e5c2683f7a605712f83903c9272d7d4bc0b03d8399595d7ae88189b38db2ae84

Resubmissions

29/06/2023, 02:37

230629-c36v3acf8y 8

04/06/2023, 17:51

230604-we6pyadf2s 7

04/06/2023, 17:49

230604-weeapada36 7

04/06/2023, 17:36

230604-v6lcmsde5w 8

Analysis

max time kernel
172s
max time network
717s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
04/06/2023, 17:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

MEMZ × ADZP 20 Complex.exe
Size

387KB
MD5

580ccf644a5efb8b9d0157ea6b0049ab
SHA1

dd4433c9c670cef10344f3d52a4397a520404a7e
SHA256

e5c2683f7a605712f83903c9272d7d4bc0b03d8399595d7ae88189b38db2ae84
SHA512

402497966cc73cb3d87d3ce72fc08372c996b790c6535253d01604b007b57d9efdcb2bf8e96f9a1418dd23632bb314d9de3c7fcc552d42fab3c11ee47fdd9136
SSDEEP

12288:actEagGmcl4gBF1BRnI6hAVebOe1gsT+tcVtQ:TR+cl7X1BRnI6hmebOe1gmLQ

Score

8^/10

bootkit discovery evasion persistence

Malware Config

Signatures

Modifies Windows Firewall 1 TTPs 9 IoCs

evasion

Modify Existing Service

T1031

pid	Process
5008	netsh.exe
7092	netsh.exe
2328	netsh.exe
5188	netsh.exe
4916	netsh.exe
6712	netsh.exe
8692	netsh.exe
6348	netsh.exe
6160	netsh.exe

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\Control Panel\International\Geo\Nation	MEMZ × ADZP 20 Complex.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\Control Panel\International\Geo\Nation	MEMZ-Destructive.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\Control Panel\International\Geo\Nation	MEMZ-Destructive.exe

Executes dropped EXE 7 IoCs

pid	Process
2900	MEMZ-Destructive.exe
1900	MEMZ-Destructive.exe
3944	MEMZ-Destructive.exe
3892	MEMZ-Destructive.exe
4384	MEMZ-Destructive.exe
2888	MEMZ-Destructive.exe
4316	MEMZ-Destructive.exe

Modifies file permissions 1 TTPs 5 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
6048	takeown.exe
5916	takeown.exe
2308	takeown.exe
3740	takeown.exe
8736	takeown.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1067

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	MEMZ-Destructive.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\44db5867-a52e-4aae-8912-ce5e127870bc.tmp	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20230604173731.pma	setup.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	mspaint.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5992	3136	WerFault.exe	505

Enumerates system info in registry 2 TTPs 9 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Gathers network information 2 TTPs 5 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command-Line Interface

T1059

pid	Process
5028	ipconfig.exe
6752	ipconfig.exe
1788	ipconfig.exe
4860	ipconfig.exe
3416	ipconfig.exe

Kills process with taskkill 4 IoCs

evasion

pid	Process
1476	taskkill.exe
6080	taskkill.exe
2348	taskkill.exe
6580	taskkill.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000_Classes\Local Settings	MEMZ × ADZP 20 Complex.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000_Classes\Local Settings	explorer.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1900	MEMZ-Destructive.exe
1900	MEMZ-Destructive.exe
1900	MEMZ-Destructive.exe
1900	MEMZ-Destructive.exe
1900	MEMZ-Destructive.exe
1900	MEMZ-Destructive.exe
3944	MEMZ-Destructive.exe
3944	MEMZ-Destructive.exe
1900	MEMZ-Destructive.exe
1900	MEMZ-Destructive.exe
3944	MEMZ-Destructive.exe
1900	MEMZ-Destructive.exe
3944	MEMZ-Destructive.exe
1900	MEMZ-Destructive.exe
3892	MEMZ-Destructive.exe
3892	MEMZ-Destructive.exe
3892	MEMZ-Destructive.exe
3892	MEMZ-Destructive.exe
1900	MEMZ-Destructive.exe
1900	MEMZ-Destructive.exe
3944	MEMZ-Destructive.exe
3944	MEMZ-Destructive.exe
4384	MEMZ-Destructive.exe
4384	MEMZ-Destructive.exe
3944	MEMZ-Destructive.exe
3944	MEMZ-Destructive.exe
3892	MEMZ-Destructive.exe
3892	MEMZ-Destructive.exe
1900	MEMZ-Destructive.exe
2888	MEMZ-Destructive.exe
1900	MEMZ-Destructive.exe
2888	MEMZ-Destructive.exe
1900	MEMZ-Destructive.exe
1900	MEMZ-Destructive.exe
2888	MEMZ-Destructive.exe
2888	MEMZ-Destructive.exe
3892	MEMZ-Destructive.exe
3892	MEMZ-Destructive.exe
3944	MEMZ-Destructive.exe
3944	MEMZ-Destructive.exe
4384	MEMZ-Destructive.exe
4384	MEMZ-Destructive.exe
1900	MEMZ-Destructive.exe
1900	MEMZ-Destructive.exe
1900	MEMZ-Destructive.exe
1900	MEMZ-Destructive.exe
4384	MEMZ-Destructive.exe
3944	MEMZ-Destructive.exe
4384	MEMZ-Destructive.exe
3944	MEMZ-Destructive.exe
3892	MEMZ-Destructive.exe
3892	MEMZ-Destructive.exe
2888	MEMZ-Destructive.exe
2888	MEMZ-Destructive.exe
2888	MEMZ-Destructive.exe
3892	MEMZ-Destructive.exe
2888	MEMZ-Destructive.exe
3892	MEMZ-Destructive.exe
3944	MEMZ-Destructive.exe
3944	MEMZ-Destructive.exe
4384	MEMZ-Destructive.exe
4384	MEMZ-Destructive.exe
1900	MEMZ-Destructive.exe
1900	MEMZ-Destructive.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 25 IoCs

pid	Process
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
5780	msedge.exe
5780	msedge.exe
5780	msedge.exe
5780	msedge.exe
5780	msedge.exe
5780	msedge.exe
5780	msedge.exe
5780	msedge.exe
5780	msedge.exe
5780	msedge.exe
5780	msedge.exe
5780	msedge.exe
5780	msedge.exe
5780	msedge.exe
5780	msedge.exe
5920	msedge.exe
5920	msedge.exe
5920	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	1512	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1512	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 7 IoCs

pid	Process
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
5780	msedge.exe
5780	msedge.exe
5920	msedge.exe
5920	msedge.exe

Suspicious use of SetWindowsHookEx 11 IoCs

pid	Process
2900	MEMZ-Destructive.exe
1900	MEMZ-Destructive.exe
3944	MEMZ-Destructive.exe
3892	MEMZ-Destructive.exe
4384	MEMZ-Destructive.exe
2888	MEMZ-Destructive.exe
4316	MEMZ-Destructive.exe
6068	mspaint.exe
6068	mspaint.exe
6068	mspaint.exe
6068	mspaint.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1500 wrote to memory of 2900	1500	MEMZ × ADZP 20 Complex.exe	84
PID 1500 wrote to memory of 2900	1500	MEMZ × ADZP 20 Complex.exe	84
PID 1500 wrote to memory of 2900	1500	MEMZ × ADZP 20 Complex.exe	84
PID 1500 wrote to memory of 4620	1500	MEMZ × ADZP 20 Complex.exe	86
PID 1500 wrote to memory of 4620	1500	MEMZ × ADZP 20 Complex.exe	86
PID 2900 wrote to memory of 1900	2900	MEMZ-Destructive.exe	93
PID 2900 wrote to memory of 1900	2900	MEMZ-Destructive.exe	93
PID 2900 wrote to memory of 1900	2900	MEMZ-Destructive.exe	93
PID 2900 wrote to memory of 3944	2900	MEMZ-Destructive.exe	94
PID 2900 wrote to memory of 3944	2900	MEMZ-Destructive.exe	94
PID 2900 wrote to memory of 3944	2900	MEMZ-Destructive.exe	94
PID 2900 wrote to memory of 3892	2900	MEMZ-Destructive.exe	95
PID 2900 wrote to memory of 3892	2900	MEMZ-Destructive.exe	95
PID 2900 wrote to memory of 3892	2900	MEMZ-Destructive.exe	95
PID 2900 wrote to memory of 4384	2900	MEMZ-Destructive.exe	96
PID 2900 wrote to memory of 4384	2900	MEMZ-Destructive.exe	96
PID 2900 wrote to memory of 4384	2900	MEMZ-Destructive.exe	96
PID 2900 wrote to memory of 2888	2900	MEMZ-Destructive.exe	97
PID 2900 wrote to memory of 2888	2900	MEMZ-Destructive.exe	97
PID 2900 wrote to memory of 2888	2900	MEMZ-Destructive.exe	97
PID 2900 wrote to memory of 4316	2900	MEMZ-Destructive.exe	98
PID 2900 wrote to memory of 4316	2900	MEMZ-Destructive.exe	98
PID 2900 wrote to memory of 4316	2900	MEMZ-Destructive.exe	98
PID 4316 wrote to memory of 3924	4316	MEMZ-Destructive.exe	99
PID 4316 wrote to memory of 3924	4316	MEMZ-Destructive.exe	99
PID 4316 wrote to memory of 3924	4316	MEMZ-Destructive.exe	99
PID 4316 wrote to memory of 4356	4316	MEMZ-Destructive.exe	101
PID 4316 wrote to memory of 4356	4316	MEMZ-Destructive.exe	101
PID 4356 wrote to memory of 2196	4356	msedge.exe	102
PID 4356 wrote to memory of 2196	4356	msedge.exe	102
PID 4356 wrote to memory of 4928	4356	msedge.exe	103
PID 4356 wrote to memory of 4928	4356	msedge.exe	103
PID 4356 wrote to memory of 4928	4356	msedge.exe	103
PID 4356 wrote to memory of 4928	4356	msedge.exe	103
PID 4356 wrote to memory of 4928	4356	msedge.exe	103
PID 4356 wrote to memory of 4928	4356	msedge.exe	103
PID 4356 wrote to memory of 4928	4356	msedge.exe	103
PID 4356 wrote to memory of 4928	4356	msedge.exe	103
PID 4356 wrote to memory of 4928	4356	msedge.exe	103
PID 4356 wrote to memory of 4928	4356	msedge.exe	103
PID 4356 wrote to memory of 4928	4356	msedge.exe	103
PID 4356 wrote to memory of 4928	4356	msedge.exe	103
PID 4356 wrote to memory of 4928	4356	msedge.exe	103
PID 4356 wrote to memory of 4928	4356	msedge.exe	103
PID 4356 wrote to memory of 4928	4356	msedge.exe	103
PID 4356 wrote to memory of 4928	4356	msedge.exe	103
PID 4356 wrote to memory of 4928	4356	msedge.exe	103
PID 4356 wrote to memory of 4928	4356	msedge.exe	103
PID 4356 wrote to memory of 4928	4356	msedge.exe	103
PID 4356 wrote to memory of 4928	4356	msedge.exe	103
PID 4356 wrote to memory of 4928	4356	msedge.exe	103
PID 4356 wrote to memory of 4928	4356	msedge.exe	103
PID 4356 wrote to memory of 4928	4356	msedge.exe	103
PID 4356 wrote to memory of 4928	4356	msedge.exe	103
PID 4356 wrote to memory of 4928	4356	msedge.exe	103
PID 4356 wrote to memory of 4928	4356	msedge.exe	103
PID 4356 wrote to memory of 4928	4356	msedge.exe	103
PID 4356 wrote to memory of 4928	4356	msedge.exe	103
PID 4356 wrote to memory of 4928	4356	msedge.exe	103
PID 4356 wrote to memory of 4928	4356	msedge.exe	103
PID 4356 wrote to memory of 4928	4356	msedge.exe	103
PID 4356 wrote to memory of 4928	4356	msedge.exe	103
PID 4356 wrote to memory of 4928	4356	msedge.exe	103
PID 4356 wrote to memory of 4928	4356	msedge.exe	103

Views/modifies file attributes 1 TTPs 4 IoCs

evasion

Hidden Files and Directories

T1158

pid	Process
6368	attrib.exe
5756	attrib.exe
2700	attrib.exe
4668	attrib.exe

C:\Users\Admin\AppData\Local\Temp\MEMZ × ADZP 20 Complex.exe
"C:\Users\Admin\AppData\Local\Temp\MEMZ × ADZP 20 Complex.exe"
1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1500
- C:\Users\Admin\AppData\Local\Temp\MEMZ-Destructive.exe
  "C:\Users\Admin\AppData\Local\Temp\MEMZ-Destructive.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2900
- - C:\Users\Admin\AppData\Local\Temp\MEMZ-Destructive.exe
    "C:\Users\Admin\AppData\Local\Temp\MEMZ-Destructive.exe" /watchdog
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:1900
- - C:\Users\Admin\AppData\Local\Temp\MEMZ-Destructive.exe
    "C:\Users\Admin\AppData\Local\Temp\MEMZ-Destructive.exe" /watchdog
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:3944
- - C:\Users\Admin\AppData\Local\Temp\MEMZ-Destructive.exe
    "C:\Users\Admin\AppData\Local\Temp\MEMZ-Destructive.exe" /watchdog
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:3892
- - C:\Users\Admin\AppData\Local\Temp\MEMZ-Destructive.exe
    "C:\Users\Admin\AppData\Local\Temp\MEMZ-Destructive.exe" /watchdog
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:4384
- - C:\Users\Admin\AppData\Local\Temp\MEMZ-Destructive.exe
    "C:\Users\Admin\AppData\Local\Temp\MEMZ-Destructive.exe" /watchdog
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:2888
- - C:\Users\Admin\AppData\Local\Temp\MEMZ-Destructive.exe
    "C:\Users\Admin\AppData\Local\Temp\MEMZ-Destructive.exe" /main
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Writes to the Master Boot Record (MBR)
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4316
  - - C:\Windows\SysWOW64\notepad.exe
      "C:\Windows\System32\notepad.exe" \note.txt
      4⤵
      PID:3924
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=stanky+danky+maymays
      4⤵
      Enumerates system info in registry
      Modifies registry class
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:4356
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x114,0x118,0x11c,0xf0,0x120,0x7ff93a5746f8,0x7ff93a574708,0x7ff93a574718
        5⤵
        
        PID:2196
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2168,12593802987639438620,23433851411179183,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2184 /prefetch:2
        5⤵
        
        PID:4928
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2168,12593802987639438620,23433851411179183,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2308 /prefetch:3
        5⤵
        
        PID:4912
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2168,12593802987639438620,23433851411179183,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2888 /prefetch:8
        5⤵
        
        PID:2468
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,12593802987639438620,23433851411179183,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3716 /prefetch:1
        5⤵
        
        PID:2688
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,12593802987639438620,23433851411179183,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3736 /prefetch:1
        5⤵
        
        PID:3388
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,12593802987639438620,23433851411179183,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5228 /prefetch:1
        5⤵
        
        PID:1136
    - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2168,12593802987639438620,23433851411179183,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5592 /prefetch:8
        5⤵
        
        PID:4568
    - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
        5⤵
        Drops file in Program Files directory
        
        PID:2396
      - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x238,0x23c,0x240,0x214,0x244,0x7ff65eb65460,0x7ff65eb65470,0x7ff65eb65480
        6⤵
        
        PID:3932
    - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2168,12593802987639438620,23433851411179183,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5592 /prefetch:8
        5⤵
        
        PID:4960
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,12593802987639438620,23433851411179183,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3732 /prefetch:1
        5⤵
        
        PID:4080
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,12593802987639438620,23433851411179183,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5368 /prefetch:1
        5⤵
        
