.exe
3116	chrome.exe
3116	chrome.exe
3116	chrome.exe
3116	chrome.exe
3116	chrome.exe
3116	chrome.exe
3784	vlc.exe
3784	vlc.exe
3784	vlc.exe
6912	msedge.exe
6912	msedge.exe
2520	MEMZ.exe
2520	MEMZ.exe
2520	MEMZ.exe
2520	MEMZ.exe
2520	MEMZ.exe
2520	MEMZ.exe
2520	MEMZ.exe
2520	MEMZ.exe
2520	MEMZ.exe
2520	MEMZ.exe
2520	MEMZ.exe
2520	MEMZ.exe

Suspicious use of SetWindowsHookEx 27 IoCs

Processes:

MEMZ.exevlc.exeAcroRd32.exemmc.exemmc.exe

pid	process
2520	MEMZ.exe
3784	vlc.exe
5076	AcroRd32.exe
5076	AcroRd32.exe
5076	AcroRd32.exe
5076	AcroRd32.exe
5076	AcroRd32.exe
5076	AcroRd32.exe
5076	AcroRd32.exe
2520	MEMZ.exe
2520	MEMZ.exe
2520	MEMZ.exe
2520	MEMZ.exe
2520	MEMZ.exe
2520	MEMZ.exe
2520	MEMZ.exe
2520	MEMZ.exe
2520	MEMZ.exe
2520	MEMZ.exe
2520	MEMZ.exe
2520	MEMZ.exe
2520	MEMZ.exe
4312	mmc.exe
940	mmc.exe
940	mmc.exe
2520	MEMZ.exe
2520	MEMZ.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

cmd.exeMEMZ.exeMEMZ.exechrome.exe

description	pid	process	target process
PID 4508 wrote to memory of 4860	4508	cmd.exe	cscript.exe
PID 4508 wrote to memory of 4860	4508	cmd.exe	cscript.exe
PID 4508 wrote to memory of 3492	4508	cmd.exe	MEMZ.exe
PID 4508 wrote to memory of 3492	4508	cmd.exe	MEMZ.exe
PID 4508 wrote to memory of 3492	4508	cmd.exe	MEMZ.exe
PID 3492 wrote to memory of 2248	3492	MEMZ.exe	MEMZ.exe
PID 3492 wrote to memory of 2248	3492	MEMZ.exe	MEMZ.exe
PID 3492 wrote to memory of 2248	3492	MEMZ.exe	MEMZ.exe
PID 3492 wrote to memory of 912	3492	MEMZ.exe	MEMZ.exe
PID 3492 wrote to memory of 912	3492	MEMZ.exe	MEMZ.exe
PID 3492 wrote to memory of 912	3492	MEMZ.exe	MEMZ.exe
PID 3492 wrote to memory of 3164	3492	MEMZ.exe	MEMZ.exe
PID 3492 wrote to memory of 3164	3492	MEMZ.exe	MEMZ.exe
PID 3492 wrote to memory of 3164	3492	MEMZ.exe	MEMZ.exe
PID 3492 wrote to memory of 556	3492	MEMZ.exe	MEMZ.exe
PID 3492 wrote to memory of 556	3492	MEMZ.exe	MEMZ.exe
PID 3492 wrote to memory of 556	3492	MEMZ.exe	MEMZ.exe
PID 3492 wrote to memory of 2272	3492	MEMZ.exe	MEMZ.exe
PID 3492 wrote to memory of 2272	3492	MEMZ.exe	MEMZ.exe
PID 3492 wrote to memory of 2272	3492	MEMZ.exe	MEMZ.exe
PID 3492 wrote to memory of 2520	3492	MEMZ.exe	MEMZ.exe
PID 3492 wrote to memory of 2520	3492	MEMZ.exe	MEMZ.exe
PID 3492 wrote to memory of 2520	3492	MEMZ.exe	MEMZ.exe
PID 2520 wrote to memory of 1276	2520	MEMZ.exe	notepad.exe
PID 2520 wrote to memory of 1276	2520	MEMZ.exe	notepad.exe
PID 2520 wrote to memory of 1276	2520	MEMZ.exe	notepad.exe
PID 2520 wrote to memory of 412	2520	MEMZ.exe	explorer.exe
PID 2520 wrote to memory of 412	2520	MEMZ.exe	explorer.exe
PID 2520 wrote to memory of 412	2520	MEMZ.exe	explorer.exe
PID 3116 wrote to memory of 4336	3116	chrome.exe	chrome.exe
PID 3116 wrote to memory of 4336	3116	chrome.exe	chrome.exe
PID 3116 wrote to memory of 1484	3116	chrome.exe	chrome.exe
PID 3116 wrote to memory of 1484	3116	chrome.exe	chrome.exe
PID 3116 wrote to memory of 1484	3116	chrome.exe	chrome.exe
PID 3116 wrote to memory of 1484	3116	chrome.exe	chrome.exe
PID 3116 wrote to memory of 1484	3116	chrome.exe	chrome.exe
PID 3116 wrote to memory of 1484	3116	chrome.exe	chrome.exe
PID 3116 wrote to memory of 1484	3116	chrome.exe	chrome.exe
PID 3116 wrote to memory of 1484	3116	chrome.exe	chrome.exe
PID 3116 wrote to memory of 1484	3116	chrome.exe	chrome.exe
PID 3116 wrote to memory of 1484	3116	chrome.exe	chrome.exe
PID 3116 wrote to memory of 1484	3116	chrome.exe	chrome.exe
PID 3116 wrote to memory of 1484	3116	chrome.exe	chrome.exe
PID 3116 wrote to memory of 1484	3116	chrome.exe	chrome.exe
PID 3116 wrote to memory of 1484	3116	chrome.exe	chrome.exe
PID 3116 wrote to memory of 1484	3116	chrome.exe	chrome.exe
PID 3116 wrote to memory of 1484	3116	chrome.exe	chrome.exe
PID 3116 wrote to memory of 1484	3116	chrome.exe	chrome.exe
PID 3116 wrote to memory of 1484	3116	chrome.exe	chrome.exe
PID 3116 wrote to memory of 1484	3116	chrome.exe	chrome.exe
PID 3116 wrote to memory of 1484	3116	chrome.exe	chrome.exe
PID 3116 wrote to memory of 1484	3116	chrome.exe	chrome.exe
PID 3116 wrote to memory of 1484	3116	chrome.exe	chrome.exe
PID 3116 wrote to memory of 1484	3116	chrome.exe	chrome.exe
PID 3116 wrote to memory of 1484	3116	chrome.exe	chrome.exe
PID 3116 wrote to memory of 1484	3116	chrome.exe	chrome.exe
PID 3116 wrote to memory of 1484	3116	chrome.exe	chrome.exe
PID 3116 wrote to memory of 1484	3116	chrome.exe	chrome.exe
PID 3116 wrote to memory of 1484	3116	chrome.exe	chrome.exe
PID 3116 wrote to memory of 1484	3116	chrome.exe	chrome.exe
PID 3116 wrote to memory of 1484	3116	chrome.exe	chrome.exe
PID 3116 wrote to memory of 1484	3116	chrome.exe	chrome.exe
PID 3116 wrote to memory of 1484	3116	chrome.exe	chrome.exe
PID 3116 wrote to memory of 1484	3116	chrome.exe	chrome.exe

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\MEMZ 3.0\MEMZ.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:4508

C:\Windows\system32\cscript.exe
cscript x.js
2⤵
- Suspicious use of FindShellTrayWindow
PID:4860

C:\Users\Admin\AppData\Roaming\MEMZ.exe
"C:\Users\Admin\AppData\Roaming\MEMZ.exe"
2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3492

C:\Users\Admin\AppData\Roaming\MEMZ.exe
"C:\Users\Admin\AppData\Roaming\MEMZ.exe" /watchdog
3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2248

C:\Users\Admin\AppData\Roaming\MEMZ.exe
"C:\Users\Admin\AppData\Roaming\MEMZ.exe" /watchdog
3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:912

C:\Users\Admin\AppData\Roaming\MEMZ.exe
"C:\Users\Admin\AppData\Roaming\MEMZ.exe" /watchdog
3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:3164

C:\Users\Admin\AppData\Roaming\MEMZ.exe
"C:\Users\Admin\AppData\Roaming\MEMZ.exe" /watchdog
3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:556

C:\Users\Admin\AppData\Roaming\MEMZ.exe
"C:\Users\Admin\AppData\Roaming\MEMZ.exe" /watchdog
3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2272

C:\Users\Admin\AppData\Roaming\MEMZ.exe
"C:\Users\Admin\AppData\Roaming\MEMZ.exe" /main
3⤵
- Checks computer location settings
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2520

C:\Windows\SysWOW64\notepad.exe
"C:\Windows\System32\notepad.exe" \note.txt
4⤵
PID:1276

C:\Windows\SysWOW64\explorer.exe
"C:\Windows\System32\explorer.exe"
4⤵
- Modifies registry class
PID:412

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://google.co.ck/search?q=how+to+send+a+virus+to+my+friend
4⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
PID:5384

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x114,0x118,0x11c,0xf0,0x120,0x7ffeaa1d46f8,0x7ffeaa1d4708,0x7ffeaa1d4718
5⤵
PID:5520

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2156,3278523926225180119,524958495392664241,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2192 /prefetch:2
5⤵
PID:5880

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2156,3278523926225180119,524958495392664241,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2304 /prefetch:3
5⤵
PID:5888

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2156,3278523926225180119,524958495392664241,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2768 /prefetch:8
5⤵
PID:5924

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,3278523926225180119,524958495392664241,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3648 /prefetch:1
5⤵
PID:412

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,3278523926225180119,524958495392664241,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3660 /prefetch:1
5⤵
PID:3692

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,3278523926225180119,524958495392664241,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4968 /prefetch:1
5⤵
PID:6008

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,3278523926225180119,524958495392664241,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4720 /prefetch:1
5⤵
PID:5776

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,3278523926225180119,524958495392664241,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3120 /prefetch:1
5⤵
PID:6004

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2156,3278523926225180119,524958495392664241,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5720 /prefetch:8
5⤵
PID:4512

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
5⤵
- Drops file in Program Files directory
PID:1856

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x238,0x23c,0x240,0x214,0x244,0x7ff6f67f5460,0x7ff6f67f5470,0x7ff6f67f5480
6⤵
PID:4036

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2156,3278523926225180119,524958495392664241,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5720 /prefetch:8
5⤵
PID:5820

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,3278523926225180119,524958495392664241,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5336 /prefetch:1
5⤵
PID:5260

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,3278523926225180119,524958495392664241,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5400 /prefetch:1
5⤵
PID:4104

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,3278523926225180119,524958495392664241,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5912 /prefetch:1
5⤵
PID:5028

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,3278523926225180119,524958495392664241,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5948 /prefetch:1
5⤵
PID:4788

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,3278523926225180119,524958495392664241,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3916 /prefetch:1
5⤵
PID:4656

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,3278523926225180119,524958495392664241,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5476 /prefetch:1
5⤵
PID:6004

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,3278523926225180119,524958495392664241,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6236 /prefetch:1
5⤵
PID:2296

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,3278523926225180119,524958495392664241,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3936 /prefetch:1
5⤵
PID:2428

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,3278523926225180119,524958495392664241,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6608 /prefetch:1
5⤵
PID:3452

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,3278523926225180119,524958495392664241,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5212 /prefetch:1
5⤵
PID:2016

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,3278523926225180119,524958495392664241,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6904 /prefetch:1
5⤵
PID:2232

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,3278523926225180119,524958495392664241,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6840 /prefetch:1
5⤵
PID:2204

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,3278523926225180119,524958495392664241,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6748 /prefetch:1
5⤵
PID:6032

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,3278523926225180119,524958495392664241,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7548 /prefetch:1
5⤵
PID:6264

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,3278523926225180119,524958495392664241,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6580 /prefetch:1
5⤵
PID:6604

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,3278523926225180119,524958495392664241,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7748 /prefetch:1
5⤵
PID:6852

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,3278523926225180119,524958495392664241,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7692 /prefetch:1
5⤵
PID:7060

C:\Windows\SysWOW64\regedit.exe
"C:\Windows\System32\regedit.exe"
4⤵
- Runs regedit.exe
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
PID:1952

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe"
4⤵
PID:2848

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://google.co.ck/search?q=mcafee+vs+norton
4⤵
PID:5412

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffeaa1d46f8,0x7ffeaa1d4708,0x7ffeaa1d4718
5⤵
PID:5764

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://softonic.com/
4⤵
PID:4104

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffeaa1d46f8,0x7ffeaa1d4708,0x7ffeaa1d4718
5⤵
PID:2888

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://google.co.ck/search?q=bonzi+buddy+download+free
4⤵
PID:6528

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffeaa1d46f8,0x7ffeaa1d4708,0x7ffeaa1d4718
5⤵
PID:6564

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://google.co.ck/search?q=virus.exe
4⤵
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
PID:5340

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffeaa1d46f8,0x7ffeaa1d4708,0x7ffeaa1d4718
5⤵
PID:1620

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2184,2287283913623393829,10442483991553562567,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2236 /prefetch:3
5⤵
PID:6044

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2184,2287283913623393829,10442483991553562567,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2188 /prefetch:2
5⤵
PID:5752

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2184,2287283913623393829,10442483991553562567,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2928 /prefetch:8
5⤵
PID:6388

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,2287283913623393829,10442483991553562567,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3508 /prefetch:1
5⤵
PID:3296

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,2287283913623393829,10442483991553562567,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3432 /prefetch:1
5⤵
PID:744

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,2287283913623393829,10442483991553562567,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4728 /prefetch:1
5⤵
PID:3508

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2184,2287283913623393829,10442483991553562567,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3740 /prefetch:8
5⤵
PID:5132

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2184,2287283913623393829,10442483991553562567,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3740 /prefetch:8
5⤵
PID:5096

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,2287283913623393829,10442483991553562567,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5112 /prefetch:1
5⤵
PID:6788

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,2287283913623393829,10442483991553562567,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5156 /prefetch:1
5⤵
PID:4212

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,2287283913623393829,10442483991553562567,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5512 /prefetch:1
5⤵
PID:5124

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,2287283913623393829,10442483991553562567,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4952 /prefetch:1
5⤵
PID:3216

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,2287283913623393829,10442483991553562567,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5196 /prefetch:1
5⤵
PID:3692

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,2287283913623393829,10442483991553562567,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5116 /prefetch:1
5⤵
PID:5212

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,2287283913623393829,10442483991553562567,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5832 /prefetch:1
5⤵
PID:316

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,2287283913623393829,10442483991553562567,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4900 /prefetch:1
5⤵
PID:2720

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,2287283913623393829,10442483991553562567,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5844 /prefetch:1
5⤵
PID:4460

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,2287283913623393829,10442483991553562567,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6056 /prefetch:1
5⤵
PID:5308

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,2287283913623393829,10442483991553562567,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6132 /prefetch:1
5⤵
PID:6512

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,2287283913623393829,10442483991553562567,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6216 /prefetch:1
5⤵
PID:6808

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,2287283913623393829,10442483991553562567,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6232 /prefetch:1
5⤵
PID:6660

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,2287283913623393829,10442483991553562567,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6260 /prefetch:1
5⤵
PID:4508

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,2287283913623393829,10442483991553562567,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7196 /prefetch:1
5⤵
PID:4236

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,2287283913623393829,10442483991553562567,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6724 /prefetch:1
5⤵
PID:6252

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,2287283913623393829,10442483991553562567,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7668 /prefetch:1
5⤵
PID:1152

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,2287283913623393829,10442483991553562567,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6656 /prefetch:1
5⤵
PID:5324

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://softonic.com/
4⤵
PID:3800

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffeaa1d46f8,0x7ffeaa1d4708,0x7ffeaa1d4718
5⤵
PID:1072

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://google.co.ck/search?q=g3t+r3kt
4⤵
PID:5164

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffeaa1d46f8,0x7ffeaa1d4708,0x7ffeaa1d4718
5⤵
PID:6008

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://softonic.com/
4⤵
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
PID:4368

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffeaa1d46f8,0x7ffeaa1d4708,0x7ffeaa1d4718
5⤵
PID:3536

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2168,5127374478626061329,15338876116437788558,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2212 /prefetch:2
5⤵
PID:872

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2168,5127374478626061329,15338876116437788558,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2264 /prefetch:3
5⤵
PID:5728

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2168,5127374478626061329,15338876116437788558,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2920 /prefetch:8
5⤵
PID:6652

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,5127374478626061329,15338876116437788558,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3596 /prefetch:1
5⤵
PID:1564

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,5127374478626061329,15338876116437788558,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3456 /prefetch:1
5⤵
PID:3460

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,5127374478626061329,15338876116437788558,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4940 /prefetch:1
5⤵
PID:5152

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,5127374478626061329,15338876116437788558,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3828 /prefetch:1
5⤵
PID:5428

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,5127374478626061329,15338876116437788558,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3880 /prefetch:1
5⤵
PID:6056

C:\Windows\SysWOW64\explorer.exe
"C:\Windows\System32\explorer.exe"
4⤵
- Modifies registry class
PID:3380

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://play.clubpenguin.com/
4⤵
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
PID:6188

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x118,0x11c,0x120,0xf8,0x124,0x7ffeaa1d46f8,0x7ffeaa1d4708,0x7ffeaa1d4718
5⤵
PID:6172

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2128,18061759376082708497,17107767860868930166,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2240 /prefetch:3
5⤵
PID:3480

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,18061759376082708497,17107767860868930166,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2140 /prefetch:2
5⤵
PID:3036

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2128,18061759376082708497,17107767860868930166,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2828 /prefetch:8
5⤵
PID:2380

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,18061759376082708497,17107767860868930166,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3588 /prefetch:1
5⤵
PID:6076

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,18061759376082708497,17107767860868930166,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3408 /prefetch:1
5⤵
PID:5748

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,18061759376082708497,17107767860868930166,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4740 /prefetch:1
5⤵
PID:5180

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,18061759376082708497,17107767860868930166,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3368 /prefetch:1
5⤵
PID:396

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,18061759376082708497,17107767860868930166,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5064 /prefetch:1
5⤵
PID:3884

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,18061759376082708497,17107767860868930166,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5024 /prefetch:1
5⤵
PID:5996

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,18061759376082708497,17107767860868930166,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5012 /prefetch:8
5⤵
PID:2360

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,18061759376082708497,17107767860868930166,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5012 /prefetch:8
5⤵
PID:1768

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,18061759376082708497,17107767860868930166,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4836 /prefetch:1
5⤵
PID:6288

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,18061759376082708497,17107767860868930166,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5384 /prefetch:1
5⤵
PID:5836

C:\Windows\SysWOW64\notepad.exe
"C:\Windows\System32\notepad.exe"
4⤵
PID:5008

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://pcoptimizerpro.com/
4⤵
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:6912

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffeaa1d46f8,0x7ffeaa1d4708,0x7ffeaa1d4718
5⤵
PID:5232

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2148,1122591592864328060,8435332492920795573,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2224 /prefetch:3
5⤵
PID:2464

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2148,1122591592864328060,8435332492920795573,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2160 /prefetch:2
5⤵
PID:5840

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2148,1122591592864328060,8435332492920795573,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2964 /prefetch:8
5⤵
PID:832

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,1122591592864328060,8435332492920795573,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3344 /prefetch:1
5⤵
PID:4360

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,1122591592864328060,8435332492920795573,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3388 /prefetch:1
5⤵
PID:3872

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,1122591592864328060,8435332492920795573,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4968 /prefetch:1
5⤵
PID:2844

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2148,1122591592864328060,8435332492920795573,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5400 /prefetch:8
5⤵
PID:7060

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2148,1122591592864328060,8435332492920795573,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5400 /prefetch:8
5⤵
PID:3140

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,1122591592864328060,8435332492920795573,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5140 /prefetch:1
5⤵
PID:5288

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,1122591592864328060,8435332492920795573,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3524 /prefetch:1
5⤵
PID:7144

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,1122591592864328060,8435332492920795573,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5044 /prefetch:1
5⤵
PID:5704

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,1122591592864328060,8435332492920795573,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5068 /prefetch:1
5⤵
PID:3356

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,1122591592864328060,8435332492920795573,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5680 /prefetch:1
5⤵
PID:3704

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,1122591592864328060,8435332492920795573,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4700 /prefetch:1
5⤵
PID:2540

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,1122591592864328060,8435332492920795573,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5808 /prefetch:1
5⤵
PID:7036

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,1122591592864328060,8435332492920795573,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5768 /prefetch:1
5⤵
PID:2052

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,1122591592864328060,8435332492920795573,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2912 /prefetch:1
5⤵
PID:6384

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,1122591592864328060,8435332492920795573,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3524 /prefetch:1
5⤵
PID:4616

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,1122591592864328060,8435332492920795573,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5132 /prefetch:1
5⤵
PID:5788

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,1122591592864328060,8435332492920795573,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6088 /prefetch:1
5⤵
PID:1800

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,1122591592864328060,8435332492920795573,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1968 /prefetch:1
5⤵
PID:6704

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,1122591592864328060,8435332492920795573,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3952 /prefetch:1
5⤵
PID:4184

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,1122591592864328060,8435332492920795573,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6400 /prefetch:1
5⤵
PID:7008

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2148,1122591592864328060,8435332492920795573,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3584 /prefetch:2
5⤵
PID:736

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,1122591592864328060,8435332492920795573,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5392 /prefetch:1
5⤵
PID:3344

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,1122591592864328060,8435332492920795573,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4024 /prefetch:1
5⤵
PID:6800

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,1122591592864328060,8435332492920795573,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6452 /prefetch:1
5⤵
PID:4604

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,1122591592864328060,8435332492920795573,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6768 /prefetch:1
5⤵
PID:4460

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,1122591592864328060,8435332492920795573,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6352 /prefetch:1
5⤵
PID:5768

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,1122591592864328060,8435332492920795573,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5532 /prefetch:1
5⤵
PID:5592

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,1122591592864328060,8435332492920795573,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6520 /prefetch:1
5⤵
PID:4880

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,1122591592864328060,8435332492920795573,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6348 /prefetch:1
5⤵
PID:4376

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,1122591592864328060,8435332492920795573,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7188 /prefetch:1
5⤵
PID:6280

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,1122591592864328060,8435332492920795573,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6168 /prefetch:1
5⤵
PID:1896

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,1122591592864328060,8435332492920795573,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3920 /prefetch:1
5⤵
PID:5908

