Overview

overview

10

Static

static

1

URLScan

urlscan

https://github.com/D...

windows10-1703-x64

4

https://github.com/D...

windows7-x64

7

https://github.com/D...

windows10-2004-x64

8

https://github.com/D...

windows11-21h2-x64

10

Resubmissions

09-07-2024 20:30

240709-y97xlatgqk 10

Analysis

  • max time kernel
    1023s
  • max time network
    1021s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09-07-2024 20:30

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    https://github.com/Da2dalus/The-MALWARE-Repo

Score
8/10
bootkitpersistence

Malware Config

Signatures

  • Downloads MZ/PE file
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 10 IoCs
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  • Drops file in System32 directory 2 IoCs
  • Drops file in Windows directory 57 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 44 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies Internet Explorer settings 1 TTPs 2 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • NTFS ADS 4 IoCs
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 5 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 61 IoCs
  • Suspicious behavior: SetClipboardViewer 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 36 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 57 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://github.com/Da2dalus/The-MALWARE-Repo
    1⤵
    • Enumerates system info in registry
    • NTFS ADS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:3500
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc368846f8,0x7ffc36884708,0x7ffc36884718
      2⤵
        PID:3220
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,17867300732874051658,7311981501055868569,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2172 /prefetch:2
        2⤵
          PID:3188
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2124,17867300732874051658,7311981501055868569,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2240 /prefetch:3
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:4980
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2124,17867300732874051658,7311981501055868569,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2824 /prefetch:8
          2⤵
            PID:340
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,17867300732874051658,7311981501055868569,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1
            2⤵
              PID:3572
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,17867300732874051658,7311981501055868569,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:1
              2⤵
                PID:3096
              • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,17867300732874051658,7311981501055868569,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4152 /prefetch:8
                2⤵
                  PID:4316
                • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,17867300732874051658,7311981501055868569,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4152 /prefetch:8
                  2⤵
                  • Suspicious behavior: EnumeratesProcesses
                  PID:4436
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,17867300732874051658,7311981501055868569,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5320 /prefetch:1
                  2⤵
                    PID:3596
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,17867300732874051658,7311981501055868569,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5260 /prefetch:1
                    2⤵
                      PID:1644
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,17867300732874051658,7311981501055868569,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3360 /prefetch:1
                      2⤵
                        PID:444
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,17867300732874051658,7311981501055868569,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3428 /prefetch:1
                        2⤵
                          PID:2792
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,17867300732874051658,7311981501055868569,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4988 /prefetch:2
                          2⤵
                          • Suspicious behavior: EnumeratesProcesses
                          PID:4260
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2124,17867300732874051658,7311981501055868569,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=1256 /prefetch:8
                          2⤵
                            PID:4740
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,17867300732874051658,7311981501055868569,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1960 /prefetch:1
                            2⤵
                              PID:3784
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2124,17867300732874051658,7311981501055868569,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5296 /prefetch:8
                              2⤵
                                PID:2500
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2124,17867300732874051658,7311981501055868569,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6048 /prefetch:8
                                2⤵
                                • Suspicious behavior: EnumeratesProcesses
                                PID:4084
                              • C:\Users\Admin\Downloads\LoveYou.exe
                                "C:\Users\Admin\Downloads\LoveYou.exe"
                                2⤵
                                • Executes dropped EXE
                                PID:4648
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,17867300732874051658,7311981501055868569,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1
                                2⤵
                                  PID:4344
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,17867300732874051658,7311981501055868569,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6644 /prefetch:1
                                  2⤵
                                    PID:4776
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2124,17867300732874051658,7311981501055868569,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5912 /prefetch:8
                                    2⤵
                                      PID:4852
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,17867300732874051658,7311981501055868569,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6420 /prefetch:1
                                      2⤵
                                        PID:4176
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2124,17867300732874051658,7311981501055868569,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4712 /prefetch:8
                                        2⤵
                                          PID:4924
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2124,17867300732874051658,7311981501055868569,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6364 /prefetch:8
                                          2⤵
                                            PID:2372
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2124,17867300732874051658,7311981501055868569,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5296 /prefetch:8
                                            2⤵
                                              PID:2144
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,17867300732874051658,7311981501055868569,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5824 /prefetch:1
                                              2⤵
                                                PID:2632
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,17867300732874051658,7311981501055868569,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6860 /prefetch:1
                                                2⤵
                                                  PID:4988
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,17867300732874051658,7311981501055868569,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7052 /prefetch:1
                                                  2⤵
                                                    PID:4884
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,17867300732874051658,7311981501055868569,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5428 /prefetch:1
                                                    2⤵
                                                      PID:4252
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,17867300732874051658,7311981501055868569,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4992 /prefetch:1
                                                      2⤵
                                                        PID:180
                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,17867300732874051658,7311981501055868569,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5500 /prefetch:1
                                                        2⤵
                                                          PID:3780
                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,17867300732874051658,7311981501055868569,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4692 /prefetch:1
                                                          2⤵
                                                            PID:1824
                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,17867300732874051658,7311981501055868569,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5956 /prefetch:1
                                                            2⤵
                                                              PID:5072
                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,17867300732874051658,7311981501055868569,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6692 /prefetch:1
                                                              2⤵
                                                                PID:2464
                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,17867300732874051658,7311981501055868569,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6424 /prefetch:1
                                                                2⤵
                                                                  PID:1284
                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,17867300732874051658,7311981501055868569,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4900 /prefetch:1
                                                                  2⤵
                                                                    PID:2312
                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,17867300732874051658,7311981501055868569,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1376 /prefetch:1
                                                                    2⤵
                                                                      PID:2064
                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,17867300732874051658,7311981501055868569,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5764 /prefetch:1
                                                                      2⤵
                                                                        PID:2412
                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,17867300732874051658,7311981501055868569,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7292 /prefetch:1
                                                                        2⤵