        PID:3292
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,12593802987639438620,23433851411179183,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4996 /prefetch:1
        5⤵
        
        PID:2228
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,12593802987639438620,23433851411179183,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5924 /prefetch:1
        5⤵
        
        PID:1876
  - - C:\Windows\SysWOW64\explorer.exe
      "C:\Windows\System32\explorer.exe"
      4⤵
      Modifies registry class
      PID:5440
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=how+2+buy+weed
      4⤵
      Enumerates system info in registry
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of FindShellTrayWindow
      PID:5780
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ff93a5746f8,0x7ff93a574708,0x7ff93a574718
        5⤵
        
        PID:5796
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,6482504975156648828,8175088349383078246,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2108 /prefetch:2
        5⤵
        
        PID:6032
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2112,6482504975156648828,8175088349383078246,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2304 /prefetch:3
        5⤵
        
        PID:6040
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2112,6482504975156648828,8175088349383078246,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2868 /prefetch:8
        5⤵
        
        PID:6088
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,6482504975156648828,8175088349383078246,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
        5⤵
        
        PID:5004
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,6482504975156648828,8175088349383078246,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
        5⤵
        
        PID:3396
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,6482504975156648828,8175088349383078246,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4868 /prefetch:1
        5⤵
        
        PID:3992
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,6482504975156648828,8175088349383078246,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3476 /prefetch:1
        5⤵
        
        PID:2668
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,6482504975156648828,8175088349383078246,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4840 /prefetch:1
        5⤵
        
        PID:4864
    - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,6482504975156648828,8175088349383078246,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5344 /prefetch:8
        5⤵
        
        PID:4924
    - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,6482504975156648828,8175088349383078246,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5344 /prefetch:8
        5⤵
        
        PID:3868
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,6482504975156648828,8175088349383078246,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6168 /prefetch:1
        5⤵
        
        PID:4212
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,6482504975156648828,8175088349383078246,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6148 /prefetch:1
        5⤵
        
        PID:5080
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,6482504975156648828,8175088349383078246,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6060 /prefetch:1
        5⤵
        
        PID:4116
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,6482504975156648828,8175088349383078246,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5920 /prefetch:1
        5⤵
        
        PID:852
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,6482504975156648828,8175088349383078246,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5924 /prefetch:1
        5⤵
        
        PID:212
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,6482504975156648828,8175088349383078246,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5768 /prefetch:1
        5⤵
        
        PID:2408
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,6482504975156648828,8175088349383078246,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5640 /prefetch:1
        5⤵
        
        PID:216
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,6482504975156648828,8175088349383078246,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5636 /prefetch:1
        5⤵
        
        PID:228
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,6482504975156648828,8175088349383078246,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5436 /prefetch:1
        5⤵
        
        PID:3380
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,6482504975156648828,8175088349383078246,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5384 /prefetch:1
        5⤵
        
        PID:100
  - - C:\Windows\SysWOW64\mspaint.exe
      "C:\Windows\System32\mspaint.exe"
      4⤵
      Drops file in Windows directory
      Suspicious use of SetWindowsHookEx
      PID:6068
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=best+way+to+kill+yourself
      4⤵
      Enumerates system info in registry
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of FindShellTrayWindow
      PID:5920
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ff93a5746f8,0x7ff93a574708,0x7ff93a574718
        5⤵
        
        PID:4388
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2104,3338039077441504538,17159415269285972782,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2424 /prefetch:3
        5⤵
        
        PID:4400
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,3338039077441504538,17159415269285972782,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2152 /prefetch:2
        5⤵
        
        PID:4108
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2104,3338039077441504538,17159415269285972782,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2832 /prefetch:8
        5⤵
        
        PID:5964
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,3338039077441504538,17159415269285972782,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3376 /prefetch:1
        5⤵
        
        PID:1920
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,3338039077441504538,17159415269285972782,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:1
        5⤵
        
        PID:2080
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,3338039077441504538,17159415269285972782,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4860 /prefetch:1
        5⤵
        
        PID:2656
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=how+to+send+a+virus+to+my+friend
      4⤵
      PID:4996
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ff93a5746f8,0x7ff93a574708,0x7ff93a574718
        5⤵
        
        PID:4984
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2172,13694619527654942352,15279469221721806514,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2268 /prefetch:3
        5⤵
        
        PID:5412
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2172,13694619527654942352,15279469221721806514,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2184 /prefetch:2
        5⤵
        
        PID:2852
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2172,13694619527654942352,15279469221721806514,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2932 /prefetch:8
        5⤵
        
        PID:5416
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,13694619527654942352,15279469221721806514,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3392 /prefetch:1
        5⤵
        
        PID:1788
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,13694619527654942352,15279469221721806514,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3380 /prefetch:1
        5⤵
        
        PID:2116
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,13694619527654942352,15279469221721806514,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4764 /prefetch:1
        5⤵
        
        PID:2656
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=how+to+create+your+own+ransomware
      4⤵
      PID:5284
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2156,1542671350918641813,7223432944869170067,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2220 /prefetch:3
        5⤵
        
        PID:5808
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2156,1542671350918641813,7223432944869170067,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2900 /prefetch:8
        5⤵
        
        PID:2188
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2156,1542671350918641813,7223432944869170067,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2168 /prefetch:2
        5⤵
        
        PID:5196
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,1542671350918641813,7223432944869170067,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1
        5⤵
        
        PID:3808
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,1542671350918641813,7223432944869170067,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
        5⤵
        
        PID:3264
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,1542671350918641813,7223432944869170067,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4804 /prefetch:1
        5⤵
        
        PID:6280
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,1542671350918641813,7223432944869170067,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3408 /prefetch:1
        5⤵
        
        PID:7040
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,1542671350918641813,7223432944869170067,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5308 /prefetch:1
        5⤵
        
        PID:7132
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,1542671350918641813,7223432944869170067,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5180 /prefetch:1
        5⤵
        
        PID:4400
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,1542671350918641813,7223432944869170067,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5100 /prefetch:1
        5⤵
        
        PID:5380
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,1542671350918641813,7223432944869170067,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5800 /prefetch:1
        5⤵
        
        PID:3648
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,1542671350918641813,7223432944869170067,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5824 /prefetch:1
        5⤵
        
        PID:7032
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=how+to+remove+memz+trojan+virus
      4⤵
      PID:6964
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ff93a5746f8,0x7ff93a574708,0x7ff93a574718
        5⤵
        
        PID:6976
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=how+2+remove+a+virus
      4⤵
      PID:6884
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ff93a5746f8,0x7ff93a574708,0x7ff93a574718
        5⤵
        
        PID:6432
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2080,16877056478910791033,13566100727463336250,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2140 /prefetch:3
        5⤵
        
        PID:1096
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,16877056478910791033,13566100727463336250,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2092 /prefetch:2
        5⤵
        
        PID:2656
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2080,16877056478910791033,13566100727463336250,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2808 /prefetch:8
        5⤵
        
        PID:7100
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,16877056478910791033,13566100727463336250,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3396 /prefetch:1
        5⤵
        
        PID:5212
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,16877056478910791033,13566100727463336250,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3452 /prefetch:1
        5⤵
        
        PID:6900
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,16877056478910791033,13566100727463336250,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3880 /prefetch:1
        5⤵
        
        PID:5696
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,16877056478910791033,13566100727463336250,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4168 /prefetch:1
        5⤵
        
        PID:6956
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,16877056478910791033,13566100727463336250,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5060 /prefetch:1
        5⤵
        
        PID:3652
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,16877056478910791033,13566100727463336250,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5472 /prefetch:1
        5⤵
        
        PID:1284
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,16877056478910791033,13566100727463336250,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5012 /prefetch:1
        5⤵
        
        PID:984
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,16877056478910791033,13566100727463336250,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5820 /prefetch:1
        5⤵
        
        PID:5996
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,16877056478910791033,13566100727463336250,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6192 /prefetch:1
        5⤵
        
        PID:4428
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,16877056478910791033,13566100727463336250,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5984 /prefetch:1
        5⤵
        
        PID:3648
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,16877056478910791033,13566100727463336250,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6044 /prefetch:1
        5⤵
        
        PID:7032
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,16877056478910791033,13566100727463336250,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5076 /prefetch:1
        5⤵
        
        PID:3924
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,16877056478910791033,13566100727463336250,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4884 /prefetch:1
        5⤵
        
        PID:5188
    - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,16877056478910791033,13566100727463336250,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5276 /prefetch:8
        5⤵
        
        PID:8040
    - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,16877056478910791033,13566100727463336250,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5276 /prefetch:8
        5⤵
        
        PID:7944
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=is+illuminati+real
      4⤵
      PID:5216
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ff93a5746f8,0x7ff93a574708,0x7ff93a574718
        5⤵
        
        PID:4092
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=virus+builder+legit+free+download
      4⤵
      PID:6488
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ff93a5746f8,0x7ff93a574708,0x7ff93a574718
        5⤵
        
        PID:6492
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=the+memz+are+real
      4⤵
      PID:4524
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ff93a5746f8,0x7ff93a574708,0x7ff93a574718
        5⤵
        
        PID:4872
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=how+2+remove+a+virus
      4⤵
      PID:7128
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ff93a5746f8,0x7ff93a574708,0x7ff93a574718
        5⤵
        
        PID:4172
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,6912479814726269551,7248796608509743166,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2156 /prefetch:2
        5⤵
        
        PID:4188
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2096,6912479814726269551,7248796608509743166,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2240 /prefetch:3
        5⤵
        
        PID:8248
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=how+to+get+money
      4⤵
      PID:7452
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x114,0x118,0x11c,0xf0,0x120,0x7ff93a5746f8,0x7ff93a574708,0x7ff93a574718
        5⤵
        
        PID:7524
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,6012893911825793382,7601304206743096069,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2224 /prefetch:2
        5⤵
        
        PID:1860
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2140,6012893911825793382,7601304206743096069,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2276 /prefetch:3
        5⤵
        
        PID:6848
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2140,6012893911825793382,7601304206743096069,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2936 /prefetch:8
        5⤵
        
        PID:2268
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,6012893911825793382,7601304206743096069,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3640 /prefetch:1
        5⤵
        
        PID:9116
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,6012893911825793382,7601304206743096069,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3592 /prefetch:1
        5⤵
        
        PID:9108
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,6012893911825793382,7601304206743096069,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4152 /prefetch:1
        5⤵
        
        PID:5644
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,6012893911825793382,7601304206743096069,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4408 /prefetch:1
        5⤵
        
        PID:8580
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,6012893911825793382,7601304206743096069,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4416 /prefetch:1
        5⤵
        
        PID:2068
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,6012893911825793382,7601304206743096069,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5988 /prefetch:1
        5⤵
        
        PID:2740
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,6012893911825793382,7601304206743096069,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5864 /prefetch:1
        5⤵
        
        PID:5408
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,6012893911825793382,7601304206743096069,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5712 /prefetch:1
        5⤵
        
        PID:2852
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,6012893911825793382,7601304206743096069,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6208 /prefetch:1
        5⤵
        
        PID:2388
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,6012893911825793382,7601304206743096069,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5440 /prefetch:1
        5⤵
        
        PID:5220
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,6012893911825793382,7601304206743096069,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5460 /prefetch:1
        5⤵
        
        PID:6296
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,6012893911825793382,7601304206743096069,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4076 /prefetch:1
        5⤵
        
        PID:4880
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,6012893911825793382,7601304206743096069,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4060 /prefetch:1
        5⤵
        
        PID:8512
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,6012893911825793382,7601304206743096069,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4436 /prefetch:1
        5⤵
        
        PID:8228
    - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,6012893911825793382,7601304206743096069,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6280 /prefetch:8
        5⤵
        
        PID:2012
    - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,6012893911825793382,7601304206743096069,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6280 /prefetch:8
        5⤵
        
        PID:5260
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,6012893911825793382,7601304206743096069,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3232 /prefetch:2
        5⤵
        
        PID:8128
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,6012893911825793382,7601304206743096069,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5632 /prefetch:1
        5⤵
        
        PID:7244
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,6012893911825793382,7601304206743096069,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4400 /prefetch:1
        5⤵
        
        PID:1544
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,6012893911825793382,7601304206743096069,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5052 /prefetch:1
        5⤵
        
        PID:4728
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,6012893911825793382,7601304206743096069,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4060 /prefetch:1
        5⤵
        
        PID:8184
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,6012893911825793382,7601304206743096069,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3704 /prefetch:1
        5⤵
        
        PID:5680
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,6012893911825793382,7601304206743096069,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5432 /prefetch:1
        5⤵
        
        PID:9584
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,6012893911825793382,7601304206743096069,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6468 /prefetch:1
        5⤵
        
        PID:9840
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,6012893911825793382,7601304206743096069,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5556 /prefetch:1
        5⤵
        
        PID:10172
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,6012893911825793382,7601304206743096069,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5624 /prefetch:1
        5⤵
        
        PID:5448
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,6012893911825793382,7601304206743096069,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6876 /prefetch:1
        5⤵
        
        PID:3856
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=virus.exe
      4⤵
      PID:7912
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ff93a5746f8,0x7ff93a574708,0x7ff93a574718
        5⤵
        
        PID:7920
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2112,17904753346867746684,14418350283923395259,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2128 /prefetch:3
        5⤵
        
        PID:8384
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=john+cena+midi+legit+not+converted
      4⤵
      PID:8320
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ff93a5746f8,0x7ff93a574708,0x7ff93a574718
        5⤵
        
        PID:8392
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://answers.microsoft.com/en-us/protect/forum/protect_other-protect_scanning/memz-malwarevirus-trojan-completely-destroying/268bc1c2-39f4-42f8-90c2-597a673b6b45
      4⤵
      PID:4152
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf4,0x11c,0x120,0x118,0x124,0x7ff93a5746f8,0x7ff93a574708,0x7ff93a574718
        5⤵
        
        PID:5460
  - - C:\Windows\SysWOW64\calc.exe
      "C:\Windows\System32\calc.exe"
      4⤵
      PID:3784
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://pcoptimizerpro.com/
      4⤵
      PID:6096
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x118,0x11c,0x120,0xf8,0x124,0x7ff93a5746f8,0x7ff93a574708,0x7ff93a574718
        5⤵
        
        PID:2064
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=batch+virus+download
      4⤵
      PID:5724
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ff93a5746f8,0x7ff93a574708,0x7ff93a574718
        5⤵
        
        PID:7780
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=half+life+3+release+date
      4⤵
      PID:9300
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ff93a5746f8,0x7ff93a574708,0x7ff93a574718
        5⤵
        
        PID:9388
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=is+illuminati+real
      4⤵
      PID:8928
  - - C:\Windows\SysWOW64\explorer.exe
      "C:\Windows\System32\explorer.exe"
      4⤵
      PID:10092
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ADZP 20 Complex-Destructive.vbs"
  2⤵
  PID:4620
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempShingapi.sk.bat" "
    3⤵
    PID:4124
  - - C:\Windows\system32\certutil.exe
      certutil -decode x.bin ADZP-20-Complex.bat
      4⤵
      PID:2972
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K Twain_20.cmd
      4⤵
      PID:3520
    - - C:\Windows\system32\reg.exe
        
        REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v Twain_20 /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\Twain_20.cmd"
        5⤵
        