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,1122591592864328060,8435332492920795573,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
5⤵
PID:1868

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,1122591592864328060,8435332492920795573,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=37 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7596 /prefetch:1
5⤵
PID:3976

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,1122591592864328060,8435332492920795573,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=38 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7324 /prefetch:1
5⤵
PID:6812

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,1122591592864328060,8435332492920795573,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=39 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7436 /prefetch:1
5⤵
PID:4728

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,1122591592864328060,8435332492920795573,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=40 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8148 /prefetch:1
5⤵
PID:3880

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,1122591592864328060,8435332492920795573,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=41 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7916 /prefetch:1
5⤵
PID:3352

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,1122591592864328060,8435332492920795573,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=42 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5248 /prefetch:1
5⤵
PID:3148

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,1122591592864328060,8435332492920795573,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=43 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7716 /prefetch:1
5⤵
PID:5808

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,1122591592864328060,8435332492920795573,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=44 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7952 /prefetch:1
5⤵
PID:2436

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,1122591592864328060,8435332492920795573,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=45 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8312 /prefetch:1
5⤵
PID:1700

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,1122591592864328060,8435332492920795573,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=46 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7712 /prefetch:1
5⤵
PID:6320

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,1122591592864328060,8435332492920795573,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=47 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8452 /prefetch:1
5⤵
PID:1748

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,1122591592864328060,8435332492920795573,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=48 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7712 /prefetch:1
5⤵
PID:5072

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,1122591592864328060,8435332492920795573,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=49 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7216 /prefetch:1
5⤵
PID:5408

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,1122591592864328060,8435332492920795573,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=50 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8292 /prefetch:1
5⤵
PID:6168

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,1122591592864328060,8435332492920795573,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=51 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7172 /prefetch:1
5⤵
PID:1044

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,1122591592864328060,8435332492920795573,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=52 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8092 /prefetch:1
5⤵
PID:5000

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,1122591592864328060,8435332492920795573,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=53 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7564 /prefetch:1
5⤵
PID:2216

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,1122591592864328060,8435332492920795573,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=54 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9040 /prefetch:1
5⤵
PID:5876

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,1122591592864328060,8435332492920795573,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=55 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8544 /prefetch:1
5⤵
PID:2152

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,1122591592864328060,8435332492920795573,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=56 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9176 /prefetch:1
5⤵
PID:5516

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,1122591592864328060,8435332492920795573,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=57 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8516 /prefetch:1
5⤵
PID:7660

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,1122591592864328060,8435332492920795573,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=58 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9212 /prefetch:1
5⤵
PID:6520

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,1122591592864328060,8435332492920795573,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=59 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7752 /prefetch:1
5⤵
PID:1572

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,1122591592864328060,8435332492920795573,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=60 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9552 /prefetch:1
5⤵
PID:7752

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,1122591592864328060,8435332492920795573,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=61 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9452 /prefetch:1
5⤵
PID:1748

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,1122591592864328060,8435332492920795573,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=62 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9556 /prefetch:1
5⤵
PID:3452

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,1122591592864328060,8435332492920795573,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=63 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9432 /prefetch:1
5⤵
PID:4768

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,1122591592864328060,8435332492920795573,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=64 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9360 /prefetch:1
5⤵
PID:2540

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,1122591592864328060,8435332492920795573,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=65 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9680 /prefetch:1
5⤵
PID:5808

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,1122591592864328060,8435332492920795573,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=66 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8056 /prefetch:1
5⤵
PID:7972

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,1122591592864328060,8435332492920795573,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=67 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9252 /prefetch:1
5⤵
PID:8056

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,1122591592864328060,8435332492920795573,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=68 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10264 /prefetch:1
5⤵
PID:928

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,1122591592864328060,8435332492920795573,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=69 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9988 /prefetch:1
5⤵
PID:4192

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,1122591592864328060,8435332492920795573,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=70 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10600 /prefetch:1
5⤵
PID:7540

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,1122591592864328060,8435332492920795573,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=71 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10664 /prefetch:1
5⤵
PID:7208

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,1122591592864328060,8435332492920795573,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=72 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9268 /prefetch:1
5⤵
PID:3248

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,1122591592864328060,8435332492920795573,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=73 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=11076 /prefetch:1
5⤵
PID:3620

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,1122591592864328060,8435332492920795573,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=74 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10692 /prefetch:1
5⤵
PID:8272

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,1122591592864328060,8435332492920795573,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=75 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10972 /prefetch:1
5⤵
PID:8452

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,1122591592864328060,8435332492920795573,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=76 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=11320 /prefetch:1
5⤵
PID:8612

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,1122591592864328060,8435332492920795573,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=78 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=11488 /prefetch:1
5⤵
PID:8892

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,1122591592864328060,8435332492920795573,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=80 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10300 /prefetch:1
5⤵
PID:8908

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,1122591592864328060,8435332492920795573,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=79 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=11600 /prefetch:1
5⤵
PID:8900

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,1122591592864328060,8435332492920795573,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=77 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10172 /prefetch:1
5⤵
PID:8884

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,1122591592864328060,8435332492920795573,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=81 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=12092 /prefetch:1
5⤵
PID:9156

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,1122591592864328060,8435332492920795573,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=82 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10224 /prefetch:1
5⤵
PID:8788

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,1122591592864328060,8435332492920795573,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=83 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=12512 /prefetch:1
5⤵
PID:8444

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,1122591592864328060,8435332492920795573,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=84 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10772 /prefetch:1
5⤵
PID:7612

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,1122591592864328060,8435332492920795573,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=85 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10992 /prefetch:1
5⤵
PID:4500

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,1122591592864328060,8435332492920795573,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=86 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=12652 /prefetch:1
5⤵
PID:8248

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,1122591592864328060,8435332492920795573,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=87 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=13364 /prefetch:1
5⤵
PID:9564

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,1122591592864328060,8435332492920795573,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=88 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=13636 /prefetch:1
5⤵
PID:9684

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,1122591592864328060,8435332492920795573,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=89 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=12804 /prefetch:1
5⤵
PID:9332

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,1122591592864328060,8435332492920795573,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=90 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=13212 /prefetch:1
5⤵
PID:9404

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,1122591592864328060,8435332492920795573,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=91 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10768 /prefetch:1
5⤵
PID:1076

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,1122591592864328060,8435332492920795573,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=92 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=12284 /prefetch:1
5⤵
PID:9460

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,1122591592864328060,8435332492920795573,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=93 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=12176 /prefetch:1
5⤵
PID:9948

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,1122591592864328060,8435332492920795573,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=94 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=13268 /prefetch:1
5⤵
PID:10028

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,1122591592864328060,8435332492920795573,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=98 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10536 /prefetch:1
5⤵
PID:10052

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,1122591592864328060,8435332492920795573,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=97 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=13448 /prefetch:1
5⤵
PID:224

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,1122591592864328060,8435332492920795573,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=96 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=13812 /prefetch:1
5⤵
PID:7436

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,1122591592864328060,8435332492920795573,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=95 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=13148 /prefetch:1
5⤵
PID:9636

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,1122591592864328060,8435332492920795573,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=99 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10120 /prefetch:1
5⤵
PID:9976

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,1122591592864328060,8435332492920795573,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=100 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=13468 /prefetch:1
5⤵
PID:1664

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,1122591592864328060,8435332492920795573,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=101 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=13932 /prefetch:1
5⤵
PID:7732

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,1122591592864328060,8435332492920795573,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=102 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10116 /prefetch:1
5⤵
PID:9676

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,1122591592864328060,8435332492920795573,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=103 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=11124 /prefetch:1
5⤵
PID:8316

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,1122591592864328060,8435332492920795573,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=104 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=14104 /prefetch:1
5⤵
PID:9992

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,1122591592864328060,8435332492920795573,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=105 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=12732 /prefetch:1
5⤵
PID:10232

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,1122591592864328060,8435332492920795573,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=106 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9808 /prefetch:1
5⤵
PID:9344

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,1122591592864328060,8435332492920795573,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=107 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=13968 /prefetch:1
5⤵
PID:1240

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,1122591592864328060,8435332492920795573,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=108 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=13836 /prefetch:1
5⤵
PID:10512

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,1122591592864328060,8435332492920795573,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=109 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=14064 /prefetch:1
5⤵
PID:10904

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe"
4⤵
PID:5300

C:\Windows\SysWOW64\control.exe
"C:\Windows\System32\control.exe"
4⤵
PID:316

C:\Windows\SysWOW64\regedit.exe
"C:\Windows\System32\regedit.exe"
4⤵
- Runs regedit.exe
PID:5308

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://google.co.ck/search?q=how+2+buy+weed
4⤵
PID:5888

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffeaa1d46f8,0x7ffeaa1d4708,0x7ffeaa1d4718
5⤵
PID:5236

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://play.clubpenguin.com/
4⤵
PID:5368

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffeaa1d46f8,0x7ffeaa1d4708,0x7ffeaa1d4718
5⤵
PID:3252

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://google.co.ck/search?q=how+2+buy+weed
4⤵
PID:4832

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffeaa1d46f8,0x7ffeaa1d4708,0x7ffeaa1d4718
5⤵
PID:7148

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://google.co.ck/search?q=bonzi+buddy+download+free
4⤵
PID:2952

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffeaa1d46f8,0x7ffeaa1d4708,0x7ffeaa1d4718
5⤵
PID:6124

C:\Windows\SysWOW64\mmc.exe
"C:\Windows\system32\mmc.exe" "C:\Windows\System32\devmgmt.msc"
4⤵
- Suspicious use of SetWindowsHookEx
PID:4312

C:\Windows\system32\mmc.exe
"C:\Windows\System32\devmgmt.msc" "C:\Windows\System32\devmgmt.msc"
5⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious use of SetWindowsHookEx
PID:940

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://google.co.ck/search?q=bonzi+buddy+download+free
4⤵
PID:6056

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x124,0x128,0x12c,0xf4,0x130,0x7ffeaa1d46f8,0x7ffeaa1d4708,0x7ffeaa1d4718
5⤵
PID:6440

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://google.co.ck/search?q=facebook+hacking+tool+free+download+no+virus+working+2016
4⤵
PID:972

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffeaa1d46f8,0x7ffeaa1d4708,0x7ffeaa1d4718
5⤵
PID:5688

C:\Windows\SysWOW64\mmc.exe
"C:\Windows\System32\mmc.exe"
4⤵
PID:2564

C:\Windows\system32\mmc.exe
"C:\Windows\system32\mmc.exe"
5⤵
PID:6272

C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe
"C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe"
4⤵
PID:980

C:\Windows\splwow64.exe
C:\Windows\splwow64.exe 12288
5⤵
PID:6432

C:\Windows\SysWOW64\regedit.exe
"C:\Windows\System32\regedit.exe"
4⤵
- Runs regedit.exe
PID:6592

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://google.co.ck/search?q=minecraft+hax+download+no+virus
4⤵
PID:5728

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x118,0x11c,0x120,0xb8,0x124,0x7ffeaa1d46f8,0x7ffeaa1d4708,0x7ffeaa1d4718
5⤵
PID:2240

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://pcoptimizerpro.com/
4⤵
PID:5680

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffeaa1d46f8,0x7ffeaa1d4708,0x7ffeaa1d4718
5⤵
PID:5700

C:\Windows\SysWOW64\regedit.exe
"C:\Windows\System32\regedit.exe"
4⤵
- Runs regedit.exe
PID:2196

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://google.co.ck/search?q=virus+builder+legit+free+download
4⤵
PID:4848

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x124,0x128,0x12c,0xf4,0x130,0x7ffeaa1d46f8,0x7ffeaa1d4708,0x7ffeaa1d4718
5⤵
PID:7056

C:\Windows\SysWOW64\control.exe
"C:\Windows\System32\control.exe"
4⤵
PID:6740

C:\Windows\SysWOW64\mmc.exe
"C:\Windows\system32\mmc.exe" "C:\Windows\System32\devmgmt.msc"
4⤵
PID:2760

C:\Windows\system32\mmc.exe
"C:\Windows\System32\devmgmt.msc" "C:\Windows\System32\devmgmt.msc"
5⤵
PID:5600

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe"
4⤵
PID:3052

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://google.co.ck/search?q=virus+builder+legit+free+download
4⤵
PID:4924

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffeaa1d46f8,0x7ffeaa1d4708,0x7ffeaa1d4718
5⤵
PID:4428

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe"
4⤵
PID:2068

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://google.co.ck/search?q=how+to+send+a+virus+to+my+friend
4⤵
PID:3572

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffeaa1d46f8,0x7ffeaa1d4708,0x7ffeaa1d4718
5⤵
PID:64

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://google.co.ck/search?q=bonzi+buddy+download+free
4⤵
PID:1864

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffeaa1d46f8,0x7ffeaa1d4708,0x7ffeaa1d4718
5⤵
PID:7160

C:\Windows\SysWOW64\notepad.exe
"C:\Windows\System32\notepad.exe"
4⤵
PID:6964

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://google.co.ck/search?q=what+happens+if+you+delete+system32
4⤵
PID:4824

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffeaa1d46f8,0x7ffeaa1d4708,0x7ffeaa1d4718
5⤵
PID:2612

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://google.co.ck/search?q=how+to+create+your+own+ransomware
4⤵
PID:5912

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffeaa1d46f8,0x7ffeaa1d4708,0x7ffeaa1d4718
5⤵
PID:3152

C:\Windows\SysWOW64\Taskmgr.exe
"C:\Windows\System32\Taskmgr.exe"
4⤵
PID:1628

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://play.clubpenguin.com/
4⤵
PID:5308

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffeaa1d46f8,0x7ffeaa1d4708,0x7ffeaa1d4718
5⤵
PID:6748

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://google.co.ck/search?q=my+computer+is+doing+weird+things+wtf+is+happenin+plz+halp
4⤵
PID:2060

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffeaa1d46f8,0x7ffeaa1d4708,0x7ffeaa1d4718
5⤵
PID:6980

C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe
"C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe"
4⤵
PID:5908

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://google.co.ck/search?q=how+to+get+money
4⤵
PID:7040

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffeaa1d46f8,0x7ffeaa1d4708,0x7ffeaa1d4718
5⤵
PID:6436

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://google.co.ck/search?q=best+way+to+kill+yourself
4⤵
PID:2544

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffeaa1d46f8,0x7ffeaa1d4708,0x7ffeaa1d4718
5⤵
PID:6656

C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe
"C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe"
4⤵
PID:2428

C:\Windows\SysWOW64\mmc.exe
"C:\Windows\System32\mmc.exe"
4⤵
PID:5356

C:\Windows\system32\mmc.exe
"C:\Windows\system32\mmc.exe"
5⤵
PID:6348

C:\Windows\SysWOW64\explorer.exe
"C:\Windows\System32\explorer.exe"
4⤵
PID:3816

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://google.co.ck/search?q=mcafee+vs+norton
4⤵
PID:2592

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffeaa1d46f8,0x7ffeaa1d4708,0x7ffeaa1d4718
5⤵
PID:2128

C:\Windows\SysWOW64\mspaint.exe
"C:\Windows\System32\mspaint.exe"
4⤵
PID:7788

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://google.co.ck/search?q=minecraft+hax+download+no+virus
4⤵
PID:7608

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffeaa1d46f8,0x7ffeaa1d4708,0x7ffeaa1d4718
5⤵
PID:7584

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://google.co.ck/search?q=how+to+remove+memz+trojan+virus
4⤵
PID:7448

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffeaa1d46f8,0x7ffeaa1d4708,0x7ffeaa1d4718
5⤵
PID:7464

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://google.co.ck/search?q=how+2+buy+weed
4⤵
PID:7088

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffeaa1d46f8,0x7ffeaa1d4708,0x7ffeaa1d4718
5⤵
PID:7676

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://google.co.ck/search?q=best+way+to+kill+yourself
4⤵
PID:7452

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffeaa1d46f8,0x7ffeaa1d4708,0x7ffeaa1d4718
5⤵
PID:6132

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://google.co.ck/search?q=how+to+send+a+virus+to+my+friend
4⤵
PID:5516

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffeaa1d46f8,0x7ffeaa1d4708,0x7ffeaa1d4718
5⤵
PID:7432

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://google.co.ck/search?q=virus+builder+legit+free+download
4⤵
PID:312

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffeaa1d46f8,0x7ffeaa1d4708,0x7ffeaa1d4718
5⤵
PID:7484

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe"
4⤵
PID:7924

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://google.co.ck/search?q=bonzi+buddy+download+free
4⤵
PID:7956

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffeaa1d46f8,0x7ffeaa1d4708,0x7ffeaa1d4718
5⤵
PID:8172

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://softonic.com/
4⤵
PID:5168

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffeaa1d46f8,0x7ffeaa1d4708,0x7ffeaa1d4718
5⤵
PID:7328

C:\Windows\SysWOW64\mmc.exe
"C:\Windows\system32\mmc.exe" "C:\Windows\System32\devmgmt.msc"
4⤵
PID:8804

C:\Windows\system32\mmc.exe
"C:\Windows\System32\devmgmt.msc" "C:\Windows\System32\devmgmt.msc"
5⤵
PID:8828

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://softonic.com/
4⤵
PID:8728

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x120,0x124,0x128,0xfc,0x12c,0x7ffeaa1d46f8,0x7ffeaa1d4708,0x7ffeaa1d4718
5⤵
PID:8724

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://google.co.ck/search?q=my+computer+is+doing+weird+things+wtf+is+happenin+plz+halp
4⤵
PID:7296

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffeaa1d46f8,0x7ffeaa1d4708,0x7ffeaa1d4718
5⤵
PID:680

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://google.co.ck/search?q=how+2+remove+a+virus
4⤵
PID:8136

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffeaa1d46f8,0x7ffeaa1d4708,0x7ffeaa1d4718
5⤵
PID:992

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://pcoptimizerpro.com/
4⤵
PID:9488

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffeaa1d46f8,0x7ffeaa1d4708,0x7ffeaa1d4718
5⤵
PID:9500

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://google.co.ck/search?q=how+2+buy+weed
4⤵
PID:10212

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffeaa1d46f8,0x7ffeaa1d4708,0x7ffeaa1d4718
5⤵
PID:10224

C:\Windows\SysWOW64\mmc.exe
"C:\Windows\system32\mmc.exe" "C:\Windows\System32\devmgmt.msc"
4⤵
PID:9812

C:\Windows\system32\mmc.exe
"C:\Windows\System32\devmgmt.msc" "C:\Windows\System32\devmgmt.msc"
5⤵
PID:9860

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://google.co.ck/search?q=my+computer+is+doing+weird+things+wtf+is+happenin+plz+halp
4⤵
PID:10172

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffeaa1d46f8,0x7ffeaa1d4708,0x7ffeaa1d4718
5⤵
PID:10192

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://google.co.ck/search?q=my+computer+is+doing+weird+things+wtf+is+happenin+plz+halp
4⤵
PID:9836

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffeaa1d46f8,0x7ffeaa1d4708,0x7ffeaa1d4718
5⤵
PID:9888

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://google.co.ck/search?q=batch+virus+download
4⤵
PID:9820

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0xf4,0xf8,0x124,0x7ffeaa1d46f8,0x7ffeaa1d4708,0x7ffeaa1d4718
5⤵
PID:9844

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe"
4⤵
PID:7600

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://google.co.ck/search?q=my+computer+is+doing+weird+things+wtf+is+happenin+plz+halp
4⤵
PID:9936

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffeaa1d46f8,0x7ffeaa1d4708,0x7ffeaa1d4718
5⤵
PID:9920

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://play.clubpenguin.com/
4⤵
PID:9784

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffeaa1d46f8,0x7ffeaa1d4708,0x7ffeaa1d4718
5⤵
PID:9124

C:\Windows\SysWOW64\mspaint.exe
"C:\Windows\System32\mspaint.exe"
4⤵
PID:9776

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://google.co.ck/search?q=how+to+send+a+virus+to+my+friend
4⤵
PID:6028

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffeaa1d46f8,0x7ffeaa1d4708,0x7ffeaa1d4718
5⤵
PID:9664

C:\Windows\SysWOW64\regedit.exe
"C:\Windows\System32\regedit.exe"
4⤵
- Runs regedit.exe
PID:8292

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://google.co.ck/search?q=facebook+hacking+tool+free+download+no+virus+working+2016
4⤵
PID:1076

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x118,0x11c,0x120,0xe0,0x124,0x7ffeaa1d46f8,0x7ffeaa1d4708,0x7ffeaa1d4718
5⤵
PID:4492

C:\Windows\SysWOW64\explorer.exe
"C:\Windows\System32\explorer.exe"
4⤵
PID:9672

C:\Windows\SysWOW64\regedit.exe
"C:\Windows\System32\regedit.exe"
4⤵
- Runs regedit.exe
PID:6280

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://softonic.com/
4⤵
PID:9616

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffeaa1d46f8,0x7ffeaa1d4708,0x7ffeaa1d4718
5⤵
PID:7488

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://softonic.com/
4⤵
PID:10356

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0x118,0x128,0x7ffeaa1d46f8,0x7ffeaa1d4708,0x7ffeaa1d4718
5⤵
PID:10372

C:\Windows\SysWOW64\calc.exe
"C:\Windows\System32\calc.exe"
4⤵
PID:11084

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1748

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Adds Run key to start application
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3116

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffeb25a9758,0x7ffeb25a9768,0x7ffeb25a9778
2⤵
PID:4336

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1792 --field-trial-handle=1808,i,17967292547720574224,9030332217675428371,131072 /prefetch:2
2⤵
PID:1484

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2180 --field-trial-handle=1808,i,17967292547720574224,9030332217675428371,131072 /prefetch:8
2⤵
PID:3204

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2220 --field-trial-handle=1808,i,17967292547720574224,9030332217675428371,131072 /prefetch:8
2⤵
PID:2972

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3160 --field-trial-handle=1808,i,17967292547720574224,9030332217675428371,131072 /prefetch:1
2⤵
PID:3396

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3180 --field-trial-handle=1808,i,17967292547720574224,9030332217675428371,131072 /prefetch:1
2⤵
PID:2996

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4612 --field-trial-handle=1808,i,17967292547720574224,9030332217675428371,131072 /prefetch:1
2⤵
PID:1768

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4756 --field-trial-handle=1808,i,17967292547720574224,9030332217675428371,131072 /prefetch:8
2⤵
PID:1864

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4748 --field-trial-handle=1808,i,17967292547720574224,9030332217675428371,131072 /prefetch:8
2⤵
PID:2884