                                                                          PID:2588
                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,17867300732874051658,7311981501055868569,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5252 /prefetch:1
                                                                          2⤵
                                                                            PID:720
                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,17867300732874051658,7311981501055868569,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7580 /prefetch:1
                                                                            2⤵
                                                                              PID:2212
                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,17867300732874051658,7311981501055868569,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7788 /prefetch:1
                                                                              2⤵
                                                                                PID:2012
                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,17867300732874051658,7311981501055868569,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7824 /prefetch:1
                                                                                2⤵
                                                                                  PID:4768
                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,17867300732874051658,7311981501055868569,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7784 /prefetch:1
                                                                                  2⤵
                                                                                    PID:1836
                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,17867300732874051658,7311981501055868569,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8452 /prefetch:1
                                                                                    2⤵
                                                                                      PID:4760
                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,17867300732874051658,7311981501055868569,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8468 /prefetch:1
                                                                                      2⤵
                                                                                        PID:1588
                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,17867300732874051658,7311981501055868569,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3436 /prefetch:1
                                                                                        2⤵
                                                                                          PID:4404
                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,17867300732874051658,7311981501055868569,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7608 /prefetch:1
                                                                                          2⤵
                                                                                            PID:3204
                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,17867300732874051658,7311981501055868569,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=55 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7688 /prefetch:1
                                                                                            2⤵
                                                                                              PID:212
                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,17867300732874051658,7311981501055868569,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=56 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8712 /prefetch:1
                                                                                              2⤵
                                                                                                PID:5060
                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,17867300732874051658,7311981501055868569,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=57 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8740 /prefetch:1
                                                                                                2⤵
                                                                                                  PID:1544
                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,17867300732874051658,7311981501055868569,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=58 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8196 /prefetch:1
                                                                                                  2⤵
                                                                                                    PID:2008
                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,17867300732874051658,7311981501055868569,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=59 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6684 /prefetch:1
                                                                                                    2⤵
                                                                                                      PID:972
                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,17867300732874051658,7311981501055868569,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=60 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8252 /prefetch:1
                                                                                                      2⤵
                                                                                                        PID:1412
                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,17867300732874051658,7311981501055868569,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=61 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7204 /prefetch:1
                                                                                                        2⤵
                                                                                                          PID:1244
                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,17867300732874051658,7311981501055868569,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=62 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9528 /prefetch:1
                                                                                                          2⤵
                                                                                                            PID:3160
                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,17867300732874051658,7311981501055868569,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=63 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8616 /prefetch:1
                                                                                                            2⤵
                                                                                                              PID:3040
                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,17867300732874051658,7311981501055868569,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=64 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9800 /prefetch:1
                                                                                                              2⤵
                                                                                                                PID:4532
                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,17867300732874051658,7311981501055868569,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=65 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9192 /prefetch:1
                                                                                                                2⤵
                                                                                                                  PID:4260
                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,17867300732874051658,7311981501055868569,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=66 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10096 /prefetch:1
                                                                                                                  2⤵
                                                                                                                    PID:868
                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,17867300732874051658,7311981501055868569,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=67 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10068 /prefetch:1
                                                                                                                    2⤵
                                                                                                                      PID:452
                                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,17867300732874051658,7311981501055868569,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=68 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10392 /prefetch:1
                                                                                                                      2⤵
                                                                                                                        PID:560
                                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,17867300732874051658,7311981501055868569,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=69 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10284 /prefetch:1
                                                                                                                        2⤵
                                                                                                                          PID:5696
                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,17867300732874051658,7311981501055868569,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=70 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10648 /prefetch:1
                                                                                                                          2⤵
                                                                                                                            PID:5732
                                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,17867300732874051658,7311981501055868569,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=71 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10576 /prefetch:1
                                                                                                                            2⤵
                                                                                                                              PID:1948
                                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,17867300732874051658,7311981501055868569,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=72 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10836 /prefetch:1
                                                                                                                              2⤵