        PID:5060
  - - C:\Windows\system32\netsh.exe
      netsh advfirewall set publicprofile state off
      4⤵
      Modifies Windows Firewall
      PID:4916
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K Twain_20.cmd
      4⤵
      PID:968
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Informacion.vbs"
      4⤵
      PID:5792
  - - C:\Windows\system32\reg.exe
      reg add hkey_local_machinesoftwaremicrosoftwindowscurrentversionrun /v WINDOWsAPI /t reg_sz /d c:windowswimn32.bat /f
      4⤵
      PID:5352
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K Taskdl.bat
      4⤵
      PID:5596
    - - C:\Windows\system32\takeown.exe
        
        takeown /f "C:\Windows\System32" /r
        5⤵
        Modifies file permissions
        
        PID:6048
  - - C:\Windows\system32\reg.exe
      reg add hkey_current_usersoftwaremicrosoftwindowscurrentversionrun /v CONTROLexit /t reg_sz /d c:windowswimn32.bat /f
      4⤵
      PID:2072
  - - C:\Windows\system32\ipconfig.exe
      ipconfig /release
      4⤵
      Gathers network information
      PID:5028
  - - C:\Windows\system32\taskkill.exe
      taskkill /im DiskPart /f
      4⤵
      Kills process with taskkill
      PID:6080
  - - C:\Windows\system32\attrib.exe
      attrib -r -a -s -h *.*
      4⤵
      Views/modifies file attributes
      PID:2700
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ErrorCritico.vbs"
      4⤵
      PID:4892
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Advertencia.vbs"
      4⤵
      PID:5244
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ErrorCritico.vbs"
      4⤵
      PID:4388
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Advertencia.vbs"
      4⤵
      PID:4732
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ErrorCritico.vbs"
      4⤵
      PID:4912
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Advertencia.vbs"
      4⤵
      PID:504
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ErrorCritico.vbs"
      4⤵
      PID:5516
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Advertencia.vbs"
      4⤵
      PID:5656
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ErrorCritico.vbs"
      4⤵
      PID:5660
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Advertencia.vbs"
      4⤵
      PID:6104
  - - C:\Windows\system32\msg.exe
      msg * Virus Detectado
      4⤵
      PID:4828
  - - C:\Windows\system32\msg.exe
      msg * Virus Detectado
      4⤵
      PID:4088
  - - C:\Windows\system32\msg.exe
      msg * Has Sido Hackeado!
      4⤵
      PID:1644
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K C:\Users\Admin\AppData\Local\Temp\ADZP-20-Complex.bat
      4⤵
      PID:3568
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K Twain_20.cmd
        5⤵
        
        PID:404
    - - C:\Windows\system32\netsh.exe
        
        netsh advfirewall set publicprofile state off
        5⤵
        Modifies Windows Firewall
        
        PID:5008
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K Twain_20.cmd
        5⤵
        
        PID:2480
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Informacion.vbs"
        5⤵
        
        PID:6068
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K Taskdl.bat
        5⤵
        
        PID:5224
      - C:\Windows\system32\takeown.exe
        
        takeown /f "C:\Windows\System32" /r
        6⤵
        Modifies file permissions
        
        PID:5916
    - - C:\Windows\system32\reg.exe
        
        reg add hkey_local_machinesoftwaremicrosoftwindowscurrentversionrun /v WINDOWsAPI /t reg_sz /d c:windowswimn32.bat /f
        5⤵
        
        PID:6824
    - - C:\Windows\system32\reg.exe
        
        reg add hkey_current_usersoftwaremicrosoftwindowscurrentversionrun /v CONTROLexit /t reg_sz /d c:windowswimn32.bat /f
        5⤵
        
        PID:4100
    - - C:\Windows\system32\ipconfig.exe
        
        ipconfig /release
        5⤵
        Gathers network information
        
        PID:6752
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /im DiskPart /f
        5⤵
        Kills process with taskkill
        
        PID:6580
    - - C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h *.*
        5⤵
        Views/modifies file attributes
        
        PID:6368
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ErrorCritico.vbs"
        5⤵
        
        PID:1652
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Advertencia.vbs"
        5⤵
        
        PID:5696
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ErrorCritico.vbs"
        5⤵
        
        PID:4568
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Advertencia.vbs"
        5⤵
        
        PID:7080
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ErrorCritico.vbs"
        5⤵
        
        PID:688
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Advertencia.vbs"
        5⤵
        
        PID:1500
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ErrorCritico.vbs"
        5⤵
        
        PID:6740
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Advertencia.vbs"
        5⤵
        
        PID:5152
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ErrorCritico.vbs"
        5⤵
        
        PID:3804
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Advertencia.vbs"
        5⤵
        
        PID:6668
    - - C:\Windows\system32\msg.exe
        
        msg * Virus Detectado
        5⤵
        
        PID:4488
    - - C:\Windows\system32\msg.exe
        
        msg * Virus Detectado
        5⤵
        
        PID:428
    - - C:\Windows\system32\msg.exe
        
        msg * Has Sido Hackeado!
        5⤵
        
        PID:5804
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K C:\Users\Admin\AppData\Local\Temp\ADZP-20-Complex.bat
        5⤵
        
        PID:7276
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K Twain_20.cmd
        6⤵
        
        PID:5928
      - C:\Windows\system32\netsh.exe
        
        netsh advfirewall set publicprofile state off
        6⤵
        Modifies Windows Firewall
        
        PID:5188
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K Twain_20.cmd
        6⤵
        
        PID:8076
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Informacion.vbs"
        6⤵
        
        PID:9780
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K Taskdl.bat
        6⤵
        
        PID:10180
    - - C:\Windows\system32\notepad.exe
        
        notepad
        5⤵
        
        PID:7492
    - - C:\Windows\system32\calc.exe
        
        calc
        5⤵
        
        PID:8136
    - - C:\Windows\explorer.exe
        
        explorer.exe
        5⤵
        
        PID:7296
    - - C:\Windows\system32\mspaint.exe
        
        mspaint.exe
        5⤵
        
        PID:7596
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K C:\Users\Admin\AppData\Local\Temp\ADZP-20-Complex.bat
        5⤵
        
        PID:7992
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K Twain_20.cmd
        6⤵
        
        PID:4360
      - C:\Windows\system32\netsh.exe
        
        netsh advfirewall set publicprofile state off
        6⤵
        Modifies Windows Firewall
        
        PID:6160
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K Twain_20.cmd
        6⤵
        
        PID:1372
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Informacion.vbs"
        6⤵
        
        PID:10164
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K Taskdl.bat
        6⤵
        
        PID:9304
    - - C:\Windows\system32\notepad.exe
        
        notepad
        5⤵
        
        PID:7752
    - - C:\Windows\system32\calc.exe
        
        calc
        5⤵
        
        PID:6508
    - - C:\Windows\explorer.exe
        
        explorer.exe
        5⤵
        
        PID:5568
    - - C:\Windows\system32\mspaint.exe
        
        mspaint.exe
        5⤵
        
        PID:6004
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K C:\Users\Admin\AppData\Local\Temp\ADZP-20-Complex.bat
        5⤵
        
        PID:7884
    - - C:\Windows\system32\notepad.exe
        
        notepad
        5⤵
        
        PID:8740
    - - C:\Windows\system32\calc.exe
        
        calc
        5⤵
        
        PID:5572
    - - C:\Windows\explorer.exe
        
        explorer.exe
        5⤵
        
        PID:8592
    - - C:\Windows\system32\mspaint.exe
        
        mspaint.exe
        5⤵
        
        PID:5852
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ErrorCritico.vbs"
        5⤵
        
        PID:8712
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Advertencia.vbs"
        5⤵
        
        PID:8824
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Advertencia.vbs"
        5⤵
        
        PID:7440
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ErrorCritico.vbs"
        5⤵
        
        PID:7604
  - - C:\Windows\system32\notepad.exe
      notepad
      4⤵
      PID:1972
  - - C:\Windows\system32\calc.exe
      calc
      4⤵
      PID:428
  - - C:\Windows\explorer.exe
      explorer.exe
      4⤵
      PID:1288
  - - C:\Windows\system32\mspaint.exe
      mspaint.exe
      4⤵
      PID:3012
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K C:\Users\Admin\AppData\Local\Temp\ADZP-20-Complex.bat
      4⤵
      PID:3592
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K Twain_20.cmd
        5⤵
        
        PID:6592
    - - C:\Windows\system32\netsh.exe
        
        netsh advfirewall set publicprofile state off
        5⤵
        Modifies Windows Firewall
        
        PID:6712
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K Twain_20.cmd
        5⤵
        
        PID:7076
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Informacion.vbs"
        5⤵
        
        PID:4832
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K Taskdl.bat
        5⤵
        
        PID:2980
      - C:\Windows\system32\takeown.exe
        
        takeown /f "C:\Windows\System32" /r
        6⤵
        Modifies file permissions
        
        PID:2308
    - - C:\Windows\system32\reg.exe
        
        reg add hkey_local_machinesoftwaremicrosoftwindowscurrentversionrun /v WINDOWsAPI /t reg_sz /d c:windowswimn32.bat /f
        5⤵
        
        PID:6320
    - - C:\Windows\system32\reg.exe
        
        reg add hkey_current_usersoftwaremicrosoftwindowscurrentversionrun /v CONTROLexit /t reg_sz /d c:windowswimn32.bat /f
        5⤵
        
        PID:5552
    - - C:\Windows\system32\ipconfig.exe
        
        ipconfig /release
        5⤵
        Gathers network information
        
        PID:1788
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /im DiskPart /f
        5⤵
        Kills process with taskkill
        
        PID:2348
    - - C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h *.*
        5⤵
        Views/modifies file attributes
        
        PID:4668
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ErrorCritico.vbs"
        5⤵
        
        PID:760
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Advertencia.vbs"
        5⤵
        
        PID:5616
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ErrorCritico.vbs"
        5⤵
        
        PID:7152
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Advertencia.vbs"
        5⤵
        
        PID:6900
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ErrorCritico.vbs"
        5⤵
        
        PID:6540
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Advertencia.vbs"
        5⤵
        
        PID:6448
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ErrorCritico.vbs"
        5⤵
        
        PID:5368
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Advertencia.vbs"
        5⤵
        
        PID:2776
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ErrorCritico.vbs"
        5⤵
        
        PID:4028
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Advertencia.vbs"
        5⤵
        
        PID:6560
    - - C:\Windows\system32\msg.exe
        
        msg * Virus Detectado
        5⤵
        
        PID:4644
    - - C:\Windows\system32\msg.exe
        
        msg * Virus Detectado
        5⤵
        
        PID:1476
    - - C:\Windows\system32\msg.exe
        
        msg * Has Sido Hackeado!
        5⤵
        
        PID:5588
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K C:\Users\Admin\AppData\Local\Temp\ADZP-20-Complex.bat
        5⤵
        
        PID:7144
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K Twain_20.cmd
        6⤵
        
        PID:8856
      - C:\Windows\system32\netsh.exe
        
        netsh advfirewall set publicprofile state off
        6⤵
        Modifies Windows Firewall
        
        PID:2328
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K Twain_20.cmd
        6⤵
        
        PID:7208
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Informacion.vbs"
        6⤵
        
        PID:8528
      - C:\Windows\system32\reg.exe
        
        reg add hkey_local_machinesoftwaremicrosoftwindowscurrentversionrun /v WINDOWsAPI /t reg_sz /d c:windowswimn32.bat /f
        6⤵
        
        PID:228
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K Taskdl.bat
        6⤵
        
        PID:4144
        
        C:\Windows\system32\takeown.exe
        
        takeown /f "C:\Windows\System32" /r
        7⤵
        Modifies file permissions
        
        PID:8736
      - C:\Windows\system32\reg.exe
        
        reg add hkey_current_usersoftwaremicrosoftwindowscurrentversionrun /v CONTROLexit /t reg_sz /d c:windowswimn32.bat /f
        6⤵
        
        PID:8516
      - C:\Windows\system32\ipconfig.exe
        
        ipconfig /release
        6⤵
        Gathers network information
        
        PID:3416
    - - C:\Windows\system32\notepad.exe
        
        notepad
        5⤵
        
        PID:2148
    - - C:\Windows\system32\calc.exe
        
        calc
        5⤵
        
        PID:3704
    - - C:\Windows\explorer.exe
        
        explorer.exe
        5⤵
        
        PID:7216
    - - C:\Windows\system32\mspaint.exe
        
        mspaint.exe
        5⤵
        
        PID:7264
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K C:\Users\Admin\AppData\Local\Temp\ADZP-20-Complex.bat
        5⤵
        
        PID:7508
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K Twain_20.cmd
        6⤵
        
        PID:5008
      - C:\Windows\system32\netsh.exe
        
        netsh advfirewall set publicprofile state off
        6⤵
        Modifies Windows Firewall
        
        PID:6348
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K Twain_20.cmd
        6⤵
        
        PID:7384
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Informacion.vbs"
        6⤵
        
        PID:9100
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K Taskdl.bat
        6⤵
        
        PID:9752
    - - C:\Windows\system32\notepad.exe
        
        notepad
        5⤵
        
        PID:8144
    - - C:\Windows\system32\calc.exe
        
        calc
        5⤵
        
        PID:6960
    - - C:\Windows\explorer.exe
        
        explorer.exe
        5⤵
        
        PID:7584
    - - C:\Windows\system32\mspaint.exe
        
        mspaint.exe
        5⤵
        
        PID:7976
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K C:\Users\Admin\AppData\Local\Temp\ADZP-20-Complex.bat
        5⤵
        
        PID:984
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K Twain_20.cmd
        6⤵
        
        PID:8248
      - C:\Windows\system32\netsh.exe
        
        netsh advfirewall set publicprofile state off
        6⤵
        Modifies Windows Firewall
        
        PID:8692
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K Twain_20.cmd
        6⤵
        
        PID:8608
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Informacion.vbs"
        6⤵
        
        PID:9796
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K Taskdl.bat
        6⤵
        
        PID:8216
    - - C:\Windows\system32\notepad.exe
        
        notepad
        5⤵
        
        PID:7688
    - - C:\Windows\system32\calc.exe
        
        calc
        5⤵
        
        PID:6164
    - - C:\Windows\explorer.exe
        
        explorer.exe
        5⤵
        
        PID:6724
    - - C:\Windows\system32\mspaint.exe
        
        mspaint.exe
        5⤵
        
        PID:5508
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ErrorCritico.vbs"
        5⤵
        
        PID:8360
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Advertencia.vbs"
        5⤵
        
        PID:1640
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ErrorCritico.vbs"
        5⤵
        
        PID:8732
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Advertencia.vbs"
        5⤵
        
        PID:8872
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Advertencia.vbs"
        5⤵
        
        PID:6040
  - - C:\Windows\system32\notepad.exe
      notepad
      4⤵
      PID:2892
  - - C:\Windows\system32\calc.exe
      calc
      4⤵
      PID:5552
  - - C:\Windows\explorer.exe
      explorer.exe
      4⤵
      PID:4608
  - - C:\Windows\system32\mspaint.exe
      mspaint.exe
      4⤵
      PID:4436
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K C:\Users\Admin\AppData\Local\Temp\ADZP-20-Complex.bat
      4⤵
      PID:6176
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K Twain_20.cmd
        5⤵
        
        PID:1056
    - - C:\Windows\system32\netsh.exe
        
        netsh advfirewall set publicprofile state off
        5⤵
        Modifies Windows Firewall
        
        PID:7092
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K Twain_20.cmd
        5⤵
        
        PID:2136
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Informacion.vbs"
        5⤵
        
        PID:5052
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K Taskdl.bat
        5⤵
        
        PID:5536
      - C:\Windows\system32\takeown.exe
        
        takeown /f "C:\Windows\System32" /r
        6⤵
        Modifies file permissions
        
        PID:3740
    - - C:\Windows\system32\reg.exe
        
        reg add hkey_local_machinesoftwaremicrosoftwindowscurrentversionrun /v WINDOWsAPI /t reg_sz /d c:windowswimn32.bat /f
        5⤵
        
