asyncrat | 891ee274ce0525c01243687a78287d091b0cd442dc0334735c79c45c3204845c

Analysis

max time kernel
1049s
max time network
1050s
platform
windows11-21h2_x64
resource
win11-20240221-en
resource tags

arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system
submitted
17-03-2024 20:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Infected.exe
Size

63KB
MD5

0ec2079a55830a7847e3a58d8ea463b1
SHA1

4a1c085aa29b4399195ac20f6290e8f1a3ebf6f4
SHA256

891ee274ce0525c01243687a78287d091b0cd442dc0334735c79c45c3204845c
SHA512

0e7a6d9cba3c71f98c8cc0df8b8b867d6ba0dcfed0c13b3b85117669dcb2d81cdbdc4b40fae3f703cab026ba9d8a7b3c7d5b7c310e42195c03c22d62e4d4fd01
SSDEEP

768:Cm0vnfEXf78awC8A+XU2azcBRL5JTk1+T4KSBGHmDbD/ph0oXXsEYdSusdpqKYhg:qEXiLdSJYUbdh91YMusdpqKmY7

Score

10^/10

asyncrat wannacry default discovery persistence ransomware rat spyware stealer worm

Malware Config

Extracted

Family

asyncrat

Botnet

Default

asked-inexpensive.gl.at.ply.gg:33624

Mutex

4HomQU0Η斯WUx艾ωJת

Attributes

delay
1
install
false
install_folder
%AppData%

aes.plain

Extracted

Path

C:\Users\Admin\Downloads\@[email protected]

Family

wannacry

Ransom Note

Q: What's wrong with my files? A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted. If you follow our instructions, we guarantee that you can decrypt all your files quickly and safely! Let's start decrypting! Q: What do I do? A: First, you need to pay service fees for the decryption. Please send $300 worth of bitcoin to this bitcoin address: 115p7UMMngoj1pMvkpHijcRdfJNXj6LrLn Next, please find an application file named "@[email protected]". It is the decrypt software. Run and follow the instructions! (You may need to disable your antivirus for a while.) Q: How can I trust? A: Don't worry about decryption. We will decrypt your files surely because nobody will trust us if we cheat users. * If you need our assistance, send a message by clicking <Contact Us> on the decryptor window. �

Wallets

115p7UMMngoj1pMvkpHijcRdfJNXj6LrLn

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat
Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1070.004

Inhibit System Recovery
T1490
Downloads MZ/PE file

Drops startup file 2 IoCs

Processes:

WannaCry.EXE

description	ioc	process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\~SD6BAC.tmp	WannaCry.EXE
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\~SD6BB3.tmp	WannaCry.EXE

Executes dropped EXE 21 IoCs

Processes:

SmileyBot.exeSmileyBot.exeSmileyBot.exeWannaCry.EXEtaskdl.exe@[email protected]@[email protected]taskhsvc.exe@[email protected]taskdl.exetaskse.exe@[email protected]taskdl.exetaskse.exe@[email protected]taskdl.exetaskse.exe@[email protected]taskse.exe@[email protected]taskdl.exe

pid	process
4168	SmileyBot.exe
3284	SmileyBot.exe
2208	SmileyBot.exe
15972	WannaCry.EXE
15500	taskdl.exe
3112	@[email protected]
15896	@[email protected]
12032	taskhsvc.exe
10068	@[email protected]
13596	taskdl.exe
9252	taskse.exe
11012	@[email protected]
6548	taskdl.exe
16364	taskse.exe
12724	@[email protected]
16276	taskdl.exe
6604	taskse.exe
5788	@[email protected]
1720	taskse.exe
8424	@[email protected]
5828	taskdl.exe

Loads dropped DLL 7 IoCs

Processes:

taskhsvc.exe

pid process

12032 taskhsvc.exe
12032 taskhsvc.exe
12032 taskhsvc.exe
12032 taskhsvc.exe
12032 taskhsvc.exe
12032 taskhsvc.exe
12032 taskhsvc.exe
Modifies file permissions 1 TTPs 1 IoCs
discovery

File and Directory Permissions Modification
T1222

Processes:

icacls.exe

pid process

6964 icacls.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

pid	process
12032	taskhsvc.exe
12032	taskhsvc.exe
12032	taskhsvc.exe
12032	taskhsvc.exe
12032	taskhsvc.exe
12032	taskhsvc.exe
12032	taskhsvc.exe

pid	process
6964	icacls.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

reg.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\mhvdvdzzqm115 = "\"C:\\Users\\Admin\\Downloads\\tasksche.exe\""	reg.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service
T1102

Processes:

flow ioc

59 raw.githubusercontent.com
74 raw.githubusercontent.com
76 camo.githubusercontent.com

flow	ioc
59	raw.githubusercontent.com
74	raw.githubusercontent.com
76	camo.githubusercontent.com

Sets desktop wallpaper using registry 2 TTPs 2 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

Processes:

WannaCry.EXE@[email protected]

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-4280069375-290121026-380765049-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Desktop\\@[email protected]"	WannaCry.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-4280069375-290121026-380765049-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Desktop\\@[email protected]"	@[email protected]

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 2 IoCs

Processes:

msedge.exemsedge.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-4280069375-290121026-380765049-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4280069375-290121026-380765049-1000\{7055A198-39E1-4560-A3F9-8BD31CE04D3A}	msedge.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry
T1112

Processes:

reg.exe

pid process

13940 reg.exe

pid	process
13940	reg.exe

NTFS ADS 9 IoCs

Processes:

msedge.exemsedge.exemsedge.exemsedge.exemsedge.exemsedge.exemsedge.exe

description	ioc	process
File opened for modification	C:\Users\Admin\Downloads\WannaCry.EXE:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\VirusShare_af34546979079042a99b99b5613ad26b.zip:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 109729.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\SmileyBot.exe:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 182481.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\WannaCry2.exe:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\smb-0e89k3id.zip:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\smb-ij2n4cyd.zip:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 586328.crdownload:SmartScreen	msedge.exe

Runs net.exe
Suspicious behavior: AddClipboardFormatListener 2 IoCs

Processes:

vlc.exevlc.exe

pid process

4976 vlc.exe
12216 vlc.exe

Suspicious behavior: EnumeratesProcesses 32 IoCs

Processes:

msedge.exemsedge.exemsedge.exeidentity_helper.exemsedge.exemsedge.exemsedge.exemsedge.exemsedge.exemsedge.exemsedge.exemsedge.exetaskhsvc.exe

pid	process
3476	msedge.exe
3476	msedge.exe
3620	msedge.exe
3620	msedge.exe
1776	msedge.exe
1776	msedge.exe
3760	identity_helper.exe
3760	identity_helper.exe
5048	msedge.exe
5048	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2060	msedge.exe
2060	msedge.exe
12104	msedge.exe
12104	msedge.exe
8528	msedge.exe
8528	msedge.exe
7640	msedge.exe
7640	msedge.exe
2728	msedge.exe
2728	msedge.exe
13432	msedge.exe
13432	msedge.exe
12032	taskhsvc.exe
12032	taskhsvc.exe
12032	taskhsvc.exe
12032	taskhsvc.exe
12032	taskhsvc.exe
12032	taskhsvc.exe

Suspicious behavior: GetForegroundWindowSpam 4 IoCs

Processes:

cmd.exevlc.exe@[email protected]vlc.exe

pid process

3752 cmd.exe
4976 vlc.exe
10068 @[email protected]
12216 vlc.exe

pid	process
3752	cmd.exe
4976	vlc.exe
10068	@[email protected]
12216	vlc.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 64 IoCs

Processes:

msedge.exe

pid	process
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe

Suspicious use of AdjustPrivilegeToken 54 IoCs

Processes:

Infected.exeWMIC.exevssvc.exetaskse.exetaskse.exetaskse.exetaskse.exe

description	pid	process
Token: SeDebugPrivilege	2844	Infected.exe
Token: SeIncreaseQuotaPrivilege	10356	WMIC.exe
Token: SeSecurityPrivilege	10356	WMIC.exe
Token: SeTakeOwnershipPrivilege	10356	WMIC.exe
Token: SeLoadDriverPrivilege	10356	WMIC.exe
Token: SeSystemProfilePrivilege	10356	WMIC.exe
Token: SeSystemtimePrivilege	10356	WMIC.exe
Token: SeProfSingleProcessPrivilege	10356	WMIC.exe
Token: SeIncBasePriorityPrivilege	10356	WMIC.exe
Token: SeCreatePagefilePrivilege	10356	WMIC.exe
Token: SeBackupPrivilege	10356	WMIC.exe
Token: SeRestorePrivilege	10356	WMIC.exe
Token: SeShutdownPrivilege	10356	WMIC.exe
Token: SeDebugPrivilege	10356	WMIC.exe
Token: SeSystemEnvironmentPrivilege	10356	WMIC.exe
Token: SeRemoteShutdownPrivilege	10356	WMIC.exe
Token: SeUndockPrivilege	10356	WMIC.exe
Token: SeManageVolumePrivilege	10356	WMIC.exe
Token: 33	10356	WMIC.exe
Token: 34	10356	WMIC.exe
Token: 35	10356	WMIC.exe
Token: 36	10356	WMIC.exe
Token: SeIncreaseQuotaPrivilege	10356	WMIC.exe
Token: SeSecurityPrivilege	10356	WMIC.exe
Token: SeTakeOwnershipPrivilege	10356	WMIC.exe
Token: SeLoadDriverPrivilege	10356	WMIC.exe
Token: SeSystemProfilePrivilege	10356	WMIC.exe
Token: SeSystemtimePrivilege	10356	WMIC.exe
Token: SeProfSingleProcessPrivilege	10356	WMIC.exe
Token: SeIncBasePriorityPrivilege	10356	WMIC.exe
Token: SeCreatePagefilePrivilege	10356	WMIC.exe
Token: SeBackupPrivilege	10356	WMIC.exe
Token: SeRestorePrivilege	10356	WMIC.exe
Token: SeShutdownPrivilege	10356	WMIC.exe
Token: SeDebugPrivilege	10356	WMIC.exe
Token: SeSystemEnvironmentPrivilege	10356	WMIC.exe
Token: SeRemoteShutdownPrivilege	10356	WMIC.exe
Token: SeUndockPrivilege	10356	WMIC.exe
Token: SeManageVolumePrivilege	10356	WMIC.exe
Token: 33	10356	WMIC.exe
Token: 34	10356	WMIC.exe
Token: 35	10356	WMIC.exe
Token: 36	10356	WMIC.exe
Token: SeBackupPrivilege	10932	vssvc.exe
Token: SeRestorePrivilege	10932	vssvc.exe
Token: SeAuditPrivilege	10932	vssvc.exe
Token: SeTcbPrivilege	9252	taskse.exe
Token: SeTcbPrivilege	9252	taskse.exe
Token: SeTcbPrivilege	16364	taskse.exe
Token: SeTcbPrivilege	16364	taskse.exe
Token: SeTcbPrivilege	6604	taskse.exe
Token: SeTcbPrivilege	6604	taskse.exe
Token: SeTcbPrivilege	1720	taskse.exe
Token: SeTcbPrivilege	1720	taskse.exe

Suspicious use of FindShellTrayWindow 64 IoCs

Processes:

msedge.exe

pid	process
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe

Suspicious use of SendNotifyMessage 31 IoCs

Processes:

msedge.exevlc.exevlc.exe

pid	process
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
4976	vlc.exe
4976	vlc.exe
4976	vlc.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
12216	vlc.exe
12216	vlc.exe
12216	vlc.exe
12216	vlc.exe
12216	vlc.exe
12216	vlc.exe
12216	vlc.exe
12216	vlc.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe

Suspicious use of SetWindowsHookEx 12 IoCs

Processes:

vlc.exe@[email protected]@[email protected]@[email protected]@[email protected]@[email protected]vlc.exe@[email protected]@[email protected]

pid	process
4976	vlc.exe
3112	@[email protected]
3112	@[email protected]
15896	@[email protected]
15896	@[email protected]
10068	@[email protected]
10068	@[email protected]
11012	@[email protected]
12724	@[email protected]
12216	vlc.exe
5788	@[email protected]
8424	@[email protected]

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 3620 wrote to memory of 1540	3620	msedge.exe	msedge.exe
PID 3620 wrote to memory of 1540	3620	msedge.exe	msedge.exe
PID 3620 wrote to memory of 2344	3620	msedge.exe	msedge.exe
PID 3620 wrote to memory of 2344	3620	msedge.exe	msedge.exe
PID 3620 wrote to memory of 2344	3620	msedge.exe	msedge.exe
PID 3620 wrote to memory of 2344	3620	msedge.exe	msedge.exe
PID 3620 wrote to memory of 2344	3620	msedge.exe	msedge.exe
PID 3620 wrote to memory of 2344	3620	msedge.exe	msedge.exe
PID 3620 wrote to memory of 2344	3620	msedge.exe	msedge.exe
PID 3620 wrote to memory of 2344	3620	msedge.exe	msedge.exe
PID 3620 wrote to memory of 2344	3620	msedge.exe	msedge.exe
PID 3620 wrote to memory of 2344	3620	msedge.exe	msedge.exe
PID 3620 wrote to memory of 2344	3620	msedge.exe	msedge.exe
PID 3620 wrote to memory of 2344	3620	msedge.exe	msedge.exe
PID 3620 wrote to memory of 2344	3620	msedge.exe	msedge.exe
PID 3620 wrote to memory of 2344	3620	msedge.exe	msedge.exe
PID 3620 wrote to memory of 2344	3620	msedge.exe	msedge.exe
PID 3620 wrote to memory of 2344	3620	msedge.exe	msedge.exe
PID 3620 wrote to memory of 2344	3620	msedge.exe	msedge.exe
PID 3620 wrote to memory of 2344	3620	msedge.exe	msedge.exe
PID 3620 wrote to memory of 2344	3620	msedge.exe	msedge.exe
PID 3620 wrote to memory of 2344	3620	msedge.exe	msedge.exe
PID 3620 wrote to memory of 2344	3620	msedge.exe	msedge.exe
PID 3620 wrote to memory of 2344	3620	msedge.exe	msedge.exe
PID 3620 wrote to memory of 2344	3620	msedge.exe	msedge.exe
PID 3620 wrote to memory of 2344	3620	msedge.exe	msedge.exe
PID 3620 wrote to memory of 2344	3620	msedge.exe	msedge.exe
PID 3620 wrote to memory of 2344	3620	msedge.exe	msedge.exe
PID 3620 wrote to memory of 2344	3620	msedge.exe	msedge.exe
PID 3620 wrote to memory of 2344	3620	msedge.exe	msedge.exe
PID 3620 wrote to memory of 2344	3620	msedge.exe	msedge.exe
PID 3620 wrote to memory of 2344	3620	msedge.exe	msedge.exe
PID 3620 wrote to memory of 2344	3620	msedge.exe	msedge.exe
PID 3620 wrote to memory of 2344	3620	msedge.exe	msedge.exe
PID 3620 wrote to memory of 2344	3620	msedge.exe	msedge.exe
PID 3620 wrote to memory of 2344	3620	msedge.exe	msedge.exe
PID 3620 wrote to memory of 2344	3620	msedge.exe	msedge.exe
PID 3620 wrote to memory of 2344	3620	msedge.exe	msedge.exe
PID 3620 wrote to memory of 2344	3620	msedge.exe	msedge.exe
PID 3620 wrote to memory of 2344	3620	msedge.exe	msedge.exe
PID 3620 wrote to memory of 2344	3620	msedge.exe	msedge.exe
PID 3620 wrote to memory of 2344	3620	msedge.exe	msedge.exe
PID 3620 wrote to memory of 3476	3620	msedge.exe	msedge.exe
PID 3620 wrote to memory of 3476	3620	msedge.exe	msedge.exe
PID 3620 wrote to memory of 2148	3620	msedge.exe	msedge.exe
PID 3620 wrote to memory of 2148	3620	msedge.exe	msedge.exe
PID 3620 wrote to memory of 2148	3620	msedge.exe	msedge.exe
PID 3620 wrote to memory of 2148	3620	msedge.exe	msedge.exe
PID 3620 wrote to memory of 2148	3620	msedge.exe	msedge.exe
PID 3620 wrote to memory of 2148	3620	msedge.exe	msedge.exe
PID 3620 wrote to memory of 2148	3620	msedge.exe	msedge.exe
PID 3620 wrote to memory of 2148	3620	msedge.exe	msedge.exe
PID 3620 wrote to memory of 2148	3620	msedge.exe	msedge.exe
PID 3620 wrote to memory of 2148	3620	msedge.exe	msedge.exe
PID 3620 wrote to memory of 2148	3620	msedge.exe	msedge.exe
PID 3620 wrote to memory of 2148	3620	msedge.exe	msedge.exe
PID 3620 wrote to memory of 2148	3620	msedge.exe	msedge.exe
PID 3620 wrote to memory of 2148	3620	msedge.exe	msedge.exe
PID 3620 wrote to memory of 2148	3620	msedge.exe	msedge.exe
PID 3620 wrote to memory of 2148	3620	msedge.exe	msedge.exe
PID 3620 wrote to memory of 2148	3620	msedge.exe	msedge.exe
PID 3620 wrote to memory of 2148	3620	msedge.exe	msedge.exe
PID 3620 wrote to memory of 2148	3620	msedge.exe	msedge.exe
PID 3620 wrote to memory of 2148	3620	msedge.exe	msedge.exe

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Views/modifies file attributes 1 TTPs 2 IoCs
evasion

Hidden Files and Directories
T1564.001

Processes:

attrib.exeattrib.exe

pid process

6952 attrib.exe
12428 attrib.exe

pid	process
6952	attrib.exe
12428	attrib.exe

C:\Users\Admin\AppData\Local\Temp\Infected.exe
"C:\Users\Admin\AppData\Local\Temp\Infected.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2844

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
- Modifies registry class
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3620

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x104,0x108,0x10c,0x100,0x110,0x7ffbbd983cb8,0x7ffbbd983cc8,0x7ffbbd983cd8
2⤵
PID:1540

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1892,3715708669793074896,4637793484009536609,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1920 /prefetch:2
2⤵
PID:2344

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1892,3715708669793074896,4637793484009536609,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2300 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3476

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1892,3715708669793074896,4637793484009536609,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2552 /prefetch:8
2⤵
PID:2148

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,3715708669793074896,4637793484009536609,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
2⤵
PID:2744

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,3715708669793074896,4637793484009536609,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
2⤵
PID:4948

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,3715708669793074896,4637793484009536609,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4932 /prefetch:1
2⤵
PID:3904

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,3715708669793074896,4637793484009536609,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4960 /prefetch:1
2⤵
PID:3396

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1892,3715708669793074896,4637793484009536609,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4820 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1776

C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1892,3715708669793074896,4637793484009536609,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5284 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3760

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,3715708669793074896,4637793484009536609,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4660 /prefetch:1
2⤵
PID:3448

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,3715708669793074896,4637793484009536609,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5520 /prefetch:1
2⤵
PID:3764

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1892,3715708669793074896,4637793484009536609,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4904 /prefetch:8
2⤵
PID:4916

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=1892,3715708669793074896,4637793484009536609,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5092 /prefetch:8
2⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:5048

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,3715708669793074896,4637793484009536609,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3884 /prefetch:1
2⤵
PID:4368

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,3715708669793074896,4637793484009536609,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5748 /prefetch:1
2⤵
PID:5068

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,3715708669793074896,4637793484009536609,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5468 /prefetch:1
2⤵
PID:3532

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,3715708669793074896,4637793484009536609,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5688 /prefetch:1
2⤵
PID:4624

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,3715708669793074896,4637793484009536609,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5996 /prefetch:1
2⤵
PID:2684

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,3715708669793074896,4637793484009536609,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5896 /prefetch:1
2⤵
PID:1768

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,3715708669793074896,4637793484009536609,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5960 /prefetch:1
2⤵
PID:4396

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,3715708669793074896,4637793484009536609,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6200 /prefetch:1
2⤵
PID:3292

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,3715708669793074896,4637793484009536609,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6192 /prefetch:1
2⤵
PID:4876

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,3715708669793074896,4637793484009536609,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5852 /prefetch:1
2⤵
PID:2668

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,3715708669793074896,4637793484009536609,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5976 /prefetch:1
2⤵
PID:3616

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,3715708669793074896,4637793484009536609,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3508 /prefetch:1
2⤵
PID:4732