                                                                                                                                PID:4744
                                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,17867300732874051658,7311981501055868569,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=73 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10932 /prefetch:1
                                                                                                                                2⤵
                                                                                                                                  PID:220
                                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,17867300732874051658,7311981501055868569,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=74 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=11224 /prefetch:1
                                                                                                                                  2⤵
                                                                                                                                    PID:5544
                                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,17867300732874051658,7311981501055868569,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=75 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=12280 /prefetch:1
                                                                                                                                    2⤵
                                                                                                                                      PID:5844
                                                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,17867300732874051658,7311981501055868569,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=76 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=12100 /prefetch:1
                                                                                                                                      2⤵
                                                                                                                                        PID:5864
                                                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,17867300732874051658,7311981501055868569,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=77 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10544 /prefetch:1
                                                                                                                                        2⤵
                                                                                                                                          PID:4448
                                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,17867300732874051658,7311981501055868569,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=78 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=11820 /prefetch:1
                                                                                                                                          2⤵
                                                                                                                                            PID:5656
                                                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,17867300732874051658,7311981501055868569,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=79 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=11580 /prefetch:1
                                                                                                                                            2⤵
                                                                                                                                              PID:1580
                                                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,17867300732874051658,7311981501055868569,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=80 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=11420 /prefetch:1
                                                                                                                                              2⤵
                                                                                                                                                PID:6096
                                                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,17867300732874051658,7311981501055868569,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=81 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=11392 /prefetch:1
                                                                                                                                                2⤵
                                                                                                                                                  PID:3120
                                                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,17867300732874051658,7311981501055868569,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=82 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=11528 /prefetch:1
                                                                                                                                                  2⤵
                                                                                                                                                    PID:6016
                                                                                                                                                • C:\Windows\System32\CompPkgSrv.exe
                                                                                                                                                  C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                                                                                                  1⤵
                                                                                                                                                    PID:4892
                                                                                                                                                  • C:\Windows\System32\CompPkgSrv.exe
                                                                                                                                                    C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                                                                                                    1⤵
                                                                                                                                                      PID:2764
                                                                                                                                                    • C:\Windows\System32\rundll32.exe
                                                                                                                                                      C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                                                                                                                                                      1⤵
                                                                                                                                                        PID:1512
                                                                                                                                                      • C:\Users\Admin\Downloads\LoveYou.exe
                                                                                                                                                        "C:\Users\Admin\Downloads\LoveYou.exe"
                                                                                                                                                        1⤵
                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                        PID:676
                                                                                                                                                      • C:\Users\Admin\Downloads\Nostart.exe
                                                                                                                                                        "C:\Users\Admin\Downloads\Nostart.exe"
                                                                                                                                                        1⤵
                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                        PID:2964
                                                                                                                                                      • C:\Users\Admin\Downloads\MEMZ.exe
                                                                                                                                                        "C:\Users\Admin\Downloads\MEMZ.exe"
                                                                                                                                                        1⤵
                                                                                                                                                        • Checks computer location settings
                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                        • Suspicious use of SetWindowsHookEx
                                                                                                                                                        PID:1988
                                                                                                                                                        • C:\Users\Admin\Downloads\MEMZ.exe
                                                                                                                                                          "C:\Users\Admin\Downloads\MEMZ.exe" /watchdog
                                                                                                                                                          2⤵
                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                                                                          PID:4864
                                                                                                                                                        • C:\Users\Admin\Downloads\MEMZ.exe
                                                                                                                                                          "C:\Users\Admin\Downloads\MEMZ.exe" /watchdog
                                                                                                                                                          2⤵
                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                                                                          PID:3592
                                                                                                                                                        • C:\Users\Admin\Downloads\MEMZ.exe
                                                                                                                                                          "C:\Users\Admin\Downloads\MEMZ.exe" /watchdog