        PID:2064
    - - C:\Windows\system32\reg.exe
        
        reg add hkey_current_usersoftwaremicrosoftwindowscurrentversionrun /v CONTROLexit /t reg_sz /d c:windowswimn32.bat /f
        5⤵
        
        PID:6616
    - - C:\Windows\system32\ipconfig.exe
        
        ipconfig /release
        5⤵
        Gathers network information
        
        PID:4860
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /im DiskPart /f
        5⤵
        Kills process with taskkill
        
        PID:1476
    - - C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h *.*
        5⤵
        Views/modifies file attributes
        
        PID:5756
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ErrorCritico.vbs"
        5⤵
        
        PID:2948
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Advertencia.vbs"
        5⤵
        
        PID:6680
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ErrorCritico.vbs"
        5⤵
        
        PID:6320
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Advertencia.vbs"
        5⤵
        
        PID:1284
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ErrorCritico.vbs"
        5⤵
        
        PID:5392
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Advertencia.vbs"
        5⤵
        
        PID:6932
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ErrorCritico.vbs"
        5⤵
        
        PID:6152
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Advertencia.vbs"
        5⤵
        
        PID:1084
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ErrorCritico.vbs"
        5⤵
        
        PID:7188
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Advertencia.vbs"
        5⤵
        
        PID:7416
    - - C:\Windows\system32\msg.exe
        
        msg * Virus Detectado
        5⤵
        
        PID:5948
    - - C:\Windows\system32\msg.exe
        
        msg * Virus Detectado
        5⤵
        
        PID:8120
    - - C:\Windows\system32\msg.exe
        
        msg * Has Sido Hackeado!
        5⤵
        
        PID:7716
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K C:\Users\Admin\AppData\Local\Temp\ADZP-20-Complex.bat
        5⤵
        
        PID:8568
    - - C:\Windows\system32\notepad.exe
        
        notepad
        5⤵
        
        PID:5252
    - - C:\Windows\system32\calc.exe
        
        calc
        5⤵
        
        PID:7656
    - - C:\Windows\explorer.exe
        
        explorer.exe
        5⤵
        
        PID:2996
    - - C:\Windows\system32\mspaint.exe
        
        mspaint.exe
        5⤵
        
        PID:8640
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K C:\Users\Admin\AppData\Local\Temp\ADZP-20-Complex.bat
        5⤵
        
        PID:8480
    - - C:\Windows\system32\notepad.exe
        
        notepad
        5⤵
        
        PID:6696
    - - C:\Windows\system32\calc.exe
        
        calc
        5⤵
        
        PID:6168
    - - C:\Windows\explorer.exe
        
        explorer.exe
        5⤵
        
        PID:6936
    - - C:\Windows\system32\mspaint.exe
        
        mspaint.exe
        5⤵
        
        PID:1240
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K C:\Users\Admin\AppData\Local\Temp\ADZP-20-Complex.bat
        5⤵
        
        PID:4572
    - - C:\Windows\system32\notepad.exe
        
        notepad
        5⤵
        
        PID:8884
    - - C:\Windows\system32\calc.exe
        
        calc
        5⤵
        
        PID:3332
    - - C:\Windows\explorer.exe
        
        explorer.exe
        5⤵
        
        PID:4508
    - - C:\Windows\system32\mspaint.exe
        
        mspaint.exe
        5⤵
        
        PID:3648
  - - C:\Windows\system32\notepad.exe
      notepad
      4⤵
      PID:6248
  - - C:\Windows\system32\calc.exe
      calc
      4⤵
      PID:6316
  - - C:\Windows\explorer.exe
      explorer.exe
      4⤵
      PID:6396
  - - C:\Windows\system32\mspaint.exe
      mspaint.exe
      4⤵
      PID:6456
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ErrorCritico.vbs"
      4⤵
      PID:6532
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Advertencia.vbs"
      4⤵
      PID:4612
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ErrorCritico.vbs"
      4⤵
      PID:6400
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Advertencia.vbs"
      4⤵
      PID:3836
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ErrorCritico.vbs"
      4⤵
      PID:1556
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Advertencia.vbs"
      4⤵
      PID:6316

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4092

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5184

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService
1⤵
PID:5136

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x4e8 0x4f8
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1512

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:6100

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2700

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ff93a5746f8,0x7ff93a574708,0x7ff93a574718
1⤵
PID:2072

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:1056

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:5176

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2668

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:6416

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2368

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:7348

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:2464

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:7612

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:4888

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:7244

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:8944

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:8140

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:2228

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:4396

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:7908

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:5364

C:\Windows\system32\werfault.exe
werfault.exe /hc /shared Global\254c9f98092f47e7859ed46fec572497 /t 8760 /p 1752 1512
1⤵
PID:6548

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x124,0x128,0x12c,0xf4,0x130,0x7ff93a5746f8,0x7ff93a574708,0x7ff93a574718
1⤵
PID:8132

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 516 -p 3136 -ip 3136
1⤵
PID:9920

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 3136 -s 1752
1⤵
- Program crash
PID:5992

C:\Windows\system32\werfault.exe
werfault.exe /hc /shared Global\ec976e37db82491383b884f5766ffd74 /t 8916 /p 3136
1⤵
PID:9192

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Command-Line Interface

T1059

Persistence

Bootkit

T1067

Hidden Files and Directories

T1158

Modify Existing Service

T1031

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Hidden Files and Directories

T1158

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\27ba1bd7-2e47-4f98-9921-4bcaa051d079.tmp

Filesize
12KB

MD5
ea2f0c206bf06e9655c97d894cccd407

SHA1
3cdd64d3b402911946e3423757eb47abf2e0ab39

SHA256
4eed13b5d51bab6bd1ddd7ac08a187f671af6dff7fb34a7c7fed92215f98e101

SHA512
e2453b6e5bbbc25b80639887a7f9820ebf16631fe8dbd8f13f4f0943623bf9e543ae58301038e0ef501fe7c7ba6b22e441bff5eace009915d73b051c2afe64c9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d28e30e4be195571e047a23b1b4baa50

SHA1
be3f96d47cb1561a8952dbeffc0c7271afbf8843

SHA256
455cee660076bbfb039d821ef66462d16721af132a78f755e3a1ae873df34a48

SHA512
ae38ccf325f0859a8cd4bb220c2ca3373e52b7082bff0ad230a7ea27d53e5539dc59569cbc41ca6fafaa7cfbf01984d6451a138333b524d2f7c654684023c9ab

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
179a7bef55c55eb05471429a44e8d9f8

SHA1
6c795413a8c7497901d54bdd72fb0579690f8af3

SHA256
37bc80695f27f9a0fa47f0ea3601dfcd3fdb7a47a380d05e356c00f5379fdb65

SHA512
9d5d3771208215fc0fde14afbfb8afc6dbc5526f03e30d31fbd9111f62da70dba7e417189785795c300cd8fc4dff7f0be5f004683b75ca39a889020ae0c88aaa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b8c9383861d9295966a7f745d7b76a13

SHA1
d77273648971ec19128c344f78a8ffeb8a246645

SHA256
b75207c223dfc38fbb3dbf03107043a7dce74129d88053c9316350c97ac26d2e

SHA512
094e6978e09a6e762022e8ff57935a26b3171a0627639ca91a373bddd06092241d695b9f3b609ba60bc28e78a5c78cf0f072d79cd5769f1b9f6d873169f0df14

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
db85520d15e005b74171b45230d4b3dd

SHA1
ae19bce3974babb692cd73e093c576b93123b67d

SHA256
0c00e2c9f019ec789ff4ec582a3447ee30005fe3301d795ea207b63bac05e75b

SHA512
df455cc867ac91688b4f43231aca636cf8766d7383e9a027376d82b46dbac64ff9c07ea50e4555e545fd0ee755d7afa12a093817f82b175fe750cdba6d874297

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
91fa8f2ee8bf3996b6df4639f7ca34f7

SHA1
221b470deb37961c3ebbcc42a1a63e76fb3fe830

SHA256
e8e0588b16d612fa9d9989d16b729c082b4dd9bfca62564050cdb8ed03dd7068

SHA512
5415cd41f2f3bb5d9c7dadc59e347994444321cf8abe346b08e8c5a3fc6a5adae910eda43b4251ba4e317fbb7696c45dba9fd5e7fa61144c9b947206c7b999c4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
671266cd0b70e1fd7b6038fd4a48bbed

SHA1
1ad40671ba92bdd92a7af9279272b7fcf49bf855

SHA256
c090f98a075fdce2368d39b3633e320bf1227ba548b02bdb38d2a19d208d6496

SHA512
bb537503d3819c0d407beeadeb9bb293f4b0b8344914407ff218ccfc2b54086444582ad63c3fdb78dbd7751e1f7499e50d0e7ff3a6029522e16153d31f568863

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
671266cd0b70e1fd7b6038fd4a48bbed

SHA1
1ad40671ba92bdd92a7af9279272b7fcf49bf855

SHA256
c090f98a075fdce2368d39b3633e320bf1227ba548b02bdb38d2a19d208d6496

SHA512
bb537503d3819c0d407beeadeb9bb293f4b0b8344914407ff218ccfc2b54086444582ad63c3fdb78dbd7751e1f7499e50d0e7ff3a6029522e16153d31f568863

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e61f152cc1c9a7a297a9a19137006b3a

SHA1
31e626b0e71c57d45f61770872262410a5c41d4c

SHA256
7191d50b3c76a0c4030d8d0ac8f31efbaef37de74cb8d7eaca6fbdd1ff41b900

SHA512
6adf1d99a9e7b3cefd9f9cb7a0d633a9eb8fc633416fdb3b5fc7b5cd6d20225e1a412d861d41a28a6a8b8d2833ed7c2775873d7d910cd856b4344f316bcc3422

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a3cb9af51c486453ede7e0cd678d912c

SHA1
5fc8511a537b40790691b23b78307694308b25c2

SHA256
de4ece73235342db1afd06bd94660e860d0fc9bf4d97f79d29c5ac4c66c42a04

SHA512
2f30b44a8a3bffc364e98a5b05319da1b0798053bbf62270f171757deb5d9f6c33a9237e33dac3560fed10264d1dfd82cd70c782118bd434b25af9711ea3a466

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
64139f68279a56195d5aa534617cd064

SHA1
e7e866c76e33ee9a092384a8ba52fb0f99027c6b

SHA256
95adc0e61e06076090c95f4f94128626eb4c3b7d9ab08ea7d02ec1e157daeb7d

SHA512
18ccfab265b871f43465ab1ca1ce73da7d71d30cb59d4b74d1bccd4f23608cc4f7286a96b781606c3e3bca99d212338de97b13d04604a4ae0e61aa0fe824b993

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f7d949e76fa9e99013fa61ce0b215152

SHA1
70e0c1d92b44bfcf2f5909dcb36bc8ce43b84de6

SHA256
be174789abba53962ff42a377d6851ac1f71d0e8793a46e6283e1a5ea6ad3590

SHA512
5c64413e4957c4f5d65c109e438436b4a87476972b3182c59b9f42ba9eecf3c90ab4ceb724358015f710da82fd3a836116989c2a22da07c8a3110bab51cad6f7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\3554c7a5-c98d-40c4-a18d-5170c3afb64d.tmp

Filesize
6KB

MD5
2f494b236fd119841f9bc968a2ad6801

SHA1
981971561b2b49da9c6b3f4d0067f76220e9d590

SHA256
c0565a92615aee827632463c84ca6c99ecdf9ad08509f71d5776dca03506c965

SHA512
6d0b6cc45c6a8301e3b60ae29271f379043137493cd464cebd3eb0b62ca1cde31379b692b476ede1bc89b37cec9e16d46d14e374786f310402458335f1c13f13

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000019

Filesize
64KB

MD5
8f4b9a1f69401554234f0fd84396386d

SHA1
916263a475ce2fce977aa39ea1d1a4712b56c164

SHA256
14c47c9f29c00c39c0a71f0ada4e7cdbd2687f146a89426031e81c8c7e3e9c27

SHA512
e4650141970c4d63ca1c2dc967dd7a8f52992e4f6b944a65fdd8e1b250733b82aaf5a3868726f3c4b427a40808fffb83fb8f435660dd2b1fcd825fe468ad91f5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00002d

Filesize
161KB

MD5
6025746f0aee0a2ff164b6d031ca83f0

SHA1
07e54012f62153e21fa42161307d9c2de8a021fe

SHA256
2db907296ee252b4198fe630ed0707ba245a4c6124c046743da47064c5854337

SHA512
82f1292b8fe811f432359b1a90c8b398367b34d0307b88a505036acf31e01ee81ce3f83d2ff212ca01874596ad67130919326dfa97375f9d6e4246859bf2dcca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000032

Filesize
21KB

MD5
8120b14d056969ed6e984397f5b56b43

SHA1
fea8bffea306a9f161f76253e403ec6757a58978

SHA256
1d97d5347c369980d63c6435ece9628f4399d04ed79f68683c8804f66586324f

SHA512
7f96fe848fc41ca4b9035d05c809a5e2938415c9b3da1e4000cc444876f931ac290f3ebe025edef3ac3391633d729e5f56db533fb40e9e9608b1844b333668f4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
432B

MD5
358f82c5749ec608c576868c9e9b7332

SHA1
e65b8bd762dba44803841baa4dbaacd575ac43fd

SHA256
e8eb1afa617518afa975a2c393bac192e1ecf921ebaea61f1fbdc6c529f507b6

SHA512
fec5a4de5eae58c11cfae0e72fa6d6c48e4d947b865d92bb90ed79ae36ad7d254df93bffe5a5e23ee88042f84538434b30a6a92899f8d4402b3f08607ec6f95b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
432B

MD5
358f82c5749ec608c576868c9e9b7332

SHA1
e65b8bd762dba44803841baa4dbaacd575ac43fd

SHA256
e8eb1afa617518afa975a2c393bac192e1ecf921ebaea61f1fbdc6c529f507b6

SHA512
fec5a4de5eae58c11cfae0e72fa6d6c48e4d947b865d92bb90ed79ae36ad7d254df93bffe5a5e23ee88042f84538434b30a6a92899f8d4402b3f08607ec6f95b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
48B

MD5
eab64e69870e446882994ed706583f03

SHA1
37da2a60dde1260148931e959c7a86733cc3ac46

SHA256
baefdf71fa502fe7d05e65033e67fc6275bc026fa310f7355f8ff408e0e0b7b4

SHA512
b782eacc539717fcba6b64545c420e454aff9b88a96c78ba29f3dead4c6b74fb906452529e73080591c7a55685746de3e49a3b3777d5f6acd9390c6bda8dc95e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
792B

MD5
95163c6f60f04ade749ecadd5d0d70e7

SHA1
c3d9b42980bce470dc5861067430db1ae743cbda

SHA256
ba8a8fc7513001c3dec978397ca263ecbf925868c0e818ebb2efdbbc45cc4f8d

SHA512
481b6da89ca3fd9267e58347a2c7c7c25893935fe0b3274c649553a1fe8175d92498b267869abb586ee5c22ab432b52b8c97885f61270ced8bb4c85b9d061f03

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
816B

MD5
b588a370c204566a506f40699efbefb7

SHA1
70f30f8a2ac5bb6373fdcfba5b499cbc2debc24a

SHA256
dffff420aafc1d115661462e59cfb54690b9bce9986f4b581df831170f16d3c9

SHA512
b659371ec0c1665b3ef1565c85e8f0952e0efc060fe3be38d86a0f3b5ea847956abfe5034622ed847c7f6f62001ff34b04b0bf993feceac3dfccd5620c9971ee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
303bcccb504e4848de64b8576d27a8f6