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,3715708669793074896,4637793484009536609,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4816 /prefetch:1
2⤵
PID:3532

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,3715708669793074896,4637793484009536609,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6188 /prefetch:1
2⤵
PID:964

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,3715708669793074896,4637793484009536609,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6696 /prefetch:1
2⤵
PID:2668

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,3715708669793074896,4637793484009536609,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6848 /prefetch:1
2⤵
PID:2032

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1892,3715708669793074896,4637793484009536609,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=4728 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2856

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1892,3715708669793074896,4637793484009536609,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6888 /prefetch:8
2⤵
PID:3944

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,3715708669793074896,4637793484009536609,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5544 /prefetch:1
2⤵
PID:608

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1892,3715708669793074896,4637793484009536609,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=7060 /prefetch:8
2⤵
PID:5112

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1892,3715708669793074896,4637793484009536609,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=7188 /prefetch:8
2⤵
PID:2256

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1892,3715708669793074896,4637793484009536609,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7020 /prefetch:8
2⤵
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
PID:2060

C:\Users\Admin\Downloads\SmileyBot.exe
"C:\Users\Admin\Downloads\SmileyBot.exe"
2⤵
- Executes dropped EXE
PID:4168

C:\Windows\system32\cmd.exe
"C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\BA1A.tmp\BA1B.tmp\BA1C.bat C:\Users\Admin\Downloads\SmileyBot.exe"
3⤵
PID:3372

C:\Users\Admin\Downloads\SmileyBot.exe
"C:\Users\Admin\Downloads\SmileyBot.exe"
2⤵
- Executes dropped EXE
PID:3284

C:\Windows\system32\cmd.exe
"C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\1653.tmp\1654.tmp\1655.bat C:\Users\Admin\Downloads\SmileyBot.exe"
3⤵
PID:2212

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,3715708669793074896,4637793484009536609,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3472 /prefetch:1
2⤵
PID:1204

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,3715708669793074896,4637793484009536609,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7432 /prefetch:1
2⤵
PID:880

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,3715708669793074896,4637793484009536609,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2160 /prefetch:1
2⤵
PID:3868

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,3715708669793074896,4637793484009536609,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7184 /prefetch:1
2⤵
PID:4340

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,3715708669793074896,4637793484009536609,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7948 /prefetch:1
2⤵
PID:3888

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,3715708669793074896,4637793484009536609,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8160 /prefetch:1
2⤵
PID:2192

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,3715708669793074896,4637793484009536609,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8356 /prefetch:1
2⤵
PID:4808

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,3715708669793074896,4637793484009536609,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8568 /prefetch:1
2⤵
PID:5172

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,3715708669793074896,4637793484009536609,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8784 /prefetch:1
2⤵
PID:5348

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,3715708669793074896,4637793484009536609,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8992 /prefetch:1
2⤵
PID:5520

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,3715708669793074896,4637793484009536609,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9196 /prefetch:1
2⤵
PID:5708

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,3715708669793074896,4637793484009536609,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9156 /prefetch:1
2⤵
PID:5880

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,3715708669793074896,4637793484009536609,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9572 /prefetch:1
2⤵
PID:6048

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,3715708669793074896,4637793484009536609,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9612 /prefetch:1
2⤵
PID:5320

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,3715708669793074896,4637793484009536609,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9936 /prefetch:1
2⤵
PID:5672

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,3715708669793074896,4637793484009536609,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=55 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10176 /prefetch:1
2⤵
PID:5340

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,3715708669793074896,4637793484009536609,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=56 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10348 /prefetch:1
2⤵
PID:6208

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,3715708669793074896,4637793484009536609,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=57 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7752 /prefetch:1
2⤵
PID:6388

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,3715708669793074896,4637793484009536609,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=58 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7956 /prefetch:1
2⤵
PID:6560

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,3715708669793074896,4637793484009536609,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=59 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10904 /prefetch:1
2⤵
PID:6728

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,3715708669793074896,4637793484009536609,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=60 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=11088 /prefetch:1
2⤵
PID:6900

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,3715708669793074896,4637793484009536609,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=61 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=11100 /prefetch:1
2⤵
PID:7080

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,3715708669793074896,4637793484009536609,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=62 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=11396 /prefetch:1
2⤵
PID:6304

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,3715708669793074896,4637793484009536609,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=63 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8792 /prefetch:1
2⤵
PID:7040

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,3715708669793074896,4637793484009536609,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=64 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=11968 /prefetch:1
2⤵
PID:7228

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,3715708669793074896,4637793484009536609,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=65 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=12264 /prefetch:1
2⤵
PID:7432

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,3715708669793074896,4637793484009536609,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=66 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9896 /prefetch:1
2⤵
PID:7612

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,3715708669793074896,4637793484009536609,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=67 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=12488 /prefetch:1
2⤵
PID:7780

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,3715708669793074896,4637793484009536609,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=68 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6688 /prefetch:1
2⤵
PID:7964

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,3715708669793074896,4637793484009536609,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=69 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=12884 /prefetch:1
2⤵
PID:8124

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,3715708669793074896,4637793484009536609,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=70 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=11692 /prefetch:1
2⤵
PID:7344

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,3715708669793074896,4637793484009536609,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=71 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=13168 /prefetch:1
2⤵
PID:8068

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,3715708669793074896,4637793484009536609,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=72 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10900 /prefetch:1
2⤵
PID:8224

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,3715708669793074896,4637793484009536609,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=73 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=13344 /prefetch:1
2⤵
PID:8408

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,3715708669793074896,4637793484009536609,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=74 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=11408 /prefetch:1
2⤵
PID:8584

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,3715708669793074896,4637793484009536609,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=75 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=13896 /prefetch:1
2⤵
PID:8756

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,3715708669793074896,4637793484009536609,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=76 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=14156 /prefetch:1
2⤵
PID:8944

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,3715708669793074896,4637793484009536609,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=77 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=14260 /prefetch:1
2⤵
PID:9112

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,3715708669793074896,4637793484009536609,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=78 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=14468 /prefetch:1
2⤵
PID:8376

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,3715708669793074896,4637793484009536609,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=79 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=13172 /prefetch:1
2⤵
PID:8876

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,3715708669793074896,4637793484009536609,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=80 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=14876 /prefetch:1
2⤵
PID:8508

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,3715708669793074896,4637793484009536609,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=81 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=11156 /prefetch:1
2⤵
PID:9328

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,3715708669793074896,4637793484009536609,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=83 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=17260 /prefetch:1
2⤵
PID:16120

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,3715708669793074896,4637793484009536609,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=85 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7092 /prefetch:1
2⤵
PID:9608

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1892,3715708669793074896,4637793484009536609,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=16916 /prefetch:8
2⤵
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
PID:12104

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,3715708669793074896,4637793484009536609,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=88 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2228 /prefetch:1
2⤵
PID:8964

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,3715708669793074896,4637793484009536609,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=90 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=16736 /prefetch:1
2⤵
PID:3516

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,3715708669793074896,4637793484009536609,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=92 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=16268 /prefetch:1
2⤵
PID:16232

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1892,3715708669793074896,4637793484009536609,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=17800 /prefetch:8
2⤵
PID:11452

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1892,3715708669793074896,4637793484009536609,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=17400 /prefetch:8
2⤵
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
PID:8528

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,3715708669793074896,4637793484009536609,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=96 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=16916 /prefetch:1
2⤵
PID:11452

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,3715708669793074896,4637793484009536609,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=95 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5504 /prefetch:1
2⤵
PID:16020

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,3715708669793074896,4637793484009536609,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=97 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4780 /prefetch:1
2⤵
PID:16272

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,3715708669793074896,4637793484009536609,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=98 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=11404 /prefetch:1
2⤵
PID:8980

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,3715708669793074896,4637793484009536609,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=100 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7064 /prefetch:1
2⤵
PID:10196

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1892,3715708669793074896,4637793484009536609,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=9192 /prefetch:8
2⤵
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
PID:7640

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,3715708669793074896,4637793484009536609,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=103 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1812 /prefetch:1
2⤵
PID:5656

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1892,3715708669793074896,4637793484009536609,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6116 /prefetch:8
2⤵
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
PID:2728

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,3715708669793074896,4637793484009536609,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=105 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=15504 /prefetch:1
2⤵
PID:4488

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,3715708669793074896,4637793484009536609,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=106 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7868 /prefetch:1
2⤵
PID:8352

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,3715708669793074896,4637793484009536609,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=107 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8300 /prefetch:1
2⤵
PID:15788

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,3715708669793074896,4637793484009536609,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=109 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=11052 /prefetch:1
2⤵
PID:15796

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1892,3715708669793074896,4637793484009536609,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=10364 /prefetch:8
2⤵
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
PID:13432

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1892,3715708669793074896,4637793484009536609,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=15524 /prefetch:8
2⤵
PID:9696

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4752

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1796

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3508

C:\Users\Admin\Downloads\SmileyBot.exe
"C:\Users\Admin\Downloads\SmileyBot.exe"
1⤵
- Executes dropped EXE
PID:2208

C:\Windows\system32\cmd.exe
"C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\41F7.tmp\41F8.tmp\41F9.bat C:\Users\Admin\Downloads\SmileyBot.exe"
2⤵
- Suspicious behavior: GetForegroundWindowSpam
PID:3752

C:\Windows\system32\net.exe
Net user 32463 /add
3⤵
PID:3608

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user 32463 /add
4⤵
PID:2024

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://speed.hetzner.de/100MB.bin
3⤵
PID:4900

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffbbd983cb8,0x7ffbbd983cc8,0x7ffbbd983cd8
4⤵
PID:3148

C:\Windows\system32\net.exe
Net user 15233 /add
3⤵
PID:3784

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user 15233 /add
4⤵
PID:4108

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://speed.hetzner.de/100MB.bin
3⤵
PID:4732

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xe4,0x10c,0x7ffbbd983cb8,0x7ffbbd983cc8,0x7ffbbd983cd8
4⤵
PID:564

C:\Windows\system32\net.exe
Net user 11758 /add
3⤵
PID:3428

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user 11758 /add
4⤵
PID:3128

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://speed.hetzner.de/100MB.bin
3⤵
PID:3524

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x10c,0x110,0x114,0xdc,0x118,0x7ffbbd983cb8,0x7ffbbd983cc8,0x7ffbbd983cd8
4⤵
PID:744

C:\Windows\system32\net.exe
Net user 25229 /add
3⤵
PID:1532

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user 25229 /add
4⤵
PID:3756

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://speed.hetzner.de/100MB.bin
3⤵
PID:3508

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffbbd983cb8,0x7ffbbd983cc8,0x7ffbbd983cd8
4⤵
PID:2952

C:\Windows\system32\net.exe
Net user 20647 /add
3⤵
PID:1400

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user 20647 /add
4⤵
PID:4688

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://speed.hetzner.de/100MB.bin
3⤵
PID:436

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffbbd983cb8,0x7ffbbd983cc8,0x7ffbbd983cd8
4⤵
PID:2824

C:\Windows\system32\net.exe
Net user 4963 /add
3⤵
PID:1488

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user 4963 /add
4⤵
PID:2728

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://speed.hetzner.de/100MB.bin
3⤵
PID:4388

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffbbd983cb8,0x7ffbbd983cc8,0x7ffbbd983cd8
4⤵
PID:1924

C:\Windows\system32\net.exe
Net user 20802 /add
3⤵
PID:3900

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user 20802 /add
4⤵
PID:4108

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://speed.hetzner.de/100MB.bin
3⤵
PID:2052

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x108,0x10c,0x110,0xe4,0x114,0x7ffbbd983cb8,0x7ffbbd983cc8,0x7ffbbd983cd8
4⤵
PID:328

C:\Windows\system32\net.exe
Net user 15837 /add
3⤵
PID:3512

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user 15837 /add
4⤵
PID:4796

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://speed.hetzner.de/100MB.bin
3⤵
PID:3440

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0x7c,0x10c,0x7ffbbd983cb8,0x7ffbbd983cc8,0x7ffbbd983cd8
4⤵
PID:1488

C:\Windows\system32\net.exe
Net user 7194 /add
3⤵
PID:2728

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user 7194 /add
4⤵
PID:5148

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://speed.hetzner.de/100MB.bin
3⤵
PID:5252

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffbbd983cb8,0x7ffbbd983cc8,0x7ffbbd983cd8
4⤵
PID:5268

C:\Windows\system32\net.exe
Net user 4391 /add
3⤵
PID:5280

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user 4391 /add
4⤵
PID:5324

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://speed.hetzner.de/100MB.bin
3⤵
PID:5368

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x108,0x10c,0x110,0xe4,0x114,0x7ffbbd983cb8,0x7ffbbd983cc8,0x7ffbbd983cd8
4⤵
PID:5440

C:\Windows\system32\net.exe
Net user 20194 /add
3⤵
PID:5448

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user 20194 /add
4⤵
PID:5496

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://speed.hetzner.de/100MB.bin
3⤵
PID:5600

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x80,0x84,0xe8,0x7c,0x10c,0x7ffbbd983cb8,0x7ffbbd983cc8,0x7ffbbd983cd8
4⤵
PID:5616

C:\Windows\system32\net.exe
Net user 6783 /add
3⤵
PID:5628

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user 6783 /add
4⤵
PID:5676

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://speed.hetzner.de/100MB.bin
3⤵
PID:5748

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x10c,0x110,0x114,0xe0,0x118,0x7ffbbd983cb8,0x7ffbbd983cc8,0x7ffbbd983cd8
4⤵
PID:5792

C:\Windows\system32\net.exe
Net user 22250 /add
3⤵
PID:5800

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user 22250 /add
4⤵
PID:5824

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://speed.hetzner.de/100MB.bin
3⤵
PID:5956

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffbbd983cb8,0x7ffbbd983cc8,0x7ffbbd983cd8
4⤵
PID:5968

C:\Windows\system32\net.exe
Net user 31445 /add
3⤵
PID:5976

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user 31445 /add
4⤵
PID:6024

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://speed.hetzner.de/100MB.bin
3⤵
PID:6128

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffbbd983cb8,0x7ffbbd983cc8,0x7ffbbd983cd8
4⤵
PID:5168

C:\Windows\system32\net.exe
Net user 7870 /add
3⤵
PID:6136

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user 7870 /add
4⤵
PID:4060

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://speed.hetzner.de/100MB.bin
3⤵
PID:5496

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffbbd983cb8,0x7ffbbd983cc8,0x7ffbbd983cd8
4⤵
PID:5604

C:\Windows\system32\net.exe
Net user 29305 /add
3⤵
PID:5668

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user 29305 /add
4⤵
PID:5660

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://speed.hetzner.de/100MB.bin
3⤵
PID:6040

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffbbd983cb8,0x7ffbbd983cc8,0x7ffbbd983cd8
4⤵
PID:5976

C:\Windows\system32\net.exe
Net user 11670 /add
3⤵
PID:5964

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user 11670 /add
4⤵
PID:6020

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://speed.hetzner.de/100MB.bin
3⤵
PID:6020

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffbbd983cb8,0x7ffbbd983cc8,0x7ffbbd983cd8
4⤵
PID:5960

C:\Windows\system32\net.exe
Net user 15167 /add
3⤵
PID:5980

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user 15167 /add
4⤵
PID:6160

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://speed.hetzner.de/100MB.bin
3⤵
PID:6292

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x10c,0x110,0x114,0xe8,0x118,0x7ffbbd983cb8,0x7ffbbd983cc8,0x7ffbbd983cd8
4⤵
PID:6312

C:\Windows\system32\net.exe
Net user 28530 /add
3⤵
PID:6300

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user 28530 /add
4⤵
PID:6336

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://speed.hetzner.de/100MB.bin
3⤵
PID:6464

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffbbd983cb8,0x7ffbbd983cc8,0x7ffbbd983cd8
4⤵
PID:6484

C:\Windows\system32\net.exe
Net user 11456 /add
3⤵
PID:6472

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user 11456 /add
4⤵
PID:6512

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://speed.hetzner.de/100MB.bin
3⤵
PID:6636

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x104,0x108,0x10c,0xe0,0x110,0x7ffbbd983cb8,0x7ffbbd983cc8,0x7ffbbd983cd8
4⤵
PID:6648

C:\Windows\system32\net.exe
Net user 21201 /add
3⤵
PID:6656

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user 21201 /add
4⤵
PID:6704

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://speed.hetzner.de/100MB.bin
3⤵
PID:6808

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffbbd983cb8,0x7ffbbd983cc8,0x7ffbbd983cd8
4⤵
PID:6828

C:\Windows\system32\net.exe
Net user 17311 /add
3⤵
PID:6820

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user 17311 /add
4⤵
PID:6876

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://speed.hetzner.de/100MB.bin
3⤵
PID:6984

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x10c,0x110,0x114,0xe8,0x118,0x7ffbbd983cb8,0x7ffbbd983cc8,0x7ffbbd983cd8
4⤵
PID:7012

C:\Windows\system32\net.exe
Net user 4451 /add
3⤵
PID:6996

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user 4451 /add
4⤵
PID:7024

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://speed.hetzner.de/100MB.bin
3⤵
PID:7100

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffbbd983cb8,0x7ffbbd983cc8,0x7ffbbd983cd8
4⤵
PID:7112

C:\Windows\system32\net.exe
Net user 11260 /add
3⤵
PID:7124

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user 11260 /add
4⤵
PID:6308

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://speed.hetzner.de/100MB.bin
3⤵
PID:6516

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffbbd983cb8,0x7ffbbd983cc8,0x7ffbbd983cd8
4⤵
PID:6724

C:\Windows\system32\net.exe
Net user 25394 /add
3⤵
PID:6572

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user 25394 /add
4⤵
PID:6884

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://speed.hetzner.de/100MB.bin
3⤵
PID:6296

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffbbd983cb8,0x7ffbbd983cc8,0x7ffbbd983cd8
4⤵
PID:7068

C:\Windows\system32\net.exe
Net user 12412 /add
3⤵
PID:7200

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user 12412 /add
4⤵
PID:7308

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://speed.hetzner.de/100MB.bin
3⤵
PID:7332

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffbbd983cb8,0x7ffbbd983cc8,0x7ffbbd983cd8
4⤵
PID:7360

C:\Windows\system32\net.exe
Net user 6155 /add
3⤵
PID:7344

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user 6155 /add
4⤵
PID:7376

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://speed.hetzner.de/100MB.bin
3⤵
PID:7452

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0x80,0x10c,0x7ffbbd983cb8,0x7ffbbd983cc8,0x7ffbbd983cd8
4⤵
PID:7516

C:\Windows\system32\net.exe
Net user 14988 /add
3⤵
PID:7524

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user 14988 /add
4⤵
PID:7576

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://speed.hetzner.de/100MB.bin
3⤵
PID:7680

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffbbd983cb8,0x7ffbbd983cc8,0x7ffbbd983cd8
4⤵
PID:7720

C:\Windows\system32\net.exe
Net user 12589 /add
3⤵
PID:7688

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user 12589 /add
4⤵
PID:7712

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://speed.hetzner.de/100MB.bin
3⤵
PID:7860

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x104,0x108,0x10c,0xdc,0x110,0x7ffbbd983cb8,0x7ffbbd983cc8,0x7ffbbd983cd8
4⤵
PID:7872

C:\Windows\system32\net.exe
Net user 13773 /add
3⤵
PID:7880

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user 13773 /add
4⤵
PID:7912

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://speed.hetzner.de/100MB.bin
3⤵
PID:8032

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffbbd983cb8,0x7ffbbd983cc8,0x7ffbbd983cd8
4⤵
PID:8060

C:\Windows\system32\net.exe
Net user 9617 /add
3⤵
PID:8040

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user 9617 /add
4⤵
PID:8068

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://speed.hetzner.de/100MB.bin
3⤵
PID:8180

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffbbd983cb8,0x7ffbbd983cc8,0x7ffbbd983cd8
4⤵
PID:7312

C:\Windows\system32\net.exe
Net user 30666 /add
3⤵
PID:7308

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user 30666 /add
4⤵
PID:7412

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://speed.hetzner.de/100MB.bin
3⤵
PID:7708

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffbbd983cb8,0x7ffbbd983cc8,0x7ffbbd983cd8
4⤵
PID:7796