                                                                                                                                                          2⤵
                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                                                                          PID:2052
                                                                                                                                                        • C:\Users\Admin\Downloads\MEMZ.exe
                                                                                                                                                          "C:\Users\Admin\Downloads\MEMZ.exe" /watchdog
                                                                                                                                                          2⤵
                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                                                                          PID:2716
                                                                                                                                                        • C:\Users\Admin\Downloads\MEMZ.exe
                                                                                                                                                          "C:\Users\Admin\Downloads\MEMZ.exe" /watchdog
                                                                                                                                                          2⤵
                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                                                                          PID:2952
                                                                                                                                                        • C:\Users\Admin\Downloads\MEMZ.exe
                                                                                                                                                          "C:\Users\Admin\Downloads\MEMZ.exe" /main
                                                                                                                                                          2⤵
                                                                                                                                                          • Checks computer location settings
                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                          • Writes to the Master Boot Record (MBR)
                                                                                                                                                          • Modifies registry class
                                                                                                                                                          • Suspicious behavior: GetForegroundWindowSpam
                                                                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                                                                          PID:4076
                                                                                                                                                          • C:\Windows\SysWOW64\notepad.exe
                                                                                                                                                            "C:\Windows\System32\notepad.exe" \note.txt
                                                                                                                                                            3⤵
                                                                                                                                                              PID:5012
                                                                                                                                                            • C:\Windows\SysWOW64\control.exe
                                                                                                                                                              "C:\Windows\System32\control.exe"
                                                                                                                                                              3⤵
                                                                                                                                                              • Modifies registry class
                                                                                                                                                              PID:2840
                                                                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=minecraft+hax+download+no+virus
                                                                                                                                                              3⤵
                                                                                                                                                                PID:324
                                                                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffc368846f8,0x7ffc36884708,0x7ffc36884718
                                                                                                                                                                  4⤵
                                                                                                                                                                    PID:184
                                                                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=what+happens+if+you+delete+system32
                                                                                                                                                                  3⤵
                                                                                                                                                                    PID:536
                                                                                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffc368846f8,0x7ffc36884708,0x7ffc36884718
                                                                                                                                                                      4⤵
                                                                                                                                                                        PID:4208
                                                                                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://softonic.com/
                                                                                                                                                                      3⤵
                                                                                                                                                                        PID:1760
                                                                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffc368846f8,0x7ffc36884708,0x7ffc36884718
                                                                                                                                                                          4⤵
                                                                                                                                                                            PID:4792
                                                                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=vinesauce+meme+collection
                                                                                                                                                                          3⤵
                                                                                                                                                                            PID:1680
                                                                                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffc368846f8,0x7ffc36884708,0x7ffc36884718
                                                                                                                                                                              4⤵
                                                                                                                                                                                PID:4164
                                                                                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://answers.microsoft.com/en-us/protect/forum/protect_other-protect_scanning/memz-malwarevirus-trojan-completely-destroying/268bc1c2-39f4-42f8-90c2-597a673b6b45
                                                                                                                                                                              3⤵
                                                                                                                                                                                PID:4316
                                                                                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffc368846f8,0x7ffc36884708,0x7ffc36884718
                                                                                                                                                                                  4⤵
                                                                                                                                                                                    PID:4148
                                                                                                                                                                                • C:\Windows\SysWOW64\notepad.exe
                                                                                                                                                                                  "C:\Windows\System32\notepad.exe"
                                                                                                                                                                                  3⤵
                                                                                                                                                                                    PID:3316
                                                                                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://pcoptimizerpro.com/
                                                                                                                                                                                    3⤵
                                                                                                                                                                                      PID:3772
                                                                                                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffc368846f8,0x7ffc36884708,0x7ffc36884718
                                                                                                                                                                                        4⤵