SHA1
cf422422421e8efe074b19c557db1f728457148e

SHA256
ced9926db9409e319c6aed9150c2d52111c837c9c1ff19f484d0aa6ac7ae334f

SHA512
f4a61b8034e2759fe3b1564c656d553518520c9e139ea1aef57afd4a3e99dd890531bafdb368e4250248b0a6668d46868c97cc6a431f022e72a13aa68aaf767c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
f183d45a2748e8bba3deeed0da2153ce

SHA1
e9f1d73cb6a99bbaaf743c8b4b44a3d3e8d10d36

SHA256
9d14fcd0034bac0fad5c5f1f6f32c3a8267ce69666e458d035c2e961a7473725

SHA512
ab888f64834da18d5a447c32d725c94a0e441ad7ed3c14d2c2bec3c7657a6aa92887319be23291f67cdedbce26e5fc981a674a7954c1838780a566b09e1a44b0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
5e57ec246e698f6dc427ed450753b3a9

SHA1
4f03d28066a493c06b2e4f1f65a70bc8f04c8ccd

SHA256
8bcc517d54cd1575d7ded7c99a0e757e080ed3344f21233a5d01fe1c2a6b7cf8

SHA512
e6bed0ca04c7feaf6081d9cd0e11d326ff2c92ea332b4b45fc70ae431c370665755067904bb8d135430f1526d9a88c2e6af360c19f34a3360da7bc9d18cebdf0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
720B

MD5
5786004317d862acd66678c93332fc3f

SHA1
fdefa51cf732694151f99b84d043abf1253d6908

SHA256
c1e2b81a2bbc4196bb853ac34b4255dfb45c4a3ffed81b8198115c202ba812a5

SHA512
a95caa05cdc33ca2118f10ee17f2f317f838e737b41139260c64f44bf57727cf0af8fa656d4076b7291cf03d54e1b1094d330a7ed4457596bad5a8e95c46481e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\wasm\index-dir\the-real-index

Filesize
48B

MD5
eab64e69870e446882994ed706583f03

SHA1
37da2a60dde1260148931e959c7a86733cc3ac46

SHA256
baefdf71fa502fe7d05e65033e67fc6275bc026fa310f7355f8ff408e0e0b7b4

SHA512
b782eacc539717fcba6b64545c420e454aff9b88a96c78ba29f3dead4c6b74fb906452529e73080591c7a55685746de3e49a3b3777d5f6acd9390c6bda8dc95e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies

Filesize
20KB

MD5
9158a0a6d42cc690ab886a5fcc03f8b0

SHA1
4127184c62cbad4bd2bba35240d06d4cec339e4c

SHA256
12978b0735bbe1728d1ebab314647de7a2d8fe37aff84ebf6b42c2c4d7520a2b

SHA512
615ba8fc3745c69d1c1516dba01649f6ddb9d5e3ae2dfd397869b0204fe10af210b668309330e4651434bd35e85704549c9cfc935f9ae874ee20c20b1fa3a007

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico

Filesize
70KB

MD5
e5e3377341056643b0494b6842c0b544

SHA1
d53fd8e256ec9d5cef8ef5387872e544a2df9108

SHA256
e23040951e464b53b84b11c3466bbd4707a009018819f9ad2a79d1b0b309bc25

SHA512
83f09e48d009a5cf83fa9aa8f28187f7f4202c84e2d0d6e5806c468f4a24b2478b73077381d2a21c89aa64884df3c56e8dc94eb4ad2d6a8085ac2feb1e26c2ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG

Filesize
281B

MD5
e93a98f5aa2e3f23969ab067d65a7fed

SHA1
5341c3c84c07fdcfb35577c8cd36360b63bbae2a

SHA256
c2ddaa182acdc609cb17bfcd95f3c8b208bff118d9dfda639c7fe4ce028fa770

SHA512
bee1f578d67660831bfa7d052fc802ae85c566c4a001edb4bb8942e9ad4d6e53f3dc223c13de03a1bd46daad10fd6e9893e345fb15401b43190320395387898f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Favicons

Filesize
20KB

MD5
dc3caf6bb8f7300447ec064ff1f516c6

SHA1
478053e4eb53114f9d6a2cda6244abe7b24c1496

SHA256
7e332a241246ec4f4649804ba7155e4034e1ab231160fedc150a4f13f7d386d1

SHA512
5e9471ee1613fe117a14e7c45c634744d7612afe117e3eefedba50a78aefd4346f3a02bf19e4192f3f323b01b794f06324467fcdd125c5d77e84cf2799397806

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\GPUCache\data_0

Filesize
8KB

MD5
cf89d16bb9107c631daabf0c0ee58efb

SHA1
3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b

SHA256
d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e

SHA512
8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\GPUCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\GPUCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\GPUCache\data_2

Filesize
8KB

MD5
0962291d6d367570bee5454721c17e11

SHA1
59d10a893ef321a706a9255176761366115bedcb

SHA256
ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7

SHA512
f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\GPUCache\data_3

Filesize
8KB

MD5
41876349cb12d6db992f1309f22df3f0

SHA1
5cf26b3420fc0302cd0a71e8d029739b8765be27

SHA256
e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c

SHA512
e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\GPUCache\index

Filesize
256KB

MD5
2a4de21f18f2ec2265865fc9c9dfc683

SHA1
0d7a3444424393f20fce2b928394e7c526b7a1db

SHA256
d3fa46248638ae013fca3d7f123b132759b250f09a4f7cafbfd7181fd6f50185

SHA512
b9f0b9718b4c01a556579fe0c83e7f4811e22c0676409a9985fa071431884c13dcbdb3b1374467894fbd7b03396472f431f910c67a9036ce0533378ed025bd5b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History

Filesize
124KB

MD5
0be42f34527d8e8927882cb664dde2b5

SHA1
9968a90ace62457ae134090381059f4837ae7aaf

SHA256
9d88e314b16e1978e2733378f4b5bd41c8da59f865c206d1122b0c3c16df1926

SHA512
1c2b0be6e10df79d1aa59687f3eb824b39d36fe41b0d61a2eb1f5b344f900baaf1b2b4463feb94ead951991fd54e24ba8780b4e402b25dddf4da3134bc76daf4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History Provider Cache

Filesize
1KB

MD5
8fd4ae87a21db39e5dac21ed98bb6451

SHA1
d136ba538f8fe9e89d599d8d3a6573bf46d06e5e

SHA256
0560682b37ea76d5fee17e5ad5515e0ba7121301335a4a29eab79b9a47bfeded

SHA512
3d8d066d3574de4af197e8304626c7f05193d0d56b7595711e560b836071f9306025ee1c41599b2c0f12d9062ff2a35f78d3e0525fe645cace33f34f2706537f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log

Filesize
1KB

MD5
17ef77ced52a4dede6088176ac979c04

SHA1
313ee5f4e950b184dae85a67305fb18df154eca5

SHA256
0ba35e8e9ed10c8382c1b22c6ef124b4e01e49883d6deed52f7e97999e1ac707

SHA512
2a631e147118c1b14a39708e82c872926c015b57e0a0fc5fb8f682c169a321c37226834ccebf57f50437831d0738dc6d75b88202446157d465509f9259a91244

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG

Filesize
331B

MD5
fdb8eb314ea6c300469cbd48341b3b50

SHA1
ef269c3fef5fa5cf93063dbd320b115e34dc87b6

SHA256
1cd091e1385d7c74f43d4d4f9c2939e72537473d4bdc314d0685dce2ea6f06e7

SHA512
e4547ff293543fe098958fffaf52625339c9525ddcec83175f295b95dbe899c01f2ba8a56474d9a9323390ad175827afb735d4ffe9b6e02d6209828fc80753d7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Microsoft Edge.lnk

Filesize
2KB

MD5
2a0d078bab0fb832427125f75d2472e6

SHA1
374685f9d67c0c0515e37e610d54ae8b19b5cf7e

SHA256
6afb57702d4fc4a1686ca56be926247d82ab611e7cfd5bd4470985b127c19f1e

SHA512
f34a21b80dd760af8b318bf83c417162b2197ca6cb6a121beef46d93891446079d4b4f88020a5cfc5cd85dbd774f5cc23b1102093c877075ddf9b9f6082947c6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
490B

MD5
0a9764c76b191355285759f602a7ed2a

SHA1
0eaa1fc5b5d3809f76e28bb80ea9b54fd8be5dd5

SHA256
17e8c9023ce579a2c1c38f2a642a71d89e6577a9ca37a3cf3ade0fae03d121ff

SHA512
f79e819fa47794bf88e7b7c9c2266ef9db5649a31eac77d4c0630b4f20d0169f71256366a2a25957878004efab9787d741a088b9c762cba511e56fbd6995d9ff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
325579f56bf3ddacd75b0216fe4cfd5c

SHA1
6d880241f0e1174765cd0e20593bc6dffcf24949

SHA256
88370be05576fba2b71d9a9639d458e1b5873cc3e702686cd1635bb28013a619

SHA512
74ddf2b5edba411c4f3042067911bc26695f16aa44e9d9d4366f5fb37f30ff16480af45a34b3589c707ccf9ca63dc212e9d1434955eac1bbc9564e2668e490b1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
5ce0e02b7cd4a9b85fb7ca572d98fb8b

SHA1
d9eb8e944a0da4569a6d52d3f9572e17b637fc18

SHA256
c233446ba5bac5129d239e0c612213757ebd1baed0680708f89cb975a1565bb0

SHA512
4adc63fba73fb3d25783cef19501995f3e5e959fac9ead6ebe4f9f23b16adeae0856ae4b33d1422b874a23d1df634ebbb73d6054aaa920fbaac2f504b19faab1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
278aae174cfee6d19b1e3b6037928b68

SHA1
7c0acec486f779654109807709e834593cb53363

SHA256
ae3900fa36ea5a0344cfc05b443578a03f4d365fa4ef7833a51f14022ac4d445

SHA512
a3629725a735ade6657fb8b0ae759fea4c03942a51a927dafe72d2a70d63085233e4efa90529239379867599983c70f11ee5c28f89f1a16a764d558ffd2717b8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
440B

MD5
0d518cd15fe3e52975b63b27fc2ebf4a

SHA1
3ac5414dba90e444f264b3ffbda951ed3aa9d659

SHA256
70ba15b01e8c30fbd6100ef83c9f6d55527975bd0c51043d2fb29da1bd1206aa

SHA512
39c383ce029423787789780bb84725dbaa17dfc8ad31f53c572aa13d6e83576e36a9b036c9f77d598fc62bff8dad3687d47cad21d58e764801b85a3476cb7d24

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
4bb7c7f338763b4e5f4468f702b697c5

SHA1
f64c3ca8820e8d1941ec54f6bc9221be1052326d

SHA256
49fb32e8c8651be28a8547b31f138fe72f2fea305c4a03e0d361125b597b57b9

SHA512
af115543e7bae345040355842b462cea98d503863f596e253fc854012a781b3b1b42d103c0cbd3eac5c24cb4e16456fdfb07fe83104fed63940cdd7539dfe4e3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
9e9859bbdcb0855b758baf6b038b1c24

SHA1
601cbb4b7c1d641916d937ea0c96b9ecf5ee9bd1

SHA256
41ed4288893aa3cff0ec62b4ae46fcedd6865675867dc9d2bd7dc3ee67bbce3f

SHA512
0954577badc7af5dcf49537be311f9102fcfd1b3cbd88c92468f3d679d374c1e959800e2c2328cd5d9308965e44667c4dcdf0b7ca2ce9bc2e11068875ffc77fc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
36f1b2b1e0af62cde1eb72f5802346f8

SHA1
b1e043aca941b67bcaa312f2a9786c5c55994c10

SHA256
713456762920e6fa5a62ef5c7e1cc4f9710eb6cb0f449895fd843ec48fe5396e

SHA512
557bf373c6a2c2f9afdbe26a0e206ac2d2072e683003d64dd7a491120d0057781461d8ef66e18c628b8784ff57d306dd5d0869c92114595bad1fb0f1bdb78e80

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
b43325ad77870f9ed018ab6e2b5a9b90

SHA1
aecca3678837fe68d465e7f415b15de8cc4b8ef2

SHA256
2d8072a707ff7ec7c623bb27b8b780ad728070c40168c711b54e9bd0c8d59d41

SHA512
096fe8736cd309ce7d53f69341716ba7a5286e9d63d4958e8c2645f9a689451e561bbe0e1bce90b9483c8a49104e70b8f5d3ce55d4880e5f4a9f7dc469fd6088

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
d16feda23118fe7308928d3a75758507

SHA1
ebb9bd708a618d635b6f2a40c26fbbe67deb738e

SHA256
e1a9ca7e6fc5ac588c18d9909013c205945862c5096666910b70ccf797704644

SHA512
294374436bf02ebf6e56ba4f3977aeb934ab6d17705f82a5f8444f5a2c5376c653a98a0e9aa54e5a8fe4ba17ee819bc1022c127bc1afcc46bccf19259d10e51a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
221b61b43d8b33a45d20f1cd2c6f33db

SHA1
162c94f8cb570e3bfb058572fe732d8ec98a91cc

SHA256
33edf39158adc0c733b1ef593a2096a81410097b77d553f106ad8eef792d253e

SHA512
b2f69f8c084f3498d746016c61730a8798f5cb1be0b7d5f6868ca4cbac8a23948be7d2ddc101a7a1f27c74489de8e501105ed86c62d9dfd60997d73bde9da8bf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
c114ff735be0664842cc3ad3b8111cdb

SHA1
6f3e932e30ad91cc0e502bc73012bc95e316c538

SHA256
9d3c7d12879a7748244e41a8b50985bf8846274f37aca6664f4b80bc7b594327

SHA512
2bc6b88a1264e5e0c203f892e9edbd74a0a7d6fef8cef43ab4044ec4b82cbc1c12327ecbb4a793cfc67b983a2a0e46ef0f3072fd2b2cca8f58e678d40a8d5f7e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
5e160ea1a3cb875857b3102b73a3c56f

SHA1
f88b55ee057fec31884acd390dc1478fe3f84444

SHA256
0e6a4de374e26ceb57e0c771bffebeb43d8e654e59fbca634cbbe1452932b929

SHA512
e8b990442cab96e65279ee75b3d7b79bfc225422aca3fdebf41b824c6401fbf3ae3d6fae0a92ccbc54cbdba47b791c551ff8643aecd71e90af9422db26b1ae45

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
6c26801de706d4b1b429f0af71720b45

SHA1
7c76816f39cf7e7926e6d55dde132eb15819747d

SHA256
c52a64c16add995b4fd65d9f204a68c6bec70036c17c5b236bc19bcc77c15363

SHA512
7401a01f7087cd20c14711f3801ccbc60abe8cc02e55f442cca475c61d27c25f13a17876a82b99163dad9072af588dd1bb806718bcf0b44b3ec7dc67aa6740c0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
4KB

MD5
e3621e031b0a7387da172ccd3fb419b2

SHA1
92c4f915e0c37eb25a5814f8896d98772e437f89

SHA256
5d712957b0de8ce9f03eae180b8b5b66b01468969710ce0e33ac5c042fc7c57a

SHA512
dc9460d73d1b5fe6c3bf08444caec380db3b207ddd5107160259d79f316bfc6f086f215a9cda9e1fa00d25fd6406745ce6863abe22532762c4e69589d6b05223

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
51ba6d51e266e0fd2ebd870a9a6b0beb

SHA1
67bd5173161cc69ee3c3b4be1c937d8329386d62

SHA256
097665a9c3b7676748d856c522cda18e6f972b15642eeb958dbe97c4328399dc

SHA512
a695e8832cc455eadaaf7790fa9f305ffde37c8315fdbba0fde98fdbfa6fb338f3d578458d15cc7b587db6ff87cb721ef157d582088fa6643b43add69f511b17