C:\Windows\system32\net.exe
Net user 3394 /add
3⤵
PID:7688

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user 3394 /add
4⤵
PID:7912

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://speed.hetzner.de/100MB.bin
3⤵
PID:3116

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffbbd983cb8,0x7ffbbd983cc8,0x7ffbbd983cd8
4⤵
PID:7772

C:\Windows\system32\net.exe
Net user 5729 /add
3⤵
PID:8112

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user 5729 /add
4⤵
PID:7704

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://speed.hetzner.de/100MB.bin
3⤵
PID:8312

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffbbd983cb8,0x7ffbbd983cc8,0x7ffbbd983cd8
4⤵
PID:8332

C:\Windows\system32\net.exe
Net user 5277 /add
3⤵
PID:8324

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user 5277 /add
4⤵
PID:8372

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://speed.hetzner.de/100MB.bin
3⤵
PID:8460

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x108,0x10c,0x110,0xe4,0x114,0x7ffbbd983cb8,0x7ffbbd983cc8,0x7ffbbd983cd8
4⤵
PID:8500

C:\Windows\system32\net.exe
Net user 10896 /add
3⤵
PID:8508

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user 10896 /add
4⤵
PID:8536

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://speed.hetzner.de/100MB.bin
3⤵
PID:8604

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x104,0x108,0x10c,0x100,0x110,0x7ffbbd983cb8,0x7ffbbd983cc8,0x7ffbbd983cd8
4⤵
PID:8676

C:\Windows\system32\net.exe
Net user 24180 /add
3⤵
PID:8684

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user 24180 /add
4⤵
PID:8732

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://speed.hetzner.de/100MB.bin
3⤵
PID:8840

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffbbd983cb8,0x7ffbbd983cc8,0x7ffbbd983cd8
4⤵
PID:8860

C:\Windows\system32\net.exe
Net user 10878 /add
3⤵
PID:8852

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user 10878 /add
4⤵
PID:8876

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://speed.hetzner.de/100MB.bin
3⤵
PID:9016

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffbbd983cb8,0x7ffbbd983cc8,0x7ffbbd983cd8
4⤵
PID:9028

C:\Windows\system32\net.exe
Net user 29802 /add
3⤵
PID:9036

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user 29802 /add
4⤵
PID:9060

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://speed.hetzner.de/100MB.bin
3⤵
PID:9136

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffbbd983cb8,0x7ffbbd983cc8,0x7ffbbd983cd8
4⤵
PID:9212

C:\Windows\system32\net.exe
Net user 7419 /add
3⤵
PID:9168

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user 7419 /add
4⤵
PID:8272

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://speed.hetzner.de/100MB.bin
3⤵
PID:8512

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffbbd983cb8,0x7ffbbd983cc8,0x7ffbbd983cd8
4⤵
PID:8744

C:\Windows\system32\net.exe
Net user 7933 /add
3⤵
PID:8508

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user 7933 /add
4⤵
PID:8580

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://speed.hetzner.de/100MB.bin
3⤵
PID:9036

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffbbd983cb8,0x7ffbbd983cc8,0x7ffbbd983cd8
4⤵
PID:9120

C:\Windows\system32\net.exe
Net user 14793 /add
3⤵
PID:8396

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user 14793 /add
4⤵
PID:8036

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://speed.hetzner.de/100MB.bin
3⤵
PID:8776

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x10c,0x110,0x114,0xdc,0x118,0x7ffbbd983cb8,0x7ffbbd983cc8,0x7ffbbd983cd8
4⤵
PID:9232

C:\Windows\system32\net.exe
Net user 2845 /add
3⤵
PID:9240

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user 2845 /add
4⤵
PID:9264

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://speed.hetzner.de/100MB.bin
3⤵
PID:9412

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x108,0x10c,0x110,0xe4,0x114,0x7ffbbd983cb8,0x7ffbbd983cc8,0x7ffbbd983cd8
4⤵
PID:9440

C:\Windows\system32\net.exe
Net user 25966 /add
3⤵
PID:9424

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user 25966 /add
4⤵
PID:9452

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://speed.hetzner.de/100MB.bin
3⤵
PID:9584

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x104,0x108,0x10c,0xdc,0x110,0x7ffbbd983cb8,0x7ffbbd983cc8,0x7ffbbd983cd8
4⤵
PID:9596

C:\Windows\system32\net.exe
Net user 4416 /add
3⤵
PID:9604

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user 4416 /add
4⤵
PID:9628

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://speed.hetzner.de/100MB.bin
3⤵
PID:9692

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffbbd983cb8,0x7ffbbd983cc8,0x7ffbbd983cd8
4⤵
PID:9716

C:\Windows\system32\net.exe
Net user 11365 /add
3⤵
PID:9700

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user 11365 /add
4⤵
PID:9740

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://speed.hetzner.de/100MB.bin
3⤵
PID:9804

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x104,0x108,0x10c,0xe0,0x110,0x7ffbbd983cb8,0x7ffbbd983cc8,0x7ffbbd983cd8
4⤵
PID:9828

C:\Windows\system32\net.exe
Net user 21077 /add
3⤵
PID:9816

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user 21077 /add
4⤵
PID:9852

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://speed.hetzner.de/100MB.bin
3⤵
PID:9920

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffbbd983cb8,0x7ffbbd983cc8,0x7ffbbd983cd8
4⤵
PID:9948

C:\Windows\system32\net.exe
Net user 16602 /add
3⤵
PID:9928

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user 16602 /add
4⤵
PID:9956

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://speed.hetzner.de/100MB.bin
3⤵
PID:10036

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffbbd983cb8,0x7ffbbd983cc8,0x7ffbbd983cd8
4⤵
PID:10076

C:\Windows\system32\net.exe
Net user 16639 /add
3⤵
PID:10044

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user 16639 /add
4⤵
PID:10068

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://speed.hetzner.de/100MB.bin
3⤵
PID:10148

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffbbd983cb8,0x7ffbbd983cc8,0x7ffbbd983cd8
4⤵
PID:10176

C:\Windows\system32\net.exe
Net user 22367 /add
3⤵
PID:10160

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user 22367 /add
4⤵
PID:10188

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://speed.hetzner.de/100MB.bin
3⤵
PID:9316

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffbbd983cb8,0x7ffbbd983cc8,0x7ffbbd983cd8
4⤵
PID:9256

C:\Windows\system32\net.exe
Net user 8707 /add
3⤵
PID:9296

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user 8707 /add
4⤵
PID:9496

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://speed.hetzner.de/100MB.bin
3⤵
PID:9604

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x104,0x108,0x10c,0x100,0x110,0x7ffbbd983cb8,0x7ffbbd983cc8,0x7ffbbd983cd8
4⤵
PID:9744

C:\Windows\system32\net.exe
Net user 25149 /add
3⤵
PID:9772

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user 25149 /add
4⤵
PID:9892

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://speed.hetzner.de/100MB.bin
3⤵
PID:9836

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffbbd983cb8,0x7ffbbd983cc8,0x7ffbbd983cd8
4⤵
PID:9968

C:\Windows\system32\net.exe
Net user 9422 /add
3⤵
PID:9980

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user 9422 /add
4⤵
PID:9936

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://speed.hetzner.de/100MB.bin
3⤵
PID:10064

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffbbd983cb8,0x7ffbbd983cc8,0x7ffbbd983cd8
4⤵
PID:10208

C:\Windows\system32\net.exe
Net user 26698 /add
3⤵
PID:10140

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user 26698 /add
4⤵
PID:9324

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://speed.hetzner.de/100MB.bin
3⤵
PID:9504

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffbbd983cb8,0x7ffbbd983cc8,0x7ffbbd983cd8
4⤵
PID:2984

C:\Windows\system32\net.exe
Net user 32124 /add
3⤵
PID:9296

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user 32124 /add
4⤵
PID:4240

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://speed.hetzner.de/100MB.bin
3⤵
PID:9660

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0x48,0x10c,0x7ffbbd983cb8,0x7ffbbd983cc8,0x7ffbbd983cd8
4⤵
PID:9776

C:\Windows\system32\net.exe
Net user 23401 /add
3⤵
PID:9812

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user 23401 /add
4⤵
PID:9964

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://speed.hetzner.de/100MB.bin
3⤵
PID:10016

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0x7c,0x10c,0x7ffbbd983cb8,0x7ffbbd983cc8,0x7ffbbd983cd8
4⤵
PID:10052

C:\Windows\system32\net.exe
Net user 29640 /add
3⤵
PID:9456

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user 29640 /add
4⤵
PID:10032

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://speed.hetzner.de/100MB.bin
3⤵
PID:9972

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x104,0x108,0x10c,0xe0,0x110,0x7ffbbd983cb8,0x7ffbbd983cc8,0x7ffbbd983cd8
4⤵
PID:10048

C:\Windows\system32\net.exe
Net user 13350 /add
3⤵
PID:9856

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user 13350 /add
4⤵
PID:9888

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://speed.hetzner.de/100MB.bin
3⤵
PID:9632

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffbbd983cb8,0x7ffbbd983cc8,0x7ffbbd983cd8
4⤵
PID:9508

C:\Windows\system32\net.exe
Net user 14028 /add
3⤵
PID:9456

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user 14028 /add
4⤵
PID:9608

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://speed.hetzner.de/100MB.bin
3⤵
PID:10304

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xac,0x10c,0x7ffbbd983cb8,0x7ffbbd983cc8,0x7ffbbd983cd8
4⤵
PID:10332

C:\Windows\system32\net.exe
Net user 775 /add
3⤵
PID:10312

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user 775 /add
4⤵
PID:10348

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://speed.hetzner.de/100MB.bin
3⤵
PID:10420

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffbbd983cb8,0x7ffbbd983cc8,0x7ffbbd983cd8
4⤵
PID:10444

C:\Windows\system32\net.exe
Net user 896 /add
3⤵
PID:10436

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user 896 /add
4⤵
PID:10476

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://speed.hetzner.de/100MB.bin
3⤵
PID:10536

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffbbd983cb8,0x7ffbbd983cc8,0x7ffbbd983cd8
4⤵
PID:10576

C:\Windows\system32\net.exe
Net user 28039 /add
3⤵
PID:10544

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user 28039 /add
4⤵
PID:10568

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://speed.hetzner.de/100MB.bin
3⤵
PID:10656

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffbbd983cb8,0x7ffbbd983cc8,0x7ffbbd983cd8
4⤵
PID:10680

C:\Windows\system32\net.exe
Net user 23629 /add
3⤵
PID:10664

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user 23629 /add
4⤵
PID:10692

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://speed.hetzner.de/100MB.bin
3⤵
PID:10768

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffbbd983cb8,0x7ffbbd983cc8,0x7ffbbd983cd8
4⤵
PID:10808

C:\Windows\system32\net.exe
Net user 31707 /add
3⤵
PID:10776

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user 31707 /add
4⤵
PID:10800

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://speed.hetzner.de/100MB.bin
3⤵
PID:10888

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffbbd983cb8,0x7ffbbd983cc8,0x7ffbbd983cd8
4⤵
PID:10912

C:\Windows\system32\net.exe
Net user 16955 /add
3⤵
PID:10900

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user 16955 /add
4⤵
PID:10936

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://speed.hetzner.de/100MB.bin
3⤵
PID:11008

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffbbd983cb8,0x7ffbbd983cc8,0x7ffbbd983cd8
4⤵
PID:11032

C:\Windows\system32\net.exe
Net user 1523 /add
3⤵
PID:11020

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user 1523 /add
4⤵
PID:11044

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://speed.hetzner.de/100MB.bin
3⤵
PID:11116

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffbbd983cb8,0x7ffbbd983cc8,0x7ffbbd983cd8
4⤵
PID:11144

C:\Windows\system32\net.exe
Net user 9337 /add
3⤵
PID:11132

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user 9337 /add
4⤵
PID:11160

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://speed.hetzner.de/100MB.bin
3⤵
PID:11232

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffbbd983cb8,0x7ffbbd983cc8,0x7ffbbd983cd8
4⤵
PID:10128

C:\Windows\system32\net.exe
Net user 16714 /add
3⤵
PID:11240

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user 16714 /add
4⤵
PID:9616

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://speed.hetzner.de/100MB.bin
3⤵
PID:10340

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffbbd983cb8,0x7ffbbd983cc8,0x7ffbbd983cd8
4⤵
PID:10300

C:\Windows\system32\net.exe
Net user 8540 /add
3⤵
PID:10392

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user 8540 /add
4⤵
PID:10480

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://speed.hetzner.de/100MB.bin
3⤵
PID:10632

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffbbd983cb8,0x7ffbbd983cc8,0x7ffbbd983cd8
4⤵
PID:10568

C:\Windows\system32\net.exe
Net user 16011 /add
3⤵
PID:10572

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user 16011 /add
4⤵
PID:10544

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://speed.hetzner.de/100MB.bin
3⤵
PID:10792

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffbbd983cb8,0x7ffbbd983cc8,0x7ffbbd983cd8
4⤵
PID:10784

C:\Windows\system32\net.exe
Net user 19453 /add
3⤵
PID:10860

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user 19453 /add
4⤵
PID:10892

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://speed.hetzner.de/100MB.bin
3⤵
PID:11096

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffbbd983cb8,0x7ffbbd983cc8,0x7ffbbd983cd8
4⤵
PID:10996

C:\Windows\system32\net.exe
Net user 23833 /add
3⤵
PID:11040

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user 23833 /add
4⤵
PID:11176

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://speed.hetzner.de/100MB.bin
3⤵
PID:10296

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffbbd983cb8,0x7ffbbd983cc8,0x7ffbbd983cd8
4⤵
PID:11248

C:\Windows\system32\net.exe
Net user 1055 /add
3⤵
PID:11240

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user 1055 /add
4⤵
PID:10436

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://speed.hetzner.de/100MB.bin
3⤵
PID:10592

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffbbd983cb8,0x7ffbbd983cc8,0x7ffbbd983cd8
4⤵
PID:10644

C:\Windows\system32\net.exe
Net user 11245 /add
3⤵
PID:10556

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user 11245 /add
4⤵
PID:10804

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://speed.hetzner.de/100MB.bin
3⤵
PID:11028

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffbbd983cb8,0x7ffbbd983cc8,0x7ffbbd983cd8
4⤵
PID:11220

C:\Windows\system32\net.exe
Net user 6670 /add
3⤵
PID:11112

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user 6670 /add
4⤵
PID:10540

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://speed.hetzner.de/100MB.bin
3⤵
PID:10744

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffbbd983cb8,0x7ffbbd983cc8,0x7ffbbd983cd8
4⤵
PID:10804

C:\Windows\system32\net.exe
Net user 10871 /add
3⤵
PID:10672

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user 10871 /add
4⤵
PID:11236

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://speed.hetzner.de/100MB.bin
3⤵
PID:11236

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffbbd983cb8,0x7ffbbd983cc8,0x7ffbbd983cd8
4⤵
PID:11268

C:\Windows\system32\net.exe
Net user 1674 /add
3⤵
PID:10780

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user 1674 /add
4⤵
PID:11276

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://speed.hetzner.de/100MB.bin
3⤵
PID:11356

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x10c,0x110,0x114,0xdc,0x118,0x7ffbbd983cb8,0x7ffbbd983cc8,0x7ffbbd983cd8
4⤵
PID:11380

C:\Windows\system32\net.exe
Net user 12634 /add
3⤵
PID:11372

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user 12634 /add
4⤵
PID:11396

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://speed.hetzner.de/100MB.bin
3⤵
PID:11476

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffbbd983cb8,0x7ffbbd983cc8,0x7ffbbd983cd8
4⤵
PID:11504

C:\Windows\system32\net.exe
Net user 32512 /add
3⤵
PID:11492

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user 32512 /add
4⤵
PID:11516

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://speed.hetzner.de/100MB.bin
3⤵
PID:11588

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffbbd983cb8,0x7ffbbd983cc8,0x7ffbbd983cd8
4⤵
PID:11608

C:\Windows\system32\net.exe
Net user 19006 /add
3⤵
PID:11600

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user 19006 /add
4⤵
PID:11656

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://speed.hetzner.de/100MB.bin
3⤵
PID:11704

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffbbd983cb8,0x7ffbbd983cc8,0x7ffbbd983cd8
4⤵
PID:11736

C:\Windows\system32\net.exe
Net user 12449 /add
3⤵
PID:11716

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user 12449 /add
4⤵
PID:11748

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://speed.hetzner.de/100MB.bin
3⤵
PID:11824

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xa0,0x10c,0x7ffbbd983cb8,0x7ffbbd983cc8,0x7ffbbd983cd8
4⤵
PID:11848

C:\Windows\system32\net.exe
Net user 14100 /add
3⤵
PID:11836

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user 14100 /add
4⤵
PID:11868

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://speed.hetzner.de/100MB.bin
3⤵
PID:11936

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x108,0x10c,0x110,0xe4,0x114,0x7ffbbd983cb8,0x7ffbbd983cc8,0x7ffbbd983cd8
4⤵
PID:11976

C:\Windows\system32\net.exe
Net user 277 /add
3⤵
PID:11948

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user 277 /add
4⤵
PID:11964

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://speed.hetzner.de/100MB.bin
3⤵
PID:12048

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffbbd983cb8,0x7ffbbd983cc8,0x7ffbbd983cd8
4⤵
PID:12092

C:\Windows\system32\net.exe
Net user 11382 /add
3⤵
PID:12056

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user 11382 /add
4⤵
PID:12084

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://speed.hetzner.de/100MB.bin
3⤵
PID:12168

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffbbd983cb8,0x7ffbbd983cc8,0x7ffbbd983cd8
4⤵
PID:12196

C:\Windows\system32\net.exe
Net user 27098 /add
3⤵
PID:12176

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user 27098 /add
4⤵
PID:12208

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://speed.hetzner.de/100MB.bin
3⤵
PID:11128

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffbbd983cb8,0x7ffbbd983cc8,0x7ffbbd983cd8
4⤵
PID:10776

C:\Windows\system32\net.exe
Net user 8202 /add
3⤵
PID:10672

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user 8202 /add
4⤵
PID:11440

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://speed.hetzner.de/100MB.bin
3⤵
PID:11516

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffbbd983cb8,0x7ffbbd983cc8,0x7ffbbd983cd8
4⤵
PID:11492

C:\Windows\system32\net.exe
Net user 27539 /add
3⤵
PID:11512

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user 27539 /add
4⤵
PID:11660

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://speed.hetzner.de/100MB.bin
3⤵
PID:11720

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xe4,0x10c,0x7ffbbd983cb8,0x7ffbbd983cc8,0x7ffbbd983cd8
4⤵
PID:11872

C:\Windows\system32\net.exe
Net user 21275 /add
3⤵
PID:11732

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user 21275 /add
4⤵
PID:11712

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://speed.hetzner.de/100MB.bin
3⤵
PID:11940

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffbbd983cb8,0x7ffbbd983cc8,0x7ffbbd983cd8
4⤵
PID:11972

C:\Windows\system32\net.exe
Net user 16592 /add
3⤵
PID:11988

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user 16592 /add
4⤵
PID:11948

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://speed.hetzner.de/100MB.bin
3⤵
PID:12264

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffbbd983cb8,0x7ffbbd983cc8,0x7ffbbd983cd8
4⤵
PID:11328

C:\Windows\system32\net.exe
Net user 17079 /add
3⤵
PID:12276

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user 17079 /add
4⤵
PID:12228

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://speed.hetzner.de/100MB.bin
3⤵
PID:11440

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffbbd983cb8,0x7ffbbd983cc8,0x7ffbbd983cd8
4⤵
PID:11520

C:\Windows\system32\net.exe
Net user 29721 /add
3⤵
PID:10772

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user 29721 /add
4⤵
PID:11652

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://speed.hetzner.de/100MB.bin
3⤵
PID:11708

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffbbd983cb8,0x7ffbbd983cc8,0x7ffbbd983cd8
4⤵
PID:11748

C:\Windows\system32\net.exe
Net user 12831 /add
3⤵
PID:11724

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user 12831 /add
4⤵
PID:12112

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://speed.hetzner.de/100MB.bin
3⤵
PID:11344

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffbbd983cb8,0x7ffbbd983cc8,0x7ffbbd983cd8
4⤵
PID:11460