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5456 --field-trial-handle=1808,i,17967292547720574224,9030332217675428371,131072 /prefetch:8
2⤵
PID:5392

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=4792 --field-trial-handle=1808,i,17967292547720574224,9030332217675428371,131072 /prefetch:1
2⤵
PID:5760

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=5616 --field-trial-handle=1808,i,17967292547720574224,9030332217675428371,131072 /prefetch:1
2⤵
PID:5944

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=4364 --field-trial-handle=1808,i,17967292547720574224,9030332217675428371,131072 /prefetch:1
2⤵
PID:4676

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=3228 --field-trial-handle=1808,i,17967292547720574224,9030332217675428371,131072 /prefetch:8
2⤵
PID:5992

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5876 --field-trial-handle=1808,i,17967292547720574224,9030332217675428371,131072 /prefetch:8
2⤵
PID:1208

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4660 --field-trial-handle=1808,i,17967292547720574224,9030332217675428371,131072 /prefetch:8
2⤵
- Modifies registry class
PID:5488

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3352 --field-trial-handle=1808,i,17967292547720574224,9030332217675428371,131072 /prefetch:8
2⤵
PID:5248

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5516 --field-trial-handle=1808,i,17967292547720574224,9030332217675428371,131072 /prefetch:2
2⤵
PID:2824

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe"
1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:3784

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe"
1⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:5076

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
2⤵
PID:3844

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=5094178BAF84E34E27951370BBE95C92 --mojo-platform-channel-handle=1708 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
3⤵
PID:5040

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=8DE7D2F465E4C3D9B030BD9DB77C0C31 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=8DE7D2F465E4C3D9B030BD9DB77C0C31 --renderer-client-id=2 --mojo-platform-channel-handle=1736 --allow-no-sandbox-job /prefetch:1
3⤵
PID:2592

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=055255C3DECD835DEEC08F4CEEDF07EC --mojo-platform-channel-handle=2272 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
3⤵
PID:3544

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=DE46A9F85CAE1883863CF71A12EF6E3E --mojo-platform-channel-handle=1828 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
3⤵
PID:5168

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=8E5261195A67D0EDADB2053C05A4A3D5 --mojo-platform-channel-handle=1712 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
3⤵
PID:5260

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:1640

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2700

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x404 0x4b4
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4776

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{5BD95610-9434-43C2-886C-57852CC8A120} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
PID:1476

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
1⤵
PID:3480

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k wsappx -p -s AppXSvc
1⤵
PID:4616

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc
1⤵
PID:6808

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService
1⤵
PID:7912

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:11212

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Bootkit

T1067

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Peripheral Device Discovery

T1120

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Filesize
36KB

MD5
b30d3becc8731792523d599d949e63f5

SHA1
19350257e42d7aee17fb3bf139a9d3adb330fad4

SHA256
b1b77e96279ead2b460de3de70e2ea4f5ad1b853598a4e27a5caf3f1a32cc4f3

SHA512
523f54895fb07f62b9a5f72c8b62e83d4d9506bda57b183818615f6eb7286e3b9c5a50409bc5c5164867c3ccdeae88aa395ecca6bc7e36d991552f857510792e

Download Submit
C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Filesize
56KB

MD5
752a1f26b18748311b691c7d8fc20633

SHA1
c1f8e83eebc1cc1e9b88c773338eb09ff82ab862

SHA256
111dac2948e4cecb10b0d2e10d8afaa663d78d643826b592d6414a1fd77cc131

SHA512
a2f5f262faf2c3e9756da94b2c47787ce3a9391b5bd53581578aa9a764449e114836704d6dec4aadc097fed4c818831baa11affa1eb25be2bfad9349bb090fe5

Download Submit
C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Filesize
64KB

MD5
755587c1a2c8c80aa9c825013dd0037e

SHA1
095802adbd8af694b97b680697e62120c5b2cb6b

SHA256
4b7fbf6e712946f20d8dc5fb2e0f6e2a65a4073f301f918e307d359b24f1ed83

SHA512
6f2a3e551f83187cb3c143275e090904dca201540090d540272db86016438b8aa044d57cdfc87db0aef66e7f8dbb775ce9a39d51dddb2f9f65edf0e51eb4af4a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04
Filesize
471B

MD5
8b4d27b4293775376543799e03ebf511

SHA1
58733c656c4cb94e4fc74afa19cc5157e8eede7c

SHA256
d297babe46f5aaf95335099146855e5a628621c165c51d8ab480af6ed6c548dd

SHA512
d22b4879f6592a685b1c8f90b00cd464df4e339744b98fd0464ae1165c0289dca33a15c8c6669738aec684a8ee583796f9afcdb445ac3bad885a3016fd2d14a3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04
Filesize
430B

MD5
c61966f1066521e7ec00676d3be50699

SHA1
0eb2d05d1c3fcdbf1829aae790903662ebcf7fe6

SHA256
b04bf0313667f5eab4ac9e30e78f2fee7c1d54b9a21a2dd3d838cbd928099448

SHA512
b7bdf3fbc631ac59de89f0a814f3f5f410a8b988e6e1fbe98cde7ff5e90196eeda6c2611dedb7f278de2eed3a1172d24267c2e3f72eb26c18bb2934246a457c4

Download Submit
C:\Users\Admin\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents
Filesize
12KB

MD5
abdb4d461be3da2cba206fdf9c2741e5

SHA1
3428e4fa9140d9da8e41b092f511b95af6802521

SHA256
c785f5d3ccaf29fbfbc0fd8c7811ee1cf07a785c11c52866b3be26899266fdec

SHA512
cbd4b5645633b5cfd46b93a152c7c357ce43d54764733ae3eb2b2c9f31782588c3dd32d3e057556da4449d9f12218c3e04c2c5546b2355e72552c5710d24f133

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000a
Filesize
22KB

MD5
a34c77847d7a957a99edaf10a7deaccd

SHA1
1619cedec658842283a7a474adba2efdcb0d3598

SHA256
ebee5d0011bcd484c4e7067822a1bcac208a0d03a33fced5c6a222666df67350

SHA512
afe20d031816081eba10587141518fbce91ed5f3b44fa002a593f784603d4b2007c89713cd6d9ef3eee3ecb8b53a57ecd078826ba0fcc5d02f2b7de814dd1b7c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000b
Filesize
1.6MB

MD5
6b1275d40a481add93c024cee90ca5c1

SHA1
5393a6451876fd627b43f451a5767c11b38ffe84

SHA256
409a5e4ed7ad0a59238727004b97f28657620bf01d1e400d0b28dacec50a777e

SHA512
fa06b79912a9be3888eed4b1d8ef9427918f64dec0ea40333e9baab12d8f807c6874a23ff4c86099e44d7c41cdd20a1a7e8cd34d71728f6b0ca6c1ac6520958f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000e
Filesize
30KB

MD5
7e897d66ee94831b3c858558360c300e

SHA1
eb6e58a6b781169493bb4172dd97b481d94c323e

SHA256
b8661c9af20eb7aaf65db725c41b186f75e7dd64f845f74bcc83181649ebe8ce

SHA512
5ddd025dae1329bbbe032d9f217a66dd0d0a99ae7f23e4b0cf02977a468b608da78deff953a02495d704b4ee6fd41d74b5b5723fae25252f887a36bfe3a893b7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
480B

MD5
02eaa91433b5b29b66cca8d145265e8a

SHA1
19dfee5c5474dc8822c45e319bc6bcd48006d009

SHA256
724a1fe2462cf61497cc38d69b5d487c4709e8ccd6ade209f7ae060181c17c74

SHA512
0bb336d9975b1059e16a1799e7d2736af07afd1bb4ac9c8f913b771d035b10a0c782f5572e13235945671cfbe2f47e0791c25293d423987a60dde30e8bb07be2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\9ed82463-501f-4dff-b821-ea1009d52452.tmp
Filesize
707B

MD5
6380fd58541ef1a2af9ef18fe891521e

SHA1
a2168d21b91f0fcd50ad012967f64503247ddce2

SHA256
b740994f919ae2179776093a933fdbd4f0b7be572c2fe05a1826f92c88a1e842

SHA512
cc263d54ec64169f71b53c1d03c190531af2f3ecb324d7822ac25b8733b00f2f4f8644e32fa7773656b4a8e48eb69d6310d35c1f5426c4ed17761e0cf5dde3be

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Filesize
3KB

MD5
ad125902fb86cfd312e734fc3d342e3e

SHA1
9c8477216c32936b78116ef8937886efde960af8

SHA256
aba0e7dfde01400b32b4c7cdefc54cc13515623c04a8461645b46eedee53660f

SHA512
ff96a163da4d9c61dee9047fc4872eaae27f769eb34049ff82e7ccfdf7a0ba7c6832976dd7303d3fe0e5b6cbeea6f8a26e96f7b197800f69ba78ad13ed5c36bc

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Filesize
4KB

MD5
7da5a9c43cfeeeaca69c065e626e11d8

SHA1
a60eccd85028a3aa186e9b93a5c5ef77a3f0110a

SHA256
8850b78ebbf029ba570a8d951e6f868ea9fd7fc1c5b398f7a91415ace7c714ed

SHA512
9b839555fbc8bee8fb06ef14252ba2385975cf8baf771306d597cb694e3a57fae612a765db932941189c79c2861806b0fc7fa972ba1ef9f3906f9cb65f6da5a8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
371B

MD5
f8601a57f76e584f6e9255053b7fc7b9

SHA1
5f7c81bdf770c1ef487b595435f6127bbbf4127a

SHA256
6a36eee518775ce9a705dbf0031195b79cad2e147ed1609289ca6fcf976a1758

SHA512
7d526d856592c29ffb611cc05cada7eb96b39f2bd22c6ca1f92a6d1f1ec00bdfa9373bbef447924a35e452a8ff0e05ff9a896222be5f70e3635be039dbae3606

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
874B

MD5
5c62082dbe57da7a8fcdec4ac90c0962

SHA1
e94b2d293e22abace31f835d2d146948eb458249

SHA256
093dd556d3c2c40edcebf3f23c1848fb7b7299eef9d0d3cf9abfb7601cccac03

SHA512
d1d017c7e1db2664397162fb55db162d2b5c03531b1ad15c04e3735a98553abeb2f8e3a582d9f92a01820fe1dd84c2d0f51633585fa67e4b443d24d515dce468

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
4KB

MD5
5987c1cb9429cecbf80849b4895a26ae

SHA1
d8400fc176b218dd21d279909d262d6a4fd06169

SHA256
eed704b6451c0042397791f3a07cde3db2bfbd1cf7913785a2e4eef6788a625c

SHA512
9585accdaf647b4431a4d8d3088f91e81791c4b252de41f569c3a227774c8b08b2f66ef925a0dc0f317a550f51634f9495d4c78cb96d86a81a33bd83461efc9d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
6KB

MD5
4ba33aa1f1e524d09160bb4dc077231f

SHA1
b09fddc0cf6c42c83d7b12a1055a7c92478c6307

SHA256
61f280d5019ad0fa154507318b2373e8a978e0e135342d64ec7544341f60cf07

SHA512
bd0cf3cfc087f1fd1ab29e77ae431f4e472c9e9760d9c7b2fb5709a5c9c3935f8fd772297b232bfc4e006b512277530618315d2b4b0b72d6397c9b763922b793

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
6KB

MD5
d5d100c4bb5de387e34ddf6377a2adcf

SHA1
f738298d85ce3bae13f29107ef0d49f81d427241

SHA256
4a3781900e0a77d7ee7b77269669a0ef33a077c6bb90b2a261361ac0ba3aa2d9

SHA512
bb668ff080e81644a17049a19857d91ca967b8de4147007daf29c19638633922ccee5beb95936818ed55645f6c34f5923c1fb0ed566eb8b0d016e28bd5756b22

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\e5ea83c6-4b5c-4c95-9c49-ecf747dfbf79\index-dir\the-real-index
Filesize
624B

MD5
5818b5ff0e2f0a70843b0de1b847553a

SHA1
61c9f55d7898880905f52849a1f442c598abdaca

SHA256
3eb2eb0724c05689de1aeb9b109dde62c7491c748cb3a6a3df810d18eec0a64f

SHA512
bb4bbc19e47d37239c92bf316911634be626393ce31bfb42f7c0ea19ff4a336a99774b22c54c153ccc3084d2be3adbb4b15847a7bd28eb5a783718f1dde79e6d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\e5ea83c6-4b5c-4c95-9c49-ecf747dfbf79\index-dir\the-real-index~RFe585668.TMP
Filesize
48B

MD5
8d282bdc448d8fb61258e6fe3c87f81b

SHA1
71f474795ea34ac587126335f0ac153f33ec1bb0

SHA256
75d3390b8bbd3308cb2836354b8c1c97831fc1e0ad65577ef4a162f59c33eef2

SHA512
82611d2fcac80a3b31578e19dd3817ba667d3282b811dbb184b7fda51bc472a2712c590f2a0d421290668ef2e1ddcee4c5d20f6cf9967835dec5043271e66cc2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Filesize
56B

MD5
ae1bccd6831ebfe5ad03b482ee266e4f

SHA1
01f4179f48f1af383b275d7ee338dd160b6f558a

SHA256
1b11047e738f76c94c9d15ee981ec46b286a54def1a7852ca1ade7f908988649

SHA512
baf7ff6747f30e542c254f46a9678b9dbf42312933962c391b79eca6fcb615e4ba9283c00f554d6021e594f18c087899bc9b5362c41c0d6f862bba7fb9f83038

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Filesize
129B

MD5
73e89476d433f67cda267338d227a649

SHA1
abb452bd5eed14993560e0191798ee4b162c94e1

SHA256
d73131060f4297538a8ce991a794319e4e90b305178a130fd846951bd0772c41

SHA512
a8f6ee37f6428fbc3455682a35d33a5113d95ae478f2b0c72f0c16b1c552d0d936217ab4485c8b6f5f4201aed29fd6ce04970ca344a802acf5505ede7e01829b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Filesize
125B

MD5
9d83b2dbc2a7bf402c3ab0099cdd8bcf

SHA1
bebf41c9ab8a196e64b0cfc07bb5e8204d7dc7ea

SHA256
0eb3e290bcc07d1bd2597084f9a2bebc7d7bb51b32b5662232c7eca4cce90c7f

SHA512
1ec96daa9483fd8928b893b420a482e30dd73272b89674bfe02dbdb26473dc4718dea982fc1fb6e0f2037912f432a07bf9b7beb280d920240a5f26f338ef8efc

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt~RFe57e6e5.TMP
Filesize
120B

MD5
baf83bec0f6e444719b1df02f7d6ec1c

SHA1
c1540f6309e36769057b981a93574ac181d52c8b

SHA256
0f0f7a2dda1cbc4f515725750892b93aa37ac2453840aeee192290fd8da0f77a

SHA512
d8fbcdd57da6c36291a07cd6b61ffe04f4f9d3bd1f234bf1570b88b90974714a49251c107249941364f9594f104bf5d73e1efbd47ffe05a82579a461ccf998f5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Filesize
96B

MD5
d49ba4af5fa64f4754d7d1da24f5f361

SHA1
06d14960b445ebf01745fb736e9eeaa6024e6eb2

SHA256
c2f441b36017cabb42ed40eca080c8ab352e5550991e1b5d04e1fb6bb67bf85d

SHA512
9cf7b9b0aba83863d1b7f1a5fe54afbd6f62227db155f446e975ca4912117f4446384456d001ae802e1f2b3033ab82c3239d9c1fc5c7610bf7290784f3e78e5c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58430f.TMP
Filesize
48B

MD5
a7d2e60b456a4e7bfc021ad7e7e28e3b

SHA1
69a1c516850417acd1ae6c12b8d69d160c3704f9

SHA256
1e93350316d32e07b8e96dcd638e90c03f3c5c85f383f508c96e8f2443665813

SHA512
91287321f57afaf7cee54991dc1aea699850338a8fec4c0e0eece345829d8196e05166ba98f326644149b4d990066023e7be9b51ee753958bede0c20d2c3955a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\eccb5349-d081-4710-bb34-50208d6b4020.tmp
Filesize
5KB

MD5
73d05b3d3c76f74870d9516c08e8f9c9

SHA1
ab1a1971e7f704abb6fe9b4ef4307d6f17331835

SHA256
a18efc566f3e8a7bd56cc08853138719fd9377241f1acaef6a3cfdfa59d89c42

SHA512
ff0452d4cc97ea65ba57f79f305ea7ba27e8f8d016e27326033063e5cf114f1202a94bbaa12ebe2faa674d40c53fee485598c32ef9a118c54cc3e8328f3b9b22

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Filesize
200KB

MD5
cd26dc420a89191739d40522fd03f38c

SHA1
013f8d27b442d07a47e6ce61d9d6c8e329b01c1c

SHA256
fe19182d94a0e3442f0ba41aa7a93101b87069c74702a9f5511bffe5e7f65dd2

SHA512
ece83e3f6c9d80fd3436fc344d197e93e164d030fa51dddb508fc1e3f904ca2cbe881c6a791d26b65cf890d58ead6c464e65e22ea985affddc735f44c3e42d91

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Filesize
200KB

MD5
cd26dc420a89191739d40522fd03f38c

SHA1
013f8d27b442d07a47e6ce61d9d6c8e329b01c1c

SHA256
fe19182d94a0e3442f0ba41aa7a93101b87069c74702a9f5511bffe5e7f65dd2

SHA512
ece83e3f6c9d80fd3436fc344d197e93e164d030fa51dddb508fc1e3f904ca2cbe881c6a791d26b65cf890d58ead6c464e65e22ea985affddc735f44c3e42d91

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Filesize
200KB

MD5
ea84fc87cbe36c9969773469adfa2ffd

SHA1
e4fcaed80be9b2a53ae047b3b817204e6ead7d39

SHA256
784dc06ceb89f6f453dfe7f698ebd4f54328699c36b652448de9d13b64d4da54

SHA512
f47b38debc655d5ba46f8d20aeb6d6f32c3e6a83ee8fef05d176b3443aa968c4ffc0ed3a6da5ad198cc61f29063f4ef1f7c91b8958774b6d230446ba188ca47a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ea78c424-7978-43c9-8125-f21266c67500.tmp
Filesize
200KB

MD5
079a9f2bf8598db6831e728ae71e4402

SHA1
36fb35f81f5037a454766a8f95cc4979ad4013f3

SHA256
af6f59dcd8f332838ce926dba8b7a24823397a2ca67360d667b88331dc758773

SHA512
01e7d4469239fb9eaf224bef626c50edb717aac57936a972d3ed37f24091b483e718ec9cc41d2e8cefbd4c7059eba5dcb296afee71ed595c7d3560c9b5fef401

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
65621744863bc73bfc8816ca10cf29ba

SHA1
028b975c9b485e74162bd2692c6b5c5a304b2ac7

SHA256
b0d6a73c6c76b2c9f68dcb709d78f20c8337c97eff1ccd2dc45a5b827ab97d2f

SHA512
badba897706c97d897e1e768bc7aa776f7c4824272985bc83aabc75608312363b7035d71654b2463bb25fbc61eb8529fcdf40791ffd2d1834d638d269c6af836

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
65621744863bc73bfc8816ca10cf29ba

SHA1
028b975c9b485e74162bd2692c6b5c5a304b2ac7

SHA256
b0d6a73c6c76b2c9f68dcb709d78f20c8337c97eff1ccd2dc45a5b827ab97d2f

SHA512
badba897706c97d897e1e768bc7aa776f7c4824272985bc83aabc75608312363b7035d71654b2463bb25fbc61eb8529fcdf40791ffd2d1834d638d269c6af836

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
65621744863bc73bfc8816ca10cf29ba

SHA1
028b975c9b485e74162bd2692c6b5c5a304b2ac7

SHA256
b0d6a73c6c76b2c9f68dcb709d78f20c8337c97eff1ccd2dc45a5b827ab97d2f

SHA512
badba897706c97d897e1e768bc7aa776f7c4824272985bc83aabc75608312363b7035d71654b2463bb25fbc61eb8529fcdf40791ffd2d1834d638d269c6af836

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
65621744863bc73bfc8816ca10cf29ba

SHA1
028b975c9b485e74162bd2692c6b5c5a304b2ac7

SHA256
b0d6a73c6c76b2c9f68dcb709d78f20c8337c97eff1ccd2dc45a5b827ab97d2f

SHA512
badba897706c97d897e1e768bc7aa776f7c4824272985bc83aabc75608312363b7035d71654b2463bb25fbc61eb8529fcdf40791ffd2d1834d638d269c6af836

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
65621744863bc73bfc8816ca10cf29ba

SHA1
028b975c9b485e74162bd2692c6b5c5a304b2ac7

SHA256
b0d6a73c6c76b2c9f68dcb709d78f20c8337c97eff1ccd2dc45a5b827ab97d2f

SHA512
badba897706c97d897e1e768bc7aa776f7c4824272985bc83aabc75608312363b7035d71654b2463bb25fbc61eb8529fcdf40791ffd2d1834d638d269c6af836

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
65621744863bc73bfc8816ca10cf29ba

SHA1
028b975c9b485e74162bd2692c6b5c5a304b2ac7

SHA256
b0d6a73c6c76b2c9f68dcb709d78f20c8337c97eff1ccd2dc45a5b827ab97d2f

SHA512
badba897706c97d897e1e768bc7aa776f7c4824272985bc83aabc75608312363b7035d71654b2463bb25fbc61eb8529fcdf40791ffd2d1834d638d269c6af836

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
0553e98abd27fede2581f887db576240

SHA1
5b9102857b4007fdb4f1b3ceba044567825b9b07

SHA256
1064e20260a43e4f31f4f3904bd9334bd65433a8d23efa89ed26f60a0524cad0

SHA512
d9b8060f1d9ee4cb8713f3825515acbeada094e90edb3eccb4fdd64510391317295045891d3fff7a9979b05fb421e7fde01a16fff4d6d91c70691a6ad4cd5529

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
1a1b4a5026f49a8d24ef2134eb8c3bd8

SHA1
7b5769b5fefde9d46d9576731866131c6aae0dbc

SHA256
283478e9874256c1fe6db63d748fd5171ac69567edd1cb8adfad2d67bc897bd6

SHA512
3d6f810d7b7903406027bc2ec6b99ce267a5e0fc9376f2e64058019ff63f31a15a67e782adac6516ceef88c8fc382eb54e958e766102fd3fdbce1d989c13d1c9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
94df551497d6396172b7de8d41974af0