                                                                                                                                                                                          PID:2192
                                                                                                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=mcafee+vs+norton
                                                                                                                                                                                        3⤵
                                                                                                                                                                                          PID:1788
                                                                                                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffc368846f8,0x7ffc36884708,0x7ffc36884718
                                                                                                                                                                                            4⤵
                                                                                                                                                                                              PID:4800
                                                                                                                                                                                          • C:\Windows\SysWOW64\mmc.exe
                                                                                                                                                                                            "C:\Windows\system32\mmc.exe" "C:\Windows\System32\devmgmt.msc"
                                                                                                                                                                                            3⤵
                                                                                                                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                            PID:2728
                                                                                                                                                                                            • C:\Windows\system32\mmc.exe
                                                                                                                                                                                              "C:\Windows\System32\devmgmt.msc" "C:\Windows\System32\devmgmt.msc"
                                                                                                                                                                                              4⤵
                                                                                                                                                                                              • Drops file in System32 directory
                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                              • Checks SCSI registry key(s)
                                                                                                                                                                                              • Suspicious behavior: GetForegroundWindowSpam
                                                                                                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                              • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                              PID:2440
                                                                                                                                                                                          • C:\Windows\SysWOW64\control.exe
                                                                                                                                                                                            "C:\Windows\System32\control.exe"
                                                                                                                                                                                            3⤵
                                                                                                                                                                                            • Modifies registry class
                                                                                                                                                                                            PID:4228
                                                                                                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=vinesauce+meme+collection
                                                                                                                                                                                            3⤵
                                                                                                                                                                                              PID:1672
                                                                                                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x12c,0x130,0x134,0x108,0x138,0x7ffc368846f8,0x7ffc36884708,0x7ffc36884718
                                                                                                                                                                                                4⤵
                                                                                                                                                                                                  PID:2188
                                                                                                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=the+memz+are+real
                                                                                                                                                                                                3⤵
                                                                                                                                                                                                  PID:1140
                                                                                                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffc368846f8,0x7ffc36884708,0x7ffc36884718
                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                      PID:956
                                                                                                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=best+way+to+kill+yourself
                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                      PID:4880
                                                                                                                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffc368846f8,0x7ffc36884708,0x7ffc36884718
                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                          PID:3292
                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                        "C:\Windows\System32\cmd.exe"
                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                          PID:3612
                                                                                                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=minecraft+hax+download+no+virus
                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                            PID:4288
                                                                                                                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffc368846f8,0x7ffc36884708,0x7ffc36884718
                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                PID:1172
                                                                                                                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=best+way+to+kill+yourself
                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                PID:1944
                                                                                                                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffc368846f8,0x7ffc36884708,0x7ffc36884718
                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                    PID:5064
                                                                                                                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=dank+memz
                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                    PID:1036
                                                                                                                                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x128,0x12c,0x130,0xf8,0x134,0x7ffc368846f8,0x7ffc36884708,0x7ffc36884718
                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                        PID:1136
                                                                                                                                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=skrillex+scay+onster+an+nice+sprites+midi
                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                        PID:4748
                                                                                                                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffc368846f8,0x7ffc36884708,0x7ffc36884718
                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                            PID:3272
                                                                                                                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=how+to+remove+memz+trojan+virus
                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                            PID:940
                                                                                                                                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xfc,0x128,0x7ffc368846f8,0x7ffc36884708,0x7ffc36884718
                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                PID:2500
                                                                                                                                                                                                                            • C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe
                                                                                                                                                                                                                              "C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe"
                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                              • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                              PID:2788
                                                                                                                                                                                                                              • C:\Windows\splwow64.exe