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
990af964812c9c2d24640f11b155d7f2

SHA1
94916cc7b6473e9bef5d3d95b26dca62a3361b8c

SHA256
74b9f49d6f4e55cc47a3d75a02ff11b214e151da02d4e352d94704e6b4bfb5f5

SHA512
fda60d162c99508f36d1d7222fd0ce7014e48f06c94a8f636de6aa4aec25306502276582b337f51b330d33176285db6dffbdae195838257bfc2e4268535fc40a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
217de7108e57a7f315a0dd186c63221a

SHA1
91befc879855b0d8aefcfeac3ebf24e0b4d3a856

SHA256
14bed6ef4740ae795ae47306ccc87e6bb18f1e43caac55e438c22843c81df969

SHA512
c6f672ba5975a7933a7c37671f4b3d84a5e463d1693674af8df9f499576e48f97e5a579f143dc84624078255a36af08b64b0c9be41bce2149ddddafefc88631f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
ed852e149d94394a99d2d1ef1274f2ca

SHA1
8f9094151a970d0744f160940f8a92a9bd8063ea

SHA256
e4621d692796e6d641c6d686b85a7b4b820f2ee09ad635f205b063ad16cb6cb1

SHA512
10084eb810ab66b0721168726c0691f072c56611b1d90d1420e13b9075d970ba0541656eb911b2586a6ba3d84ada3c6bdb5b4f330343da2ff62e6b66e31008aa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
b4cf29ae1df2241f8823c25a1b962bbb

SHA1
42158a98b66679929aff5185bba7c7221afb68d4

SHA256
9e4264308998d8bd1dfad18dee7e851056114bb1c43f96e256b642267f03cc99

SHA512
3c2204bfef6ed526145f48e17eb90fed6fbf8d2d87c4e4fd0f3c4df0e4dcf5028eb8eafb6bc3dec080adfa1018f6b1bf771cb82df14c6f6e1a8f5c5f9f4a3828

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
08dbffeb018a82011f45a73dbc210342

SHA1
6b3fb1f5081609b660da69e874f496af31c6dabf

SHA256
4c2d0ff33fd13854fc3a47f00193f1d3cf405a0677d99767783f4b6044ffbbf6

SHA512
2a5a9852a48a31805926a7af037274c203d5b5c28d201501c723ba809d21780db254ebec92885527c3a904724b8ee9e71e199db755ea94d99215adabcb434ee0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
7fcdddcdaae8dded2c1144f33d301fc4

SHA1
e973c0542c82d491957bd6cce57e1678ffe102ce

SHA256
bc5c497db5ddfdd850023a18b4bc70f7bec58ee87809bba63a89e5d53850052d

SHA512
da81d97fa87744f9618d089ca966066f793db54bfbb4e36f9d138d6b4c977f60dcc835c23febc95465fd563c7fd58cfa947149c3d30bd9adbc50835f4d0a612f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
4b5980c3cf580bb53fc48e72918fe21d

SHA1
d86477e7fef93cf4e8767545b5952daaf27733cd

SHA256
8af8d0af8bc2ff0214829f69046f3439fa93020dd3cbe7cf96ab4452142df524

SHA512
bf041382cf1c80c0b2d403347647e95a89988d8e7762d0783ec59b7247b9695876b8383ae74706f9b0eef7b5a92aabbb925d3beaf102de24fa086fc35691ee23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
fe3bfc22361450af2926c3a53730c31c

SHA1
350d2407528e3e513eaa1d6f42c4efdd734320b3

SHA256
504b59ba0fdf4d83c4db309ecf23d3f559f42c17ebc1a05891157ab6e94b4f1d

SHA512
e45196874ccdd000feb0bbf13043cfc17b7e053f1e698576b7194a378a88df1b96366aeeb04a41f30b7ae20b5721c718773022ea4ae8ec4dfe8fc24a3506afb9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
81c94c4146a222e843ff7c0a0282f2c4

SHA1
33ac691d5d833f1783fe67f0adf5eac4a239d381

SHA256
c14955548c94346dd638c728134d54ae66fa952c9faf2c22d97b7d9be76102da

SHA512
c5d6256c9df97d475c999c90356951ad505d66e77982e70edddd413e8f27885a3c1655a988b2f362865ffed9814b70be1c98e311bb3e4e86a55fcc74bf582674

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
9712a6992e8d300c89e5f90bb4bdb471

SHA1
489e02c2cb9567780cd4e8c3d86823148485d23e

SHA256
6e7100bc1b843da243577155d756a7bb2c1e37460297b66c6c4993bbf7f6efee

SHA512
80d3e50a28e0732b3cfdf396428e4816e1646c17511f9bc965e7a8be9ffd57013d5f5d3042bafd6101ff0d41480672b607c0b78541712782c418ce86fbd068bb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
9f2ec4473f35ff649f224d1acc3a944d

SHA1
7b83551878cb3444eea9b3a761bacb93f95adb12

SHA256
aa0b0953294a5ef30235b1d1ca3ad2cf7a67dcaa3a047def7c054ee9ce7ff299

SHA512
2201d0627f104b83338ab8a18ff4aaaa22a03b42050ed04209f2373bc973537525fa59b51593f493f473ef5a7cdade9d9a64a848d6e5bb4bc0100dd232f583b9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
b3c80fa07c59a0e137e12edf44a7de4c

SHA1
bd9b1e14929862fd6acaebac07d8d3b3c7306ea6

SHA256
ea1c00b2ba9e8a45a1ab8724603a0f37f46527d6bcfa49d819b4872b053d81a6

SHA512
f5de63b3e6740da3480705a6405576e5272b08a6787a7a7e766de115af86beb24339a4619572b69aaf6af1b25ec4d4a50f81dce78c96d16a5aade00431282b7f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
7630be09902d1eebbb0aefbfb9a17b99

SHA1
2ddb7323793bc13676099e4f1fa1177ee0754899

SHA256
b8cca89e06eb84320802b77842eb12f91cb6fda2325596f8e12437cb1cdcc4fb

SHA512
57eca3d321f11f3f277cf5d9ed1e3e770513c62b7c3b603867e26054a7b13f3c4fbaf8d8971400a0330f8342275ef4d3269635f5c4a57d681cffc22502499227

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
18dd05201afccc6f18ac2ad5b9f2b93b

SHA1
27d851af14ffc2b951f86087d8698af07580696c

SHA256
88f1b15e87b755e6b0f877cc7aabeacc8aad13523999add1d1e9d7c3a245be52

SHA512
b7fcdaa16767d98a6b7398542fccdbf74a739738659ea39b1dcf9d2831acfa95e34d6479644e3c8116ee9d668fcff0fb0d1f272cca00c965a8397a6cf290f9b2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
5788881a5a01158ad2630a35b617585a

SHA1
3ab8042e2162d2e716a9d37e33c1f4c98bf9ac69

SHA256
d2e6321b10d07d49c79abecbdcae821763a34480078034a5baf3d4b8f5d4d23f

SHA512
0776cba502bc1678b2076e300c0e0562e4fc6a364b119419d9018fad9b7e7f129c35b13a7d6bb34099350e6086aa76dd386fd3bcb124b5f5e65592a1e4a29248

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
2e129c2dc0940ba42109753db76e5316

SHA1
2981d6388adb93a8a451c8a7d6ed599208df98e4

SHA256
334c7b3c15160f8adbce8b69ffdf3e80719916d63f6ad0024e6020e0cb10c192

SHA512
fb1800d586b2f29d6e941122a4460f72eb57a973cafac283a2c728c3043f022a6858f748f6a47d25c779f91b0ed09fac90c1ea5912d2a3341bd69d5ee0f2f2b3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
feb520a1fee8dcb0620debea3364bc7c

SHA1
2ee5884d1b12126da9fc434954e8264fe43333e4

SHA256
c24cbeaeec01739af4ccddf103e250811bc3b1c6f6016014579cc53bd71135ab

SHA512
fb6a0c66b5b227e298ab3070d23ed97492ca363fdacaec3b3bc042e4997709eccebe28ba9302bdac3f3f8e620ce9fc8836a12ad291723e81a40f5b52edfff9a0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
4b40599ee489a19359616f0c837bf504

SHA1
ef067a7e23f62eb4a74c73d96a027f8029bf52ed

SHA256
e573a5357125d5558e906befc6797bc1453a37df8230713755458f7720be551a

SHA512
aee6d8bf86cd1ae8d9db40fb19843384e1f0c38c72c888519a7cd60baa5e35beb4d38cb68ee06054d19794a5247140822cea0c168467c642b8a98acd575a37e3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
4b40599ee489a19359616f0c837bf504

SHA1
ef067a7e23f62eb4a74c73d96a027f8029bf52ed

SHA256
e573a5357125d5558e906befc6797bc1453a37df8230713755458f7720be551a

SHA512
aee6d8bf86cd1ae8d9db40fb19843384e1f0c38c72c888519a7cd60baa5e35beb4d38cb68ee06054d19794a5247140822cea0c168467c642b8a98acd575a37e3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
1abb483d0c831aec94741b1c175903bf

SHA1
3d66cf05801afcb2e3405d277fe4191d5cfa63e9

SHA256
98e7fdb9bb9e1e7a997dfc8845b41fb207c7d27e39fe44ad64a2a2365817ba6c

SHA512
af11c6961b92bca568dd86030c7ad2337e22a37ff23ee45a8425096146ba81053e9099e390f65bedc0ddf09fe39c411d8adc41d09a514edb6d06e0a7b331f77f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
5abe709729b226de589c8d1f621d3737

SHA1
8b30c7a9c69b04c274a526fc2882fdbe7be7b246

SHA256
668316bfc18c99b71383fb49240964747ad914522a112c48836f3bf7c903bc31

SHA512
ba9b5e01d87b027a7aa8df21b1fd4ff8dac6474d5cf8e722679727d061e9863341ddf2d9b69a2e0b50b8ca250cf2e4a04983c54a42f086a2497e36295260ca67

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
60b345592703258c513cb5fc34a2f835

SHA1
39991bd7ea37e2fc394be3b253ef96ce04088a6d

SHA256
7e358b4f7553c9385e8eb2c5692d426bc257bbd4c0213e6c69294459734f6300

SHA512
0346fb4096eb285ab0fdf7e7ec38c4daf7bbb0c506f09975eb2290121d169a34c886fca342c3e06371cb697f2753a697ca4f72af7817ed340eee6063897110a5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
1e5ba0451ff36f3ea9e13836ff06ff26

SHA1
29d9432a220b56a8aff2ec973bd6006dad895117

SHA256
be939c53dedb05948868aab0d04a7a31d9883884262e1da601e23cf95ca80951

SHA512
10247ac659e1ad79d1984e617f9ded79cbddfe9c69177968f385729cf7d934c3ca82d4da8ad5dc025336b2ffdb0fbb7629fc0c400896304a5a71a001d030ee9c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
1128df97dd5642ab9d43159c9d5f6226

SHA1
9ca10e504cf15362f4ebd932a500b4ac12a9b87c

SHA256
f1e66a4077574f873027baf9a9e4ab234b1e1b44d7ad21e529858404d23be268

SHA512
601534fb98c76739feb94b56992a8554b9ad3eab5f50e904112c4e4e7306b86868d093578450bcfc05479cdfa9c5a05395461d26da75f4af686773549397463b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\000003.log

Filesize
1KB

MD5
b0a7170044f05b0ae297eb50305c3aff

SHA1
3711b8ace599b9829c556aa0ed91c1e93ac69815

SHA256
74354dcdb9072b1155658ba16e963c4b7d0613e7979949c28b7ffd105448ce6e

SHA512
6448a9c9bfc1cee55dd01ba9164feb669dda36d42333e931575191f9b0275dad644d0868d9aab55d1b824275b56e8453ae9244106f62001d1a31d3ec30ed68ab

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG

Filesize
279B

MD5
f59bb70d1345dcfc2b4c4fc7157a86e7

SHA1
e8582208a3b4f40e12d5468cf1241afc69ff58d7

SHA256
721f84d6385913cd4b95915f69dce61d2a5bb3c9e0a560afac6ff7e4d939e982

SHA512
421068fe85042fb069562d6b63f55233d541d05be514aa4fa1f801ea93a4b6120425855dda5d09815c208a2531f410447942918cb451735172a6159f25d39f44

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sessions\Tabs_13330373861561091

Filesize
1KB

MD5
882aa1a76877d69b44e49f6cc64df2f0

SHA1
98786a2eaa1e8f73f06fa4af19ef7f6c11c950fa

SHA256
c745931d3bf06c76a93585df1ea378d6ba5fabaab586e8127a186392799b6b85

SHA512
d3484c696f053c3dd0955cb216d457ee46e230c7f3ef6704547b6d5486d73a9e98d557915a1cf200189d472d8cd04ab17f7bccae7154157f9a37821321b042f8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\000003.log

Filesize
112B

MD5
e694368a5c597bdc5d1b3bb0275daf2f

SHA1
e143759f87a089af97e4b3b13a410f8195f4fe27

SHA256
a2063cf771dc462f12b7142d492ca105f92b640b37c4dcc12f36c815ce4dc0a2

SHA512
7d306b15ed7542698adcdfdbd25bd438045351f74a692a5b1f0dccc2996108782b9d771cc7204ab1a653c637c23270b3ae2b06df6a8740ee3a2f68d894eb4645

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG

Filesize
350B

MD5
e685105b3b4996691291d8a3a885237c

SHA1
b252954399dbe768fe8b9a0202c7a56beefff27b

SHA256
6379bd2fa15eafbf0c80959edb895288ddce08d1071a81484f26ff1b326384c5

SHA512
e7cce7dd7bdd0e576017dfd79f4cc3a28862f3861fd1ff0408a8d868acc670e42056b7cc3cbb75f4a606ed512e14372ebd316c2ef96f8c9e575a72d43780df89

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG

Filesize
326B

MD5
e154f570af7417d803b9c865a0ec6c65

SHA1
2eee664cade887ea10459f8a151193b8b5b5d782

SHA256
ec62a27ca16589bd1ce51ca60686fe32e70ad4ed34f45b74fd7f16a69bafe2e4

SHA512
536865bbec07342d4a003adfbe6c843a0dd823ad676bf76fc94cfa6f25bc24dd8d56c0d2ff2bf72737dd40c23665cd4493c0819589814717ca397b3c0fa195a0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Top Sites

Filesize
20KB

MD5
f44dc73f9788d3313e3e25140002587c

SHA1
5aec4edc356bc673cba64ff31148b934a41d44c4

SHA256
2002c1e5693dd638d840bb9fb04d765482d06ba3106623ce90f6e8e42067a983

SHA512
e556e3c32c0bc142b08e5c479bf31b6101c9200896dd7fcd74fdd39b2daeac8f6dc9ba4f09f3c6715998015af7317211082d9c811e5f9e32493c9ecd888875d7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
204B

MD5
c696c464258a3bdc1b6f79c8d03f51b3

SHA1
c6172a54473ed57bf2e1df78b602de32ee908be0

SHA256
00c0034f5b8b1520effc4fdc72ab2dc416d0cf8c4f8f1ecca523c0c38fb6c815

SHA512
0dc6258ba59444d60232a8b317d7355f33ce2bec3d304e201a2847ec1d637aa54b3bcdf9ca8111fc76d77459034a6dc5378ca743ca0da53a4896204c1599bf13

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
204B

MD5
612dedaf27ae31106a37a508c9281955

SHA1
edb0e18c89c0670ea15e1fd660042d4cba063e6e

SHA256
829e0c6961181b3e94352041085a945bbe23334a4813af5e38c161a71b044dda

SHA512
f1807958a06d8bd3cbfcedd365094491b88dae5e1fb4ca226e1a26f4687c3628084d2fa7cb9d7ed40e2ff88f48fab82be1aea2165f8276ab066138395e538217