SHA1
ba7b223f4d63fb47352c7dcdbeee82282cd6c958

SHA256
64ceef974bf1e3b25712a34339d8251f03ab12e691d70a57a8f7407933e8ba07

SHA512
4365012147e7aff6558abf1eb68b0f819a6bce11d035847a67fbf5401c04afe98965c0ebcb22bcd010d7fdca9be51925923ab387fdde7b7275fba6dab4c18aed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
621b6016e2c22645e5af7d824b2fed67

SHA1
46d988e74469ad6fa1df708558378da2b74310ca

SHA256
b53a50356b3ebfca74f09e392fcd556f7d71b277471ea8523b923789779e7384

SHA512
f76ca43df4b9f038773452bad0e40ca0c3981dfc57be534f7ce2b525eae9340413c903e6f0d0978f10f4713b23735c5e1f20e5675f9350c52cf694b74bfd8b0b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
782ea180f280ce7662f99c13191f4baa

SHA1
9a8989f7f7e2ceab240220758b2f53ecf9b8eece

SHA256
ae8e801b3b2c7ca704731c299283e2e5d5ac2967dbf575174a986a42e24838ed

SHA512
f90e482e14eede64738692f97fab13537103fcf1ce54cc83683083f16db0040f304d4e323d2130f4c7bb29222f3b75a7578b0ccb7ac2eb126ce1efff43a016be

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
b8c9383861d9295966a7f745d7b76a13

SHA1
d77273648971ec19128c344f78a8ffeb8a246645

SHA256
b75207c223dfc38fbb3dbf03107043a7dce74129d88053c9316350c97ac26d2e

SHA512
094e6978e09a6e762022e8ff57935a26b3171a0627639ca91a373bddd06092241d695b9f3b609ba60bc28e78a5c78cf0f072d79cd5769f1b9f6d873169f0df14

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
91fa8f2ee8bf3996b6df4639f7ca34f7

SHA1
221b470deb37961c3ebbcc42a1a63e76fb3fe830

SHA256
e8e0588b16d612fa9d9989d16b729c082b4dd9bfca62564050cdb8ed03dd7068

SHA512
5415cd41f2f3bb5d9c7dadc59e347994444321cf8abe346b08e8c5a3fc6a5adae910eda43b4251ba4e317fbb7696c45dba9fd5e7fa61144c9b947206c7b999c4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\61f0fae5-d892-40b0-924a-3a24235bc593.tmp
Filesize
17KB

MD5
e865af0ab835ee71f2b67767a6682cbb

SHA1
6b79b679840a979e67542ec31566841f86b9dd3e

SHA256
e79c0b922dffcf6c9d62e9f04abd220b173a514f4f51d4186f70ece7b6b18217

SHA512
6825f67fee48ac9a0fb5e2322fed1f1e9c32706878d3cc9251fea8778569a01511a7a8ad43fcceb44e9f13a983b7f1a21f7cf252657c24ea20709e7b0474e05a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000002
Filesize
20KB

MD5
923a543cc619ea568f91b723d9fb1ef0

SHA1
6f4ade25559645c741d7327c6e16521e43d7e1f9

SHA256
bf7344209edb1be5a2886c425cf6334a102d76cbea1471fd50171e2ee92877cd

SHA512
a4153751761cd67465374828b0514d7773b8c4ed37779d1ecfd4f19be4faa171585c8ee0b4db59b556399d5d2b9809ba87e04d4715e9d090e1f488d02219d555

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000003
Filesize
329KB

MD5
3ae81f0e48a496e1b00d5cc77e5fdae5

SHA1
6d04d88c4db8a775c59d2bb067a4f10f3acc00fa

SHA256
d257740df56ccf1e53eb46e5b7451577f6767e279a345a48862c7e64c216dd2b

SHA512
b3513b7ca7c3e79b1933524aa3debb0a39193de6a094b6358563302ae40775be4c08db74db0bd36daf810e5783028c8e3c63cc3ae26b466c2face795b4c25827

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000007
Filesize
37KB

MD5
47ae9b25af86702d77c7895ac6f6b57c

SHA1
f56f78729b99247a975620a1103cac3ee9f313a5

SHA256
9bde79a1b0866f68d6baa43f920e971b5feb35a8e0af7ffadc114366f8538224

SHA512
72b5296e3dd1c5b4c42d8c3e4a56693819779167b9f02bc2d5f5a626b519a9cf10bee59846d614c929c42094b65d13039f6024f6cb1c023e740969aaefd060c4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000033
Filesize
50KB

MD5
6d81cd0d857a5d1728e08c77b9b0ae22

SHA1
3cc0e10ffa948e94df63f20a66f5190224c57d07

SHA256
703521ee76a6b56c41ea6bec08e91e25e64705acfce7abfc2ff9e75c3d92b2b4

SHA512
9d0cea67338db2e97b58f30e25c702aaeaa41ea0f480a5b2b0c8e9d2935e4ae65c10b1186507a5bcd86540c6b333b5856fe0902146e1a9ce57cd4ed0eb67d959

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000035
Filesize
613KB

MD5
117a24f8df93cb18f513ca58d426ad41

SHA1
cfc25336c98be31856a0d4a064c9119033a95ea8

SHA256
6914dd9ba2bdc56c2dc31ffa487b61b71240d238445d99d1cfd1ff395dc0692d

SHA512
406bfcf17969f06e17dab79005db344ea3bf6bfde4a0891fd4314aebf7e0f21e49364a7c4c3a160908b9f5d2dba6c93ed481ce32139cb7d17540f0eb84aa8285

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000036
Filesize
35KB

MD5
aef13a646c7327cbd4a6d3bcebb034db

SHA1
7d9ee720386efcddc69c6d6f810732f5debfd067

SHA256
e22cf8b805411472bc63a30289ad2fddf603a0d4fb1f7ad6ba5a72511da75412

SHA512
ded8aad01610fd13228905f618dc5f6954fc4a175f4ddafb681bb504b1990d75b6c00d55907f8b25ee8aefbe35fbcd3966dd5de8d69351c83bc725ff554416b7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000039
Filesize
37KB

MD5
ae2b5e6fd36c38beb90ca24ed95ddb5d

SHA1
b447190bb67f2a881b718f6cc70a136d698fc5fd

SHA256
cf22d1a1efc7c1aae3bc34d87149304a0198ddd635df1d73ba4c87dac536a136

SHA512
5bc508d40dc2d9f2b81582ad828ed01e0895db01178a3189383e58723597651f314b80c6c1ad16300dd8f886cc64d3bb9131d58e0f71f46bc3cb92d15a096db8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00003a
Filesize
47KB

MD5
5b611912157812382ae02bde399ff48f

SHA1
6089fbf66004233d7f64b590c883156200df8c54

SHA256
8495adbc7f8e03685d4b40ee4141a989d53f96dd1c95588612fd6c3acd77ecb1

SHA512
357afe88b2addb2a73d164d552feb20b73b576d53027442a983e35e64c395d7a469d0b851f2715a0febb6534359b7323a050d87a2226969adfbdd43e99653707

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00003b
Filesize
18KB

MD5
45f4d9e7d2e260e8288babc1c6509235

SHA1
00b2ff2b04aeae39c3a1acd010c8814bf9f775e9

SHA256
9e0bba84f77cc947769f33b6a9595f95bca6f04e76b38d3f6be385e6c00837a7

SHA512
f2da98b6c541267dd2847a230aa9bd7589b4fcf8e0cba30aaa0314f92146981ec654506e005b9b5d33bd23b6cea8fca0c6953260943bd1200cdc33cc903550e9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00003c
Filesize
46KB

MD5
50e7c652cf5d57d97906cc8c89cccec8

SHA1
b44c48b98c90686ac69762412e87099693cfe308

SHA256
17fdc0f29e08e58b3157887e3d01f54eb089ceb07ee1f11e7c23b8aaf24d17f0

SHA512
5b9f0ed5d62b92b85a56b3d3636f5b3f2b00b7c0ad1a29a7a8a15a9d41ffc09230c71631d50a8912884e64b6aecabfd88a41eb0eba41a7590a6979cf71ec4668

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00003d
Filesize
32KB

MD5
4956a5a7644eeec3c23c11c34eb8d8cc

SHA1
a5a07b734e130facc24e0d45b3931d23c4858174

SHA256
0cdbb6cc76b5af1f50459c53cdac5a883736b1e78c22d3876ab127646790a9c5

SHA512
bfdc9b07e753b76f84ddda98efd611ae26dfb44be5032b1a01563e18e829fb6f6b43f03d09239b054dbd1fe599edea8ea291e3b9e15725367b7bfcfeedd77d5e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00003e
Filesize
46KB

MD5
baff94c63010c402a48da7cb2ef08bf8

SHA1
a6bc98e9fe1b1dc9dbf168e7a781476ea95e7407

SHA256
517b17052575e9e90f98e7e3ddefb178cc2ac72ff02b779ff488fbcbf9bf9adf

SHA512
d939db777208d103c46c6905e497211e7e872c601a7fc6763103cffc0d9f90ca0ee0ba6269e70fb17054deaf96efa26e378c904a95206f27f225ef2d5a32bfd4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00003f
Filesize
59KB

MD5
c6b0f95171fa2aa59458f9c82f36fa41

SHA1
203e9f34c6b963cd318b7eaa65d35b036a88fb5a

SHA256
839ed500777fea51856b087dc772416bb529be3fcc980bd735c40abfe522d322

SHA512
da87caa4c81a4dcf662bc7f81cff9332964cc21d8022c53ff7abd8fc9936a31230586172ceeb9d13d483e061b6ed990ea52cd8fa609846b25b0b7b792d37a3c1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000040
Filesize
23KB

MD5
1eb089bc02718406772cb599d62a0fe0

SHA1
ee6372c7be0c7cd4d5071da68c9475e4dde618bb

SHA256
d6b3ba9d8328f4c7c57f25b4d08047f1bf05cfbc0f50783c99cb6ecd377c7439

SHA512
109bba3c5faa1307fe5e349a80ba89e5230f58b9523552c52cc73407ad10c390ee3f9c99f52127845b76823b4e8ab6311cb403bdd83b48385af77a6abd7c8477

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000041
Filesize
19KB

MD5
ca7fbbfd120e3e329633044190bbf134

SHA1
d17f81e03dd827554ddd207ea081fb46b3415445

SHA256
847004cefb32f85a9cc16b0b1eb77529ff5753680c145bfcb23f651d214737db

SHA512
ab85f774403008f9f493e5988a66c4f325cbcfcb9205cc3ca23b87d8a99c0e68b9aaa1bf7625b4f191dd557b78ef26bb51fe1c75e95debf236f39d9ed1b4a59f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000042
Filesize
67KB

MD5
22434a1a358ac85abe874fda15be93c5

SHA1
f4e986a8e4647693ba7e571566ed80fda26e63a0

SHA256
1fc781e941db1b2c6e1ad04cfb4007a20be5bfdc151c5fc12a11df34b337b3f6

SHA512
5611cdda4459006b46d8db7c7648370cc6bbdb77c870f4d14b3bfa79cb7b1c7a3b707813013d32aa5859ab587ae9564fda6b70a72d280b500e3e99ebfc8197cd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000044
Filesize
67KB

MD5
ab0910933aa6e9a5145f3952870e4b92

SHA1
925a2147b9fafd5f68515da5413eb8c7f535a9f9

SHA256
453e6d3ba096f935e6ab4167258ede88bb45c61b144ec303f24bfd2bf871b44e

SHA512
b7fba15ad837056b8a975c6fc4096371173f2667f47313e4e30d8bff5701f50d25abc0ffe2a86c0343c593df153511cc2f0d1390f111779b9f0612bca299253d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000045
Filesize
121KB

MD5
6a004fb80d57b9b1d508bce751b18237

SHA1
20685febda106bee97df14caaadd3cf598932901

SHA256
ba6d3c68070dbbcb7d5ca939a4eebea67112d7ad74e19c5994dbf5788bbe9625

SHA512
73326a0b9902f00267294f247f1972b6ff01aa43f033ff7dd0cc69c9f06c2dad1a3266e829bd96d8c1ac6b42fd68ce52a1c7ddea6a68dfbbada964f318e0245a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000047
Filesize
278KB

MD5
8ca5b4c94bdb9059b420f716c641beae

SHA1
6d0b9ffbeddf43792d909d697c9d893287b5c89b

SHA256
dea24dda6399ee36e9e3a9a330025d87ef7857412e9851945b053f19727ca695

SHA512
c744b390521f9b575a88de078986b701f20aef1ddd1bc7d050ab63188b2fa23f6f22729206f97d1058c7d4f7b2eefa1591a22ccd1ca9c9b7c2f70f329ff02819

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00004c
Filesize
137KB

MD5
c957dd5285c0bfc1f005d90e958229a2

SHA1
882885e675159f8da5dab016fff5267ed6c80609

SHA256
1de4038564b80d878b9c6aa69dd0562df013e859f1e6ca4568d4a4cfde7896f9

SHA512
cf87d38739f1b7c39662ac399e7bdb12a2da59a039a7c2ba4ee3b7048b7c8c841b6c9538540aa493875dfaf2d76c86439777b4df0cdd9e717d181c728a8042a6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00004d
Filesize
278KB

MD5
d759af14eb62165e4aadcf1f9294ea52

SHA1
44f5f1518d125cc218722f90bbfbb0503bb16beb

SHA256
0110eb2d346586e533926840ebff1410b42ef33b2998fd60ed4ecad27b340bb6

SHA512
8bebdfa1ffb2b0a308cba19876cd8f9d5071cb8538c81523f7a37844f4725cd238d711a9afb907785cc21305778c4478afc3a794d368ec96aaeaade41678ab66

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00005a
Filesize
51KB

MD5
bf5046032b544777653bf4c69e6c33a2

SHA1
d5fcb71ad73cc72b21b7ffc9d3f7ac0f3eeab07b

SHA256
e2ae374d9ec8952c88039366fcbe2abf98f5d0ea543466d92df2d79b84db085c

SHA512
e6cef5d0496a1daf7896dea513ae0d20e6830b75b492a69430ab6549728a3bc33c38da31d6ce6c3270dd60233c030128402afc9c387f7f49d9c6a74f9b693719

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00005e
Filesize
66KB

MD5
c0e026542819525eb779ff47a3891992

SHA1
99a4ef07fadce742ab89dde2938fae71ea179cba

SHA256
7b991e8692d0fa0d8c8bfb8c11e87d5fc86be50fc64792767669f568a93ef84c

SHA512
c9c99a745f89ee70ab6090ff008473e03d6b5d3cbcffb5aec537ccb61f45cab0738f6b4b7c0f135cdcc9b013aecf935a8ebef4036309048f382e0582d52ec747

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000063
Filesize
58KB

MD5
2e99ddafcd82cab831d9d7e642e53b9b

SHA1
43f5165cf92315938e0cc52d307c4a5978be772d

SHA256
3a8b836aa2bbb2282a34584d125baaaa42727ca5a0c8caa24daf8595e6f60508

SHA512
54180fba17add25463d27bb0a22f1f2470dd24537e1a46ed98ffb0258b87ac601ad0007032e6d9a86dea3d67d29d3bb962c6d4140c9bf639ddd49b1a39d5afc7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000064
Filesize
124KB

MD5
6c1a881f418e6ca2b5104a9cfc43b9c3

SHA1
e0c30b2e92b0560bf5bd60450738e28ad777e15d

SHA256
780c6887d73f150e5dca9ae3b8518a63a2f966354b17ac2589e119130330b063

SHA512
266dea5801e6163d6527566e4d861cb51a02b04516de692e7b66989b083cd24bfa4a7cc55358c36666b7a0f90cc8e27e26cd31b51450b2dfd2ea11944b9753ed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00006f
Filesize
72KB

MD5
581a68d11a70f977d60ac3269e579fdb

SHA1
85c7dc304ce9237bf43fa29a5bfa7e70c6406790

SHA256
e85079670a60d315e72d63208d1d3dca665fcf1d52dbee3c01414b4c11f6eaa0

SHA512
f82cc5d3b3600bde72f9bcb37e0ec770aa6b0fcea3e77ed6700bd36f131fc6955fb284017ef5279c3b224dba55a071e4b8838f974800a884c2c29b78e546adab

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000071
Filesize
288KB

MD5
6187c09eb1c7b40072cdbd67d6844c43

SHA1
0ebf5b86a6de49dbcda7f2417e8e28a59985c63a

SHA256
4f8eb33e06caced54296f74a54dbcd07f7667fcd6e6b9e5ebb4f108cdba81120

SHA512
54a7e984c6fc227d714d1e17fc6e8c10d73a4b528b9e6e0cbb367b15cdeb8871a9b93edbb9655482e780310d886b9e95aeaab4c68eceb5d3dfe5bb2ea71a2d92

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000074
Filesize
195KB

MD5
b407172cbaf2bb4f13c794dffd87f070

SHA1
f2c8cee6f3d6de0818840b4f8e902a9082b04b8c

SHA256
aab711cf220dda27ab4dfe5ce4a9d5687660e09c69e90567186b7feafd5445e2

SHA512
1070fc23e7cf7a1dc3d35c0fe267ca5ac61575e4d6b4833c7294491b5bb40713672c174e8500ac654402ce773bc8920622257bea96772bd7ff9b0e0f19759429

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000076
Filesize
252KB

MD5
34c1d54257a0d0fe87486cfb1fbeb18f

SHA1
bab31ee2472895b45f51244eccfedc1c2c759c8a

SHA256
0309807f47ca426fbc6159c427cc5a8c3863ae1cafcf4aeef233b05efe42c656

SHA512
632f6fea984996a8f565ca41c097a1b2039e8cf09f374fa61a819cdd566afbdb8c5fee88292c73bec0ac95f1e1ef6ef8112b42ef05da467eb976f5c3d14132d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000088
Filesize
127KB

MD5
993c8ab9c346e2f6bfb20ae688081029

SHA1
edf6f3832445c757b41c8fde40ed4df780a81319

SHA256
5fb4fdd99cb465d4248bd39ff3acf91ba3f16e754c332af04f1e0dfa0bc1e5dc

SHA512
f1999e9807e54f84220e031c70082fb98635aa5fdaf7d59c19829eb9582a6db5292a6096fa8e8f4e6e6fa8cf0c826d31303b4eed40e9e0d8facacaeb23de12ea

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000097
Filesize
25KB

MD5
51b6e0aaa809ce8aa080d68c24acdcc4

SHA1
052b0701a2aaa74d6dc2e5e09a31b644bb04e176

SHA256
45d2471f4a8596ebd07428c2385003af6d31a2e7bf0e59a466455c9e00c2a811

SHA512
207f91fe7c0c84711770a98df1397a4acb065542d8878fe07b30521b66046a8b2dfb54705ecf2d03e060acb1072c008eff1b9976d723afa0338555047bdc4371

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_0000a3
Filesize
136KB

MD5
c0fa453237ad3aede7eba76599f57a24

SHA1
64551f09f759ea931640d8c5f25192701ab092af

SHA256
d90fb2ff753cbc00a3ff147de8ed4b24b5acaade406ab3a7b9e55315e1de8508

SHA512
b635dfa5d44579f721ec589a03a8b0814cee1d5cfb577497d9b97cb98fa4d43b2353704f8b3b2f54536a7785a99c2be3a1c188261ef317dd795b579064d2d6fe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\00893fc23c8be7d9_0
Filesize
8KB

MD5
de372e2a89d2e25a140c8da6906c49dc

SHA1
4dc56ef43dc6f0e13a32b086ad6999eb9a2bd3e8

SHA256
358b9efdf677576afa2e718f8b4a2b35b4c3325e6c8ffcf97649c3c4c3602ab4

SHA512
2887f9399fa424bf93050ddc96c29a6359d66bf7c58f78b4a22205de8ed057eddd7027cbfaa3c0b65b3f20405f2737192e614ac6a5485cf16ab228066ac912f5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\0c292c1461644261_0
Filesize
8KB

MD5
6276a791238d60635f4c4c44cdc7f8de

SHA1
736360c31102af8abb6234b62b8feedcf93b4673

SHA256
e4e150870a0f8dfc4bbb18e6dd776d6cabb5fd61bf4fa482f2740f453ced29ea

SHA512
b4e06a7015666ff40a17f371b6f4dc6aae24c575dae734347f1e6d550af7f0f9bda788070f9dbd7387cb8ca7b442017b040abc1efabcaefd252de6d7c5cecdc1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\1bc2502aeca86705_0
Filesize
72KB

MD5
d8241ea22593d7b5b21fd74f0b9a0866

SHA1
e3b9c90c0383c469f0223a9f5bad952569e473fe

SHA256
a6d8cf7246cfbddcdefe0ac4ce95a5dbcfd8806cf2eed444edfc18d42edba11f

SHA512
f1935d7f06e73c692dc51cdd518ee09f5d1f67342feee7c8c1f0a8134b865d73bb96a6918bc7937031ee904d29aec4f2ab17dd2381f89c3dc21acbdea8acf544

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\77f72344d6720091_0
Filesize
281B

MD5
a1c16f816a3ecbe29c747d21c2308c2e

SHA1
d1f00fa23ae52736afc9ec301ee4e56b919491e0

SHA256
aa137d198123612ba45d6ba76e3d1728fff953b49f9712a7e2caa89840584d5e

SHA512
bfef8637396389eda315d6424cb225b6da34e0fb50b65892d87f9f4a2b53202f153e1caf104315d9a81b3b376d624b45d7c3da70da26c02ba38846f5b64fc8f5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\904ac5bdf29d245f_0
Filesize
11KB

MD5
b83c09e2c0b6e4c3b35a3148bbedbc25

SHA1
b6649d906ae1f849025ad2ec07ab897302125aef

SHA256
9caff1f1261ccc48354613abb35d9a5920abd28baede6592dcd3750b3c409fcf

SHA512
b774ce981559d94556b44621c49a828f329bf74fbe69ba28c48b1d84f1d68ca47820fa4ecf75e3fe443879d4ca526a569bdc9184124fbfa08c94c8988403d4a9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\acffe90cf605ddea_0
Filesize
13KB

MD5
3ccb71ee768349c7fc14a759f247ebad

SHA1
1d0be2abef7d8fcadc335edca02fca3bb1cbdff5

SHA256
dd2c153ff99fad54d17902216b9e7ec9a01f734ffd8168a480f0da0150909e7d

SHA512
c9cebdc9d84b3b6901dafc0000579e6df56c4a87d5e7397a28b67929358685541ab956f75e9cdfdb8a6cd40c1addecbce39e57e52eeb340328ccd6f979ec7c25