C:\Windows\system32\net.exe
Net user 23355 /add
3⤵
PID:12172

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user 23355 /add
4⤵
PID:11580

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://speed.hetzner.de/100MB.bin
3⤵
PID:11944

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffbbd983cb8,0x7ffbbd983cc8,0x7ffbbd983cd8
4⤵
PID:11832

C:\Windows\system32\net.exe
Net user 26952 /add
3⤵
PID:11744

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user 26952 /add
4⤵
PID:11796

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://speed.hetzner.de/100MB.bin
3⤵
PID:11724

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xe0,0x10c,0x7ffbbd983cb8,0x7ffbbd983cc8,0x7ffbbd983cd8
4⤵
PID:11744

C:\Windows\system32\net.exe
Net user 18994 /add
3⤵
PID:11796

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user 18994 /add
4⤵
PID:11932

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://speed.hetzner.de/100MB.bin
3⤵
PID:12356

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xe0,0x10c,0x7ffbbd983cb8,0x7ffbbd983cc8,0x7ffbbd983cd8
4⤵
PID:12380

C:\Windows\system32\net.exe
Net user 20659 /add
3⤵
PID:12368

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user 20659 /add
4⤵
PID:12428

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://speed.hetzner.de/100MB.bin
3⤵
PID:12476

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffbbd983cb8,0x7ffbbd983cc8,0x7ffbbd983cd8
4⤵
PID:12496

C:\Windows\system32\net.exe
Net user 8736 /add
3⤵
PID:12488

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user 8736 /add
4⤵
PID:12520

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://speed.hetzner.de/100MB.bin
3⤵
PID:12584

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffbbd983cb8,0x7ffbbd983cc8,0x7ffbbd983cd8
4⤵
PID:12612

C:\Windows\system32\net.exe
Net user 7421 /add
3⤵
PID:12592

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user 7421 /add
4⤵
PID:12620

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://speed.hetzner.de/100MB.bin
3⤵
PID:12696

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffbbd983cb8,0x7ffbbd983cc8,0x7ffbbd983cd8
4⤵
PID:12708

C:\Windows\system32\net.exe
Net user 17707 /add
3⤵
PID:12716

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user 17707 /add
4⤵
PID:12744

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://speed.hetzner.de/100MB.bin
3⤵
PID:12808

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffbbd983cb8,0x7ffbbd983cc8,0x7ffbbd983cd8
4⤵
PID:12848

C:\Windows\system32\net.exe
Net user 4035 /add
3⤵
PID:12816

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user 4035 /add
4⤵
PID:12840

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://speed.hetzner.de/100MB.bin
3⤵
PID:12920

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffbbd983cb8,0x7ffbbd983cc8,0x7ffbbd983cd8
4⤵
PID:12948

C:\Windows\system32\net.exe
Net user 32325 /add
3⤵
PID:12932

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user 32325 /add
4⤵
PID:12964

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://speed.hetzner.de/100MB.bin
3⤵
PID:13044

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffbbd983cb8,0x7ffbbd983cc8,0x7ffbbd983cd8
4⤵
PID:13056

C:\Windows\system32\net.exe
Net user 16593 /add
3⤵
PID:13064

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user 16593 /add
4⤵
PID:13096

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://speed.hetzner.de/100MB.bin
3⤵
PID:13164

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffbbd983cb8,0x7ffbbd983cc8,0x7ffbbd983cd8
4⤵
PID:13192

C:\Windows\system32\net.exe
Net user 9250 /add
3⤵
PID:13176

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user 9250 /add
4⤵
PID:13204

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://speed.hetzner.de/100MB.bin
3⤵
PID:13296

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffbbd983cb8,0x7ffbbd983cc8,0x7ffbbd983cd8
4⤵
PID:12112

C:\Windows\system32\net.exe
Net user 14783 /add
3⤵
PID:13304

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user 14783 /add
4⤵
PID:12316

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://speed.hetzner.de/100MB.bin
3⤵
PID:12420

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x104,0x108,0x10c,0x100,0xdc,0x7ffbbd983cb8,0x7ffbbd983cc8,0x7ffbbd983cd8
4⤵
PID:12564

C:\Windows\system32\net.exe
Net user 14568 /add
3⤵
PID:12368

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user 14568 /add
4⤵
PID:12552

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://speed.hetzner.de/100MB.bin
3⤵
PID:12588

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffbbd983cb8,0x7ffbbd983cc8,0x7ffbbd983cd8
4⤵
PID:12744

C:\Windows\system32\net.exe
Net user 16221 /add
3⤵
PID:12600

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user 16221 /add
4⤵
PID:12700

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://speed.hetzner.de/100MB.bin
3⤵
PID:12828

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x108,0x10c,0x110,0xe4,0x114,0x7ffbbd983cb8,0x7ffbbd983cc8,0x7ffbbd983cd8
4⤵
PID:12928

C:\Windows\system32\net.exe
Net user 5216 /add
3⤵
PID:12824

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user 5216 /add
4⤵
PID:12940

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://speed.hetzner.de/100MB.bin
3⤵
PID:13096

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffbbd983cb8,0x7ffbbd983cc8,0x7ffbbd983cd8
4⤵
PID:13064

C:\Windows\system32\net.exe
Net user 16289 /add
3⤵
PID:13144

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user 16289 /add
4⤵
PID:13208

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://speed.hetzner.de/100MB.bin
3⤵
PID:13308

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffbbd983cb8,0x7ffbbd983cc8,0x7ffbbd983cd8
4⤵
PID:12660

C:\Windows\system32\net.exe
Net user 21680 /add
3⤵
PID:12084

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user 21680 /add
4⤵
PID:12672

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://speed.hetzner.de/100MB.bin
3⤵
PID:12836

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffbbd983cb8,0x7ffbbd983cc8,0x7ffbbd983cd8
4⤵
PID:12940

C:\Windows\system32\net.exe
Net user 20474 /add
3⤵
PID:12772

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user 20474 /add
4⤵
PID:12924

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://speed.hetzner.de/100MB.bin
3⤵
PID:13208

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffbbd983cb8,0x7ffbbd983cc8,0x7ffbbd983cd8
4⤵
PID:12840

C:\Windows\system32\net.exe
Net user 29161 /add
3⤵
PID:13248

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user 29161 /add
4⤵
PID:12844

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://speed.hetzner.de/100MB.bin
3⤵
PID:12668

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffbbd983cb8,0x7ffbbd983cc8,0x7ffbbd983cd8
4⤵
PID:13184

C:\Windows\system32\net.exe
Net user 18220 /add
3⤵
PID:12748

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user 18220 /add
4⤵
PID:12316

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://speed.hetzner.de/100MB.bin
3⤵
PID:12964

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffbbd983cb8,0x7ffbbd983cc8,0x7ffbbd983cd8
4⤵
PID:12316

C:\Windows\system32\net.exe
Net user 29412 /add
3⤵
PID:12520

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user 29412 /add
4⤵
PID:12748

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://speed.hetzner.de/100MB.bin
3⤵
PID:13384

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffbbd983cb8,0x7ffbbd983cc8,0x7ffbbd983cd8
4⤵
PID:13412

C:\Windows\system32\net.exe
Net user 5926 /add
3⤵
PID:13392

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user 5926 /add
4⤵
PID:13428

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://speed.hetzner.de/100MB.bin
3⤵
PID:13500

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffbbd983cb8,0x7ffbbd983cc8,0x7ffbbd983cd8
4⤵
PID:13528

C:\Windows\system32\net.exe
Net user 30288 /add
3⤵
PID:13512

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user 30288 /add
4⤵
PID:13540

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://speed.hetzner.de/100MB.bin
3⤵
PID:13612

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffbbd983cb8,0x7ffbbd983cc8,0x7ffbbd983cd8
4⤵
PID:13632

C:\Windows\system32\net.exe
Net user 28273 /add
3⤵
PID:13624

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user 28273 /add
4⤵
PID:13656

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://speed.hetzner.de/100MB.bin
3⤵
PID:13724

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffbbd983cb8,0x7ffbbd983cc8,0x7ffbbd983cd8
4⤵
PID:13764

C:\Windows\system32\net.exe
Net user 6363 /add
3⤵
PID:13732

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user 6363 /add
4⤵
PID:13748

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://speed.hetzner.de/100MB.bin
3⤵
PID:13832

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x10c,0x110,0x114,0xdc,0x118,0x7ffbbd983cb8,0x7ffbbd983cc8,0x7ffbbd983cd8
4⤵
PID:13872

C:\Windows\system32\net.exe
Net user 9769 /add
3⤵
PID:13840

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user 9769 /add
4⤵
PID:13860

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://speed.hetzner.de/100MB.bin
3⤵
PID:13944

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x108,0x10c,0x110,0xe4,0x114,0x7ffbbd983cb8,0x7ffbbd983cc8,0x7ffbbd983cd8
4⤵
PID:13964

C:\Windows\system32\net.exe
Net user 18896 /add
3⤵
PID:13956

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user 18896 /add
4⤵
PID:13980

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://speed.hetzner.de/100MB.bin
3⤵
PID:14056

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffbbd983cb8,0x7ffbbd983cc8,0x7ffbbd983cd8
4⤵
PID:14080

C:\Windows\system32\net.exe
Net user 26776 /add
3⤵
PID:14064

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user 26776 /add
4⤵
PID:14104

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://speed.hetzner.de/100MB.bin
3⤵
PID:14168

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x10c,0x110,0x114,0xdc,0x118,0x7ffbbd983cb8,0x7ffbbd983cc8,0x7ffbbd983cd8
4⤵
PID:14200

C:\Windows\system32\net.exe
Net user 27060 /add
3⤵
PID:14176

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user 27060 /add
4⤵
PID:14208

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://speed.hetzner.de/100MB.bin
3⤵
PID:14280

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xec,0x10c,0x7ffbbd983cb8,0x7ffbbd983cc8,0x7ffbbd983cd8
4⤵
PID:14320

C:\Windows\system32\net.exe
Net user 7672 /add
3⤵
PID:14288

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user 7672 /add
4⤵
PID:14312

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://speed.hetzner.de/100MB.bin
3⤵
PID:13476

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffbbd983cb8,0x7ffbbd983cc8,0x7ffbbd983cd8
4⤵
PID:13428

C:\Windows\system32\net.exe
Net user 10905 /add
3⤵
PID:13432

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user 10905 /add
4⤵
PID:13400

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://speed.hetzner.de/100MB.bin
3⤵
PID:13508

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffbbd983cb8,0x7ffbbd983cc8,0x7ffbbd983cd8
4⤵
PID:13700

C:\Windows\system32\net.exe
Net user 22493 /add
3⤵
PID:4832

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user 22493 /add
4⤵
PID:13628

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://speed.hetzner.de/100MB.bin
3⤵
PID:13824

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffbbd983cb8,0x7ffbbd983cc8,0x7ffbbd983cd8
4⤵
PID:13868

C:\Windows\system32\net.exe
Net user 10311 /add
3⤵
PID:13884

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user 10311 /add
4⤵
PID:13920

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://speed.hetzner.de/100MB.bin
3⤵
PID:14040

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffbbd983cb8,0x7ffbbd983cc8,0x7ffbbd983cd8
4⤵
PID:14048

C:\Windows\system32\net.exe
Net user 31065 /add
3⤵
PID:14076

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user 31065 /add
4⤵
PID:14108

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://speed.hetzner.de/100MB.bin
3⤵
PID:14208

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffbbd983cb8,0x7ffbbd983cc8,0x7ffbbd983cd8
4⤵
PID:14176

C:\Windows\system32\net.exe
Net user 7784 /add
3⤵
PID:14316

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user 7784 /add
4⤵
PID:13360

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://speed.hetzner.de/100MB.bin
3⤵
PID:13592

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x104,0x108,0x10c,0xe0,0x110,0x7ffbbd983cb8,0x7ffbbd983cc8,0x7ffbbd983cd8
4⤵
PID:13628

C:\Windows\system32\net.exe
Net user 2265 /add
3⤵
PID:4600

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user 2265 /add
4⤵
PID:13656

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://speed.hetzner.de/100MB.bin
3⤵
PID:13920

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffbbd983cb8,0x7ffbbd983cc8,0x7ffbbd983cd8
4⤵
PID:13924

C:\Windows\system32\net.exe
Net user 5466 /add
3⤵
PID:14088

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user 5466 /add
4⤵
PID:14220

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://speed.hetzner.de/100MB.bin
3⤵
PID:13488

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffbbd983cb8,0x7ffbbd983cc8,0x7ffbbd983cd8
4⤵
PID:14160

C:\Windows\system32\net.exe
Net user 16968 /add
3⤵
PID:13372

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user 16968 /add
4⤵
PID:14344

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://speed.hetzner.de/100MB.bin
3⤵
PID:14408

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffbbd983cb8,0x7ffbbd983cc8,0x7ffbbd983cd8
4⤵
PID:14436

C:\Windows\system32\net.exe
Net user 25178 /add
3⤵
PID:14420

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user 25178 /add
4⤵
PID:14448

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://speed.hetzner.de/100MB.bin
3⤵
PID:14528

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffbbd983cb8,0x7ffbbd983cc8,0x7ffbbd983cd8
4⤵
PID:14552

C:\Windows\system32\net.exe
Net user 29443 /add
3⤵
PID:14540

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user 29443 /add
4⤵
PID:14572

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://speed.hetzner.de/100MB.bin
3⤵
PID:14640

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffbbd983cb8,0x7ffbbd983cc8,0x7ffbbd983cd8
4⤵
PID:14668

C:\Windows\system32\net.exe
Net user 32281 /add
3⤵
PID:14652

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user 32281 /add
4⤵
PID:14680

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://speed.hetzner.de/100MB.bin
3⤵
PID:14744

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffbbd983cb8,0x7ffbbd983cc8,0x7ffbbd983cd8
4⤵
PID:14776

C:\Windows\system32\net.exe
Net user 13977 /add
3⤵
PID:14768

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user 13977 /add
4⤵
PID:14816

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://speed.hetzner.de/100MB.bin
3⤵
PID:14872

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x104,0x108,0x10c,0xe0,0x110,0x7ffbbd983cb8,0x7ffbbd983cc8,0x7ffbbd983cd8
4⤵
PID:14908

C:\Windows\system32\net.exe
Net user 3330 /add
3⤵
PID:14900

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user 3330 /add
4⤵
PID:14964

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://speed.hetzner.de/100MB.bin
3⤵
PID:15156

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffbbd983cb8,0x7ffbbd983cc8,0x7ffbbd983cd8
4⤵
PID:15176

C:\Windows\system32\net.exe
Net user 8822 /add
3⤵
PID:15184

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user 8822 /add
4⤵
PID:15244

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://speed.hetzner.de/100MB.bin
3⤵
PID:15284

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffbbd983cb8,0x7ffbbd983cc8,0x7ffbbd983cd8
4⤵
PID:15308

C:\Windows\system32\net.exe
Net user 3776 /add
3⤵
PID:15296

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user 3776 /add
4⤵
PID:15328

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://speed.hetzner.de/100MB.bin
3⤵
PID:14088

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffbbd983cb8,0x7ffbbd983cc8,0x7ffbbd983cd8
4⤵
PID:14400

C:\Windows\system32\net.exe
Net user 8160 /add
3⤵
PID:14424

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user 8160 /add
4⤵
PID:14420

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://speed.hetzner.de/100MB.bin
3⤵
PID:14532

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffbbd983cb8,0x7ffbbd983cc8,0x7ffbbd983cd8
4⤵
PID:14632

C:\Windows\system32\net.exe
Net user 5817 /add
3⤵
PID:14596

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user 5817 /add
4⤵
PID:14680

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://speed.hetzner.de/100MB.bin
3⤵
PID:14820

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffbbd983cb8,0x7ffbbd983cc8,0x7ffbbd983cd8
4⤵
PID:14768

C:\Windows\system32\net.exe
Net user 28405 /add
3⤵
PID:14760

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user 28405 /add
4⤵
PID:14992

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://speed.hetzner.de/100MB.bin
3⤵
PID:14900

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0x88,0x10c,0x7ffbbd983cb8,0x7ffbbd983cc8,0x7ffbbd983cd8
4⤵
PID:15256

C:\Windows\system32\net.exe
Net user 15771 /add
3⤵
PID:15172

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user 15771 /add
4⤵
PID:15328

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://speed.hetzner.de/100MB.bin
3⤵
PID:15268

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffbbd983cb8,0x7ffbbd983cc8,0x7ffbbd983cd8
4⤵
PID:14612

C:\Windows\system32\net.exe
Net user 25230 /add
3⤵
PID:14392

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user 25230 /add
4⤵
PID:14444

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://speed.hetzner.de/100MB.bin
3⤵
PID:14836

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffbbd983cb8,0x7ffbbd983cc8,0x7ffbbd983cd8
4⤵
PID:14784

C:\Windows\system32\net.exe
Net user 15413 /add
3⤵
PID:14992

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user 15413 /add
4⤵
PID:14956

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://speed.hetzner.de/100MB.bin
3⤵
PID:14384

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffbbd983cb8,0x7ffbbd983cc8,0x7ffbbd983cd8
4⤵
PID:13372

C:\Windows\system32\net.exe
Net user 9260 /add
3⤵
PID:14536

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user 9260 /add
4⤵
PID:14608

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://speed.hetzner.de/100MB.bin
3⤵
PID:14736

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffbbd983cb8,0x7ffbbd983cc8,0x7ffbbd983cd8
4⤵
PID:15188

C:\Windows\system32\net.exe
Net user 25136 /add
3⤵
PID:14992

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user 25136 /add
4⤵
PID:14764

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://speed.hetzner.de/100MB.bin
3⤵
PID:15400

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffbbd983cb8,0x7ffbbd983cc8,0x7ffbbd983cd8
4⤵
PID:15432

C:\Windows\system32\net.exe
Net user 2140 /add
3⤵
PID:15408

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user 2140 /add
4⤵
PID:15440

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\ExpandPing.wvx"
1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:4976

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004D8 0x00000000000004BC
1⤵
PID:4320

C:\Users\Admin\Downloads\WannaCry.EXE
"C:\Users\Admin\Downloads\WannaCry.EXE"
1⤵
- Drops startup file
- Executes dropped EXE
- Sets desktop wallpaper using registry
PID:15972

C:\Windows\SysWOW64\attrib.exe
attrib +h .
2⤵
- Views/modifies file attributes
PID:6952

C:\Windows\SysWOW64\icacls.exe
icacls . /grant Everyone:F /T /C /Q
2⤵
- Modifies file permissions
PID:6964

C:\Users\Admin\Downloads\taskdl.exe
taskdl.exe
2⤵
- Executes dropped EXE
PID:15500

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c 240271710708551.bat
2⤵
PID:6760

C:\Windows\SysWOW64\cscript.exe
cscript.exe //nologo m.vbs
3⤵
PID:6448

C:\Windows\SysWOW64\attrib.exe
attrib +h +s F:\$RECYCLE
2⤵
- Views/modifies file attributes
PID:12428

C:\Users\Admin\Downloads\@[email protected]
@[email protected] co
2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3112

C:\Users\Admin\Downloads\TaskData\Tor\taskhsvc.exe
TaskData\Tor\taskhsvc.exe
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:12032

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c start /b @[email protected] vs
2⤵
PID:1812

C:\Users\Admin\Downloads\@[email protected]
@[email protected] vs
3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:15896

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet
4⤵
PID:4476

C:\Windows\SysWOW64\Wbem\WMIC.exe
wmic shadowcopy delete
5⤵
- Suspicious use of AdjustPrivilegeToken
PID:10356

C:\Users\Admin\Downloads\taskdl.exe
taskdl.exe
2⤵
- Executes dropped EXE
PID:13596

C:\Users\Admin\Downloads\taskse.exe
taskse.exe C:\Users\Admin\Downloads\@[email protected]
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:9252

C:\Users\Admin\Downloads\@[email protected]
@[email protected]
2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:11012

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "mhvdvdzzqm115" /t REG_SZ /d "\"C:\Users\Admin\Downloads\tasksche.exe\"" /f
2⤵
PID:964

C:\Windows\SysWOW64\reg.exe
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "mhvdvdzzqm115" /t REG_SZ /d "\"C:\Users\Admin\Downloads\tasksche.exe\"" /f
3⤵
- Adds Run key to start application
- Modifies registry key
PID:13940