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
204B

MD5
59e49d839edcd140163efa7b62d873f0

SHA1
ce77a1a08cca24b75afd26ce476709992966eca0

SHA256
1bcafc6d9b538cf400f5ea55f731a168c986402524c31ec60b131fc302fd4d09

SHA512
ed1b6821da7c61ce5f12ae4eae23c1e15751a8cdf80f3e48bf1c67eedd575d72746a9238265f015a6a07fc2f941b9270a7944ea36275da0bbbc029ae1c222112

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
204B

MD5
67a86844509e4de29fbeb05faad38fe0

SHA1
86bff0ab7786ce05774b4ddbda58a502fa423180

SHA256
570da67482a69ad2a06a7c1805352aa9256b994908e58e2d21a76e61fc130cf1

SHA512
b1a34df4668188145e56cd910b8ab2818c8fbb14076531eef17b43e25db31ee75c88c8c3be039b947d3a464827c839e1eeb6aa4d1ef13c7e80cdc17470839354

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
204B

MD5
83e96bba5e022d52b04ccfb25c1054f1

SHA1
71077b00f7c24b0e3ae49656bea9a1049a6d007e

SHA256
793f2a7894af2766fbe7493d6501ce1f9874e08de6c0ae7d29b6b41134736c01

SHA512
0d3c06785c85065850325badc4ccc5baed138a718d7f58a965b777ca238d8fc2396fe0a96183b8162598c501d6408fb20577af5ad726d90d3b529d000573b710

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
200B

MD5
b3b2a9174438dfd6cc7c87fdb150d470

SHA1
fdad6e8bff9b686d5f88b4722a2a498290859be2

SHA256
54a5af7bf4a0830cbe1aa9c08923d4f4a2445583391405673715a9a63b63147b

SHA512
1f97ca463150ce4d8e9d10f492b41b2e5eca0eedf4f82a81e08af50c9985045d609f2175b35b8592352db9bea3289608ae0f0a8d33859a2d9ed6bd3da6f2a0c1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
204B

MD5
72f7867ac9f4d99eff270a1df73e68c7

SHA1
98fead5516db02f5d336f748f44a4112d861d55b

SHA256
4f05ea36ca29f4cf0dd758b9651bad43c314676659874f8fafd4f55ffc89d37b

SHA512
8dd7da7dc2def05d1bc4893201ffb92692534868ead4171f8399d607a6eaa853a87fc30a5b8a50cf828fb58d531e477acce3d58d2a0c31919d975893667c28e8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
538B

MD5
a6593a9e98b23892d3f454f5f3d9b12e

SHA1
6a2e730c4e8bcd503d20a7af49a119664e8b3fd0

SHA256
2f7faef19e7849d4d7ad313e779d30218647deb2b34446ad511327b7389e59a7

SHA512
60587aebe4691d66f105d21cbcb1a8f746fdda5995c91d4381621d9e5cca511ccd2a2abbb7e0ba8467dbe74f6134c3091031e659739fd7cfe4359a0b482d19b0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
866B

MD5
1995083b3646d4354bdb997d2d8395bb

SHA1
01d94c01c177273c232cc3d2601ea483e3d79502

SHA256
3f7798bf1ffd1522c3f0be149a2c38517bd672ba45cdabeee97564ad86538f18

SHA512
4dddd4dd3b66944d7fef185ab106e52fd1c0e99355afb5a8c3b846100730a4197da1f048188c820bbabb687a8620f7124ee8e9d0b9054293dd1da8443f28c238

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
868B

MD5
c5971cd938e1c96bbd857b63b8e445f4

SHA1
d4911c9af5817afdef0687fc37b5ede870071350

SHA256
89c2b9c942bb003bcd5a5709b84ae92bc62f20f877afe176a4bfdb389130c5a5

SHA512
161fcfe7cb5a9b5f32c347fbbd82ad0af68433554c096eb10fea32a09a6f43508361efdd010eae5867fe98f69c4d7692a4557638533d43c316f163a5492533e1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
204B

MD5
3168dc5e4a40e470f4e3d54949d0dd02

SHA1
541d42c8918b7fda1ab1400fea3f4959cbc3eb75

SHA256
ac1b76da81216396b7b7a84a4afee20679157393f92754b06619c0f3d4f4534b

SHA512
14c102c266a0c675cb2ee66925bd6d01edca523cf558cb619377343731addc9c17a3565644bbe1e28dd780056f8467c54897b3123c03e52d68414a8df215f9f7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
536B

MD5
2ebf3b5d51a931169e7cf7abda74560d

SHA1
df4e66b00ca063be587c48bad3d9dbf9ac837c8a

SHA256
54320e4324fdca3407450437e6725b544c12884599b6426c2aca15e58e324c68

SHA512
98e0d5cd2a8363f37fd067bbc096690646e9b74288a55f0613651080a45b0736b2f855bd8982b9c59398acf3b9d7ed05abbd986498f6a2dae49f69feb28810ae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
1e256b4ac64ef64074a7a296ce6a1d92

SHA1
ee52e19ebe719c683399ef3d5d1b5f896c6ef15b

SHA256
51fe936e4a57b779c37bf5ed29a316bc06750c641f91730a55633795bf00f6ec

SHA512
e2a450c342242129f40d7369418f7d4f4724531f71928bcfccb7d59c9b4ff548a8a4729ac59d1b06d4931e3d832a8cc6a809646a3c076042484dfe656938f9df

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
204B

MD5
35ef9d079f5580c8287f26f36238cd6d

SHA1
85f11733e4a44eccd0713fc1b3021ad46e95a410

SHA256
6dea96acc093e32774115f7fe666bda5e6b2ebbc5f098a6d5af48929c2f79d3f

SHA512
02cad2621e4b958927d14a3eb38aa2eae2d5995fffda9937e8db67f4ec6da4fef83f1930bd1a78ade9aa4ac443670c4b7d6804a1edf89890cdcaad3838926186

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
204B

MD5
3117b39cbdb325e51e9507198b2b25ce

SHA1
e5f6eb7acb68076e6fbee19bccd910ee46e78a04

SHA256
81cee4b0023a3dd688d8118af36236dfed14e9d82bb1efd9542db304e27f59f9

SHA512
7de351d8e9a9be8c9ce6f531d72a3c11f4739b9b24a5f75126518a94febe90b9be4b59b5fb0fa02384a563707db46edc1f969f8f3821f0264401c289daf090f4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
204B

MD5
e9af08777c3fdfb89118cafe3616a127

SHA1
3f63bdf93b504a45b66da206ec0dc1f3e2bdb19e

SHA256
9ba1451872d5e4a0bb4955b15f608d8a12cec540d33a1f030188a3d63b59c07c

SHA512
87e1bd6777618c6f728f51011e24f5d5d374fbe2fe640a0adf105eaf949519f018b9bbf75635f1fc8c823d8760af124d6ef5336d656f11431cbe86454bcd1224

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
204B

MD5
585fc5dc0307021f09f86739b084d465

SHA1
54be6ccf28c6a1cda56cbf24b6fb6b31a3c880d0

SHA256
88ac5ce9d9da26e023b29b11f4f322008b064d4d9d2ee120a612158fc9817430

SHA512
c65c5af2793c8eb3125006915ac193e946218a91b5f65e67d9d40230bddcc8c5b64cdd5bf0e22f6afe83fb6bcb510ee655b488d5f3280ceaab7c25705615cc2c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Visited Links

Filesize
128KB

MD5
01fb64aed0f45465b5905bd461c84ba3

SHA1
d748b380dc6dc4e47e51bebf6c31e4d54c74aac0

SHA256
9753b1bc496fc1a327e974b99d4df9f4435f570c169fdde4601b8d9530949153

SHA512
0697f00246b72fdbdcb708613cbdf91a0a0e4b016d0ab2cd394168802c8c56e9a3927a70479c673410a7ce613f55c3327087f8c6deff9a2a356e1098ea63fd83

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data

Filesize
116KB

MD5
f70aa3fa04f0536280f872ad17973c3d

SHA1
50a7b889329a92de1b272d0ecf5fce87395d3123

SHA256
8d782aa65de6db3538a14da82216e96d5e0a3c60496726e3541a8165bccc65f8

SHA512
30675c5c610d9aa32a4c4a4d9c3af7570823cd197f8d2a709222c78e2cd15304bbed80e233e3674ec2f6e33d1961c67fd6a46dc8ba8b1a301cd0722932c03c84

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\bbc56c65-b9c1-4a47-9cdf-aef4f7127e71.tmp

Filesize
1B

MD5
5058f1af8388633f609cadb75a75dc9d

SHA1
3a52ce780950d4d969792a2559cd519d7ee8c727

SHA256
cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8

SHA512
0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
aefd77f47fb84fae5ea194496b44c67a

SHA1
dcfbb6a5b8d05662c4858664f81693bb7f803b82

SHA256
4166bf17b2da789b0d0cc5c74203041d98005f5d4ef88c27e8281e00148cd611

SHA512
b733d502138821948267a8b27401d7c0751e590e1298fda1428e663ccd02f55d0d2446ff4bc265bdcdc61f952d13c01524a5341bc86afc3c2cde1d8589b2e1c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
589c49f8a8e18ec6998a7a30b4958ebc

SHA1
cd4e0e2a5cb1fd5099ff88daf4f48bdba566332e

SHA256
26d067dbb5e448b16f93a1bb22a2541beb7134b1b3e39903346d10b96022b6b8

SHA512
e73566a037838d1f7db7e9b728eba07db08e079de471baca7c8f863c7af7beb36221e9ff77e0a898ce86d4ef4c36f83fb3af9c35e342061b7a5442ca3b9024d2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\fcf4aca1-98b7-45d3-adcb-30edcea7f397.tmp

Filesize
204B

MD5
e7745345476428e5b20163ac3cca5674

SHA1
058632c4d0553104595bf9b74077f23673dd5f52

SHA256
c2f8cd75b0c3ea4b9d62c234248c7bc0ae71a17418155dc4cf0152316b7d20da

SHA512
1555435cf38c2200f73fb0306c7d39ec880c29fee6843e4994009db962269e6d2691c7c22818761e3ed4a6c986f95e2e54f0e131bccdf3733ecc21535fbef339

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db

Filesize
44KB

MD5
cac5a1300220dce86b09c4e0eddd38ef

SHA1
86eb5544eb90d3b1ad337cca8971264e801585ad

SHA256
ab01920c4f2d6e487d2b688e47e03632c0dd24141a6a0a59e5ff0f442db8a4f6

SHA512
250bf347a88b13528f76ca255bd2300ba8e925b2b76387ea11a456d53d4c542537a6a11b3a3ff931e838525b46e30d1bb8671932506506400e56cf632334ca49

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log

Filesize
187B

MD5
3dd13c20ff7f05afed57d3c69ed33658

SHA1
bad7083e6ce83ac555c0e9d246827d974fe95b00

SHA256
0c73c8bc51662f54febe12d05b7f8c5639ff56538af740353e8f278e9f27da26

SHA512
5cac2ae679be8f7002f5e24fd61eab44c490d76ad5db6b7de3cbf4fe3a58b0cdc635aa637eb9b525e7079a02940bb88aa33db4c07faa904fb4ca04460d94e112

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG

Filesize
279B

MD5
08104027e48ddd142cb8f360def7eb8f

SHA1
d355ff2286dd883a0a55690de3ac8e951d80753b

SHA256
c33e07d04b84b4c662f612a429d1983c718a47ae71123810c5e5b95a2be8fd32

SHA512
730293428a0a9457266a9b4c6acf9ca6b6e987dc7fad89880ba78d509443526eaf58cfe1a4c1f90584f5a2b9b4ec7d001647380ef0bf0d8dbc7a4084f66ccb69

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log

Filesize
531B

MD5
805900b13b7be3c96d432dbaa0cbae70

SHA1
9893a6760ed276548013be16c394783667a2a1c0

SHA256
c863c9b397f0f89fd2f5e03e04527f65d951c9ce35af0f4842812ef8eabe1414

SHA512
950cc1fc8c35f8b95dad138d22d39b64fba4c718b1a8fd27dcca5cce94de68c5dba59c2b4119bb167f2121f0fc2d653a87739d481d8f2a6161c5929cd36a307a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG

Filesize
297B

MD5
f64e8851e24d7a63bf10bced46235f60

SHA1
419299c8dcb5dee7411675ba89bace9687220f7c

SHA256
77b96044a2004aa8135af5472320ec5b6d0e6578cbba28b9cc0aa6879f1fc499

SHA512
dd33b8bb0fa1e1bb753c622e48a8374a573267dd7839f3ba5f437f207a8b0712b28a2c6a334c0b65f244cb763152e727a4c7f199d55b18c6c8e581c637d60a59

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version

Filesize
11B

MD5
838a7b32aefb618130392bc7d006aa2e

SHA1
5159e0f18c9e68f0e75e2239875aa994847b8290

SHA256
ac3dd2221d90b09b795f1f72e72e4860342a4508fe336c4b822476eb25a55eaa

SHA512
9e350f0565cc726f66146838f9cebaaa38dd01892ffab9a45fe4f72e5be5459c0442e99107293a7c6f2412c71f668242c5e5a502124bc57cbf3b6ad8940cb3e9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version

Filesize
11B

MD5
838a7b32aefb618130392bc7d006aa2e

SHA1
5159e0f18c9e68f0e75e2239875aa994847b8290

SHA256
ac3dd2221d90b09b795f1f72e72e4860342a4508fe336c4b822476eb25a55eaa

SHA512
9e350f0565cc726f66146838f9cebaaa38dd01892ffab9a45fe4f72e5be5459c0442e99107293a7c6f2412c71f668242c5e5a502124bc57cbf3b6ad8940cb3e9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
d38d0a4acef0a45b9170d8b22afb4131

SHA1
f3ffc0eafe4aad9a91afd409a235b75ff2d8cba2

SHA256
c35c253aa65e8ca67724c9e9c1055f02897e5c3faa4a75f66b3b826308f6f0ac

SHA512
1a07c637c4e2e99cb3ce525b01c1bfcdc57c87f4c6ee380d0ee92c785b512de06b5560435bc4be8b6183077a7f8ae81df90002352a20a00319d013765d53f087

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
13KB

MD5
6e451714b003f72e981287eb006060d9

SHA1
217ce213991dbf134a05317f2bb3cba678c7d8bc

SHA256
328dcd1b38a339f128236be5696fa31d0456523a439106f4795f0ac6b8155282

SHA512
a45dba427677bfc1026aefb05dafc01c4643158e4ef653428f6ae0c82c038b1054e24d1a9bd6ef570fcbb1dc07881ecf436497c181de346eb0e9a2829562234f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
13KB

MD5
b930452893169b509d33ee635d50f886

SHA1
33d1d0db30e962868e8ff3543cb0d5ff24aef44e

SHA256
8e6b6ac372fbf83ba96565614d3448c1d207e8a9bca5ba7fecd7c09b6d07d13d

SHA512
8bd9ab8d20fd47ffe75fba9166a48f9f60a097b84a839da94be023ba4bbb9fb8b33ccbd4ad525953c6a7d7bb9de019e1086d43073bc460d506e630cabccb9db9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
13KB

MD5
ebb4d9fc96e9ba32bad8651ea7fb4f68

SHA1
95641340a85fee0846d398e1c9705deda53a2b72

SHA256
318d8b0b9224c3eb27c1dbe1b4e93702632575ef32a2f5149eb46e6e1533bc77

SHA512
143137ac8ec4834002ac4b7875538c27255abcc9a924fbc332cf1a8f91aa1550cc12950f111f608e817ff58c85122d8a6e0bdaa812bd992638839a1291e4bc86