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\d72594a2b6ee9aa8_0
Filesize
8KB

MD5
ebe1d5f5cbadbe23a691cb7025b9223e

SHA1
9fcadc06f2a441e0df6210d61661485a06271868

SHA256
0008ff5e71a20f32f360b132330302fb14a4013558f60b49928e24d524122373

SHA512
4976d1e197783240f7dfd2ce35e37677fd3f88256b7e70125c02d0dde0d2cb4e12a624ab4f45cc8c317a9f722540cc49bfefae0a4c675d899162d664c6976a5c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\e63ee7c0565abc9a_0
Filesize
286B

MD5
f11eb361022fc458d48cfd260c10c8ce

SHA1
358f16aa995e5109d99759433863ebe2d5cd1e4c

SHA256
177d1e137faabc8aff8edd5e845d3f246f3ec865883343a1a354e24ee7421d62

SHA512
ccdac8fdeb3d0b22aebe5cb899bbbd77814b44ac75a88db193f3c713049fcba66a52cb9e8aca9073c35ec577eadd4037c3b63ceb34685a34c50ec357bf9b734e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\eb42e7f13405cea4_0
Filesize
12KB

MD5
44797aa1b3350a64d13d7c005f5cb394

SHA1
b5ba8f352dc6dfd581f19265cf80ffeb4cde6611

SHA256
2f9f3f5844fee3b22c0eafafb875b20a1f1a29b7d038891c2c1ff2413747fb13

SHA512
46d184f32197dcc35a0438cfba147a8fba18f90fe530cdb0b04ab21158a0440eb42d900c199ba037877297828739accc79f289853162e6d75ee80e991c327cc1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\fcdef49c92af7ee9_0
Filesize
124KB

MD5
aab98ab991607b3b06a4927d8256dcdc

SHA1
df0642578269bd87e1e07017ae4961b7214810e4

SHA256
41633042612b7645e891d1267cd2013a2f202c7d9b2d8348d29b4da2258f6587

SHA512
f0edb1ef651019d67d429fc581fae015cb9c63b027e355d209fed6d39e34df242f22afcec57251278959c9351de405bcdb2cbbc03a38f9429ca6d0e231065331

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
504B

MD5
e0be7e2d9d751e6ace57240495c4bbb1

SHA1
4c671024ea1a68834d02c02bc243ad96a1c8486a

SHA256
84db96ef4776e81ee5b5a9a56977f5d78c81de8841ebb68d9d14fbabb9840e45

SHA512
50c0b470b724be28096e690214d79dd1492e42b62d11f4c1418f1b535a509b9d240f67681d6c099a54ebb1a05c1d28808215da7d4ca12ce29122df4a769e2580

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
720B

MD5
65878c3d46c0f04abd4cec0c682616d7

SHA1
a205ed22b81c01b5d22bd57d6e3881311aabfc45

SHA256
1089cec61eab142b664f9f46c0b197c73c58ed4033a6cf2bc3a2319839349dce

SHA512
553ffb8915058c6004c07b65b4fe4ad89edb564b5799e6b30b17d5518f4f2d938d1afdc3a91bd43fca23353d4154ccbd934be36cf218d7e577b204ffb47cbf91

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
1KB

MD5
133571ea7935d56430b728efd6601f2a

SHA1
852ddfeaa592ca6f20ffbcdff02e739e0fd63046

SHA256
98babb917b72ba99769e2070af38d0f287c0181b5e99c53367e25cdbd8e9a688

SHA512
0e636d53ea67877b8dec43dfecbeec0542c4c59edec937962e536d6632b5d08d98852e9e6ab341992bc9c2502dd4e5086d58596447edb73ab62e9b04c362b639

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
2KB

MD5
c7469f2953244eb2bb234862ec899592

SHA1
8a32aa4e872e08bf698773c2bb8b63e3debcf515

SHA256
df0031be3cf6a4d576b283077fa6f50f85e2e82e6bf6e577c6c7ef6212c727dc

SHA512
81d333537c0a6abce22fcc2cc7015b3404bf3b889b22d99375bcaf50f1e5ebf3a0f495442dffa64cec1039086b65e94e6288b263dc0ec14bbe6acb75d5369a36

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
2KB

MD5
70c0da009ab0cf94030703a682c3296f

SHA1
012ce10803995894bea054d34686e7e98a1eb0e3

SHA256
724070c7864113d4881c722a1c135754554ebc2c47abe35bcbf3f6fe3c716a12

SHA512
9089b69b8d6bf8622f40671af507629ad8f2673353c00d6fc7c1fbab1a25301cb7c998710f9a21a880a936198ea5ea615940d2a404b68fc56162e6bb666a96ab

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
1KB

MD5
bde011f05d81d8475e8373b5179036ed

SHA1
895858bb9a96af1ea8a5394410c14f70e9aaeaa5

SHA256
b693e60881882c6b085c762888d50019ff70e38c8f2ed3d7b568c3f3e6b82116

SHA512
a4a17e627aba04b6a88b3b147a10cd7aff97d1fdacdbd683762db57e9c3b3ac6301b4bf4dab528180bb7eee610a57ae9072b7943a5d18b808672a60b27c105be

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
2KB

MD5
7b7f6bc3edd5dba44d39df04875265f6

SHA1
b5f7b42abcb17e62058173b6cfcba329af10883a

SHA256
e9c41b0f24ce80fab04baa173d008d32368a964eae026aeda2e96e33047b64b4

SHA512
39307aef51c2489e288e97154d6a7d2b633498f9018842aeaa49c3f975da476cf42d15498eb7ec76320552ba53964a0b1104480da724509156b6fa3bca2c828d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
2KB

MD5
eecfe4fdf86e3ac9f81dbc365d206e21

SHA1
fb631ad5b2c0e262d2f3bcfef7714e3edaf9fb9b

SHA256
50b1916bbd28c58182001a8f7a2face0948299991cbe94f74b85972feab9ae47

SHA512
79e8b54152342853269a1aaa47d6212bb96b7b0cd6a278d1e2ab755068880fdc0be117dbf9700c36de640f179d88cf74ada0a56814aeb0f9471a6c99e2c10c61

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
2KB

MD5
73d27e88ed2b2de4860dd22a6ccaa59f

SHA1
dba53b088ce41db90fedc7251c8ce6964a964ea7

SHA256
f2913767ff8f12065040beb143168867d8a68a7533fc85e08fc2bde0e6d77d2b

SHA512
91fc40f5732993e350dad340daf2a6ed3b3310859e69db3c7edf67c5b538bef41db59412921ce63d9bf1e182d404176b65ad75ade7c903a4f3fa89c3e66ebba4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
3KB

MD5
a844e3e4c872cf0965c876fe932dc217

SHA1
2dfb23d659be84c7e5f5c5b4640e5ca939ea37e9

SHA256
79c8afb65becd28d9146fd597c433cf4f30a0eefd8281be3eff5068cffd2511d

SHA512
3e67cd7924064f0e11b7da0bcb3f1df68cfd03faded9210b73fc6c7a248e2bfeb00f9b12add7e701da2b06780911f4e3ce425d115dd7fb9fa70146dd59536423

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58c59d.TMP
Filesize
48B

MD5
c429bdbcad8f93be5b8afe13030d7d7d

SHA1
d48fe3b5c720e0cad3911875f7e14c86a644ce7a

SHA256
126f237dde96282f134701aff0db4d807acc805944f77f78e2acdbdc73196b7c

SHA512
f6969072cf61652f867909a5ce1e5b4b0b7e375f7cc9ee4b627bb738d8a87fb968247a9f2154086375128bccd775cdab48ce89a734a79ff34dbb2f45a2cfcfff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Filesize
70KB

MD5
e5e3377341056643b0494b6842c0b544

SHA1
d53fd8e256ec9d5cef8ef5387872e544a2df9108

SHA256
e23040951e464b53b84b11c3466bbd4707a009018819f9ad2a79d1b0b309bc25

SHA512
83f09e48d009a5cf83fa9aa8f28187f7f4202c84e2d0d6e5806c468f4a24b2478b73077381d2a21c89aa64884df3c56e8dc94eb4ad2d6a8085ac2feb1e26c2ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_en.softonic.com_0.indexeddb.leveldb\MANIFEST-000001
Filesize
23B

MD5
3fd11ff447c1ee23538dc4d9724427a3

SHA1
1335e6f71cc4e3cf7025233523b4760f8893e9c9

SHA256
720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed

SHA512
10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Microsoft Edge.lnk
Filesize
2KB

MD5
f1477dd9c0f49c374a234d9cf6d81716

SHA1
2d693e5d1b18784e21d7da86a208e07d8f860728

SHA256
d087a9e567c0fa3b5e51b1ff2d448787e3ab6a3bbc40d3c88215bf3ef7f8b4f8

SHA512
e8fdcdf47339b19bf6cc5189e910bd7b415d311ead0520d74a43eac38e0380036531e0fc99d44da35db4aa168076af893e3d10f25dcc2404a01ba5201c2eb4ba

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
1KB

MD5
71b0c6df2a9102352da4fdf5d2d014de

SHA1
35c833174ddf3e09bfeaab2c3eebec212d72be52

SHA256
3361ef68c47f825981d55a8717adc96ef72a609a35af4f8a10d2552729b182f3

SHA512
e833703c57155835f6683aa44c9882793d615e659616afbaea6e844daf19603d172968b08e57bc82d12d9a0bb2a24cf8f4c0dbc5bfcfc1058897658466c7b214

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
8KB

MD5
074941171db960d5bd6e41a6121ec572

SHA1
d6a54686a36436bedf763def12b09884ccdc558c

SHA256
f15dbce620e73291b401351a31dbfd710dd83f56b2e97d442eec5bc5b71de2ca

SHA512
6aa5c82f5e56993b5bfc73c51506dbeca8c869d64b759d2763ff29b0b4d8e42727e219ea608849bba4375f6e62d6e60eb194f71968d25ef8c7e76586af987c85

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
13KB

MD5
d147a83188a7b3a73bb37ca4f560b1b5

SHA1
ab82ade1ba262f1d2c124febb2ea33b42045fa51

SHA256
df05f22a6e5badc41c13f0a16bb58fd51b466190c04ac620d17aeec665327ff7

SHA512
ea0c4357ba92f631b1a0a8e2cc5463541429799305319a9288a29b8ffbd0357edaf4f8ef5c8747dafc6aa037b7cad76154b6fdbb16f59305e12e9b4aa8187c9e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
15KB

MD5
75feddceceb984a8a67a8b448d038f8f

SHA1
e19636259344e8507b7ecf25fef72bd7e7892370

SHA256
033fbd870a6b3c71fae537f01d34b96dbe6829f199354b34eaeeb5c56cf51382

SHA512
08d7f36de4f363deb39447890cedc556e35495e36b8a33a88ba90b29fc11b2f18359538be53ed382034f755466f0845d5cb75b6ab32b73eba6c0ff368e575d99

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
16KB

MD5
94110ff4377a3fbe97eb60f96f0b7c28

SHA1
9c6389d1fc33635353af730e48b63eee76465b8c

SHA256
1d17661bf6d135b8b41dce46366cde97063ad5b82a661571bc21e2bf1c358c4b

SHA512
2b2cfaf1d18d65d45192b5380dadc431ad57e207d70e484bffcb4593425f17e51156d3979a16fcd3680a0e00cee492f8c38203c97410bbfe908cfa1ebdca3bbc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
15KB

MD5
2c503d7f96457452d408270593ad466b

SHA1
35f0af7992f36d9e5a88c7f066e4ad4daceea8d6

SHA256
8f684a098f6943e33a109ecec139744d70e90bba268432986332cd33bc394395

SHA512
3fab32e4434ca12faf40965ca89c98eff0488e7896561849ca4bba9b3033db1e0ea84919d7fe648d06d2a227bef6d615a53285258f8d508831e44869f8b63063

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
16KB

MD5
6f55d55ccb21376281bc946e2a592b9f

SHA1
64d21540effbe44e9f71f2fa89b96e4d629d0734

SHA256
836c2283900f799d3f3323ac77b7b978e34e4eccbe8e3029744aa3a9b44fc759

SHA512
2a5037224d8da99390f6c6f6775132e3e15380f944ec2afd6bd3b9b69edbee49b72fb911ef5d12ac8dfffbffeb2b647870c2cabebeb5d9cd775bbf752724b12a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
16KB

MD5
ea98cc92912ec553ff26d2cb1da98cea

SHA1
35f096d48cd0c4b995e1b8ba126a3a61cf1a5b9d

SHA256
5ac2b7db1087494d393b01e7b1a40ed6748f1f0e4660b925f49821a3233a6ad4

SHA512
a133f00268b60cdc391461215d45e3ed48a7f2abf5e6ede28474e804ad1c95d7159fe2364487d73e5b654d7682a2a4621fe68a6f4d78d692fbded6e31b26db6d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
16KB

MD5
817748780835d0eb929c61a7682326cb

SHA1
40d8decdee4f8f260f57bb6b7ec284eba9f047db

SHA256
006530a2b68866775a19461ccc64ac8b7edc1ac874cda14d002decbf439b7d56

SHA512
debe7a7ebdd84abe860e2e550c51a569644202f82b81fc8c4f247400a8f437696b1ea870c65a9b5f3c7e105b5cb0ae043c83d1f0cabb195a7ddac2301621615d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
13KB

MD5
41b37bcd122da72c4700038255a54845

SHA1
3d4657f775861e72b5c8a64d6b7be8c6eb79cfc5

SHA256
4613ea658aa2cce6e3bd0c5b47570c035c432838a772fca46276aee7e8bf7ff7

SHA512
d788c93cb576ab1c27095ebe9dbbc8cde821a8001e15e96941c3027c929bb9d721cc0c926ee050cf3bf41269a37c2aa62d64d9efe74c5803262d59266998fcba

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
15KB

MD5
f1d1176c02db53fc7ade51b3628c85be

SHA1
0f6271a86c7234c122324f8d408b5b35a5d39acf

SHA256
187f233347dab8b8850a5c15fe40da498e4e9a12c1feeb4c9cfdf305e1f431ee

SHA512
6f9222d02c7a0d70e1ba0f27b05151b93785240c67afa01dc4cf9b092a8e5dad6c3b24109ca64c28aab65a2e7cf77bf24c0b010b4c0173bc3cff303c9803248b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
13KB

MD5
2899a2fc198ebc0eecf935c5983af2cf

SHA1
41b0ebe730c5f40d500839b021ffc684a1bb016f

SHA256
425bdfee10645b0f69657c6ac210b07d7c6dfe2bea05f42fc4fe60e1b4f1d93a

SHA512
907ea32ba3404951df3997e0e0257e6e0c70b149fa5fdaa92183a6fb4cdf08e9cb6868f7d0a5c8eeb849ba92382beea893976bbd97fff95b464dbff75907914a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
4KB

MD5
bea32fb6103edaacd599fa4dcef78749

SHA1
f0ca6d236d555d1c86557334a94b1d7815e42f40

SHA256
9cdabc03ddfa84c5609ad7b221d3a6d436369164abdc03a419d5f19e2c7dae37

SHA512
155222ac12e91af5acc6b146023c10817d649b24c89edbe9c5fb729d596813ccd28f181413b7680490668fbcf9b2a0e9ea6dc5224c3cfba07cbec21ffb4832b5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
5KB

MD5
99f18cce0ed0dcef990f5ee99ae1e5f7

SHA1
3a7051a6858f77145d11742281361df2bdd35721

SHA256
e1fbf96847c22b1c9156f1b83c94eaa469bc086e3729c6d21319a78adeeda94f

SHA512
b948505a83b80fa32875b87d11be90da90baab579c1b643faf36982856b6dd7fe89b549caed989dae901e3efb384108aa759dd96febf37b6fddfd471979482c9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
5KB

MD5
691e9f2cf9783d475991786df52abfb5

SHA1
d874493035e8a957f358165c41548b244d3f4058

SHA256
1ceb1a44ae1843f841face3618b5d089853da816ae75a44cb15502e46ae8c6cd

SHA512
1b2de2989533c75e46935d7d0e024af5938f65353b73af3a0c61ec3bb956f7d769189143ed41a95a83dd800c3204e4ad6b1083aa8cd8d21465b61d66c437641c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
5KB

MD5
d0134129a0a18759f4a0893b5ecfa044

SHA1
aedcc27dc26c7682a1c6f6db1942f2b6a95479b5

SHA256
41c9067da259353ac572992646a2c9b0029a11e84ece1d68f040a7f553948ffc

SHA512
1aa865f9511e65fb21d59d8f187e07a6a403882cd38eabee97cd68008a223149841a917534c8cb1795bd3c93f45b99a56ba8d59ffde7c6c468d21ea104b94163

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
7KB

MD5
0b8ea87bd10be5fe363629a123805f43

SHA1
ae7a8c22b7a8fac3bc9c18e10081f13782e0f19b

SHA256
0358af6a5a803851a04f9fb95696279ca0c7e927842e259ba550d5d94fa5f909

SHA512
7202529a19eaa96c41fe4c6d1510a31e9f1c4957058d705f39b574f6264a4a8a6e77265415b1575f16028c461b06204718e36632b291210059aacd3d626c3cf9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
10KB

MD5
48b1762cb12bbc9e8160b04bdf2529c8

SHA1
c6f81ad7bf4085d74f40952d40e801c4f10278d9

SHA256
8bc71bf2912765fbe9f9e126d66a879b678715ed0f1552edd7728dae957e964a

SHA512
1c6d45092031714e2cadcb9b4f3ede15eab8a7ba5349111907881def79fdce1f138d13c7c3bad616aca8e22fa9035bc8fafe0b738338fe4352f5dc73a31bd4ac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
13KB

MD5
7c298fd5505eebc46d5f3535906033ab

SHA1
403237a32c45dfa618b110eeeac3b6860c6577d9

SHA256
e5aa8fb2ae42d7485534c298f476cd958ebed31fe9005e13582fa3d3b1051a68

SHA512
1bb73227dec12708a02afec433e8a6f79cefe2a0e575e2870af8ddc40a664b8e8b40868100e89349772c171456a13575e43a85cf0f75dd149091ea2985d2ddb1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
17KB

MD5
8a51e145e48a21cc2917ed1ed68df778

SHA1
8e518d6c52a7c73213e6ae662b680a8b3cb8d20f

SHA256
282c04c79d4861b13d41f865982cfadbbf7038436fcd49934f8723c90f9b6bca

SHA512
98d2a43233078255fa50472a36413a58d2b90602d65ce808c39d3f94d1dd479dab5eb90f5cc855b681e4d440902cded65e8759971d2f886b6cc16483c748de55

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
17KB

MD5
3722f4c5ca2e6e224da52ee90273042f

SHA1
93fc264da9c96878ecb3b582d1b94d402548d29e

SHA256
134bab809381a2e71dc740986985930dc35a699dd5520d5828d8f2525e55d373

SHA512
50ea5207f608f16e38ae27a1af4e958c9ea3167d611f3e1e0dfb2518e5c1c7f985db997c449b389a8e0f1597ec325c7f5810029c44cd0735cc4b0b8cc5d2c31d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
17KB

MD5
997f146e0a1a4439878f7f6f6d3f39b6

SHA1
1973cddde0c6569ba3e38dd480b949f93b861f20

SHA256
a08049ca67040a80ac4744f850bbdfac60fd614526e7f0e9dfe3d8360e2a2889

SHA512
0506898fe7980ee42befda96303399086810d96f3f587da10a3c2e199eeaf7af618d487d72ba7bd93ac9daa39b7e7d6fdedd9dad07474901c39b72b34b5b533f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
17KB

MD5
cfa04a6589c7103a4a52ec0b52c9da90

SHA1
f592f9ad7cc4b70d60c56062331aed64f6e68548

SHA256
0884000696eaf15c9bb85d3cebefeee14c6c3cf3a0b8c80b8e800499c20a0f85

SHA512
b9efbc673e4f7e31d0ac47c3ae1a94b0b587ee23c89a716cee8cd531bb3a979f6857d3028cf1962a8ee61c18ff04c834574724ba8c9524bd4c1e62e8354f83ae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
18KB

MD5
480c9fdff7171000c7f72b3ef7d3583b

SHA1
52ee80bc4664b4ab51b21e0fbae9eeec2a8d675f

SHA256
efbd8611efba5e299af373866d86bea890656e300adab09b039875680de9b7e5

SHA512
153d64689147d34ee9c72d629ab8765d03abce73c9852f3c3d2ea29542154eaff0f5c0606df6af017275fde731be7e0ea201c0019426304cd0957309a69978ee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
18KB

MD5
353800a9bbb5ef7d8c7e048b729c43ef

SHA1
da2aa7820da38fba0b924a850280788bb9014125

SHA256
43ffe9d48599e93cd3c435b044ce338d7ec467c715976d17968451752870b259

SHA512
e79f2d4fd2bec624b8d1e1a30e480f3d2f5347cfd4533eb6b685ef8e5109c743cba3f6458f53a29e2076b884fe1782a714aed4b7ed55532abc0535c9a9647772

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
18KB

MD5
630c84ef311d08036e8b9f47c7eab641

SHA1
320b625d79057eb50e4883d210e3bf77cb42a257

SHA256
46156d9757251e63b49dec0e2574744e7891cd3e685e16b90761ee0048994984

SHA512
ae6581f403a41fd9dbb90da721cd770c0ce29ed30703e52bbd26640d02a3ee3c3249972b33ebc3180e8926afae0a210b9bc5858fd16b46ab4e3a1fb8a6e0b717

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
18KB

MD5
c1e7ab248ed86c231b0b9acd3bffbbc3

SHA1
f5a383367a8087a6c12f9d8086eaccac1161b065

SHA256
548043b43fdad8056cffa147bfb717fef722fe74cf7efa4f23e9fd8f3d74bfb6

SHA512
459197a98576f9ccd6137411f5c77879d33b683020c607ed81c1a09ed96fce700fd7c138fd6ce4eae7eb1b320fc693b99248eb1b063ea028092ed4dfe22bc6e9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
18KB

MD5
c825c471a6eddcd9f8eb0ece0dba6301

SHA1
484d3a0f49409e01eda9874ca185ea7c5122bf1f

SHA256
1705f1e157a49d14fbe753b261e37477afb926c48a018870eb4deb36ddbec06a

SHA512
1e4049db59ed29924cbbb25fc3dcbe72016b0c823b5f7a042524690c089bef71a6796e75bb3c558dd9636bba168fef19206f3b94835e738abd3b332ad7614372