C:\Users\Admin\Downloads\taskdl.exe
taskdl.exe
2⤵
- Executes dropped EXE
PID:6548

C:\Users\Admin\Downloads\taskse.exe
taskse.exe C:\Users\Admin\Downloads\@[email protected]
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:16364

C:\Users\Admin\Downloads\@[email protected]
@[email protected]
2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:12724

C:\Users\Admin\Downloads\taskdl.exe
taskdl.exe
2⤵
- Executes dropped EXE
PID:16276

C:\Users\Admin\Downloads\taskse.exe
taskse.exe C:\Users\Admin\Downloads\@[email protected]
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:6604

C:\Users\Admin\Downloads\@[email protected]
@[email protected]
2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5788

C:\Users\Admin\Downloads\taskse.exe
taskse.exe C:\Users\Admin\Downloads\@[email protected]
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1720

C:\Users\Admin\Downloads\@[email protected]
@[email protected]
2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:8424

C:\Users\Admin\Downloads\taskdl.exe
taskdl.exe
2⤵
- Executes dropped EXE
PID:5828

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:10932

C:\Users\Admin\Downloads\@[email protected]
"C:\Users\Admin\Downloads\@[email protected]"
1⤵
- Executes dropped EXE
- Sets desktop wallpaper using registry
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:10068

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\SaveClear.mp2v"
1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:12216

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

File and Directory Permissions Modification

T1222

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Defacement

T1491

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\@[email protected]

Filesize
585B

MD5
9cd1d58624dc6bed4db9f2597c73a7b3

SHA1
d196379d341d84db448f4404a45319ab387b66ce

SHA256
14fc04f77191e2756898b158dfe906cd300201224bdbf47a8b6b69161c7251f9

SHA512
bc4b218fd4e6f263f8d8b9bc259ec117209ef60d0ed96d16ddd67633615cb92f7703d4f15793ba980c3360de45584776b35659a9d6353a8270557f03c1395ff5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ded21ddc295846e2b00e1fd766c807db

SHA1
497eb7c9c09cb2a247b4a3663ce808869872b410

SHA256
26025f86effef56caa2ee50a64e219c762944b1e50e465be3a6b454bc0ed7305

SHA512
ddfaa73032590de904bba398331fdbf188741d96a17116ada50298b42d6eb7b20d6e50b0cfae8b17e2f145997b8ebce6c8196e6f46fbe11f133d3d82ce3656db

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a0407c5de270b9ae0ceee6cb9b61bbf1

SHA1
fb2bb8184c1b8e680bf873e5537e1260f057751e

SHA256
a56989933628f6a677ad09f634fc9b7dd9cf7d06c72a76ddbb8221bc4a62ffcd

SHA512
65162bf07705dfdd348d4eaf0a3feba08dc2c0942a3a052b4492d0675ab803b104c03c945f5608fac9544681e0fe8b81d1aaca859663e79aa87fcb591ddb8136

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000002

Filesize
69KB

MD5
a127a49f49671771565e01d883a5e4fa

SHA1
09ec098e238b34c09406628c6bee1b81472fc003

SHA256
3f208f049ffaf4a7ed808bf0ff759ce7986c177f476b380d0076fd1f5482fca6

SHA512
61b54222e54e7ab8743a2d6ca3c36768a7b2cf22d5689a3309dee9974b1f804533720ea9de2d3beab44853d565a94f1bc0e60b9382997abcf03945219f98d734

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000003

Filesize
64KB

MD5
d6b36c7d4b06f140f860ddc91a4c659c

SHA1
ccf16571637b8d3e4c9423688c5bd06167bfb9e9

SHA256
34013d7f3f0186a612bef84f2984e2767b32c9e1940df54b01d5bd6789f59e92

SHA512
2a9dd9352298ec7d1b439033b57ee9a390c373eeb8502f7f36d6826e6dd3e447b8ffd4be4f275d51481ef9a6ac2c2d97ef98f3f9d36a5a971275bf6cee48e487

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000004

Filesize
32KB

MD5
3baf7c2e036abf00bf52d8e4a918e970

SHA1
0eb5406e14050dc41227ba74b64a38da778fe5d6

SHA256
d30dcb199ca26a9664a46c01b4eccb26f5b8682f04480d0a9d2beffab7d0a049

SHA512
c12875c0e5085f534496ca9f1f43bc4d5097f6d4d969f70ad1651bf01bdd4e9f5e27c93413ef0589c06c647c0a22d8c4b7a2ffbda2fe61bdeb84657f53a6a429

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000005

Filesize
63KB

MD5
710d7637cc7e21b62fd3efe6aba1fd27

SHA1
8645d6b137064c7b38e10c736724e17787db6cf3

SHA256
c0997474b99524325dfedb5c020436e7ea9f9c9a1a759ed6daf7bdd4890bdc2b

SHA512
19aa77bed3c441228789cf8f931ca6194cc8d4bc7bb85d892faf5eaeda67d22c8c3b066f8ceda8169177da95a1fe111bd3436ceeaf4c784bd2bf96617f4d0c44

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000006

Filesize
19KB

MD5
76a3f1e9a452564e0f8dce6c0ee111e8

SHA1
11c3d925cbc1a52d53584fd8606f8f713aa59114

SHA256
381396157ed5e8021dd8e660142b35eb71a63aecd33062a1103ce9c709c7632c

SHA512
a1156a907649d6f2c3f7256405d9d5c62a626b8d4cd717fa2f29d2fbe91092a2b3fdd0716f8f31e59708fe12274bc2dea6c9ae6a413ea290e70ddf921fe7f274

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000007

Filesize
88KB

MD5
b38fbbd0b5c8e8b4452b33d6f85df7dc

SHA1
386ba241790252df01a6a028b3238de2f995a559

SHA256
b18b9eb934a5b3b81b16c66ec3ec8e8fecdb3d43550ce050eb2523aabc08b9cd

SHA512
546ca9fb302bf28e3a178e798dd6b80c91cba71d0467257b8ed42e4f845aa6ecb858f718aac1e0865b791d4ecf41f1239081847c75c6fb3e9afd242d3704ad16

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000008

Filesize
1.1MB

MD5
24a16440d5b663d0d87263e812e3fd90

SHA1
0ffec5a540218892b440703dfbf04bf1252def68

SHA256
c3af8b6de514fe12fef4987e8a1a9c6294ea0ebf46d0537bf02d18595abbe799

SHA512
9845ca0adcbdf6e77a021073f5f01c6b0ecc0593d2c7e13d58b7717368d466d69f74c51934c77f21aaaf0704815fdefdf285748aa3e17441b700ba092a6df9cc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000009

Filesize
33KB

MD5
3cd0f2f60ab620c7be0c2c3dbf2cda97

SHA1
47fad82bfa9a32d578c0c84aed2840c55bd27bfb

SHA256
29a3b99e23b07099e1d2a3c0b4cff458a2eba2519f4654c26cf22d03f149e36b

SHA512
ef6e3bbd7e03be8e514936bcb0b5a59b4cf4e677ad24d6d2dfca8c1ec95f134ae37f2042d8bf9a0e343b68bff98a0fd748503f35d5e9d42cdaa1dc283dec89fb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000a

Filesize
75KB

MD5
cf989be758e8dab43e0a5bc0798c71e0

SHA1
97537516ffd3621ffdd0219ede2a0771a9d1e01d

SHA256
beeca69af7bea038faf8f688bf2f10fda22dee6d9d9429306d379a7a4be0c615

SHA512
f8a88edb6bcd029ad02cba25cae57fdf9bbc7fa17c26e7d03f09040eb0559bc27bd4db11025706190ae548363a1d3b3f95519b9740e562bb9531c4d51e3ca2b7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000010

Filesize
40KB

MD5
3051c1e179d84292d3f84a1a0a112c80

SHA1
c11a63236373abfe574f2935a0e7024688b71ccb

SHA256
992cbdc768319cbd64c1ec740134deccbb990d29d7dccd5ecd5c49672fa98ea3

SHA512
df64e0f8c59b50bcffb523b6eab8fabf5f0c5c3d1abbfc6aa4831b4f6ce008320c66121dcedd124533867a9d5de83c424c5e9390bf0a95c8e641af6de74dabff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000011

Filesize
53KB

MD5
68f0a51fa86985999964ee43de12cdd5

SHA1
bbfc7666be00c560b7394fa0b82b864237a99d8c

SHA256
f230c691e1525fac0191e2f4a1db36046306eb7d19808b7bf8227b7ed75e5a0f

SHA512
3049b9bd4160bfa702f2e2b6c1714c960d2c422e3481d3b6dd7006e65aa5075eed1dc9b8a2337e0501e9a7780a38718d298b2415cf30ec9e115a9360df5fa2a7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000016

Filesize
49KB

MD5
93ab4cf70b3aa1641a4b258c3fe03f24

SHA1
cba2ddecb8e019e6e5a91dcf867c6d6094f39b63

SHA256
d6c2f9f2bb35841cdb53abb660544e6e6f44e39d6542323992cc1c63e998fa16

SHA512
70fa907afd9b52ed54a3cf755e394c40a3ff7a83041540b435cba47d889c1c9401afc9fb23a5e879d85bed42fd5df40cd7540d428b3ee7a9cdc278a314770884

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000018

Filesize
44KB

MD5
446d2fa9763e23dd94dce144eff6765e

SHA1
a01cd88035b291cd62ccb30ef1b7633ff983bd2f

SHA256
9ef74039645f012387be21c08645c33f1d9dec0cd8e1cb3c76aac873b44a5f13

SHA512
e3c095c046caf112c94fed42576bd799c1a2f1926ff346d663d2e45df486d84ed28af8a30a720452701fa5cd379d18944a09b3be464481ec730ef1b2e88bf30e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000019

Filesize
24KB

MD5
43dac252d21bddd2477439e023621c6c

SHA1
a7a81cd955811fd15dad91f443e0880d7aa08d79

SHA256
fedd9610bd4c2237de2d9eebba3143424967690767ba25ca7ab369f7aab3bb4a

SHA512
cc5aac6a7e47a0548ebc9a606eff04d175e1c76844160069bf4787349be6fe897cffd1444f9c00dddc214502ebd5a8ab97a1527d219679af894a28858de40fc3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001e

Filesize
20KB

MD5
8b2813296f6e3577e9ac2eb518ac437e

SHA1
6c8066353b4d463018aa1e4e9bb9bf2e9a7d9a86

SHA256
befb3b0471067ac66b93fcdba75c11d743f70a02bb9f5eef7501fa874686319d

SHA512
a1ed4d23dfbe981bf749c2008ab55a3d76e8f41801a09475e7e0109600f288aa20036273940e8ba70a172dec57eec56fe7c567cb941ba71edae080f2fdcc1e0c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001f

Filesize
26KB

MD5
dd99f5b701d962f63af0e96efe8e29f1

SHA1
0bd7d282055dc91d45802e823756c45119d14a1e

SHA256
91619320429a0354878dc4394dd5d1d3a035bf26276840d632d707dcdd284843

SHA512
bcb66de11eb166793c970bf64b22ad2ff392515741197411658572547050008142fab15b5c1d154a056c0dae31e6e49997648bc9ebb5410671f7ebe80f02b172

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000020

Filesize
63KB

MD5
aa6ffba997d9e6535da1a2c26a004749

SHA1
9ed525230c4bccae34454a71adf723fb7479b53b

SHA256
db0eecba023386f47ac57fef8a8cdab5f12e04637da91c13b81b8b60b43025d0

SHA512
ba7e79b263af9d9939059a28d7c73683f9cdb2c9a986adc54d8ad54d28e237c2b0f88010a4829392addb3be5a8d08923cd5931a71ff7558eee9e4b6007273d2b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000022

Filesize
59KB

MD5
063fe934b18300c766e7279114db4b67

SHA1
d7e71855cf6e8d1e7fbaa763223857f50cd1d4bd

SHA256
8745914e0214bcd9d2e6a841f0679a81084ef3fc3d99125876bee26653f4253e

SHA512
9d0dfc21306b3a56c2ecdf1265392271969e3765e161e117c8765125b34793e24458217cf6514b364f351f47e65baaaf5856be0d13406a789f844d6ba8c7075f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000023

Filesize
151KB

MD5
e0595142a80771d317d27440fd29b8e6

SHA1
db3710d0d8d60dcb64430c342c6fd921d6792fcd

SHA256
3ba245011d9a8ade367074a3774a786f50ca51d71a83956dbb0ad2647a14d7ed

SHA512
6d298295955fce4166720ee7cc42bf4562ff311b6820025a7ea710a19dd8553d8677fe194876db5e2e6440d9d21aeb603a6b3fcd73f656405428d4ec00dba288

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000024

Filesize
23KB

MD5
77a781823d1c1a1f70513ffeda9e996d

SHA1
60776ceeb79ed41e7cd49b1ee07b1e09ff846f25

SHA256
b093599957b103def2cc82ffd2d42d57a98292ace5a6596e3e4439a6cce063b2

SHA512
9aa66273ad419e1fc4ee825ec9e9fea4297139eca060572d3f59ed9bccbf2e1dbd03a006a0a35c6d37196e8297ec9a49fb787f0a31c3772b17911603eca62aac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000027

Filesize
45KB

MD5
2801b82bb51029e132240fa43d377262

SHA1
b5ccc6819f82f19fe3d33b80c6afafd1e22ccba0

SHA256
03b459d30675a5a011b03b196255dae64bbaefc81095c857274b73fd5e8111a6

SHA512
51f20e4bde602f1539a95d0965ffcd8b54958d672437febe1bb1a2e93c0d944986f7a53fb2db238e2b30a7849063fa4c9bbd3f6ff65b2082e2b58536b7d42f6a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00002b

Filesize
19KB

MD5
68628ceb90da59674fcb837277749b28

SHA1
b5564ba800acaa03dfceb0f4a23c088dc1cb508a

SHA256
077f88f8fbe31024d74e53d7e46e26f60ab6de38affbdb3152672977609ad1f9

SHA512
c12a9f70ffe39e03d99f42bac8ab857017cb50dd256fc1ec9634a899d2b33b9909a57a64be5031d1e9e3dac94ff3fa809fe9971418186f138e707765d0ecc3a1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00002c

Filesize
21KB

MD5
60a7fb6b1d3dac15d99ae51ee43a008f

SHA1
1b7c181fa43aeb2eefa9063f96482658f65ce145

SHA256
d3c5d62366b64076efef765ac811f137ff1c36870352b5f4b31e3288321578ec

SHA512
de129e7c0b7ad68480649e5a52b07ef640d2e6a76d72bc97c03a15240eccb2890787794b5c2ea29baa73a087376db1219721016163c36d0e5377e971c459831c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00002d

Filesize
19KB

MD5
06609b0a3812ad446f706d3cba5f7588

SHA1
aa5087d66d9282918a8a5a9942dac2c5382a02ee

SHA256
432c0d52ad368a2653f0feb832ec8bacab264799fd1f58169bb167e8c324d55f

SHA512
f2017be2c711eb7012b1f7122310abbe219c42fa1c4a56747ca6387fc21946b20526d7b982b6ed9323a0b7e444b65bc52bf735538052a58e93e14467e87ebe1d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000031

Filesize
91KB

MD5
4767ebdb4b0533db4275bbe6f923b787

SHA1
04f97a6062aa1ca1a823afb14fecd33db8d599e1

SHA256
a318c127abab4fd81496cf7d0483ac55d65c72306f2f4b1855e8dbeb5018d527

SHA512
5f43dc018b043b0fbcf7744de366c5db7c4e3013ad764d58875e48fa5f1d4cf28a6974ac1ff359405f930ef3a2fb7595427ca18031c0c1baf451d690d0febd86

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000032

Filesize
186KB

MD5
df748715a9fa093d0f5e09048bb1f6c6

SHA1
eb9461cb4c6e0618a5dd37284d37377df92b626d

SHA256
169ec4ffa2f13cc0bd62266426baf90297d06666838efd0d689aee4994ab634e

SHA512
2b5ad2390b1ea31dfd259dedef90097e140951f1deac7c00435fb1c764d78298800914841d29b5937141b529c11c5e216594aab8afde5ad2d598e31499322b02

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\19d62cd07dd95272_0

Filesize
3KB

MD5
f3fcf171226554b6026657e532d17500

SHA1
511925a5686e295acf025a10e08cd0083032cf5e

SHA256
73d2b792c698c79522efb6af0b2d0c2cbc994312f1988878001426012bea80a5

SHA512
44966e5eb8b43d328c7f5814e1be4615c9df9e386e31eb3e9362407b9e26f35e44c2ebdee883780b04d24373b488dbf1521a26934f6f00f348a23c73c19d0805

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\27e087ae1db041bf_0

Filesize
18KB

MD5
fe1ba7a09d7208cf383744dbb7e43623

SHA1
3ee3a1f2d59cea57d60da4ff970f4875ecf63568

SHA256
71021f91709cb923e667741e7cb8f756ecfb01b4b1e24f22b576ca5c2560f78c

SHA512
83d0d0f219507e0640babdc29b384e2ab884d8640a2f3732e7312ecd3952453c7d8a1fee5309a29a0ee15c7b8ebf2253a85faa768fdd95086e03fe09daffba6c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\286a1787eb6b73cf_0

Filesize
2KB

MD5
dcf1a10415e6d9db02ff53d401207037

SHA1
58b77f7d99f6217431f3e159cdc78410c57bade4

SHA256
a41d3f169b77da0b2f8383fe2161e43ca808d05a41cb405ea458b547d588b5bc

SHA512
bd73be30dbf971f95a254ca3e52ac52fe299516bee3a0bc43a8ee43c0672f216d24d6e5cfa52254ac339db28bc0009afff30d435d45ca02d64c5eec9f232bf34

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\29ee49a9e002c15f_0

Filesize
12KB

MD5
a4437261ae38d86ccb063f169a929e25

SHA1
0552271c5dbfe9fe0a510fdbc428abd7eb4f19d3

SHA256
d97f7b5cb81c36c74e7ae4962d2a1bf23544ffa49eec508f28a6237841e099d5

SHA512
74141877e79c537d28e7f4b01dd96ee9d1e14165d519c59cf34abfcd17ad0a485c5b5ca8260de85969a290467ec131e2dd68062fa8e61323de702b4d1985f3f3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\3a3c8393d90e5773_0

Filesize
1KB

MD5
dd4e98f9b0b2463d0386e57b9e449546

SHA1
0764d2f313e4bb264f1845f95571ba637069b372

SHA256
ece4b12b63660f4b41316cfa71ec8474b96e8eb99e5074f2988a9359283fb265

SHA512
7a837a93049052ee276025676f01fc638ccf87c432e01f34bfe87b7affea647675e90844242bab1491d742bfc4c2e40be73ced8825068cd532dae94283dc80b9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\4b3ae50f2697bede_0

Filesize
4KB

MD5
d0f1f713d8645283d6acbb33224d3296

SHA1
79727fc45dd9cec976e62dbe65c0e6e61066a33e

SHA256
d763705bce43fc12b7f97b826c87405d1c4240ff24fda44326a11c2af90118bc

SHA512
91db1bd926ecd2021749893e717736baa3df2df5b093249f4724519086a31ee6dd333ddc04b6b13d86a99684f7bf026b0c77b4b75060a2e29d26818fe5072ec9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\4c72a21382e3e8ea_0

Filesize
5KB

MD5
e253f437167343b55ac4b44230f0093a

SHA1
211318128d1deb0b3dc968538873d84ead0ba974

SHA256
e2e66949da47d2ac2cab3b7bd1ae60ce264029affda5f8a8eec61451abf9a400

SHA512
2e6974c46405b5e1fcc650edf9d03f8f8bb5604bd36c17572c2fc3b6d447917f9682146e3dae2a9d4e74565e7561e66c067748c1c291bfcbc91eb8e689a0c757

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\546dec474cffb9f7_0

Filesize
111KB

MD5
26f5e24bf7e35025b7462febdb466ff7

SHA1
f7e4a0543f6e0eac25102743f13528ecf3d16a88

SHA256
425961421923e9ebe4f53b344715fb1c31b645f4cd3cbbf0cce8d412dc927786

SHA512
4ad84d3cbefc3f3fc31956909e6db72d86d0b3bab3a55228cbe613987f835397f89f12af1e033606327c1c337679a113636171b09094b193826896652dc175e3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\84ef792e97c5476a_0