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
13KB

MD5
6a175829d13c60df11d71e3ec939318e

SHA1
24b89403577e85cd15fbca102b2e3e80f384d5af

SHA256
e97b87c824c972e8eeed44aed0a2787d7ca42e559e72466527472c5f0b8b992b

SHA512
84f1e9800c3285a2c1a3f7bc7e88bef3d2181eac55bf9960d1d178f405debc10b23aee515d992957052934f9e2d61b5e775201a286d53692dc586a2cccf062da

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
13KB

MD5
67ce60cec2f7c88520184099af6000cb

SHA1
4c153492c090280776af5c91790fff7dbae25da3

SHA256
b9c45bbe89a5101607875d9794f2ad604b9c94b81fa353be20ad2c4557d82c86

SHA512
f4da6acf9604dd7fa20cf114ce05ede6a8ae4abe6e425d2cefdd71ce4187bcaf7fcf1ddf9993b645b49bd0a868dc3b58093a322b55264b1e8b3f7d0c67d6bcd9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
9KB

MD5
c04f3ba8e06cd897e192b370966bc663

SHA1
c64e08872c15cab58c8ebefb10b6f93fcf9f028e

SHA256
e08bcb1958f63f919842ec88423b882293e8b231ea7d659e232a62b46b183a1b

SHA512
cba4646dcf6a018e68d1725588973bed72e5d18fec75f82db5dc6cde6523c72b2c45886a238ea4c63196cd7256e4486605c9a82dae1d18b851dc88c916c61bec

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
13KB

MD5
5aa628d60c59201960e8c471a751f0b2

SHA1
844168489940919e127e5d5f7c0847ecfce7e8b2

SHA256
db7e633bf21cde0cae015f521a7eeda155943b77c60be4bcdd1912537a9dd308

SHA512
fe27631b6749bbb0aadd4ecfb92532b91f8bcc70282654be6f1e30a63ac72899beb534a27a88f8cfd00f475b15cf1653b0f0381974f10ac91b1e430def4930e8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
d38d0a4acef0a45b9170d8b22afb4131

SHA1
f3ffc0eafe4aad9a91afd409a235b75ff2d8cba2

SHA256
c35c253aa65e8ca67724c9e9c1055f02897e5c3faa4a75f66b3b826308f6f0ac

SHA512
1a07c637c4e2e99cb3ce525b01c1bfcdc57c87f4c6ee380d0ee92c785b512de06b5560435bc4be8b6183077a7f8ae81df90002352a20a00319d013765d53f087

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
13KB

MD5
b5fd736168f3cae7068b79ce4ca6764e

SHA1
9b02eefd97af44079e23fe060d8d8253541e16cf

SHA256
b81e1029ea77abeb373aac7eac8d2ee2e31df444935f5be99e67f0e7a9049bea

SHA512
59a4ea5b23752daf1364b97acf871fd9edc3becacc55c4ecf2031b9b76f0923d7d142829c178976201664b3fdf75c15cc66e222a7dcca41039be9e45a26deed6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
13KB

MD5
5392cd692b6900978de7532d8fa07f97

SHA1
881a712bb551ca997e368df346c78dda1caff09c

SHA256
96e31e0717d6afd2c497be0f89f692a304936cb544acdf5c6950f64c5eede5d2

SHA512
343c061ffbca0e7bb613c2712288ec4451b004f8e197c25d7ed858a5562c3ba9f887dca65f535664e040dfb9bf1a70820ab528322c7c7d7fd79d4d63d0511f02

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\GPUCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Temp\ADZP 20 Complex-Destructive.vbs

Filesize
32KB

MD5
268ad0d0582547195a60ebe86948e93a

SHA1
7bbf897816101572fc0111a94b7f36ed59bd1ff2

SHA256
59bbca836c4db770d30c3be2713733629709ac3f573e2037bfc6507820284589

SHA512
93493ddc7cb360f3a02ea53d1c1efa5d9c86d37163ea13f2e9c172e9158a8e51026ed0554b05d13a7039f6ab0f3f485e4fa4515797eaa32e5141ef4ee6326d68

Download Submit
C:\Users\Admin\AppData\Local\Temp\Advertencia.vbs

Filesize
540B

MD5
2c77e3b1a1fbe57f517a5e20a2276067

SHA1
39b148046cd506d6e77de89363c12cf1a5dddae5

SHA256
2743c84bf8627627d8bc12b948e13740a2370bda01accf49ae68cec93d8fbfd3

SHA512
9656636f516894aab708cdd526e88c69cc943aae6790bd1a11dd56f78fa4e8779b4af1448dfa25da947f735cb74c59b35ed2c5fbda06df2744d8f770ae5ade2f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Autorun.inf

Filesize
666B

MD5
3d50285600f52fda8e1f06ad9d2a23d2

SHA1
51482c4fd3e8f8426ca7adb402c7d55729132c78

SHA256
b001e1333c230cb838a11877259e23fac1d8cf54500751180408d96541b3ef3f

SHA512
60b0cd909bf9cefd251af95cf0a2d276615d1158e91a8dff877a465b8b49c5b504c0d8163b6b1c86c12d327dea7bd3828471cb9e8f0e5bed8be0710f94deeb52

Download Submit
C:\Users\Admin\AppData\Local\Temp\ErrorCritico.vbs

Filesize
486B

MD5
bb558e6165fa51635b0385f20c501039

SHA1
26d9cf67d77eeb65d53c5b546cd5e3901c8eb8d4

SHA256
1a7ffb13c45566c7921f7efe639c7dbff8d063d6ce4f0ca506b02acb8593ad93

SHA512
db6850074fe126daf27baed7487a74e76525e6b6fcf0a5db7b1f123a3e549a6c3514a3d95d55173bc561bfccdc2db59da806d2cddb31b54c36caf474d65f02c3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Informacion.vbs

Filesize
621B

MD5
1f6a511cf3f20b52f2579f588f3a39a2

SHA1
8d8bc11847d23be6c26ead8e51c37f5cccbc1ee0

SHA256
cc10719081e957fb8cd05a9b1974914ef919cdb42494de67eb9f5b3985226bc6

SHA512
0587f6e02587aecb62730b3937a7027f7d33400c888d6f19223088805c4491dfa3a222dcfe202ed40f08cfd26b13a1db366b8f051232df3e0fe1dff85ef4bd1d

Download Submit
C:\Users\Admin\AppData\Local\Temp\MEMZ-Destructive.exe

Filesize
14KB

MD5
19dbec50735b5f2a72d4199c4e184960

SHA1
6fed7732f7cb6f59743795b2ab154a3676f4c822

SHA256
a3d5715a81f2fbeb5f76c88c9c21eeee87142909716472f911ff6950c790c24d

SHA512
aa8a6bbb1ec516d5d5acf8be6863a4c6c5d754cee12b3d374c3a6acb393376806edc422f0ffb661c210e5b9485da88521e4a0956a4b7b08a5467cfaacd90591d

Download Submit
C:\Users\Admin\AppData\Local\Temp\MEMZ-Destructive.exe

Filesize
14KB

MD5
19dbec50735b5f2a72d4199c4e184960

SHA1
6fed7732f7cb6f59743795b2ab154a3676f4c822

SHA256
a3d5715a81f2fbeb5f76c88c9c21eeee87142909716472f911ff6950c790c24d

SHA512
aa8a6bbb1ec516d5d5acf8be6863a4c6c5d754cee12b3d374c3a6acb393376806edc422f0ffb661c210e5b9485da88521e4a0956a4b7b08a5467cfaacd90591d

Download Submit
C:\Users\Admin\AppData\Local\Temp\MEMZ-Destructive.exe

Filesize
14KB

MD5
19dbec50735b5f2a72d4199c4e184960

SHA1
6fed7732f7cb6f59743795b2ab154a3676f4c822

SHA256
a3d5715a81f2fbeb5f76c88c9c21eeee87142909716472f911ff6950c790c24d

SHA512
aa8a6bbb1ec516d5d5acf8be6863a4c6c5d754cee12b3d374c3a6acb393376806edc422f0ffb661c210e5b9485da88521e4a0956a4b7b08a5467cfaacd90591d

Download Submit
C:\Users\Admin\AppData\Local\Temp\MEMZ-Destructive.exe

Filesize
14KB

MD5
19dbec50735b5f2a72d4199c4e184960

SHA1
6fed7732f7cb6f59743795b2ab154a3676f4c822

SHA256
a3d5715a81f2fbeb5f76c88c9c21eeee87142909716472f911ff6950c790c24d

SHA512
aa8a6bbb1ec516d5d5acf8be6863a4c6c5d754cee12b3d374c3a6acb393376806edc422f0ffb661c210e5b9485da88521e4a0956a4b7b08a5467cfaacd90591d

Download Submit
C:\Users\Admin\AppData\Local\Temp\MEMZ-Destructive.exe

Filesize
14KB

MD5
19dbec50735b5f2a72d4199c4e184960

SHA1
6fed7732f7cb6f59743795b2ab154a3676f4c822

SHA256
a3d5715a81f2fbeb5f76c88c9c21eeee87142909716472f911ff6950c790c24d

SHA512
aa8a6bbb1ec516d5d5acf8be6863a4c6c5d754cee12b3d374c3a6acb393376806edc422f0ffb661c210e5b9485da88521e4a0956a4b7b08a5467cfaacd90591d

Download Submit
C:\Users\Admin\AppData\Local\Temp\MEMZ-Destructive.exe

Filesize
14KB

MD5
19dbec50735b5f2a72d4199c4e184960

SHA1
6fed7732f7cb6f59743795b2ab154a3676f4c822

SHA256
a3d5715a81f2fbeb5f76c88c9c21eeee87142909716472f911ff6950c790c24d

SHA512
aa8a6bbb1ec516d5d5acf8be6863a4c6c5d754cee12b3d374c3a6acb393376806edc422f0ffb661c210e5b9485da88521e4a0956a4b7b08a5467cfaacd90591d

Download Submit
C:\Users\Admin\AppData\Local\Temp\MEMZ-Destructive.exe

Filesize
14KB

MD5
19dbec50735b5f2a72d4199c4e184960

SHA1
6fed7732f7cb6f59743795b2ab154a3676f4c822

SHA256
a3d5715a81f2fbeb5f76c88c9c21eeee87142909716472f911ff6950c790c24d

SHA512
aa8a6bbb1ec516d5d5acf8be6863a4c6c5d754cee12b3d374c3a6acb393376806edc422f0ffb661c210e5b9485da88521e4a0956a4b7b08a5467cfaacd90591d

Download Submit
C:\Users\Admin\AppData\Local\Temp\MEMZ-Destructive.exe

Filesize
14KB

MD5
19dbec50735b5f2a72d4199c4e184960

SHA1
6fed7732f7cb6f59743795b2ab154a3676f4c822

SHA256
a3d5715a81f2fbeb5f76c88c9c21eeee87142909716472f911ff6950c790c24d

SHA512
aa8a6bbb1ec516d5d5acf8be6863a4c6c5d754cee12b3d374c3a6acb393376806edc422f0ffb661c210e5b9485da88521e4a0956a4b7b08a5467cfaacd90591d

Download Submit
C:\Users\Admin\AppData\Local\Temp\MEMZ-Destructive.exe

Filesize
14KB

MD5
19dbec50735b5f2a72d4199c4e184960

SHA1
6fed7732f7cb6f59743795b2ab154a3676f4c822

SHA256
a3d5715a81f2fbeb5f76c88c9c21eeee87142909716472f911ff6950c790c24d

SHA512
aa8a6bbb1ec516d5d5acf8be6863a4c6c5d754cee12b3d374c3a6acb393376806edc422f0ffb661c210e5b9485da88521e4a0956a4b7b08a5467cfaacd90591d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Taskdl.bat

Filesize
1KB

MD5
89fd8fd619d792cde21768b339d0ff02

SHA1
d79e57146addc11bb50893ca68ff861008c44360

SHA256
4a71513a9ccb017a3aeb6c1d865fefa611330f05c3f646805f169a6b13c2a9b4

SHA512
8e058edf5bfb15022aef6442ad3b075e0d3e0746413e08e58528e0efc2bf6465be95b8d9964308c4d92cf17c2d81f7c683ff3704da40a79c8410171536dd3b1d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Taskdl.bat

Filesize
1KB

MD5
cb39136a7f12ec7e9fef351b3b4b9c80

SHA1
b75308491b91b70a61d85da72695b13582d2dbf7

SHA256
9ad8aff16d736e5131ca49eaf8d25c3aa573fbdccf8c9d30df8717878354e310

SHA512
49b2535f42775eec658899275059345420fade50a6788dcdcd800961198678c38800e1353aba39efd209bca37f64a8bcc71c7e079312a0062dd1f355e2ee4228

Download Submit
C:\Users\Admin\AppData\Local\Temp\Taskse.exe

Filesize
5KB

MD5
411c1011af0f8c438c605fc909147a18

SHA1
54bdb509432f24ef4aea877b89f2502e39f51af1

SHA256
3296f9012717a926935215da94bc9a8f83905510aef3ce095d762768d142fcec

SHA512
266b147bcc47c24eedf3843afb3d62d6e4b58e919d3da619a67508013b0ba13864dcab96e9b632b322d8c6e1d1274befd73281b22bbeb78e96cb5d7903754d71

Download Submit
C:\Users\Admin\AppData\Local\Temp\windowswimn32.bat

Filesize
49B

MD5
cfb046d3c9513b92c1b287da26f97c28

SHA1
ea8208c4dad826b7fdb3b5b728863a95e86d4383

SHA256
a06f170d4f92bf290e38b0ce1c05bb59c95de2797b1a5253b949ad7e1be9818b

SHA512
dbeeea4d284f59e1455a5426334caa02458e88833aeece9817c51be616697ca4c399b2a9d0e8e44bf4a5ee63d0b37c0aed68c01f1748fa5a23ed6d2af62b3340

Download Submit
C:\Users\Admin\AppData\Local\Temp\windowswimn32.bat

Filesize
11B

MD5
9905e5a33c6edd8eb5f59780afbf74de

SHA1
64b2cd0186ff6fe05072ee88e2bb54476023772e

SHA256
c134b2f85415ba5cfce3e3fe4745688335745a9bb22152ac8f5c77f190d8aee3

SHA512
e10711d0fb09db27192e9af05ae45b83cf3882d98e904a7f1f969cf24c2f9626f70f35d76f57477fe9c64a58bc74100410740e9d506d4e72d3e2900d6277816e

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
3KB

MD5
1b7ddad45b1c59e9bad071efd708e8fa

SHA1
f70235cc93da118e615790d64b67140c2a493a2d

SHA256
51d31dc92c0c723b0de6d8a54942ea3af3144dc7c4b42d024c477876fc0f5597

SHA512
1d9dc5d3845fe2409049d74d04c50a5152514452855ded2d71c48fe896452eb3f8abfb702bcc445b98075365e3f0e2c52858ec5377f255cbfed3c9fbe6674179

Download Submit
C:\note.txt

Filesize
218B

MD5
afa6955439b8d516721231029fb9ca1b

SHA1
087a043cc123c0c0df2ffadcf8e71e3ac86bbae9

SHA256
8e9f20f6864c66576536c0b866c6ffdcf11397db67fe120e972e244c3c022270

SHA512
5da21a31fbc4e8250dffed30f66b896bdf007ac91948140334fe36a3f010e1bac3e70a07e9f3eb9da8633189091fd5cadcabbaacd3e01da0fe7ae28a11b3dddf

Download Submit