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
18KB

MD5
e952d0df3da8e39e8ffaf44de9300ed0

SHA1
0bf7f1f2b1395d4780bd03c449de28d8bd26b878

SHA256
f41bd131804d9d69043e1eaeb8d265cb67434af368862f1d3bbab33e5d5dda96

SHA512
7896a641278b5a0a30139e1505749c174cf0247b3e3cc7e9b42bf35e60769c8aee757f33415c9bb679a95363aabfcbdeb22c5248a0a40637e4fa74af957a1705

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
18KB

MD5
9dd4fece2e0c700173907b24592a4dd1

SHA1
4c1ff96a56d2064bfa814e7d307f76dd27d4ad57

SHA256
4c835fb2b780351c21fb415340a2f372ae10042090ab1b68befce5e923864a5c

SHA512
9658e73f0b915304a435edb10bdcaf015a996ed008c012c4c415039e94721b8fa645e81810b6ef2bd568615e7eaabd0dcedc7bb5be543b926e9b9527c96f19d3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
18KB

MD5
6b2b29a01a9fb3895f117a2d0c4bee76

SHA1
30afe19c0b701c6e6307f5efbfe540a0fd43871e

SHA256
00a52cdf2e77aac22d158c1c44dbffa515238b3d380f5381d905a8fb82a46438

SHA512
6eda1dc26a53f720cb5ff77f58e93d66c204efc2cccdaf5c8f114c55f153ce097170b219dce7022c162f199ee2fd28392a5cbe20b884b2547e3d05f12af1f1c8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
18KB

MD5
667a9a735cda87bf702929d5e02bb509

SHA1
a97f38dbe3b3a64198d286e9ae400baeb4d75661

SHA256
acffa5b0383342f5279f31374d7dea3717329c04586804cb71d1b5ffc66d8795

SHA512
b50820b3aed9f06a257d25c62cf2b19662f8d017645aea2e75bf7fd68b13eb9532a0cafa5656a331ebb4dc3e447956a11fbd94f572a44700fe993c10d7e62980

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
18KB

MD5
9aaaf33ac8f466fc1dfb1fe93851427f

SHA1
5a9f8e7ea02f5bbc6770b2c145ab25e0575d7270

SHA256
ae871890c079d491972249bbd737a3f04c0ae179a8d8e31804f16d174768f368

SHA512
2afca8ff20e1a12451324ffb57ec6a0ef3305b47f3a4628b1f2e1048642610a2d038dec3184de9aa9310493fcf5522b903d29d26cf42b43a524482367a167a1e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
18KB

MD5
a19b42ecc03529a41ac73ea19945313c

SHA1
7a7215cc6b13d559e15d03159e17257e87a3b021

SHA256
f44a1e1b9023df1b7152d1a76ff7ce02ee51eb8bfb4fcd9daba7d07cb6ea5d96

SHA512
f32205a524a7673f77c670a283c1c7ba9789054f34790b888b72c7db4692c920447a818bb2036c064d179155d232ee0d69fb95872aac388d1f56b72e57580284

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
18KB

MD5
8b5bb6674a9ff110844d4c1facd8a6b9

SHA1
b496a788e7dc4540f349fe4c4cd5b6fe398e3cd2

SHA256
3bfc1beb09358238019b930f5154f26c6003c2a6a2b045b8c1c4ecd6d16d8f1e

SHA512
764168ac16d4af2e25c6ca56596e97fa34bdfabb86c94a6a381cd8cab2b504cde3c08996ab58ce691c736b108bf145f0d37482b898c56353ba5fbd21df8d4d73

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
18KB

MD5
062f902c21a37d63aef2c39c2ec265c2

SHA1
aede63b71a9888b8493357f743f12862e8bd5bea

SHA256
87dbddfedbe0409b85beb8e901f4640d7a30f02ee2830711c2dc411fb04bb73e

SHA512
a4bd577836dbfa3eef03874366483509ace6544bded27e685fe30b7bb0bcae9d83bd3f9bb30fc76a72646cc15a2012fabc816e6cfe1b791963733b28483e353e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
18KB

MD5
074bed0caa1f9871c8edd2e1b6fb7b4b

SHA1
e2b601b4cacca7c11c0bf3c044236a00fa3744b4

SHA256
2b953b250d0236896577155364658a36dd2b29600debdcf7b11cd36ad1e50e49

SHA512
4d6d57bacf30ea7f8ae3afc828744b2e4ffcfc2b4178a920124fd16a66945d9b80ee3923f8f43a28cdf6b98f7399578fe65ceebb78eca2ac99c69be11d2cbddb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
18KB

MD5
3d3ee8b0eabe08127bff7e67278a076f

SHA1
2957abb4f6f370dc36892ac88d815ae520fde471

SHA256
0f1a5884143f590a835fb3ec883a4029c4a4440e7dfe468bde319e90fed4242a

SHA512
4f545c1d8fa654fe3ad7b4f7e0f47d5866cb61ca7ac95a73b3d58f59cc47ef98a2a6166f2925a358d1c9a7880716209950e9da3378564b04a8c6ade1d7d893d7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
18KB

MD5
d892024daa927d52f8cae11e81e8a0f2

SHA1
a377f4043a4b04c183f068be1aa13b4fa9de6d78

SHA256
fb3e04b5407934894e437922d65257370eddc2e61b2ee4184c5d192675470b20

SHA512
16633267e934074273538544f0ac02261d79c19a44938f48c1d9740456165e8fe29a7d40511cd85fd8dc02dbbadc408e81c58976a844c7470e2a761cabc9233c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
18KB

MD5
091bff18db0968d377b000b046c15166

SHA1
fc9d91fade8f2562e07a0d7b1e9d8145ffeaafc9

SHA256
0b5b5905dc7463af945ade32e7571e19210871fbd66b309d619800d7dfdf740b

SHA512
a4dba2a7b885877382b83a43dfea75c1d4decac55f9de2db6b5a51b59cc922a406d5e5baa0249005f728e8803b1b632bc5dc54b610083ed2daa4a78aa487258c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
18KB

MD5
7fc8290bbd5319d1950ac96bb4e180d6

SHA1
81c38fac4a2e57f17b61c7ba2d59ad5cd48ce5f7

SHA256
78649355b1833e7dfd33e7959962bfbf5ecb1b1770781b702e7f7b4700b24c1f

SHA512
5502ecceb0c101b0bd8f8c53ab429b63314f86cb1d38428a8649d0f3103a61300635f6518991f9545dd042e6b50066de02dd1512bcb3c5913e9349b471055090

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
17KB

MD5
21cd92c2740db92c8aaca6f82ce09aa3

SHA1
6dd0c8fd975219eb5c9fddb2587139059d84db91

SHA256
9bb78fd45e91311ddac56cf87a8b8827f26be826a5442e9d67407d0a14c4e6cc

SHA512
702c50cd97ae09d01b2378c659e367f16deb28527e7177401b4b7de3bffad1b08736edaea2a94d35a5d2f023a7d9eb38dfd2562caefa56808b344a8dfedc9d39

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
17KB

MD5
1007e6e2441ca19587b99609e3b8a2c8

SHA1
d0ef3d42c1acb00079e3cadacce83be0de059eec

SHA256
fab3907f5457e45cff3e186de686ad303c07fa774ae3fe5a2fae92e0c67589c4

SHA512
d7ab379b407dfde83647abd5ef4921dfc17a152425189210a2a16c6061e7c98903ff2ffdbb07f745565c69eb7bf10818907da595c74834bc9614e4ce6f5da04a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
18KB

MD5
df57b68f56b1b79185126fbce90811f7

SHA1
02727e90ba8e19e005b6558bf9afc726c691f40d

SHA256
9cef339d3fc5eba4bb2dbd4ede92776ae6589e70d553f85a55b01875f9cc0242

SHA512
8901c780f3fc5237aca464c37dd0505a75ace20d9dd3d408aff44599522b9b4df658f23d341186d109d7f92fd07f97554a97babd513d094ae9a1756319f9e8af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
18KB

MD5
f70256328c370d488b33cab83c3057b9

SHA1
179e17b6e2fd60e44683e1e451a7d0afaa1154be

SHA256
00854ecdc5f2ab21cc4be18c5fc3e1b99fa627a60dedf63c01f98b0d69405ede

SHA512
1d74ffc41e1975939c6c869aec57555fe7a8f3e0e758fec905387e86942bac4abe90419f2b8d3d1ebf76f356f26368bb74a782f90581eab6ef7213403c1eee37

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
18KB

MD5
9201d4e0f43af3df767f0e06288d4572

SHA1
72dff7925a6304d9bc2b77812d7e03e0cfe883e1

SHA256
fec967406aed6bbfc0fd4f18a667aa47aeca31708e40961f8674fbcfcf0f4255

SHA512
db4524309a91437b9cf271e23637cb408e3d84ca1e9b0e170c688c4dae331dcc74bb14bde350694bcfa853778f87878e12fecda49e89ac036843081805fab714

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
18KB

MD5
c41bdd629e7c34f86650580e1c731193

SHA1
b99ad3c1c154a2aed47944fe1382fbe4046cb981

SHA256
cb90f1ebc11df032a44655e8e7f8c665ba907b593b2f46d24af5c5af235d28d0

SHA512
e3a304002ae3aa373f11dc9a1bdebea537a169db9024efa0f76b4f28376c25feed97d9cfd5af3acb197eeb3a5e842fd059e60ab2fb5578418ca889c3a66ad002

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
18KB

MD5
b2c94023713b59805a828547cd26a3ae

SHA1
736b4c38712b9d73c19536186bf88e090699b319

SHA256
153f492859368c07e5b7a15f144f7def7233cc84483af2695c3d637e08a32acc

SHA512
5e545c99655bdcd838e59e051e053d4c75bb02d6c1093ddace08874e1ce51841b9b2f494a2e7974de1e7de815009456491530623eac5ea9f27aca94a570f8172

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
18KB

MD5
1f40fb880948471cd777bc597d74ed57

SHA1
68609d513f76f2fa97ef1b15a417548c35d5f4dd

SHA256
de66e06f152d661cebd923d309a5eb49fb1268605727e5b562bff881b2c5f34a

SHA512
a23a48198f9c88175c185e5ed6edbe1bb62fca7c3b0cd5161809d1bc476882da92292a1bfeaa938322ea3a8c7666492063d1d5d15b120e16fd50123aa763d2ca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
18KB

MD5
95f1c3bd6ae4b3a321243e07fae6fc40

SHA1
b1aaf68361852daf589cec35c35a5f21ac7065c0

SHA256
1bd9bab3ce1c80495ded08448aabd604b47696ea496da9ddf965042b0aaad592

SHA512
6351739631311ae39e074c4dc5a229708f62f9eee33ee6ba69d2115204273a0e0d937ccc0dbcc3c975531ef61906cb62ef67b24307572b4d8f6fb1aa137b632d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
18KB

MD5
4ef5086e15b27d316a0b65abdff69656

SHA1
581ed359b4413caf7635213ec289848c95e21765

SHA256
633a6d1754162ccaa8a6e364753541a94e3aa7629ee782b94a0820999df8fde7

SHA512
c003b8610a6e9f9a3ac672db6be0f7acd3b5b6102df4667f7ba427d2ddae748191944f21ddb4c385126d49758ad0b5c146a12656dd93ac23437e49a742a4611f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
18KB

MD5
13a0e5febeb1aa39a8b2f45429ca2dff

SHA1
b038dc01eb323dd41c47683c92b5003e0fc414bc

SHA256
e03faa5b3f488c50da7928d1ce0423fd2d87d7152467a7f36afe25438a914f7f

SHA512
4e1e7eeadb7b209e0882e46daa0778ba3bad63454d890051727513799ee1518fdf160ae758f0add831d4c8460ab1bbb4b99ad2cfa6fe7e679f4d40038c51d9c4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
18KB

MD5
616afae6a19008faf108549c5fd225f3

SHA1
b9832ab9d1519ff63de61ff3232d0fec973ba6ac

SHA256
672badbad2bdbe539ccc0bc2e9e9754816af94af7d366e43164981799d2b366c

SHA512
fb551f27af587d6f8d7f02142b6b742eb3dc37f51d60d24b0c804801f892165cc5bd34d356d4dc077746a64f5c3b6ae059dd02f59fd315a423c0f8b94742fe36

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
13KB

MD5
dd4d3ee8ba635b86b7d49b4b6d951414

SHA1
da56805476782feb70fc59f1d9050bc7dd349eff

SHA256
92664355bf0950261b23933032e0e2dc897840069a18de17b094175229e74ece

SHA512
291ece10fc59d0b62cb0bcb9c70d09fb8cf822cfd4447e05adbe9a4e01ed15ff7b8e643db9fea2b8921188b0f8c565682dd6593ec3549bfce365c832da41376b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
13KB

MD5
94c9edb87a76e28a035dbd8e2e04030f

SHA1
aa5d0e03b180feb8ad154e1065b999782001539d

SHA256
acae14a82c864ed8aa99831ff94fe449aa8aa09e0b49b59aaf6404503cc427bb

SHA512
a0a69e94db4b9512b0a3336c3514bb258955ca402bc3b149a16f6167bec2086c8071b226a9d4438d65038c4eb3f5c198af737e33a5ddabffe364a3b71ea71754

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
17KB

MD5
72dce6e764be0f66ff69dba1e67ed2f5

SHA1
3fb787a032a578bad0b0aab4e79812a388855c98

SHA256
50dad44ec73b0c76ea02f15a1a03625b302d083594d1c5c7e70a19a449308761

SHA512
0dc9f5d5f0e42d89665628b3c4596269bd211b259a290b71ba1ff25d0bded5f10fa597f2d4c11e030647b17273bfc334a5ca06625ebdc4d4c70746c7b0139570

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
18KB

MD5
9365d94a14426f8c49ddbb671f2949ff

SHA1
71a3f0526854aec51b1be3c9006cec77789e0197

SHA256
6c2018328e1481f5e47f9bd1019f0b20e2d9eb032001a9c04c245f2f48205a02

SHA512
25463abbb8e16015c32d0e6927ba64d22788ea1dded948808df8a50138218f430de0f211e007afeabc03902ffae81dd1e8488c586f51d0c2e23914cc75db192a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
18KB

MD5
089d79df067cc65d0c98241fc2f7c65b

SHA1
43c7914bf59288c4991d1fe92956650665238f57

SHA256
05ab165290ed9735927e38a73d1b0d363f97cc9a424a8a002313cd109ba9674f

SHA512
521f5b330799befd9e08e1c8ee49ede1f644393e0b129553705083bc6a4382850ba62e66719ed897a9eda4d1f2bd68d32055630770a42897899e09ba4587357f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
18KB

MD5
440ee4ea7835da5c960647ef9ed75477

SHA1
7b9f723863aab1adcf8d4d36b884a1888f64f5a5

SHA256
ac8b3aefcc6e53f21de568362496415a8e7d8bb1d437575fda6442281392b2a1

SHA512
105ed2bcc4a75601127869cdc0cb762405cc8ae8046a325f716cf26faa4735735844cb540ebd4d2cf7190235a3182e01953531ca1e647c85dd7ee593b7b56a74

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
18KB

MD5
52ee6489d05974adb02a47a064142360

SHA1
d7314a49a1a20f80d81a5bd86a63d8ee2f42ce1c

SHA256
8fafce08216a02854aac9a28bf62a4eb42bc63d47a6f759fed7e5a75ce609968

SHA512
7028865f1ba897b5c224281d109471ac72f7fa3d5d86e84ae020f5f96f59549e4aa7dccf81629ac434871174541f1b57edb89b271c72890f4b80b4b9212d9468

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
18KB

MD5
2fb874516a47d7fd33da9463dd56116d

SHA1
caf20acb96f80abc3319e89ffaadf3515dcb8bed

SHA256
c21d930044770f5c59198bdd48a9ff73657f65439ece848e05e197a705bdf4ee

SHA512
039cc979810f582899fd950fb8d5fce5033c3678095a7f1662e92ff48b9c2f257b3d34346e2ca9f1332ce38675a1a505877d9c10881713247be25f9b8cd3273f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
18KB

MD5
6be6fb33d108ae7fe04a739667740ed9

SHA1
ec5530c1d0696497df9b5b5966126de4b65db6df

SHA256
e7b652974df0eba4a52431aab23c3b96d84194b14239c37b94f9c2602b7c5adf

SHA512
e3d587cd5d974843cc3e2e282e9dbec3682370871a2539ef30af042014f7d4ae39c25efd81c03fc8898a6c04a0879946d28dac22cd63771a346f18fabc953739

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
18KB

MD5
cf63a8022f4040def8ef9d07238ebc0b

SHA1
794f3ec884e27007676661a7efb9fb7d4ac7f92e

SHA256
2fb3a7fc6020e4b7f21335d123d2e7e67880158dc2a7edf63b31d8f4159cf5d5

SHA512
c27d78af2671d5bac7b1bf6124824a61443240039aed162f5862cb5476fc3b9d00b943abff802e881f0704a9b4b431df1167d79c52aa52d1e842ee398012dacd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Filesize
24KB

MD5
60b345592703258c513cb5fc34a2f835

SHA1
39991bd7ea37e2fc394be3b253ef96ce04088a6d

SHA256
7e358b4f7553c9385e8eb2c5692d426bc257bbd4c0213e6c69294459734f6300

SHA512
0346fb4096eb285ab0fdf7e7ec38c4daf7bbb0c506f09975eb2290121d169a34c886fca342c3e06371cb697f2753a697ca4f72af7817ed340eee6063897110a5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\b48fc435-b967-4cc6-86c9-3bca35c467f9\index
Filesize
24B

MD5
54cb446f628b2ea4a5bce5769910512e

SHA1
c27ca848427fe87f5cf4d0e0e3cd57151b0d820d

SHA256
fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d

SHA512
8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Filesize
26B

MD5
2892eee3e20e19a9ba77be6913508a54

SHA1
7c4ef82faa28393c739c517d706ac6919a8ffc49

SHA256
4f110831bb434c728a6895190323d159df6d531be8c4bb7109864eeb7c989ff2

SHA512
b13a336db33299ab3405e13811e3ed9e5a18542e5d835f2b7130a6ff4c22f74272002fc43e7d9f94ac3aa6a4d53518f87f25d90c29e0d286b6470667ea9336ae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Filesize
90B

MD5
740cee3b2edb5c93698b3dd55342c814

SHA1
1a99c26ca56bdb70919fad3ae984012fc048115c

SHA256
b4a75f2e515221dc514ff99fe0076e725994b4edeb35e662e0a1583585fe2884

SHA512
de4a5b05966a9cc8f262404de69663d8bf53c42acd7f9e2516891e2cdf5569d5f50b3b6a80fd756431b4bb7bb842fc7a35c54c692357d26038b93102367cf0d6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Filesize
90B

MD5
a359615f90c5db87d4d372c444689059

SHA1
cd336a415498a725e42b4474bdd024e2f8a207a3

SHA256
b26c3557eca20142fa18982fd04099edb82b7b1643533d6c5343a0f8ea6d3bc3

SHA512
2b496a1be84c60c7b8eb8dd750e28b5d5fcf9668cca59ca7c7568550dc7ce21d4e9aac4cb32c537f40df07096f5bf0afb0f84d65637844700d37633840fc9029

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Filesize
90B

MD5
aae236e2b7d1b3c4c8ba73231a026593

SHA1
4af86fe3da83d5eca926e17bbd62716669cd47af

SHA256
57766aafcb560eeb49d7a6968af88a6b360551983daddd2e9cc4d18d77f94f73

SHA512
b16cfb4af6be23d2c8cf927f8732558bd0a7bf2dfd7c83765820d412356837063a5ece65a899846d635f1b9343ec47e979a886f53c07529155fa49765248d89f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Filesize
90B

MD5
51b1d4670f42b9e157373885444f6e74

SHA1
c881bfeb2a0ae143ccb8e53ead1c810127ebcfce

SHA256
a3a1f27992aac5be69ff28be6a70a232eaee3a90b355c2d27564c43a50d4c155

SHA512
3514e21264c16a275e19930a7246c58cffaf1067b285e4b261b497c3a402d7f748bf348d551c523e185f32972644d15d87f2c2fe347302791209f5d7dc5f8dfa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Filesize
90B

MD5
e2154528bc5c7268d531f3392029e1b1

SHA1
7bc97c4f169a945e149ec4680899a9856f18d095

SHA256
dbb94c3426744d03161c4e9c2745c8509831595d958aa49019de7be25f6a1d86

SHA512
9575046a46842b0eee49866871e17930d51eaf1c02b5f6f0fd494db5039e4b8e9cb08f1cdb128c9b8f5cedf60515674dc1250464a0db2f107c26a65bd7418d89

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Filesize
83B

MD5
90a77ae59e6fb36fcd6a39c89c5d1503

SHA1
e30356f811318fcd333b88576ac538502bf3ef90

SHA256
598d783dd40edff47fea230e6229454c5c56a4e8a1dd2b6782a39d9ddb5cd8a1

SHA512
907b025d01b8b646b99e9a386c845c3c33c09dcfb12a06a8985a0c7b58bb7c5cebf957810a60e44838d6b24c5e8f4df96f140d996f7cd4633521548e7ec98fd4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Filesize
90B

MD5
4bcc687272dc93e6865501c8076dad27

SHA1
b92e969b086df573dfbc6da3446ba4ed6cd36f63

SHA256
8d9d736dcd29655b002dbdbc1fcabe79f6650437ee620ecf5fd894229edf5033

SHA512
432cc5c8c36a21d06ce1598e95103232b8f66ec7e625cf535e7f06f9566f051c74574a6e52ce73e35e1318a3b1633c19eb7733dc84d3454716391f3e8be88704

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Filesize
90B

MD5
7578bc6054850c9b8d8d730fa51c4792

SHA1
7f7d947595f94524cdc59857b00aee8475ce0813

SHA256
cbeb4764e1bcb3551227f50709c75401dd8a58379ed4a7472a55a723ed5eb7b7

SHA512
09e956bfdacfe7fe7509c1440312e9a092e7a838575e0983ac47d8809000531c16a46f966d90282aead28f58754a35c441413676dabdf38049af5af484f73838