Filesize
35KB

MD5
4b98778e38e1034c5205bf18d4056f65

SHA1
9d4d8bd0cdd19c29094de4a7dbc503eacd455cb4

SHA256
0d3422f570cb50e61573852f74dc768d4ece93254a9f3ab36b4dcb24b336a987

SHA512
66e2fc0a1aaf6401c2fe922e23e862949a4597f91c5518b371def83ecee85820027338ba14328d8c8b9ab59a594f8683cf56dea4ecbdbc50fd5ada9d903beef3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\89911cb6f335fb55_0

Filesize
13KB

MD5
61700d8ed2e5705e3a2f1d7c0da56d1b

SHA1
9247a81fd494e378ea103cad9fd6efc6243ab9c0

SHA256
defab73c1c07e1f369d706fb06c78e3c1573c643fcbddb2e75760aced7ee028c

SHA512
e3802396b2c746369646c3ce9a3ee664fa21b121abaf50124d131984d5d0dbc8262504c5009dee9f9fc8274c6f62b39314b81f6160ad87b6b0af0e0a351e8684

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\8b2929d923d98769_0

Filesize
20KB

MD5
410925c8c7bef4d0f60d58164d67219a

SHA1
5ecadd7fcdc0ef1973231a5f2331218e853333db

SHA256
baa048b7894af9cf9ab1bcf72143344b23e68248d9bb7e29433bfd7576497fb2

SHA512
75ff51c567f935a9d107147a65c560ead51b8f87a9fd7cc87b116d986580f16ee59ce5ed778b1456f4005b944351a574a8c568c5760a0623be331ca9b586d365

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\8fedfa929f63d215_0

Filesize
3KB

MD5
ab415d15912e6f583ee55a548ce61983

SHA1
a217513fd5e33f8fff3a09fbccd752ea75c2518f

SHA256
12942f5b2d282d3d5a79aca1569ef6afb8f5d44dfa52834ed22cf2b55a35dcef

SHA512
dcc1ffcf8532f9e0bc465fd47941fb37cf7124c0137165921aa25ee8f8b59c7b186c1ba790052e98fa9e8305480a40555ea0ef4673a42a5937e171faa9856646

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\91c0c0568eec2384_0

Filesize
39KB

MD5
ffcab565059e0661d2109212409243c4

SHA1
551d9f585c7fa0f6f817a26ab3950ebbffe7b628

SHA256
390af684668ca002c4c49126c8c9b758a0189673a02341f34cbeb84662118d40

SHA512
478b84287f62ac8f966f05b2c3a781dc696ec72ef6497705bc3f74b148b40277ccb097114b5ea141b9614b3127000214424d43d955c08a12bb07dc32dcca91e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\a26e313bd3986acf_0

Filesize
32KB

MD5
dd8ad684a280a38220de8a4a8b80c491

SHA1
4b924141f9de9e026f22d59d2f8ec2622066b604

SHA256
89392741671ca36567045c863f1493dfaf833dc8f7b0bfc79b9518b142254f67

SHA512
5d6dd5dd5fc4cdf0e0e820e6409cde395709db13dcfc7cb9c2b8b324169524e92d67188d227f159c22003df81504ed9c741eecd3155e0b2bf1838576621814aa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\ade44207b4253689_0

Filesize
1KB

MD5
d64e82bdb7a49841de5f70df69ee793c

SHA1
811af5d5e70118675fee0a5b1015591d0920da0d

SHA256
38fa774e5ce57b157e289c86637ebaa3abed403a1870200be5d1b1272c7d303f

SHA512
d40fc39791439be9b9cccefbe182fe091f0bb4132e09674e10287d0523b01677c5595ac1dc7e4b3fc4e2ab6c141ce54f76d618fc45e0390eee827206b8b2aa5e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\b55e27f8f44d80ba_0

Filesize
2KB

MD5
7ff32e2bf5a63fde45c28f699ca8c9d3

SHA1
2f4b079ca158463eb5a6b566c9c7eafc87c8f7d4

SHA256
9ea8e8de1f5e2d03d33bebc405099412bcaf44053ecbb7f4bf10b48212323b86

SHA512
6f5eb922385039c948d8f82fad18fd4949c67556dfe451bd2865bcaf7056f3e24ff16f07e21e0b1475b2725967de57890787c9799fc53b57f7dca3cea54f5db4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\ebe10eab84535fd9_0

Filesize
2KB

MD5
3b1c78a1982bdbff818a0fe0d7d8c6cf

SHA1
0d7fea8645939ecb2ad94230efccdb6a087a5acd

SHA256
73759ca7bcd21a43928b5f5aa6a7c10fec0fc3bb22150d6f4294b08bac859947

SHA512
00ea91479915303d2f57151543817a49a7d53369010f129becd5396764a6f1d8380a8e7ef260f31069106ff6bb0262730405e6f45481821907a116476f38e1dd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\f2455e67aba84d11_0

Filesize
5KB

MD5
9cbb11b431254f03ac733f117178a595

SHA1
4bb2c7f05a10383c56a60d083715cc5e1b0cf972

SHA256
9000f8ac7be73f2ac43bb51fd7dfeaff7f0929f31496228f3b894dad5fccdde0

SHA512
714e78ad5ffd76532e5821a5a05e50fe0b58b35b0bfab2b7c2a401d86ff7c9b991255622b436964deb1f77523f097f61aa66e73668c9488209838b8408f9f028

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\f66233e72c393c10_0

Filesize
1KB

MD5
6cf3aeda24ebd38fedc74522a621a3cb

SHA1
d9f6c09731c64009c788caefbe490d922769a9d3

SHA256
cc3b908020c608e1e012b7b6b1640bfcb98ef8ba986b31f6d1f7a73f38f08639

SHA512
7d9fbd55919ce78c85298a9fc4c3d4f205b6466abb0f1c512b013192a8f4a8779237b0dad4661e86abf8305b44ffaa797dcf704305bf3fb383cb0a99a70aec54

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\f7f4848d5ac56948_0

Filesize
366B

MD5
9ec389b10ef560de59f848671b7c5c4b

SHA1
f6936e9265a89eff2489cfd5d5fecdc682928aa7

SHA256
0014488681cb6689df630e1ee139ad90adf8dfe97463949b9b79b85044865912

SHA512
1caba5ac945b7bfe095c57130112abe6c67feb13d70d403fcdf8012a5cf63cfcd19c66bc74334739525d5ddc94d64461e11d9ae1ca506004d898c7e1c9a7b27f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\fb9846e0ec264d61_0

Filesize
6KB

MD5
6fbd1c114b8b0398dc90f54ac54e37d9

SHA1
45febcd357a7314f29796dee60856f472279b8c2

SHA256
0425b6bbf736bb7e726a363e3157c7d6a644fa6d6e45d1917ccd064a9bcbd7f6

SHA512
6b91ec93dc76aceeb1f002936a1947e85f8a3ce8b1174e40c2bd5b29d5f5911a788b1a1c5b3b222ccbb0ee118be203c83b36402bbf945680073a000bb0edeb75

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index

Filesize
4KB

MD5
1ebed54c574693520d498e36f6e466bf

SHA1
d2a2d85d1cff4b831df3fc2f09833254d8b47655

SHA256
fb2a0f2fea29707efeafb0d866f35bdad6dd80a38ab6b690492a26fa106121f7

SHA512
b1a20f7cae78ce8a4a20bcf85109dae5592836f79fa42ed9fed308bf78ecf41b361d8b786b2e802de449115058ba31053f5966e5eb8eb99e14156e518b3a09b3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index

Filesize
4KB

MD5
6d428668d6fa7f5911346101e5846f55

SHA1
879d6010b9622d3df48041f9806ef77ec5d033ca

SHA256
0586f49c49c0add0a4f05f36cbd4bc8091a62ae9393d66348ea1a4bef4350bff

SHA512
a1f67d25a5c52c496897e5a1354087ed212b1937f5e71dd15312b8c50acb5fdfe12b236c6e922c2aacbb542ef2e48c9f9b1fbe471f5584f02cb9ed02a37e7282

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
c058ede55081c5d3811ebcfd96b3762e

SHA1
201a61c349373f7286a6130d360ca3e631b50b11

SHA256
7c710ffeef567a6be34f19ae8fed1b4cbda28678f9b3df682b8558dbc14e0bf3

SHA512
680f213865ebd919c6cca75e9b8b35798f6ee22aca21e5406fe13a1fff49e5f584a2d24217a5edf17801ea1de3fd0ff791c1ec2d4a1a3bd6631fadea87b0de1b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
6d765b96bf0c12280ad58563ee71fd13

SHA1
964ce565892f6a10ba3df3d12e79936e9dcaaf2a

SHA256
99686a47faf3fd845ad05672224a29c33d4c15bf670ddc8e5bf855b0583a355d

SHA512
f1bb3be95473e2674fb6227d442d5eb21230190404c62a857805f792536c8513dfffa98d9951476f240cfc0b82072e55eb650c93a2a6aa512fa4fa3523e506b5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
0089ed8323cfa035b6b00aa6bfff0b28

SHA1
1ba850981f24864683087c4eb396c97d363cca53

SHA256
9841abe4e9876ce4639ab080765c40c4a5ea9e38822f958dda4918919d981d70

SHA512
0ded0c6025759f35d9f9be136a5ef0a7e79f2756f308cb0e807007af0fa7f4f861df7cdcc754380afb0d9838a08b350623a6f2fe06c6a116f3ca205974890a21

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
5acf4211bff24ac982b1b6ed4f891ad6

SHA1
425af0c446fa6802a3fdccda747ad83d95d3f386

SHA256
36dc57fa929f88bc99aa192ea4523eff7b9630f962784c804f98650da51d74f3

SHA512
838443cbf5794bd93d7c2fe7de26f856d7ed2c2d8e89ed515dea50def075f9b250b9f9cf7622951e54efef82e25e5086c0cbf1314eca8a0c101e95be59fe82de

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
d5561802e9dd982ec0bd65d19c212df8

SHA1
a7ca8f2c1c6a7b7f595182032233ccf388ca5948

SHA256
1b66da197bbfd13e7101ddb5a88b4601280494f9f5fad22791ff415fb65f468d

SHA512
85b1572ce608968b0227efefaf09f1ba60d9430b1ecbdf8893cf34036e353a0e0b8000038e775d33eabe5e44263431c3eab082cbd97eaa623a35765e0809af38

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
8362ad0b19a30e4f1f5b6e0b646ed68f

SHA1
c9e2c86d1a8bde2a76a134b5b30d2bfd5bf9517f

SHA256
45711e4b5028d8a8c44cd2d0d2ab1f0af2501e8dce7b582a38ee4b2a85f1a8e1

SHA512
d1c023a455d630751b610c7320aa044359214186861f6edf916088e5fa39d9212a9f452b655e9e5120d1ac1a6f2b7ea7302a7b82f04edf365938526d387b1576

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
9f58ee2652f53475e49a6d49a930d6d7

SHA1
239c400a2364f9833cbb797f75c5fae95fa91d30

SHA256
c25ad48209d7f43cfc6e9706d8d00bb82d350f3504b17955bde60c03fb989f1f

SHA512
54f78d34d6511f372524c91489f1cb58ac637c8988163194b4ef751568b5376377af2720fcfd237e62f9807cb787bf89f0e06b234d37acd1f6efd0fd52977186

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
f8330e2aab15077aec59912ac13c756b

SHA1
7670752280bba8b2bcc99271a4330984481ef9e3

SHA256
92f0f29ed3aa81a2c8f0118078615d4b7c6ef7c20889682963f0f164b3a953c5

SHA512
495da988cccae9f9cc992e9521854f8ed541584c74d34d3fee43ba0a075035849f220de9408340dbc60e219a2ce59361149c0fc4a9a6fe794fc579c0ed6a80cb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
653c101177d078298e8290e10eb659b9

SHA1
674cf43cc4ca02f30f19981a35bac1bd9e2789c2

SHA256
455a3bc3866c289053ff9c2adebd3a963f576df1542211c56fe8ac16bb397239

SHA512
069a37374224c388325e43630295789a456bd3bb40220b4a6c58483b8f4f7578818cc05360abd1d9d5f4873d9c003dbbfe7b052eeb9f8078fbdf8de754f96719

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
704f1d0ba8b0cf16afc6fd7e04d5d47d

SHA1
e6751ac723c4144b92ce0b5d25aca8167db1ccb1

SHA256
5a129a8f827e0c57765859fb95100ae95456a6a2bcc2d0b327d6b0479ca7fa6c

SHA512
85aaf5a28f90006e943686cd940e52fac9bac94ae62182b04c1578cee27d67db0507d531d3c3b0b159453e2fb5e1bdd8294ad7c3621b753e9d209c90cd75cb42

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
9ba4df16aac6c1d51a7af501793012c7

SHA1
d8a0394e9d93971d6835cc7856909b74e2cc0b46

SHA256
aa2b7f69e6fb114af8106e1a9fee57af8c68e19bda2652e8bd83eed0ee890d7a

SHA512
661f1242f91e133fa15e71bf2d6c16584a1b07dbf76ec981af7eb6995d6f1f6c5add6959e660c8f38570c33ae11441edc5ef3d6dd47d1b4600ca5130e21a7bf3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
807419ca9a4734feaf8d8563a003b048

SHA1
a723c7d60a65886ffa068711f1e900ccc85922a6

SHA256
aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631

SHA512
f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
553B

MD5
e9b730ecb4e03acf474099c5c462c37b

SHA1
2812221f1bd1eeaceead47e88c912f97313c6b6d

SHA256
d6839f414feaf20b4297af76403e219b9096f2d458de2cc6d61e5f13ea007aa7

SHA512
82081bf3b6c3dd6a60e6c3db62a77de73a98b63bfea86dbe3679f931625fd113a3069624e55c7ea1713237ea94a228ced5e36e1bd886bb4763aeb2d1bd041fa6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
390116d631ec8e093af07dcf5a78b706

SHA1
c62afb565438954c9ad3a784ceafae5b279025dd

SHA256
e16a1260ba7f8336af250a43cb78ec735146233c0f9434afaba2724909d124e5

SHA512
425a19bda33b663adce7476a8426ea68c970d725b8d98a42489da964c1a9f71da635b315a08d852d3b5d6e87618f64df0294d3dbcff67b113f81bd8fbac928b9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
553B

MD5
524dac5daa6e7f33af646e2ef91ff426

SHA1
fcdeb61474d4a820787f2570e3605b2c84610549

SHA256
6401e609deeaa602979af58846c4e4819412f142b79fbe67c04fd11fa16dbba4

SHA512
a0e637bf91489a5bc99b3bc88a47f798161ec367886d247d87b50d214c2e48c5a85810904203adac97803dd41ba82d15b54139584cbf13d352895daedfc30539

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
06cfb79848c780ac9bde8f57a5034ee3

SHA1
2f5afe4032acb1f420b6c78cf1fe2e2cb8509973

SHA256
aa82213cfa925ee403ade05be2ec74657753b2a893796e56d8c33b8e06ccd342

SHA512
d91430d9e2d2cb4c131b77119dcede6e203e1f5f465e7c311ee1b5404dd0342b7e517c73752a84879859c5bba5b6bcf1af3d13b13859bd9cbab78698a54f4822

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
3e935f9a0c74eb27972450957b59dc38

SHA1
76c6802290d2ee91360f51b5d6212fc6ca1d0858

SHA256
bd01b7e73426e1797a3ecc8fb2b3c85bf542a58cdb955a9ef3dd439640a6768e

SHA512
8a60857cec742a56ebae1acd43fac34384aba1c91ee8d4143e9380499e2a3936174df7e7042a2081813da15b43149944dc305c71cd6f296d9fe6470b7ce8ea65

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
d72eb19ed91489bd7ca5e5ba9a8464ea

SHA1
9d8927989d5ae4619bb8430e6b04f639088c43f3

SHA256
bca911a013ad99f55863f58bee14b45588cd3e23915394b33de54f2856d7382f

SHA512
0798f5ee56ad48b40a44c896d9b036dc08e216ed97ab142e1ad58b3f4fe46a0a7d2d1a41b84ba5188b9405fd7819026bed3a2c8ec76ba86b7e7ec89fed1a062e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
749b75f5dca7c060ed82f8ae5e5abc69

SHA1
daa50381fe8f569aaf93dc6eaf1d8681dc2e45d2

SHA256
985ccba744300014bcca7bdda8ea244a1bab955169f24ae436a154247662460f

SHA512
0e9dfc9f63bfa30870d74468e929d81d7837072509303c98440b1978759536f8a93723dec90299a852662a82741b685212b391bd70f64c9d5cdc5ee4a5adde23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
6c081d1a8ec8b53569ee5fec074edc36

SHA1
88a9844dd25496e376879e62ea1c25ec5d193c34

SHA256
68b539fec7869747c888abea9da2ab1a9b2032fa79f4d8d6d463dcb4babd83c9

SHA512
cf0ccd9bffcaef0c218d046febc1ec8f2d2b240102b6e872d3982d59c83358116661458c10695a6ba0ccfb0c898b6230b9c6b4a57a7e9e13c80c5303906eb834

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
68fc78f7aec068de5bd77b7c4fe3fbae

SHA1
8239f48d2199ca678c53012de9aa90d7d610c8d4

SHA256
e523d41fcb8ff300eb6bd120c05f9adfb7538c683f9ec7817823ee5959793f1f

SHA512
ee3b4b1c6080e63304e734d19e339e9a1553f5a70968cb8d104c50d5399ee4764eda899cb9b796ee5beed0f1daed50a9a6df55876b2a77a53b1c2081ee3a8ad6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
9f19c5521e48731be23f5b93ddebbe34

SHA1
19d6c33ff0d67796a4f337d48fb749bf9f1af33a

SHA256
b3a4c24841beaf30cf0d8ef5d4e583331512264863ef0ac70b1bd31261c4d4b0

SHA512
3801a247c08081aa96f625defbd18bbd61697bdfd7fbe93bc60bc4a9c4f2b105ccee067e84094c3e84ef6c350445c09143c5da6d8bdb629a404ea8a490790a7d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
8a77a0c14924aa73d9e838d69b9188f6

SHA1
ec700ba7035f44f1a442103c3513d95c956cead2

SHA256
c2a665d133139e6a45cc42bd3944a15af3cb0512c0d8ed5d6afd8706729c6987

SHA512
8eba7778abd896d87660fa07e78b35b1b2681b83bcbee45e49de5eefe8e4e8020a5f8d5a7f02c690d8822b28f05cc6b7871d0dec71296cb7d69b34798f18e1e6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
67e5669d0e9bee404fe88d9acd0fafd2

SHA1
c5372daef1cde55dad8eecc3b6fc7f977a3ef41a

SHA256
509d897549a4e65370507547b31c5267d7cd787261c01ecb827fd2e8c0231077

SHA512
476d939cc87ce8d7609384b115e2177eecb29d07338f25ad1af001736d7a19422a42188f849764f75b5a2e0844e79de6c859045d4f707ed59686c969287cbdfa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
53fc38894975f43946ee6560346275b0

SHA1
2af85c0b001ac03be3a04899e7d422b997779ca0

SHA256
1130baf5060bc37368f013a03544c55906630b22c3524b124b2d0b40ffdfe82d

SHA512
1ddee44a639e1264d56ee5386ded3338316606484e6af65ebb1abe14985257ab9aee5090e035e59b8641dd644b019063c8a5b1a407fa5c7f38ea176a91fca341

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
493d32439c6a8a8f3d3bcf52e6dbaf33

SHA1
d1453745d38d8b5440a0bef87d8c3b245593ad03

SHA256
92809cbe49652082f11aab7b367b1fe98a3d7573f15c7c468962219e686b53af

SHA512
cc8cb89ecdb7a90872b386e2d58d57b21a5cc20ef6c9ba1e98a77c1b1a8c2ec5f5203ed77ee84629e9237b5de530f3818e0400601027d2bf4db81db7583ce7f5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
148b71d0a4a1e4ea53d06ddf65f5f6bd

SHA1
bce033080bf726b9e08425910a0352ebca7f3f15

SHA256
aacc4164fdd6b0e31100976a5b04c4413075138ed505f20b97c1bf26dcd32610

SHA512
cad1ea854cc665ede2c0ce4055a78278b5ad343e9a6889c619606aadc2b756dab08264b09ee100cf288e8160f192da6576433366a08e8cbe9428ff3c3b80a990