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Filesize
90B

MD5
96475773e516bfb1fbc42590c92d9361

SHA1
72b32611fab1f62c766cf6ae99b5b039a8cd07d5

SHA256
8c7de553f53486d6f3f6935451f8320c0943682cc7906fd287dcf4d8850ac567

SHA512
48a4f83ea8c4caba2779a02a49c3354272c02fc053c7a1cd6fb79c18297f015e2615f546ebab710999024fb4af767e0299ea0ea88910853aa0884a0948a11e20

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Filesize
83B

MD5
e1a74969e5bb2985d80a962d27f6b2e2

SHA1
f32dd274d9e54d18b39a866a98f71a18211f4a59

SHA256
f2efe356d2bda767ba6908fa9ea503f889619d74a4f873d9ea13595d6ce673da

SHA512
7e36bfe26f8498228ca55f5b252dc63fbde4853492873703b1f64518ec7969ced8aee0177c3312b87f89de95d8db166f16a1cea64687a9580661eb717facd836

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt.tmp
Filesize
90B

MD5
df1fa6457dafe0d684da969181783b14

SHA1
a3363b28c526dd006669b4a9c2af16f6497c7fab

SHA256
4957d3d04288b6bc59c3672866dce8350fd9d21d43fd54a1cfc4cb85e5a57649

SHA512
cedf7a85e8485c3cf7782bc8064d76352872c04746f508e590a0b0e7f3269af89cdb5e6c44d3bf5d479429d3b1335a7ee03c6f958ab6d672e2f814d3df46e089

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt~RFe5a7a81.TMP
Filesize
90B

MD5
95593061ea6ad2ab89d00ac5f16c46cd

SHA1
57ce70739a740481dca18ae3a342d7a3488256c5

SHA256
f21c7ee02668280129e0d3d7d88902d95c29c324f15d8b2cba5df2266366ad21

SHA512
4c1b4012978548902544723bc432a23f7a614810a23a3f20fcf94cc1b78296eb4d35e99313a16c90480a34ea852959fada5697c846da613c366ca448e190eef8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
204B

MD5
adb55410f3642848b250f742cd2cd292

SHA1
d84e6f5321174efbfd43262234a54b3bc82d9739

SHA256
14945cee40fc0d9cc9bc4959b4b454d24e3bd0aff0c18e7ad9131cf91ae6c374

SHA512
967d2f27800a8a86920275fe672af82699f9a3abd3a620184d381bbb97e2bb0676c3b870cf4c6af09e9974a3ccfdb695d8fb591bbd1851acbd20371ce64aee75

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
204B

MD5
613191e95607168759dd4ef7216bc451

SHA1
9bf0036080558efa26910880fb2b11296104d7e5

SHA256
855c364243ba6a4d605cc6d7134affc009996d06957c88522096935e79913026

SHA512
e74106f2aaec7e9696461ece5e1a97c75f2a91957ca0723472dd9df738d3426036f05007a09313012876fb93aafb841633f9f87cc6ff31ba160d169efeff99cf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
204B

MD5
43e962735fec0ca5e63726e9add5fee8

SHA1
5c5dad32680c1f4211a1780c96305a6bd33a0e69

SHA256
936f49f0bf728fcbf356b6ded2a3983db577e2f0756daff2624228c8c957355b

SHA512
296e131273b2eeb8ff0415811911b8ee2a91e0797289523b5c8ca8e67317dc67c4b6e82e9782f3363af5d844bd7702d6363b60d4809a4375a51cd52607add141

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
3KB

MD5
959439c9de0bfee775ba5ee45998ba35

SHA1
058bf45be1726586a725afaa93ec92e8886fbc9d

SHA256
abf3e55f519a39b46a165b8b4f4733b909a53eba6f70c6325e2db2e80590842e

SHA512
6f5bca51c1bb57c6f07c721b290aaf74d666765f21bd96aa24f3f6eeef3f9e5c7e18ff8cbc07c9c2b921318f04677b28a44b27a1135ef585daa501a0b1605453

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
5KB

MD5
32f871aadf638d06287c51f1c7578370

SHA1
99ef6bd3e3f8bd91deba6e2b7b13dd2e4dfbb63a

SHA256
454353b2bf247823234f3111af6dccd4a6e9cf0a782bdf812948102a90ffe541

SHA512
c41354216ebe14a20b97edf4db706fa5775c2b8baaef2aebd433ec67c59aeae4ca603b001f70b993261f2c7568d2958dbe373d7eee712a8076e2f5005a0987ff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
6KB

MD5
d94ac0db9e7a3867f30d76818a2471e8

SHA1
86bd7812406d563ace5b7b03160cdafd484eafef

SHA256
c6cb0ae1eb21fd6184054288a3c6b23788ac995f1fad341aec25b6bdefc24274

SHA512
c31a5431b63a4149d9b244daaa0333bff7006f312148856f6185202d1d4d099455b12ce893d73401b8a652079b82e7c0777851f7a82b20b0c3b26b39434743b1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
6KB

MD5
915e7f3833d2d7825ce13365be061012

SHA1
2955eba52bc1be701ef4d4d503cbd3bd0642863e

SHA256
7b57a7298bd6405c73b361ca501a32e11ee2eb20342d9cc270136813cfef2b19

SHA512
6d97dc657a9d73add3ebdb41e2346ac1fb4ff831ab7d3b81aade90bf05872d9b15ced768ac981d251e62d8f816fbaa4e5c3b7e10a26dca2531d1f23223809889

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
6KB

MD5
7bb4c6ae763cc003cae033a1239b6dd5

SHA1
3e34c7ab6792a40c064c094e41b835010f4c8855

SHA256
e161fab3f2ecf07b546826f5c56539d2807cf04bf5da035d46cf253c346c232d

SHA512
52292ec88cf241a6a4909606b4da5675af5c75c55d5862a1cc9610e6058edf561ebf41f2c781f419ea32e2978247d3bd540c55948b1fb36bce28a43cc299c48a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
6KB

MD5
4c94edc19de65f7e82f89d85fc91c084

SHA1
bb9417eef579aceeb00ab75ade717f3445fb2cff

SHA256
a6d25f2bc3e496043da5565467e7a09ab43df4fb78282c221d637c63cbea760a

SHA512
d39998df321a2c683e639a99f469f89f9442a8a807413774716c846197be6cd439772abefe8001bc52046bd9d0a9a9d8d5d615a423db86e0a0e2bf6e9d2b731a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
4KB

MD5
704bcb5b6a3834c71968c21804a1edf5

SHA1
4de6e31742dac896aa79ee014debe96860145305

SHA256
1e7da957c48281c9fdc267b1313f6938f2a95b172874f7f89f3cf4914e41f86b

SHA512
a12be1b11ca34e9a198d0994ffd7a419538b25769fe0d4fb5a4bf49542f8798e7a4719f259707c1762872f0a214fbd96dc236b784ef1967ad874d00014e824b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
5KB

MD5
a5d0b05bf449d517c64f840ee444d022

SHA1
865750324947164c560acc370155825c2a9e8150

SHA256
9ecb648b0139c9860213137ddde02aab1c242a01f6dfe001a94592523967778a

SHA512
7b72844526a423ede0877db5591c2569c0d42d6954575a22040e4236dbd6535aad7d0360130d551dd83cdfbaa9724cfd57d6ace108d7d07e80ccc15267722fb2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
6KB

MD5
0ff92a8948c44db3b29ab55f4dee5c87

SHA1
86bf7a748763e37973a8a85a3d405a07d32a9567

SHA256
3d41a9deab124b7227246ef49cdef0cf02d36acd7a8c53fb242b33c04f8c489a

SHA512
be4ac64e66e6ea7bae40f38e0e8a05b70f08e78eb3b67111c1e4cbfa5f1146be7a750ed450019e63bea1444f75f9bc4f47df6e7f85899d77eca88f341e79efef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
6KB

MD5
cf251b6a8a69a3ca1b794c8897958df8

SHA1
0c6d3623af30f77e14283e945badbff737bf9967

SHA256
0e0c574cbeb40276a8da01ea40f48ff6f281188c00397627be3b910aec580e21

SHA512
89ff00edaf3570ecfe5f66f61e2176593cf7fa23f5c83c84a6dc13213e6af034e01700ac39f9c80461f05f369dd2f2d3847e2859567a1915db76bfda798f2538

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
6KB

MD5
d15550dc376999c4a6b778bd4d4a8671

SHA1
92a6f673650ce258e8a33bb3d2acd61f36949664

SHA256
518621d776708f79faa433f3b35a3b70ccf0d374121b586c990f4fb9108780a5

SHA512
dbd0a3650cfeeff24f69adf2cf6baf788971d54b0016a9b71d04d3fba0788f604be5eabab28555615123b362aa72126b1d3a44a30fbd0d0b98d53b6c70f1a592

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
6KB

MD5
7fe0fc9474049bc058dfc5dce2105acd

SHA1
6243c9722bc755e81aa6da63633d01ddc3e26256

SHA256
195f5f506b58a4ece1aa32e55ca554b0e18494211f91cf73d63adadf37edf131

SHA512
0cda713587f6bc45f3ee9e9ba322f4b8137e1298e597270186f2bbf23b22a277ae333c6e1a7d463745982ef7ea395e6a4da7da5d5c96727df48f85a079393ad7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
6KB

MD5
89f356e4b8aa1c58f98e095bc24e812a

SHA1
37503ef4a39fc8fb79395ccf2a0a7ab8e0b2fc74

SHA256
36a092973aee2882814d2719a3b92c84c477967d0496e60dee6cc4e7a538ef41

SHA512
099331488ba5bf5d6ad8957508b8db05416ec7c5bc62acc6b2d515ca36452eff6056f9d966749c7b1341b4d81ea57d8347f7b3230f9d3729fdae993f1627b8d1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
6KB

MD5
23c27c7634509ed28ba1cc1794aa23a8

SHA1
dd2df7244615f1d030217d95a07f7d439995476c

SHA256
e400467487023cbfb92e419e4cd30bcc1ad17a8f7b1559eabfc3fe2b0f8fa0b8

SHA512
c656cb3cb095136430a1ea5efb6a365f99b89757083a6f5b6e4ea17bb2346a91d4ab8e7978b1fa56890f516134954b194b249e6117056a270e551d6e5c5f37bc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
6KB

MD5
f1ce794909862a2a24a4fcc043cfa0c8

SHA1
b4af194587fa790d343572736af0fe3eb7e229bd

SHA256
2e29e56a24424b2a056cc0dfb3ac8dee161dfaa589560f1b496db570e0bd88e1

SHA512
277e8d8d19cb389d8d9c75bac00db1360ca07bf9302f95aeae08a1cb2cd3bf1425c7a3213b8e27ce50a616aa3b248132a129cc7fed392af11544cafa585929b0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
6KB

MD5
417b03a2ef2e999b1b5260588fc4f6cd

SHA1
b6a07cff03d16b99624b65ab4405dd1ce26a2f1c

SHA256
a5f196559e428058fa813453f7b87aeb99140d623dfc036f1248aecb14e9bf31

SHA512
0cc4cf2615021ec2c7338b90ed51f77dcb792a769ff36ac8b3d0419d5e01e698d39a2d5f5057abf23b1724057746562e4259922423654140960f575ac3ba475c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
4KB

MD5
61b1799275fb2086968657c83094ba33

SHA1
22759f0ddc32ca6c2488293ed38598909fd9accb

SHA256
270d4b0f69694a0acc46115afe6cafd494bda74f33ce49cdb24ad3d56d3c1861

SHA512
41455baa07f97babddc0149b46bd09d7cdd6f7f519ba38a0346813272595fabc8d6fe2ce008890027866616e8445cc49af1128c3db7638c71dd1dc9f3b1acd7e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
5KB

MD5
9a16867c19e2fd1f1453fbed70489a5c

SHA1
bbd0773d98d48c0a388397c250b349db51bb66ba

SHA256
f9b08ba5a497cc1ad40692a6b3f1b5fba9fc4b22e7e26702d1ad70c8af746c61

SHA512
e757702293f5a215b918f859fccf5e8687adc862edede788b1cef35ee95080f5493ae4d2a8c974d62c879fcac8447849d8221c25fbc3093883aeab522866674a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
6KB

MD5
632538ba956acf233be71e807271fe00

SHA1
b0ce5ee78539dfe38c43f039602decd362445371

SHA256
14a200cacbdeb622fb7d1c64d51980bcc512afe0697e90f2fbc7ffb509e8937e

SHA512
c2a80200261aae3d1e83a281217c80af7d8819b74ddf26ac1f08adc7ec8a5b82011c21c0b0537c404bef5f05124d8b610760ec43d607c96eba4ffaf4cd1c7f7a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
6KB

MD5
b096222aee03fc41a8a47aaca91829a9

SHA1
ca4b57dca8a24f54f29c51d24237c9ea2ae0bdea

SHA256
87442626d273295f27c4fcbd51e5c68de3b3de5abcaa958d88fc5c73b969f79c

SHA512
066e8bc86285015262c3bb24a2fc3fe1f139d6bc902e6f551bb05807a968f0ea8b141e7024685cfa11f699139f870ce6431a556803fd97220e7d0928daa8a5d6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe586741.TMP
Filesize
204B

MD5
5b0d8d05a1e3f92e67690f1428ff930d

SHA1
985e82a6f7e2696270d624fe242e1c24190db335

SHA256
c1d7f3c2d857298a81b96f999532152d013d78db22d5647c646a01302ce26315

SHA512
078272ca5b27e4cf65d37f5954a646ef0dffba71663581d00708aa0ce3027401e6f97fbb213c6deb460ed7519ede96eb67078cb587289e721dbfcca503d4986f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\c257597b-6a0a-49b7-8fac-7904dd1145b4.tmp
Filesize
18KB

MD5
6d8d69f3ce32f04f10dbb24a63e154d2

SHA1
9850a9fb6b0b78ac100d8cbbb056487ca779917d

SHA256
1b84455382237d7cbe0d93c57b6c2bf832e03ea02943e9d6a09ad1e8e103467f

SHA512
d6542dba44833389f66ed1fc08f2c388880ee2be129a7669738dfc0bd584c4ec55a4174ce98bdda705bf906365a4f35e22ece17bd6bab83b4a2eed3d458be0ee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
aefd77f47fb84fae5ea194496b44c67a

SHA1
dcfbb6a5b8d05662c4858664f81693bb7f803b82

SHA256
4166bf17b2da789b0d0cc5c74203041d98005f5d4ef88c27e8281e00148cd611

SHA512
b733d502138821948267a8b27401d7c0751e590e1298fda1428e663ccd02f55d0d2446ff4bc265bdcdc61f952d13c01524a5341bc86afc3c2cde1d8589b2e1c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
589c49f8a8e18ec6998a7a30b4958ebc

SHA1
cd4e0e2a5cb1fd5099ff88daf4f48bdba566332e

SHA256
26d067dbb5e448b16f93a1bb22a2541beb7134b1b3e39903346d10b96022b6b8

SHA512
e73566a037838d1f7db7e9b728eba07db08e079de471baca7c8f863c7af7beb36221e9ff77e0a898ce86d4ef4c36f83fb3af9c35e342061b7a5442ca3b9024d2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\f801818e-57fa-404b-9089-cce267244b4a.tmp
Filesize
1B

MD5
5058f1af8388633f609cadb75a75dc9d

SHA1
3a52ce780950d4d969792a2559cd519d7ee8c727

SHA256
cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8

SHA512
0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\CURRENT
Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\MANIFEST-000001
Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Filesize
11B

MD5
838a7b32aefb618130392bc7d006aa2e

SHA1
5159e0f18c9e68f0e75e2239875aa994847b8290

SHA256
ac3dd2221d90b09b795f1f72e72e4860342a4508fe336c4b822476eb25a55eaa

SHA512
9e350f0565cc726f66146838f9cebaaa38dd01892ffab9a45fe4f72e5be5459c0442e99107293a7c6f2412c71f668242c5e5a502124bc57cbf3b6ad8940cb3e9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Filesize
11B

MD5
838a7b32aefb618130392bc7d006aa2e

SHA1
5159e0f18c9e68f0e75e2239875aa994847b8290

SHA256
ac3dd2221d90b09b795f1f72e72e4860342a4508fe336c4b822476eb25a55eaa

SHA512
9e350f0565cc726f66146838f9cebaaa38dd01892ffab9a45fe4f72e5be5459c0442e99107293a7c6f2412c71f668242c5e5a502124bc57cbf3b6ad8940cb3e9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
9KB

MD5
ce8f252cf58a0083b0ac6d9a3295db36

SHA1
db8561afc11b73ee79e14111d2edc655445023fe

SHA256
d1c5a294fec718b97c01753f018279631d1d7682634773831b1576fccbdd829b

SHA512
d7574416b1f1217a8d955fd5779f0015b8be58e43ba4c62dbda802ac8767cbbf9099808db61d51c70113987d5c6abcdd9af903fc8ade2ab14b907a028362b992

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
11KB

MD5
72c25659db18bc48ee440b975bb0639e

SHA1
cde6935f2687079c1cafa8d5139fb3a74928580c

SHA256
8e272176f1883219a61bfc1299a1eb1d14d9112bce11ea369be3e3dfb0e577b3

SHA512
74df0e6645b1def2690855dbc55eae2f0d873fb4f55d10ea01f11f7c94196cc60094d7caf324fc3d6ec0ab2876a300cf621b91673a795ddcfd1849314d7e26ae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
13KB

MD5
dc6aeb336e65427f70b3eba719d0ead5

SHA1
6e7405a039a0157719812688eb411254625cd76d

SHA256
4e811e166595d77381a76434e82faa5420c898fd252c63d92d3564700c65eec6

SHA512
ab312c3dc2af8e5101539e501024e5df2e9673af5487656f24eb73c2c9eb2c00c9db3c35f1e3b9e33765b6530846f09c244af66e5fd97219d53aa53fc45b0d9a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
13KB

MD5
4cffc109c882d8f826594a30189cd1cc

SHA1
f48de7d9571d7a0633074765fbfe4622b2cadf93

SHA256
654d63864e9ec0912e11f920658c8d94ef16ad57de2368374a41982e38791c36

SHA512
d7b27a196f21b333bde146adfe84a82b80ad4c0775682c87abfcc666f9704b438f50ee50f4ab1d165ee42ac25740372c8dfa3b125dc613264f250a45a51d42c1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
13KB

MD5
8450e6aeb6dde3b8b0c3fd53a6abe40c

SHA1
a9fd062a25f7d246a919759da69c68cf723f07e9

SHA256
b0142049ee6ab3de82db239d4189aa11cb9f28ec250cdf0627b3bf5fe2a7f500

SHA512
10987ae14696f820197e38f01cda11915f1cd4b899dbe3fbe760d48effe7fae9ff56f4a872843800178695f649beae60eef095a22c1cac1021d420fffa5e3644

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
13KB

MD5
8450e6aeb6dde3b8b0c3fd53a6abe40c

SHA1
a9fd062a25f7d246a919759da69c68cf723f07e9

SHA256
b0142049ee6ab3de82db239d4189aa11cb9f28ec250cdf0627b3bf5fe2a7f500

SHA512
10987ae14696f820197e38f01cda11915f1cd4b899dbe3fbe760d48effe7fae9ff56f4a872843800178695f649beae60eef095a22c1cac1021d420fffa5e3644

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
13KB

MD5
41b4857ce91746426280c4137ece33e4

SHA1
f2ea619314f4a9e9e5161c6a065f2c333dd9624c

SHA256
856f7edb1218fe61662e67fbc179c9b9cf93a69c343d1162c9fb5fb745f008b7

SHA512
359e0e2bb94d5cbde42684e281c4e538e62c8ddcd05bff6d613d111b49d871353afa94ab36fe3b15507a24292cc47539db2c9a4027a3a7bafda42e47d4b7fef6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
13KB

MD5
82badafe3d3dbf63249ca9b1eb8c4c80

SHA1
a369b21fb67703d48753a2e3275c3312866f96ba

SHA256
6d211d41398cc5f801627aff025ab8f0691a92caad048bd1c9cdbd0cdfe492bf

SHA512
8be9d0b461e07d64ff9e1e9f68676626701eba827ef55b048a528829ee32c51c3843917a11ac446e768d33f6aab8bf59dd39c5c9048e4a4382399fe10ed61656

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
13KB

MD5
cba0725feeaa7c5d6ca08530ff5c091f

SHA1
1648c936c44efbe1c2f7eb163bfc51217b6a67e4

SHA256
7f19c575ddbfc3dcb5937f0816d310706ad88d5a516fa5d7d8cb4c936c4ce5e0

SHA512
9312d565ca3c24b694d1cfecce4773a834cb4801920ae236a812530f9fdaee7e30e24a0afa6a26843e6104b0f494a23254c2eeeb6430a5222a12c546bdf2a270

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
13KB

MD5
dca259882c53d343d5883c251faad630

SHA1
bc6d36b44d3925a282c5ede988d192f1fcbace93

SHA256
a4c799cb2ef9ae9ba17f29d7df6d937395ec5f4ace4af7814f8ab3c891dbb614

SHA512
78b45372873d41203eba99ddec9543ba799dcb5dfffd6c5f4bda4f71e389183fc034375d2b0618d0af1bde278d512cfa993aa4fa21056e3c8eea6e60d34c4a94

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
13KB

MD5
5042fc7d25ee2b4e9ca027e73e66fcdd

SHA1
5105eb0796f469c58373c6b8bb92f870eed8f0fe

SHA256
b93a37ce9c8a9bc5cd0229547fb528a81e592a194e83a328829b44465cd19a97

SHA512
2a4ea2f6079c6b841a66cf57f1bae572a4c0fcc8b6062ae0e8e676c5af088290ff3cf8b636e1c90b08e9d99803edbd2d277223cb6adcd33832e0c1d0f6eda3b5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
13KB

MD5
c6b402c62bbdf20ea4691a6174afbb9c

SHA1
0db4317b8025adfd906f4d1ea3c78e0e2522c423

SHA256
7c9900dc93daf5dbed01a56f25a5d85fa7b6e3c8c607cd8b0d46374ff7f33eb5

SHA512
fa486d9f0d62033b157e8469f271fb38b376c92cf3398426841b1a37e03c257704e649456b9e52f6c6db99ef8b0ef458f1b83de3af51387f995072d147e767a3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
13KB

MD5
45d1acfbfccaa31f86d5692ebf48407c

SHA1
7d5baf2a301e30073466e31a41a0f2257cd1312c

SHA256
b236681a2df9da2c732fe9a02fa7627de5ee5924d187569fac825a5144e7ab7f

SHA512
90b77b704781fdec810e4b40b1293bff18a5bb0ae9b35fdfc85b8d0127ba696dc7dd195decfff8a9416059906a3da3579f1ba055fd5a29cbb6c5bbed7cd393f0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
13KB