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
54da5f9efcba34597e957cf398b306eb

SHA1
6cf3a1b80051b799fff7846016529315c0a03ca2

SHA256
f025d304c7379edc5ed6458d5986d78c60d8f7524c8a368c62799f1ac2e936b0

SHA512
5907bf15afa1e53a28665baad7ac86e8d7ed41551d167e49196a5edf2d1a3a8eb5be6a3348a8d2abc95858eaa30d8331e74c37d283aea6454320cf476c6fca96

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
d405dfd6e385fe74c6a7101e3ffc3d10

SHA1
74f28ccb93914e8efda3026866ca42616e6c3ebd

SHA256
2cee93dca79dc433e8e8ebc2b45eefda9b988b94150a6f3ba38286964b50820b

SHA512
4ef290ff7d215a5d296703bd68c308f43142b2b788ba3a920c6b99be1ec3a2cf934a45648eec20c6bcde242f00f15d067efa0f3ee8acd18c6ffef112bfda03bd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
35de7ac82c84dccb2f6fa4dde3989877

SHA1
050dbc69dae545993e144f05a3fadea924f7c65a

SHA256
66e5151304fdf6920970b4502f4c7a79631f90e1f4273363b0e0f052e40ae22b

SHA512
69519c77d1e8c1791e04572da55e1535a7a8574a34bc330e546cf3cdda3be1974f5bff147eaff6306776218f712097dc028cf2116498d848446b398d8cbecf55

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
065fc546bb5e59a9db3f6a164bd274a8

SHA1
8b479d7e5dad3c8d7c6897dbc445c6512363d188

SHA256
e3a0935ac3d86de9017a535043beacbe2f29be5f9562f670974303105c6466b5

SHA512
f8d7d582d511d39527a69b252a0cb32e67697619529a2ec0bd8d1cb33e2a9777623a572aa71bef3c8600c49adaf2b8f2d334a63697a39d5d23ec9c71b8edb4b4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
ed08a9e0125b14f98cca4f192b2bb7d1

SHA1
81d0e4f411c334653de42c591f57ab757be54775

SHA256
2593fc4959af8a3d75bbb5a32341bf5670101595da07471662fff25d2954a3f2

SHA512
789f4b44e5978575c439c87d65ee1f1a26e74b8b5b2694329143bbee3aac7168e6dde1d6dda680ba2af7b9043e6a3a7cb5e8c6c4288d4c3a2ad1f6e17f2c44c8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sessions\Session_13355181605049211

Filesize
141KB

MD5
b4c9bce230429856316574b7fc6fa07e

SHA1
31ac24ccb934056aa1ea4e0bf574154fbeac5fa0

SHA256
1d98f5a67d8e5b53190ad0d143ee0d420b2e1987d27b7296e36c2f99b89ef9ea

SHA512
95ed98ea9b4b53794443f7f656eec5744cac4e3654096390ae0f27d5a1c4417ff57cab6a02e12fc61f5f6c97d0792e8aaa74e7010d93d7566f39544b7d601387

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
490241fe49bba6a576040c6f41cc935a

SHA1
da20d670667c922cc92c7515e5d4d0325500d1bb

SHA256
f06cc7f5adb43445f27517373bc65d356ef3736bf0812c7daf710692fa34adc8

SHA512
b6ff213b14ff17648f18c08f0e2b295731119804a95267fdd5f209e8b677a5084df3f8d16adab042ae2612d4a9c50773d441afd89379e363ce1db8a2d340f252

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
c72173d380b2f8751f794186f55635ee

SHA1
ef7c0299a5c542fff9586004eb707207edce9693

SHA256
9b85b27a3d0cef0df1ab05e1f6c510f02e19adb82cc2fd99f58c1e623c2b7984

SHA512
1ee405ea5e7ac6ce3a58ee9da5ed9a0290673f459fa5d4972fa591328091b22d5ebda28506747a94073a2c5c66de2e2f853089668c1281eff3a120724ff82e5c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
af2cb9f691eb3a82bad12227bdc1008f

SHA1
eec2f9c3f0aa037ca42dd738eb8f4bfbac1ac9a8

SHA256
56855825c4dd8468ac7e7e29a8ebefca1e1d5be4b3cebf3bfb93266d545aa122

SHA512
3c4db7a5fe2a87caaaaec671d33ba896ee4ff23ddf763c23dd1119d22077531a78231223b6c63ffd5761770cb0abea8f9aeb82873d8b00a14ee12b637022a380

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
e1a677255d2164fba77b170e54617487

SHA1
644e5d1fd8c1805ff1562c392968c660f991d55f

SHA256
9e5d57dfb292b6164bc0026b26ae2fb67830646517fab9456d3bf60a4b4f55b3

SHA512
8c74d9fd73806d1272be49e67ec1c64902f06b78aba65d8427f61fd4d86596976108ccbd2843efe78141e0a1df7f217a9b660d202ec4a6db8bda621ec633436f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
f8896b56c76e8a026f68956280c09e6f

SHA1
2fc65388857f3793213321847a6592a71a7c0423

SHA256
5acea7e9c628d31d20dbc6986b944febc651ec6df519ad3217f6d2e8f00e565e

SHA512
3cc697f8791da67f9f706e34900667d74377800d1aaa50aed9d18daf5931e2fba730c027f951578047bac0ba27a382ae6ede60747b9508129cd7820c87e96526

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
5f4d1bcc15fd89b9020864871595e330

SHA1
2ca1fdbff9b03104cdfd0702932ee7d12082cd84

SHA256
9f4b95ea76c58edd19ef159e19d577645ba2b396a3dd92ee470e82748a470445

SHA512
a986550180429bad62907ef4919289216df7e0894606bc820b112b4e96396c3dfbd5238abc8e2230fef9c9220cdfa7383c992ca6007ecc50bb8ac562ad175d6a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
023b4e2ca6032ff90d9618b5397670c9

SHA1
d26f38629966c130b7dfb20fcbe950604866540a

SHA256
97adde557a35d872180f5647921230bb3bebb8ff7a9a531a25dd00cfab36fd38

SHA512
a09c56b5fbb1003274348c7ef14f69e6f18eba48bd6dafd5375e0f837c043a2d475f3770394586a4c420e29353fd1a7f5fca66f4753b97bf748ae561a41228dc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
d5091109bbeb711ca624b0a8bab07103

SHA1
1b96460969c24fc949c68800a47075f72adc4573

SHA256
c8c797a1ba5d58859215883f508809486e4381318c24723ab774b8cc92ae1f58

SHA512
540604995e51586514892cc7206dfc466dc5b09b6fc73ae9a549117c7a22245f037f06e039a0f67e888862dddcce733f94c576cb0dd42af083a9b0a006c668cd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
4b4e585b8024ca5a3225edbd9f2d4a80

SHA1
30188e4ed9e6125332f631caa5aed3bad5c10d61

SHA256
c19e05d1900bfe5267704b1e952638f50cf2d63027b47b40162855563e6d0eb7

SHA512
a437b8983030f22c494c56d860e855cf9bc518bf00450bd4b00e491ae05ddc8fe4ce7cd7de3cecc90561b195634445fe500f8c0be5c39b1917a149cb62b29ff3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
4dbf0cdcb40422c9274de89bde1ba809

SHA1
ac8c16ddf1060baf00a4de2ca754a6700b249f80

SHA256
4c9d45bb05201356915ae833ddf80d6db776bb25f87e42575e2d76bec026d9f5

SHA512
95e39dd2983ebad266d748abc93cf184ea1313b15fdf88e388554c4a22afa6e27f375ca4f012f320c4db62cae24ffdf101ed398d2831afa0f20027979f448b90

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
8b2f693c0421d6b6dfb678bc3c648905

SHA1
b246bd582902dc0e71091620e1f88d4f48f79084

SHA256
3c548eafabde19634b255b99ad06def4a52a331f51790ade5362ae8e6c755ff1

SHA512
bb668088351de533aa27551a572c3ab328b18ab7f755218c2eae8f1e6c144e540ce6ff77b47b41fe6f4f2c2531d5b5aa7f30aedc8d1d2d1407509d1eddfd1cdb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
18a51fa6e3009f68f99581b77ae79c02

SHA1
3c3871a02ae3a2a6157d461ce51b17f5268a269e

SHA256
1a90651ec7076179b8d9fd6a3adb86c151d82d0cd7b1a71b948611fe753c6582

SHA512
4132cb3c6485e22d247e2ce254548bd85057f542803b298d706025ea225ac0e0d11063ca4c74c0906f12b071e6e75b9e3ec69574fba35b1b1d3287ceea5c1629

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
17f90699513fbbd498007fa875a9dd48

SHA1
21ca9e4379351abe76997b2613d0700f26cae29b

SHA256
1144628faee55c1180830942a73effc866eca11fb4106be1e3d029d857ac229b

SHA512
fd2ba73f86cc68ca0302398e474191f50a79a28594b6a52bf766065082d1705236871b5daa1fab4c8a7348eb10d500001a9bf6e330b7f54ee718cd97f0005d50

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
3da71739c9cb9d4f68d46301d54a2b1b

SHA1
1ff01310e7cd3b2d8eb6e64370b32013809f1ff7

SHA256
40e02a4ddcc8895453fb84591410790a8fd5e458ff3be7f029976929ee53b903

SHA512
7a050735f5f6f6255c5e7d06c172fdb84b3f692521240b4581865ad6146be6b71b3f0e32507e12caf802a6495624f8e242d1cf0a01990972b2b0e950dd7b514e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
dfc6e868274037d93bb61aed2ab14254

SHA1
c0ed8743429b9004db359fd5b6ba8279fd743f05

SHA256
4a2e66037bcbf46db89ed50b39ab251af04666e895a075c8ce90d8706332d2b5

SHA512
329b3c656530490c43d56fa2d2400c419a2d414fa9cc99052f830cf7ae40b11bd5b8643c8c56611e9d9108a5cdff60af90cb471ff408d92dda588a5a5d93dff6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
24e223996e79d2d4538be1ab8ec18c36

SHA1
e32f36765ccd97cdd351e6cddb3ce4f6a90066c3

SHA256
152689d8582971f2fece36fc3378633605d9e3b7ff378f84c7ad343376d49d98

SHA512
1eb1327468d14c7d0f9d63da166338cae1c80cac5690cb2740ba9112849c26e84a9787fa383fd2a77c6d3d1abf89aee9ffb918b16bab7eaca6449b948e9c3fa9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
a567240c8d3da7104e986f1a4c7f5c9a

SHA1
333823677027a7b1aef69bef37f0b0d571ed7e1d

SHA256
1aa5846bce97283b5ce5941d1aace1b5a606888267a25ce5834a3b2a35a4bdc8

SHA512
12ed3bada3b790a4dfeebcfab4d019df655e5f8cd6f57ec9faba6c55b3b922d09162cfc71d0c282b38240bee00e37e737b4ead2281e99b6ccea912159a6ed3a8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
33a0abc6fadedb4d75ea01289649ee35

SHA1
33ab6970b67422c624159431eaf5502c01f785fa

SHA256
e17a4214b105b14b8ad55b451ace3d40086589197b76e6c1fffae16f89303779

SHA512
b214bef350b26f94b7d8547028181bea0f2c8c3f1aaa2e5335c389f96b35410bbba37d710f4abfafde94a9eed95534e430b100d5a8e6711098d1955040336889

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
6125430b3297284f02ad1404862078da

SHA1
c555cb79bfd86b07a3546d522e553a1902f796ed

SHA256
0a9ab304ff68f829ae8c4ca090ce5d4d066e3725e8ae7238a3c5ac7c347d2172

SHA512
dda7ee9f4fd2d99dc24d413b882d7c8eba2f99d5adcfd989de3b944f18c97ac8248e5af6b118c24c4bbfb9406ddeb758cdbe5701e2e969adc579655413bcb387

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
59f2f2bdd8d327143f8c11dfd8d902ee

SHA1
436ac03c35b5520dae9239952c329983574b9e8f

SHA256
8ff4aea1085e4939648b56f5f20e877dd4b772fb2e937402eeb286e896515f01

SHA512
d06062be3467d7c6a3e2f9baa38b62274d64cf7e2e5f2b87e0e6f2c91386e47a9d2aac2986fed9209ff7e1e0b6365608708cab50e86c0573ffd3420437a5bd3e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
3cdd43ff21e1932bd4ccbb8c5c57ced7

SHA1
b3b09f57fb536da85e9c87ac36cc99b165ba1d93

SHA256
a762b061a5c26c869e338e431db1247417c27474cd23c2eac615cb48f882d305

SHA512
026efdd6b87556ccc175a47ba6ded63b2edea87f0000b6e6f9ac82e27b05dfa592b390ccfd15f5bc75a1c3dbf44eff4c86a92263394d581927c136360c6ec865

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
e4dfdd4da1bf8e92142c4aa61711afb6

SHA1
51c985c6e7e305305d76bb6364582e0f401e3861

SHA256
369586fd50faeba94d73c3ca628b533145e4d02a080466d05730dda059046b44

SHA512
83d98a1a247f6d0215efee7c5f8beaebd1456f0d889eca56df725e490b3339f73da90fb12b54860841b92241fc7971cc50c3f912a1d2c79ec57fdb4bec7fdbb6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
4e59e8214cda9e4df3b42a3ee3b7ca34

SHA1
9f5a642c581d755799bdeaa01ee0e1a0c6d327c8

SHA256
3cccbb3817c83a94ca5627fc9d5e9e65b2870f77d900cd28b5d72d803ea2e511

SHA512
d6aaa343aae05b427e537ceb1a0da2425b129cd466aeb6a83544385680f8810a0797d23d9af213ee3e25ee42ffec9d387db8e4001aef6bc35ead79ef7ad5b91b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
2b80ce078c3c55b8db0a86ba59eb76b0

SHA1
6436dcb948863a6cd3a27d8e668bba7750ab2ba7

SHA256
4667de4d656458a1dd9800bad62f82050d40f958b517ec585c0cfb62b702a27d

SHA512
bd2a2c3f73d5e2740fd70705b9e290f8d2079e64be3c6e271bd7c865c7ac892a363418dfbd657fbd2a42f4fe18e1c619c0a84c627122afa3965f91779108c68d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
21c98ee4c4ed4f2b4d45b17ebb6deb99

SHA1
e607856a87faeba25a72e74ac800c3320acde890

SHA256
551426efaa82902d18ffa07d8f8942aa47fc82c59abfd0eeb5803ba5acf67234

SHA512
60c0dfc716abf15902257950d273daa9ee24a05f633a54358c87fccaef3a835147bae7dc6045c2cbb13c6ec30845660934bb140f5041b81c60d742d16bbbf821

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
d817ec136cddd23792b08721df81b26e

SHA1
1ff1d4d1baad8ea63440be09f17c63360de07378

SHA256
bf246b4552cb6a78063ebb0442c5d478cc7c7ad6f0aaa4025a93cb83c094c83d

SHA512
9a5d44851e25349cb7caead2dc6543b905d845eedbffb838a39cf006730fab8fb0f43ad164d2b55d5ea0552c1fd9ade76dad95139ecd0f6ea433633c3cd91386

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
1c13d60a95ecf045fb1225d5fd9020f9

SHA1
0a2e3dc8153b5baa97db6d78b60d97ca8226bc32

SHA256
ded0cc36cc24a83ff063aa3d4879ca871f73bf99a30b85673e8871ad4911d228

SHA512
e985d2451a5191303c3184292085253a01ca1de0c65e1fa68929c4e63afc01e79f94580e6798f1880efbdbe6f2f10d01a6f2414eff56412f6944ae568fb300f2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
0f893a20a810ef70ed5735a1365ee822

SHA1
5c4db9297b3f20f79dcc5d573034bf8cbffa4789

SHA256
0df34a6b0a5d17dc9a90096616e7364fddbde4967bfc592fb78f8501094e4c68

SHA512
d053ad3433d5e381553f725248e3c66857c6d28026e0eddfb5cee7c60ed08f911ac76d6f8d63782825dcd271cd6aba2f18db92ed3a08cf30b5c6e094707eeb67

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
f52d7eb1e73bd2dc41fe6d7008978172

SHA1
8f380dc6c46e796b4909c31119815f8a6cd7fc56

SHA256
83f27255580ac91ee7e9b898ef0d62343df7c9418cd32ec1f03bfa4b98713631

SHA512
5d915913a8f8cdf12043f4b92529f95740ebd5753e4a6511f19598f6a79dbb22f4120b4ccfa680807415c422893f7e37450c102dac8dcec8ac6f018599baf129

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
85d98444afe12b1a6d7d4bb4fe712293

SHA1
36b51fdf5b8709490d3a584a20c1cc52cbfb4955

SHA256
19a3bef9a89cd6ee18d0116d1bc05a6daf866b89f3574f4955d7d15fc3de4414

SHA512
98b8c798913ebeceddf7850bf292da4ba8a78e78b4aa43ba40f3acfabd52ccb6fb6e28a86761f394d23956dfe9eb2af40fce7f8df168817d776321cad0dbf67c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
ab80b37c1eb4f10e68afc7907e6a5853

SHA1
e5b2ab7bf4d0bfb4626d86519f7c80fcad8f44ba

SHA256
664c424b890f22f5a1e3485c3b2b5f72f6e08dba43628be07aea50d21d665a10

SHA512
92e9698fa92dfc774f89e7ace1cf115969e39113f447a900075c80fd3397481ee8bf8064056324f064763867adb77a941a920de97a508065e6229a404aaf3afa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
06706b7eb7c1ad07e8f959598fc6318e

SHA1
9799d653a9400008cd503bd9445d527bf2bc24f1

SHA256
f295026f2c80334551924048da4025681d75d7714ee5eaca0a3a38db9c1018f4

SHA512
cfebbef683cb49d67a9c81f38e8b9ce105437eb45d7e2da3a84d2c6768ac6a81d5f4282b5e31e1d5a3f69d9c5a7b1736245d5bc710706c18de836638c49b3843

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
16dc7b6b1dae05090046d0ddef235f73

SHA1
719b452ebcf5ff174f5b446955d8f33c4fa429ca

SHA256
b2f91848fbbfb0c4c4c8a9c56659721a0c8899aa3083f365a073ceb30f9c0ca4

SHA512
ea7ce073044fa89b2c04fcc87f214d38cb6571b585405248a249f0af170be80c5a2ee6ac8d894c616f17af4c5d834fae0dd541ac931bd3ff0bd84113b03a0230

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
177da934708e5a840c8bae0fea0b8a91

SHA1
20c8d11a864dcf238fbbf0d0af61c84c72fabcf1

SHA256
641e2b6e27a6af01d8f600595a8b3b242b1defaf05472a23dd7c9b78fc2c5c82

SHA512
3f0d6efbf5f35bd117b5f5ab29fd9453908f66f832837b0a29c54e6dbef6bd8197221ad447d1b5f1bc1ed83a193e6094233e70aab095103eff5304ee680c06f6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
d2c43ac905b7eff31b02606f09ecb499

SHA1
dc1c0efff6c92d0f4e0e52fd1135a682f872508b

SHA256
ce33e25edc324540a2fc6cd7e5a14da71c736f45a7f369ad563d09595cc82301

SHA512
75813297b6adfa3cbbad218b363960afcd932d52d8d20aecdd06fa23204ced1be3d334e345b97d77c5ad363ecf3a745047dc06459c07d7b8ff8ac71df0e81beb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
4fedf95a1ba87fedc2dcdd978e3c20c4

SHA1
eefc293dc80a7df187b6430207e0c1985b8ffacc

SHA256
0549a1277821f1fca185b95cf6b989783d8bfdc07f8aaca5642a83225117c229

SHA512
aa734bcb7b46969033ee3379319e59af41b102ed11ddf22c651ab8df44370dd41c388f96f714f47023d7ddcd419368c4100242768a1617f6cb1dc56d07eff8fb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
f7835f75f0f4d1f7ae0e8093da6380f0

SHA1
e9ce8bff8421e9d978fc00a1168ca7f0c1faeb43

SHA256
d37ec32f88868d3649f2b056b44eba341616fbf5f8b8a39961780ac153e95576

SHA512
e26f47234a64147d52605f3860e410dcb726af604bd76d961e4310f4be21194576039158eaca2410cb921d3bdeac91236ae0edc0c23cedc0f137eef97bf1e73f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
79bc558716dc76f0fad2bc3e884a22b7

SHA1
fc1ac298317664ee47ccc2d4cb6e5cd3b58b8c87

SHA256
28d3afce4236eb756869ee1d045aec0488a132e44d9784d8254cf2d734e5577e

SHA512
aa19f618fdc84813c473d52037c6634c021cd2419958cae8b150688207a62340a06ac306d45149828870b97feccb88b2c8cdce3fb8976aa0c517ac9a71fa93c2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
2efe91db52586ae87875b541b3276e0b

SHA1
9e407a0b7e1cf872cf220b7bad6efcc43ce556c8

SHA256
470c934853c3343affb140a4ee5f6ff73c925000a37e58d17843be7ab12c5407

SHA512
94adfc5b817a6743376199f60da40467ca18f505794bb3140aa98558c142be24f1700ccc778ae378b9ff3037216478722d323b1322b7967c263ffcb784fa4f49

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
0ce2876939e40c5980cd8ffd345a1979

SHA1
5c95f0c212732b37eeaa7d33488e285d95bfc07d

SHA256
59e7236674e8d7849989bb9632f1ced80abce908b56c58c161e4548b9c039921

SHA512
fea69e39438551967ddfbadb0c446b5569c0d9405de9cba79a19335e6db79a4859c6c329253b6409674d171186dba8d2d1f6049b5beb12d31d675e8755388e53

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe59455c.TMP

Filesize
536B

MD5
deaaf26478abb91f73ac8346d20cd714

SHA1
9ecc88b1a6081bce4f038ed40f1b739c92671394

SHA256
db1dcd6af908b423e2fbae50e445ebe3aa653aa63f5bff526ed844ab51b40d35

SHA512
924d823b0855458d8c775443e480a4f0c5ead8de2ceda27e4a58bec42db6c0ff4d67f8249653e7a621dbdc2116e6a85ae60f3f553c01bf53f3a70ecf7e049f5a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
550cb5d3cfb8efd72dbeae62e3f03930

SHA1
ccb226769b337f86ff9eb008db00730eb73ce37a

SHA256
c5c209a1e4ffb50cd96ab3e2ce2bbd6654f03c3c8d0f58ac9219c362521df6a7

SHA512
10de2b2384fd101a4a2fbc7a00335b264cf4b634515e94a4ed072da6d5b57cf4c7f67ca091c225e8d314ab863e132022e69879e92911df0570f775df00629c37

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
fb2c12483be71fe7369b7e0005abd210

SHA1
bf44a7f532bea22c0c2f7218efb3ba5f4b09af95

SHA256
6dbe1e2e65a0498d2ad3dafeea313ff2fe8ef91ca6fd3cc5402d06da0943b4b2

SHA512
ad9d64695a66af285e6bbb84015a9899af8d98cd6aff8424abb3ce8221226c1809b19a3461fad7ead32c79e6e91ff41831393d186f08c8df1afbdde755ecf4b8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
93e2deeccc5da56609cb1b9533bf3831

SHA1
13348c4ad61cf6f4813e49930a0f5f3183a4485c

SHA256
31926322fe021a71fcc13238c2b05e515d5dcf855f2e42b8916f39352d937dab

SHA512
6e339c047144d3289887c1be5f044e9bd5b4705c244163ba99f44d67f4f3d97ace6481c5ac53831382cd106909cfe8694497c098742f2aa0bbf2113568e19827

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
f20899baee98ce703f5745fef4437f9e

SHA1
b5242cdef3cf8a3ca53726c52ffb2ef92ecf619a

SHA256
3c6dc9650aeaf5151221671b1a470ccd3873ab6ff5f318d4ff77b401d12e7aa9

SHA512
9f107328e6708886e9610043d23d26df0b673471584c4c8642c1599754ec1f13c2482ce44b961708e7a55026fd70d72cf68463b83a24a178326f37e04df0e90f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
100f90dcb9a73c90d5ef0412c67f1c6e

SHA1
f5d8b683405349fe42e61f2b43f150b208eccf1b

SHA256
3d4428eb065350b3932843236b06464ec8d0a18da45631db4ea7e04daddfd1f8

SHA512
92bccbc7d1d01d23c0ad572d6f2cf715054dbfc2bc82da8e1d7ae37e890bdaa3023a3586d0a833ed4f9e1592ca8da33daca4246bf2beaa4d0f97b4eff7ffd1af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
40a4f09816af9a0b9dce602a8f9b4b4f

SHA1
3f1cba4e37f39de0c8a218de1e35d5dcf77d5e2b

SHA256
a64ec6e7341fcca07a713bf20b27ec103a67424493e1836635f1849a269a15b9

SHA512
67ad1e8375fa492c62e957348c8622a9e156358415edd427e76ab72134d6255aab0505708bad6450d4f056eaecca23fc0a75b9a1a89a151fbf34df9f647170b2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
4dd6f9f5e586c858658e26b4aa9faccb

SHA1
34f35b7490329ea0bea1020a9989dabceff9dc3a

SHA256
476eabed972e2c05eb9bf33df71fe9e2e41299dae6f0ec5bfab6c4a487ea23a8

SHA512
54337b2343f6a7625e5caabe42b32577f3c20f79db2c393b024e9252d2ed6a5062c4821c939a15b50f5c58902b6a3637ad9bdd7cd208ce8f5ee88e682f0ce955

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
604f5a2655cb948bdbeaa1061a258ae8

SHA1
f6bcefd8a4ad39e5cc9dbc0069daff1d3d5522f3

SHA256
3b0876ce90553e3cf2ecc13bc5d65a7f2ce5c7edf36f5899f7bef5b7a86a001d

SHA512
2d606d3fe852b94f040b86d01d760ef0e7601cba7302f15a1b3fb0eda2ad3d26675ffcc372beccd4913747e120bb3398aa33193753da7e366686eb42303a782b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
d1515604b1d6e97ecd5f6d96046b6b89

SHA1
497503ad4b91dcd585e91dce0b5fcd3daade351e

SHA256
fdc9f3ab63d964a97ecf38e70a76db581166905cc31681e04296c4bd3e9819d2

SHA512
17f3bd9cce0836661fd021d41cc9f97969df2315d78a9a71effb16faf94c70e6f4c06d51b3b5a123ca58c4c0b9e0b769d63e4760ad88d1e88f63153ef87dda35

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
38f560cb180f1f9760e7ff6e389b994d

SHA1
65612962d69aacd40b1bfba415ddb369885802d6

SHA256
0051e421f8586378e486641908f2af09128159bada9ef9286c5e01cabc16df36

SHA512
451ab10a15a18f64acccdcf011170f6de8f8ce81191bacc120a6124aa67912639e5f38eedc5b44d48bed7bfb0d1bd76cdfd5959752eaf4013d13d43b9d2978f2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
6b7202477ee7435057a4e1e29be9134c

SHA1
7f3eb1260f7685e3061eda93a330618f0fc91d46

SHA256
44a287aa0158bfaf99d48dcd888681484a477a8065ecfe98cae313d263922c40

SHA512
91f282f0dc6c6e20d74a593f967775bdaf8e7a58632aebfab9a7ab934290ff37db69a589e5e1e268fedc6f8dd05db9aece7f32dc47f9c296b70fc3ddedefe036

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
8a84b7f319d458585daa1111ba4196ab

SHA1
ced2748f344ad8dc9d27e8249726d7d3ae44a6de

SHA256
fdb7c5bab6de8b0a0859c25f4f1be4f12ff9eb5165e53abb79df785d5a6a5a46

SHA512
eda4796e2620478ae3aec6b9f34df7e96303627802b7124bede59a02b27222e6f11e83ac4ff9f9d471b4bea28703c7e811964e997b258d6f0d2c49b3c1cbb45f

Download Submit
C:\Users\Admin\AppData\Local\Temp\BA1A.tmp\BA1B.tmp\BA1C.bat

Filesize
17KB

MD5
40a4193b987c88472f5cee7a6ba26f27

SHA1
46d83c4a7a350b5a47a45a1d22afd2df6b5c60f2

SHA256
39bbfaded74b1a00cc02181e13fe823638270ec3ae5a2aa2fc65faa172d69366

SHA512
18d51ee75a3c172c7c79aafa27d5672ef9ce63dca96febbf6d185e888c75431d94361188ed4365b1d5f686c6314c57c95708c6ed8367ecf49a24673f8ad64ea4

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
10KB

MD5
3c49ddc854512219424530d0781d8460

SHA1
89e9ea0a7c0bd54d98d8fc11f381dc3f795c02f5

SHA256
eb70b2ba75d10ddc765a62459956c3dce95737ab11332257e0ebf0e1bf0cec85

SHA512
f9f9376ee29dfb0af72896174d248ff1ff8625d2a3aa35d58f4f1d918218758b069032d4c29e76d639641d449aa96ef03a7dbb589789736f9a92306eafa34d0a

Download Submit
C:\Users\Admin\AppData\Roaming\tor\cached-microdescs.new

Filesize
4.9MB

MD5
fcc5e764a22a3c517566d7b7997a75ca

SHA1
0a2f4a792892fc0359ad53993ab46e277e252f89

SHA256
abd15a746d7eaa9aacb9d797b55f43ddc63f7db0b998e067a952b897fb859743

SHA512
cafa14059308c58d580138830356d8a7827c0c46f4dd459e6f48edd3e6425223465b7f09f55d71846b080591dc7e7287da8dcd45cf1071e9734ce14e40bc5b1e

Download Submit
C:\Users\Admin\AppData\Roaming\vlc\ml.xspf.tmp12216

Filesize
304B

MD5
781602441469750c3219c8c38b515ed4

SHA1
e885acd1cbd0b897ebcedbb145bef1c330f80595

SHA256
81970dbe581373d14fbd451ac4b3f96e5f69b79645f1ee1ca715cff3af0bf20d

SHA512
2b0a1717d96edb47bdf0ffeb250a5ec11f7d0638d3e0a62fbe48c064379b473ca88ffbececb32a72129d06c040b107834f1004ccda5f0f35b8c3588034786461

Download Submit
C:\Users\Admin\Downloads\@[email protected]

Filesize
933B

MD5
f97d2e6f8d820dbd3b66f21137de4f09

SHA1
596799b75b5d60aa9cd45646f68e9c0bd06df252

SHA256
0e5ece918132a2b1a190906e74becb8e4ced36eec9f9d1c70f5da72ac4c6b92a

SHA512
efda21d83464a6a32fdeef93152ffd32a648130754fdd3635f7ff61cc1664f7fc050900f0f871b0ddd3a3846222bf62ab5df8eed42610a76be66fff5f7b4c4c0

Download Submit
C:\Users\Admin\Downloads\@[email protected]

Filesize
240KB

MD5
7bf2b57f2a205768755c07f238fb32cc

SHA1
45356a9dd616ed7161a3b9192e2f318d0ab5ad10

SHA256
b9c5d4339809e0ad9a00d4d3dd26fdf44a32819a54abf846bb9b560d81391c25

SHA512
91a39e919296cb5c6eccba710b780519d90035175aa460ec6dbe631324e5e5753bd8d87f395b5481bcd7e1ad623b31a34382d81faae06bef60ec28b49c3122a9

Download Submit
C:\Users\Admin\Downloads\SmileyBot.exe:Zone.Identifier

Filesize
55B

MD5
0f98a5550abe0fb880568b1480c96a1c

SHA1
d2ce9f7057b201d31f79f3aee2225d89f36be07d

SHA256
2dfb5f4b33e4cf8237b732c02b1f2b1192ffe4b83114bcf821f489bbf48c6aa1

SHA512
dbc1150d831950684ab37407defac0177b7583da0fe13ee8f8eeb65e8b05d23b357722246888189b4681b97507a4262ece96a1c458c4427a9a41d8ea8d11a2f6

Download Submit
C:\Users\Admin\Downloads\TaskData\Tor\tor.exe

Filesize
3.0MB

MD5
fe7eb54691ad6e6af77f8a9a0b6de26d

SHA1
53912d33bec3375153b7e4e68b78d66dab62671a

SHA256
e48673680746fbe027e8982f62a83c298d6fb46ad9243de8e79b7e5a24dcd4eb

SHA512
8ac6dc5bb016afc869fcbb713f6a14d3692e866b94f4f1ee83b09a7506a8cb58768bd47e081cf6e97b2dacf9f9a6a8ca240d7d20d0b67dbd33238cc861deae8f

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 182481.crdownload

Filesize
5.0MB

MD5
0805cb0e64e34711530c95e58e38c11f

SHA1
69a8ba560ef1aad2b1bc7614c1de8ed22e19deb6

SHA256
773186144282a63cc3502ad10a3d8fd781a6c83eaabf06de4369b4ef96d93178

SHA512
92b54b1fdf484fe188659b40e14e40ce69a736ae7feb02cb8f165843a18a5d358bf76f7e383d6166961c90916563f308757b6e6ab47ac1c9da8007e33fa1ed1a

Download Submit
C:\Users\Admin\Downloads\VirusShare_af34546979079042a99b99b5613ad26b.zip

Filesize
655KB

MD5
69de4ddc2832ef14228a21a2e6f9be2a

SHA1
0a8c6106870d3d80aee4d0987f67dd6a813c1568

SHA256
4ae162fbde283c2c200784cfd3961580107f5f3d495ec0ddce6f8b55c5301bdc

SHA512
ca57959d6277a6aa4271e8287c453713b7f02dd4c87b20ba2a82aed48497679bd598eb2613628257a30be81f5a914af9f18673877ede72059b33142f06565290

Download Submit
C:\Users\Admin\Downloads\e27c2bab-20f0-49e8-b431-fd0fbbefa325.tmp

Filesize
3.4MB

MD5
84c82835a5d21bbcf75a61706d8ab549

SHA1
5ff465afaabcbf0150d1a3ab2c2e74f3a4426467

SHA256
ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa

SHA512
90723a50c20ba3643d625595fd6be8dcf88d70ff7f4b4719a88f055d5b3149a4231018ea30d375171507a147e59f73478c0c27948590794554d031e7d54b7244

Download Submit
C:\Users\Admin\Downloads\msg\m_finnish.wnry

Filesize
37KB

MD5
35c2f97eea8819b1caebd23fee732d8f

SHA1
e354d1cc43d6a39d9732adea5d3b0f57284255d2

SHA256
1adfee058b98206cb4fbe1a46d3ed62a11e1dee2c7ff521c1eef7c706e6a700e

SHA512
908149a6f5238fcccd86f7c374986d486590a0991ef5243f0cd9e63cc8e208158a9a812665233b09c3a478233d30f21e3d355b94f36b83644795556f147345bf

Download Submit
C:\Users\Admin\Downloads\smb-0e89k3id.zip

Filesize
76KB

MD5
6433f54abf4e649ae5c076da97252fd6

SHA1
8231a9ff03f5ea129c4a1adadb19cdef244c94ad

SHA256
060b8a227885388a7b9f821807e9c58555456a15579d380eb47d9a3c362b85ba

SHA512
402cd31e1c2ec9bef4ebaa8b37a04583e2a86aba25bc14f7bc2ce98ba10da6c6484bbeb4b5ccbad69b0919e69c3b5d9e9366cb5241cf77db622f3221a10b0f87

Download Submit
C:\Users\Admin\Downloads\smb-ij2n4cyd.zip

Filesize
685KB

MD5
3689d201223fe00911729a16ece0295a

SHA1
9ba92765394b84d2f38d376ee9671ccd0832415f

SHA256
ba8590d846de3d959ae39d650d08eed7dad40fd491e6568f24b7a84e8efa9990

SHA512
d820153317bbcf9c8195d0f31dba4b87c0db770d67eb294f438d8089f1c4a977cf3d7be0ece98ccd8dbfa4581ee68d5e163f81090e84d50b8d24be90159d0546

Download Submit
C:\Users\Default\Desktop\@[email protected]

Filesize
1.4MB

MD5
c17170262312f3be7027bc2ca825bf0c

SHA1
f19eceda82973239a1fdc5826bce7691e5dcb4fb

SHA256
d5e0e8694ddc0548d8e6b87c83d50f4ab85c1debadb106d6a6a794c3e746f4fa

SHA512
c6160fd03ad659c8dd9cf2a83f9fdcd34f2db4f8f27f33c5afd52aced49dfa9ce4909211c221a0479dbbb6e6c985385557c495fc04d3400ff21a0fbbae42ee7c

Download Submit
\??\pipe\LOCAL\crashpad_3620_JNREPSYJOSPIAWWU

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/2844-214-0x00007FFBC2920000-0x00007FFBC33E2000-memory.dmp

Filesize
10.8MB

Download
memory/2844-0-0x00000000001B0000-0x00000000001C6000-memory.dmp

Filesize
88KB

Download
memory/2844-2-0x000000001B000000-0x000000001B010000-memory.dmp

Filesize
64KB

Download
memory/2844-3-0x00007FFBE3A60000-0x00007FFBE3C69000-memory.dmp

Filesize
2.0MB

Download
memory/2844-224-0x000000001B000000-0x000000001B010000-memory.dmp

Filesize
64KB

Download
memory/2844-1-0x00007FFBC2920000-0x00007FFBC33E2000-memory.dmp

Filesize
10.8MB

Download
memory/2844-243-0x00007FFBE3A60000-0x00007FFBE3C69000-memory.dmp

Filesize
2.0MB

Download
memory/4976-2058-0x00007FFBB6640000-0x00007FFBB6752000-memory.dmp

Filesize
1.1MB

Download
memory/4976-2057-0x00007FFBB6E20000-0x00007FFBB7ECB000-memory.dmp

Filesize
16.7MB

Download
memory/4976-2056-0x00007FFBD19B0000-0x00007FFBD1C64000-memory.dmp

Filesize
2.7MB

Download
memory/4976-2054-0x00007FF68FC40000-0x00007FF68FD38000-memory.dmp

Filesize
992KB

Download
memory/4976-2055-0x00007FFBD2690000-0x00007FFBD26C4000-memory.dmp

Filesize
208KB

Download
memory/12032-4985-0x0000000073B20000-0x0000000073BA2000-memory.dmp

Filesize
520KB

Download
memory/12032-4987-0x00000000737F0000-0x0000000073A0C000-memory.dmp

Filesize
2.1MB

Download
memory/12032-4990-0x0000000000660000-0x000000000095E000-memory.dmp

Filesize
3.0MB

Download
memory/12032-4989-0x0000000073A90000-0x0000000073B12000-memory.dmp

Filesize
520KB

Download
memory/12032-5013-0x0000000073B20000-0x0000000073BA2000-memory.dmp

Filesize
520KB

Download
memory/12032-5015-0x00000000737F0000-0x0000000073A0C000-memory.dmp

Filesize
2.1MB

Download
memory/12032-5017-0x0000000073A90000-0x0000000073B12000-memory.dmp

Filesize
520KB

Download
memory/12032-5018-0x00000000737C0000-0x00000000737E2000-memory.dmp

Filesize
136KB

Download
memory/12032-5019-0x0000000000660000-0x000000000095E000-memory.dmp

Filesize
3.0MB

Download
memory/12032-4988-0x00000000737C0000-0x00000000737E2000-memory.dmp

Filesize
136KB

Download
memory/12032-4983-0x0000000073B20000-0x0000000073BA2000-memory.dmp

Filesize
520KB

Download
memory/12032-4984-0x00000000737F0000-0x0000000073A0C000-memory.dmp

Filesize
2.1MB

Download
memory/12032-4986-0x0000000073A90000-0x0000000073B12000-memory.dmp

Filesize
520KB

Download
memory/12216-5090-0x00007FFBB7220000-0x00007FFBB7332000-memory.dmp

Filesize
1.1MB

Download
memory/12216-5091-0x00007FFBB6170000-0x00007FFBB721B000-memory.dmp

Filesize
16.7MB

Download
memory/12216-5089-0x00007FFBB74C0000-0x00007FFBB7774000-memory.dmp

Filesize
2.7MB

Download
memory/12216-5088-0x00007FFBC95B0000-0x00007FFBC95E4000-memory.dmp

Filesize
208KB

Download
memory/12216-5087-0x00007FF763220000-0x00007FF763318000-memory.dmp

Filesize
992KB

Download
memory/15972-3579-0x0000000010000000-0x0000000010010000-memory.dmp

Filesize
64KB

Download