MD5
c6a59f2f7c559cad7aeb3a7c2436f4b1

SHA1
0dc7ec7c827df05c684a9952cee100d919cf1ab0

SHA256
5d02a287f1519ba23486715465f600d125a33a99678eb492a38c8062116bcbed

SHA512
e3589aec072f0d9d875c3884a1adb95b5b1e4eaf68ab43334f1b6e9c32cbf86bcbd25d6c01f664d812cee7e7ff019a1333f83fb46b533a0a10c9daf94b459516

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
13KB

MD5
4169408d7a207b893671037c8ef85ad0

SHA1
b32b89ee7abc3bce73188b2bc875596a690f9913

SHA256
1e65116d433b4062f747435c1d2334d22cdf4cac4af3de17317b2b907a40c728

SHA512
f468c5357e0ba0858f62221c6308db8e0222c7ea0f9487fe78dde2632194dab8216f7d3b9f2496b8ad88c9d418ca56ad2987b7089f018a52dfac3e501b370ebe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
13KB

MD5
c2c59a9acb0ddd0150da077a8887f52c

SHA1
a278719086c71e8117cfc97fbb0552c085f3938d

SHA256
0f0e586af5cc7a85ba0e912f22f65fc81abf0bbfe95687e5e518bf8e8620f398

SHA512
07756874b9987cc5071ba875003823e8b0ed45a9294f205a6643f1d9b961af0790daebbc1e00799cf3fec7274134acdb50791faf92cb44c2e0b5f209e06f6eec

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
13KB

MD5
86fef972589a9cfd430fd4884b9bdd7f

SHA1
4a20879e765c71a83f02df21795f76036565bc18

SHA256
41c7b48da11e9985444d5578f6e8e41395df5293ceea501f21d3bd03712fce8b

SHA512
50a61d21379c88f1b8b296f60e456b497c333ac7eb68f8417f2842b4a15234c88b5478fee4839ae335a0d4fc45fe0d745094fbe5d0aa05984ba26ef930a2600a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
13KB

MD5
44cdc2b618ab849dad25cc93ef651cfd

SHA1
d8622e163e3d538a98972dd2c675d845d185c756

SHA256
b4861729d9f8f3d096a93cfada840077777e59a2a960459e68c702e9902e71d2

SHA512
5ed3234e6fc0d1f5d4b1d8fd4d12b6bd7ddcf1a5a8bd80b128ac5cf139848c79444f9a29d9022e67a51fb650b08c3bbfd92e70ab2808384498fc8f949a84b5d1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
13KB

MD5
8c6c755098b7981733a62fde5a0ca2d9

SHA1
8d90af17163a24eb112af1a4273fa5fbf62aa6b0

SHA256
b7cfc516acfe3c3757f3c29248a8252450e27956a7979d7219f6ea0413a7d689

SHA512
35766884abfa634fb84266fabe025ef5eaaa50c72eb1aa5906fffa5c7cc55aaed01f6197d243d18fc23da95687a62c01530ef423a575467b85c9fcceb33b5d98

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
13KB

MD5
f9da3213bcf3b8d2aac62ad12b15f0e6

SHA1
51820aa249a90983ff7c47850c70ef81ac8acbd0

SHA256
06db0371c3d78797732e245458ff230af38a509b4ac1b575f67d7142b0a1a2f1

SHA512
2bd2e396b1a54694ddc780ae26186ed26af6565bb7a077ee2c3f9e49a7ca13b4923908be0d78727179dfad912bcadaa8fb698851a6876fe1c31fd4aafb0bf46f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
13KB

MD5
5c405da5d963a7f263159e020be01ebe

SHA1
55070e5ac6f59611db43554793dc0356cb3f1a2d

SHA256
1e010bfd490d77e2865b784ee805629cee4fb58837a5c9668c374bb270640cec

SHA512
1f4853e1e98dbe1b6cc3e0956c7e20984fe4a80f8df1094c0922c4d8cda9b50178cb17059db39a552203c78285deb30ac7de74872348c64063142e9f1ba5e26c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
13KB

MD5
f7a230c67e332774c9137ac67339c8a2

SHA1
936c5517b8ded8cdd75922a7b7d098833d13e96b

SHA256
c91d19f25aa00306755405332e0d96147f438012a30d10ed6bc41f86f86f4c99

SHA512
56316e5e102ad53869774ae178219d78724933580fc2f3bf9a36c0186b5f58909d275ddb05e7bfa55253ce0d1b3298604d40961eb7e175934def743d448b0f05

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
13KB

MD5
e9bc1860764db87b139d4bfd8c5e44e8

SHA1
151e448800de790047e984cec94258454bbdf355

SHA256
261736c99b8a577c8f8d971edf03d4091d29706d7ca9b0bfe918b8b859059ce6

SHA512
f685d475e74933f4ec422caaaf4bc5fbf298575f32a0d170468a2c7791e370acb58129e57f0595744d1811410f24a1757e47583ffd72c1f5e149d1a8b49fefa0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
13KB

MD5
7949cc6e80bdeecf81d36be1cc603cf6

SHA1
89251abe9deb4d43e66551c756d9488de4780130

SHA256
0ad64ac08003fc941d8278d1ad36ae4164d71a63c6408e22d78de7778c6fb2c8

SHA512
c7db47c9045968750573382428dbfbbb058f325b87a23ff2d4592b06813a4fd83fddd7d1a279e94afe59dd4851d4c8f9553016cc0a90f8e64d66f69f087fa572

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
13KB

MD5
fb4661d3d9faa607a47eddb3aa3d7802

SHA1
975e986930fc82c5667b74d3c4d61af374e5b48b

SHA256
5da27be234e0fbb574c5db632f72d9461e44cb5416b4b67c1285d080ecf0594a

SHA512
1b6cab1aebc5b113ab4713f7fda33c887c4d7ee4c9eeb3ac9cd69c04c148c29400e3d1905d728eb1ef83703c4d7b18f529db57935a0b76e209d4b0895b9da7da

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
13KB

MD5
9d3ef55f59f8e07b4e62e075d1f6d7f2

SHA1
66485854577237d0345a77babcf671419439dc1c

SHA256
71ae3f3b2867e005c238c6637b207474aa2ac877d82625fe373a7e214c6633b0

SHA512
f293c511a44d85ae4ad30b8e5b85ffd27fdabf827f1e98c5b539b69b46fe83d16a6bb315d6753f81a9e39e23af721a36b92c861b03e2e131344494033d0adb0e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
13KB

MD5
e3d5e6ef79ae9f709c3b4f5c54db5bec

SHA1
af26a97730787cafad9826c0ca0979715beadc98

SHA256
00683a373dc5102cf2b22f16e65d9810e90a5c47f4f9889623fb54a3d7b7ceed

SHA512
5217d37ec85c0aa9d401772d2b0e34a25c69d327f5150f329d32c6117631e89ef8b4c65ad2f3385c4110c9f5066067f8629f3016f4cb28c8496cc9f637d292d4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
13KB

MD5
81927641502a60f08cd46a43b87517b0

SHA1
d9d32a62502399abbd5cede2851e26d852c01c36

SHA256
9b4306afb43e45825665b5c31ba924cf73f8469090fd55e36645b92ce6a2f2e5

SHA512
46db9a4c6cc02c8355d32b5b565a120dc501ead76d750a5e168bc230ab7ee3e750772b5960358c646d1ba799d4717c9996e4634ac9fcc5c837883b2e3ecd1add

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
13KB

MD5
d4b03d60de84578a9df457864acfa91c

SHA1
e0548da99f46aa4ba22669db45a8928a179dfbf1

SHA256
a1a7f1e7e2af72550df26c531dcf06c975481d8c207a34ce4a84ff1bade48214

SHA512
74a7b1145c7be9607018970848076b11d36b9f7058d92aa4ec0bce024f5bb000b1ac366efc5e8f1dc8641ff63fc7b99fffaf07d05927080373ea024f9ebd39cc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
13KB

MD5
a33df6bd1b7b949a00a649d039be4485

SHA1
73fe3adfd77180b2bc263d1838bef013412d8045

SHA256
1e29a38d91bd38f64fe2acee6fe8d73b133c44fe4ea834550b5635a151b41ebd

SHA512
69bbb624e72865c55c21ae0db643bb1060db7236e3f86186a7136f44ace5ef13ddab89f55ace750e678197657f6057542a0ee7bb357c61c7a4fbd492c8f6b3d7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
13KB

MD5
b21ff8e847d203ca96cbb49f530b563a

SHA1
e7fd08d92621ce522c85131774e8952b39f583bd

SHA256
9875bc811fed2930cfae33c479e8a54df6919ddd71c4af475a963acea0005ced

SHA512
ac80a4fa215303eabed16636bd29ababce7e2862df1ead8e65fe74076fdd3f32650f235fe21f8bafe581f89774cde5b92d84dea15784e528621be9cb6c57375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
13KB

MD5
a5aca483075c848736604bd7505b6919

SHA1
377acee16900cd0f8f9cf5a5ab6988a1cf5de049

SHA256
5e125b1f64148be2338c9dce52eff15239d40ce5f6b3d523d327bcd0c476c51b

SHA512
a6c4b09c7eb877d3aee8c17e7dab65d0f57571fe3f3a7361d3da11e3636b7848b457d4212f94dfc7a735c1861670b6d9219e7b58c5907f110b670102a03878ed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
13KB

MD5
ee25f16400c9228a256845ac5f8fd166

SHA1
74d472888eccb280d8dfd954310c1432a0a9ffa1

SHA256
0eb02539be7a1d92688ebcc71a1393a2bd533d93573481e8bb7ca0086679ad9a

SHA512
b0aeb620cfb3eec191bf9b1866b4b79053da82dd304968942413a15c5a130f4086990f14a1166f769964ad0fdeeb408ebeaaeef0a1efc700bd478b0207dc610f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
13KB

MD5
c312ead17732a3b399b8ed7910d6cd01

SHA1
162499f7e0c03ec7c2ab0abcbe30ff113adb0167

SHA256
921332ed09d2b1d9a37f3873d2e9d8a9c78e9e9307343b1e6e364b971c55818c

SHA512
5a5b7583ba98b7c3531390f58eeee6c2d716ec0a99034b0e0d3ead10b2b673c817073c333dc52258faee8e748f3a210631058ba48d42f3bd2658b7c5ded52bf2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
13KB

MD5
38653411954354bcceac8fd7abdcd503

SHA1
d0276b94bbc48085dc4f38de3e29b6183b9c8d1a

SHA256
b7e8139969e5cb7b080142624134dc910277ce48b170bfeb5bfcd070ff65f12f

SHA512
97a9bb498c6770916a151ede16b63f453c192d5efe53e1b77cf48b9e94e269150e94ecd93fed804f5659ef64eb9e5ef3ca88fd60de1249df77b2093db6fb2c6c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\GPUCache\data_1
Filesize
264KB

MD5
a78ed546e2eb72d284ff80c823d3460b

SHA1
6baf19023791bcb6bd471eadea6fd76d57f82d3e

SHA256
26bd6b6981f1576356059683a21005f69d4acb3a2ea467de0eb38ed6756fafc5

SHA512
89a0053adf9e795ec4529838bf79191480dcadfad509941a54e9fc444d5a1a3d9f52e18303bdf1d8dad6782b5d37ba926655a0c1a57117afbb483e0445495b8e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\GPUCache\data_1
Filesize
264KB

MD5
a78ed546e2eb72d284ff80c823d3460b

SHA1
6baf19023791bcb6bd471eadea6fd76d57f82d3e

SHA256
26bd6b6981f1576356059683a21005f69d4acb3a2ea467de0eb38ed6756fafc5

SHA512
89a0053adf9e795ec4529838bf79191480dcadfad509941a54e9fc444d5a1a3d9f52e18303bdf1d8dad6782b5d37ba926655a0c1a57117afbb483e0445495b8e

Download Submit
C:\Users\Admin\AppData\Local\Temp\MEMZ 3.0\x
Filesize
4KB

MD5
b6873c6cbfc8482c7f0e2dcb77fb7f12

SHA1
844b14037e1f90973a04593785dc88dfca517673

SHA256
0a0cad82d9284ccc3c07de323b76ee2d1c0b328bd2ce59073ed5ac4eb7609bd1

SHA512
f3aa3d46d970db574113f40f489ff8a5f041606e79c4ab02301b283c66ff05732be4c5edc1cf4a851da9fbaaa2f296b97fc1135210966a0e2dfc3763398dfcaf

Download Submit
C:\Users\Admin\AppData\Local\Temp\MEMZ 3.0\x
Filesize
10KB

MD5
fc59b7d2eb1edbb9c8cb9eb08115a98e

SHA1
90a6479ce14f8548df54c434c0a524e25efd9d17

SHA256
a05b9be9dd87492f265094146e18d628744c6b09c0e7efaabf228a9f1091a279

SHA512
3392cfc0dbddb37932e76da5a49f4e010a49aaa863c882b85cccab676cd458cfc8f880d8a0e0dc7581175f447e6b0a002da1591ecd14756650bb74996eacd2b1

Download Submit
C:\Users\Admin\AppData\Local\Temp\MEMZ 3.0\x.js
Filesize
448B

MD5
8eec8704d2a7bc80b95b7460c06f4854

SHA1
1b34585c1fa7ec0bd0505478ac9dbb8b8d19f326

SHA256
aa01b8864b43e92077a106ed3d4656a511f3ba1910fba40c78a32ee6a621d596

SHA512
e274b92810e9a30627a65f87448d784967a2fcfbf49858cbe6ccb841f09e0f53fde253ecc1ea0c7de491d8cc56a6cf8c79d1b7c657e72928cfb0479d11035210

Download Submit
C:\Users\Admin\AppData\Local\Temp\MEMZ 3.0\z.zip
Filesize
7KB

MD5
cf0c19ef6909e5c1f10c8460ba9299d8

SHA1
875b575c124acfc1a4a21c1e05acb9690e50b880

SHA256
abb834ebd4b7d7f8ddf545976818f41b3cb51d2b895038a56457616d3a2c6776

SHA512
d930a022a373c283f35d103e277487c2034a0b0814913b8f6ec695b45e20528667aa830eeab58e4483d523bd6a755a16a5379095cb137db6c91909a545a19a2f

Download Submit
C:\Users\Admin\AppData\Local\Temp\MEMZ 3.0\z.zip
Filesize
7KB

MD5
cf0c19ef6909e5c1f10c8460ba9299d8

SHA1
875b575c124acfc1a4a21c1e05acb9690e50b880

SHA256
abb834ebd4b7d7f8ddf545976818f41b3cb51d2b895038a56457616d3a2c6776

SHA512
d930a022a373c283f35d103e277487c2034a0b0814913b8f6ec695b45e20528667aa830eeab58e4483d523bd6a755a16a5379095cb137db6c91909a545a19a2f

Download Submit
C:\Users\Admin\AppData\Roaming\MEMZ.exe
Filesize
12KB

MD5
a7bcf7ea8e9f3f36ebfb85b823e39d91

SHA1
761168201520c199dba68add3a607922d8d4a86e

SHA256
3ff64f10603f0330fa2386ff99471ca789391ace969bd0ec1c1b8ce1b4a6db42

SHA512
89923b669d31e590189fd06619bf27e47c5a47e82be6ae71fdb1b9b3b30b06fb7ca8ffed6d5c41ac410a367f2eb07589291e95a2644877d6bffd52775a5b1523

Download Submit
C:\Users\Admin\AppData\Roaming\MEMZ.exe
Filesize
12KB

MD5
a7bcf7ea8e9f3f36ebfb85b823e39d91

SHA1
761168201520c199dba68add3a607922d8d4a86e

SHA256
3ff64f10603f0330fa2386ff99471ca789391ace969bd0ec1c1b8ce1b4a6db42

SHA512
89923b669d31e590189fd06619bf27e47c5a47e82be6ae71fdb1b9b3b30b06fb7ca8ffed6d5c41ac410a367f2eb07589291e95a2644877d6bffd52775a5b1523

Download Submit
C:\Users\Admin\AppData\Roaming\MEMZ.exe
Filesize
12KB

MD5
a7bcf7ea8e9f3f36ebfb85b823e39d91

SHA1
761168201520c199dba68add3a607922d8d4a86e

SHA256
3ff64f10603f0330fa2386ff99471ca789391ace969bd0ec1c1b8ce1b4a6db42

SHA512
89923b669d31e590189fd06619bf27e47c5a47e82be6ae71fdb1b9b3b30b06fb7ca8ffed6d5c41ac410a367f2eb07589291e95a2644877d6bffd52775a5b1523

Download Submit
C:\Users\Admin\AppData\Roaming\MEMZ.exe
Filesize
12KB

MD5
a7bcf7ea8e9f3f36ebfb85b823e39d91

SHA1
761168201520c199dba68add3a607922d8d4a86e

SHA256
3ff64f10603f0330fa2386ff99471ca789391ace969bd0ec1c1b8ce1b4a6db42

SHA512
89923b669d31e590189fd06619bf27e47c5a47e82be6ae71fdb1b9b3b30b06fb7ca8ffed6d5c41ac410a367f2eb07589291e95a2644877d6bffd52775a5b1523

Download Submit
C:\Users\Admin\AppData\Roaming\MEMZ.exe
Filesize
12KB

MD5
a7bcf7ea8e9f3f36ebfb85b823e39d91

SHA1
761168201520c199dba68add3a607922d8d4a86e

SHA256
3ff64f10603f0330fa2386ff99471ca789391ace969bd0ec1c1b8ce1b4a6db42

SHA512
89923b669d31e590189fd06619bf27e47c5a47e82be6ae71fdb1b9b3b30b06fb7ca8ffed6d5c41ac410a367f2eb07589291e95a2644877d6bffd52775a5b1523

Download Submit
C:\Users\Admin\AppData\Roaming\MEMZ.exe
Filesize
12KB

MD5
a7bcf7ea8e9f3f36ebfb85b823e39d91

SHA1
761168201520c199dba68add3a607922d8d4a86e

SHA256
3ff64f10603f0330fa2386ff99471ca789391ace969bd0ec1c1b8ce1b4a6db42

SHA512
89923b669d31e590189fd06619bf27e47c5a47e82be6ae71fdb1b9b3b30b06fb7ca8ffed6d5c41ac410a367f2eb07589291e95a2644877d6bffd52775a5b1523

Download Submit
C:\Users\Admin\AppData\Roaming\MEMZ.exe
Filesize
12KB

MD5
a7bcf7ea8e9f3f36ebfb85b823e39d91

SHA1
761168201520c199dba68add3a607922d8d4a86e

SHA256
3ff64f10603f0330fa2386ff99471ca789391ace969bd0ec1c1b8ce1b4a6db42

SHA512
89923b669d31e590189fd06619bf27e47c5a47e82be6ae71fdb1b9b3b30b06fb7ca8ffed6d5c41ac410a367f2eb07589291e95a2644877d6bffd52775a5b1523

Download Submit
C:\Users\Admin\AppData\Roaming\MEMZ.exe
Filesize
12KB

MD5
a7bcf7ea8e9f3f36ebfb85b823e39d91

SHA1
761168201520c199dba68add3a607922d8d4a86e

SHA256
3ff64f10603f0330fa2386ff99471ca789391ace969bd0ec1c1b8ce1b4a6db42

SHA512
89923b669d31e590189fd06619bf27e47c5a47e82be6ae71fdb1b9b3b30b06fb7ca8ffed6d5c41ac410a367f2eb07589291e95a2644877d6bffd52775a5b1523

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms
Filesize
3KB

MD5
f5c49876647e44006cf67ab777bc19e4

SHA1
7fabebc75fc0241c79f6ffeb9bf9d46d5eea0b6a

SHA256
73982b386d9832283cebb7a8939bb63e92a4d15195e2b98a30d5cf703cfac584

SHA512
a284cbd564d24bb4eebe821843dbd1ef1695fec32526792ad9222e74d37138d58452fe395a343d4c57336f23230190ae2a5c2cb13815509e66cc954a5b23ff94

Download Submit
C:\note.txt
Filesize
218B

MD5
afa6955439b8d516721231029fb9ca1b

SHA1
087a043cc123c0c0df2ffadcf8e71e3ac86bbae9

SHA256
8e9f20f6864c66576536c0b866c6ffdcf11397db67fe120e972e244c3c022270

SHA512
5da21a31fbc4e8250dffed30f66b896bdf007ac91948140334fe36a3f010e1bac3e70a07e9f3eb9da8633189091fd5cadcabbaacd3e01da0fe7ae28a11b3dddf

Download Submit
\??\PIPE\wkssvc
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\??\pipe\LOCAL\crashpad_5384_WTQZLTCYJKEBMCXK
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\??\pipe\crashpad_3116_KDMOYALNTZQYHCGR
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/3784-348-0x00000277C5B40000-0x00000277C6BEB000-memory.dmp

Filesize
16.7MB

Download
memory/3784-340-0x00007FFEC19C0000-0x00007FFEC19D8000-memory.dmp

Filesize
96KB

Download
memory/3784-355-0x00007FFEABAD0000-0x00007FFEABB37000-memory.dmp

Filesize
412KB

Download
memory/3784-338-0x00007FFEC0E80000-0x00007FFEC0EB4000-memory.dmp

Filesize
208KB

Download
memory/3784-897-0x00000277C5B40000-0x00000277C6BEB000-memory.dmp

Filesize
16.7MB

Download
memory/3784-341-0x00007FFEC16C0000-0x00007FFEC16D7000-memory.dmp

Filesize
92KB

Download
memory/3784-342-0x00007FFEB1FD0000-0x00007FFEB1FE1000-memory.dmp

Filesize
68KB

Download
memory/3784-343-0x00007FFEB1FB0000-0x00007FFEB1FC7000-memory.dmp

Filesize
92KB

Download
memory/3784-339-0x00007FFEAD5E0000-0x00007FFEAD894000-memory.dmp

Filesize
2.7MB

Download
memory/3784-344-0x00007FFEB1F90000-0x00007FFEB1FAD000-memory.dmp

Filesize
116KB

Download
memory/3784-347-0x00007FFEB1F70000-0x00007FFEB1F81000-memory.dmp

Filesize
68KB

Download
memory/3784-337-0x00007FF698540000-0x00007FF698638000-memory.dmp

Filesize
992KB

Download