                                                                                                                                                                                                                                C:\Windows\splwow64.exe 12288
                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                  PID:3928
                                                                                                                                                                                                                              • C:\Windows\SysWOW64\mmc.exe
                                                                                                                                                                                                                                "C:\Windows\system32\mmc.exe" "C:\Windows\System32\devmgmt.msc"
                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                PID:1372
                                                                                                                                                                                                                                • C:\Windows\system32\mmc.exe
                                                                                                                                                                                                                                  "C:\Windows\System32\devmgmt.msc" "C:\Windows\System32\devmgmt.msc"
                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                  • Drops file in System32 directory
                                                                                                                                                                                                                                  • Checks SCSI registry key(s)
                                                                                                                                                                                                                                  • Suspicious behavior: GetForegroundWindowSpam
                                                                                                                                                                                                                                  • Suspicious behavior: SetClipboardViewer
                                                                                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                  PID:4876
                                                                                                                                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=how+to+remove+memz+trojan+virus
                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                  PID:5632
                                                                                                                                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffc368846f8,0x7ffc36884708,0x7ffc36884718
                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                      PID:5648
                                                                                                                                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=dank+memz
                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                      PID:1676
                                                                                                                                                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffc368846f8,0x7ffc36884708,0x7ffc36884718
                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                          PID:4816
                                                                                                                                                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=dank+memz
                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                          PID:5456
                                                                                                                                                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffc368846f8,0x7ffc36884708,0x7ffc36884718
                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                              PID:5468
                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\mmc.exe
                                                                                                                                                                                                                                            "C:\Windows\System32\mmc.exe"
                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                            PID:3672
                                                                                                                                                                                                                                            • C:\Windows\system32\mmc.exe
                                                                                                                                                                                                                                              "C:\Windows\system32\mmc.exe"
                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                              • Suspicious behavior: GetForegroundWindowSpam
                                                                                                                                                                                                                                              • Suspicious behavior: SetClipboardViewer
                                                                                                                                                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                              • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                              PID:6036
                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\notepad.exe
                                                                                                                                                                                                                                            "C:\Windows\System32\notepad.exe"
                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                              PID:5284
                                                                                                                                                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=john+cena+midi+legit+not+converted
                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                PID:4652
                                                                                                                                                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffc368846f8,0x7ffc36884708,0x7ffc36884718
                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                    PID:5804
                                                                                                                                                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=my+computer+is+doing+weird+things+wtf+is+happenin+plz+halp
                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                    PID:2920
                                                                                                                                                                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffc368846f8,0x7ffc36884708,0x7ffc36884718
                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                        PID:5432
                                                                                                                                                                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://play.clubpenguin.com/
                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                        PID:3112
                                                                                                                                                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffc368846f8,0x7ffc36884708,0x7ffc36884718
                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                            PID:3560
                                                                                                                                                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=john+cena+midi+legit+not+converted
                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                            PID:5980
                                                                                                                                                                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffc368846f8,0x7ffc36884708,0x7ffc36884718
                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                PID:6076
                                                                                                                                                                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=how+to+send+a+virus+to+my+friend
                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                PID:5928
                                                                                                                                                                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffc368846f8,0x7ffc36884708,0x7ffc36884718
                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                    PID:5900
                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\Taskmgr.exe
                                                                                                                                                                                                                                                                  "C:\Windows\System32\Taskmgr.exe"
                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                  • Checks SCSI registry key(s)
                                                                                                                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                  • Suspicious use of SendNotifyMessage
                                                                                                                                                                                                                                                                  PID:5940
                                                                                                                                                                                                                                                                • C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe
                                                                                                                                                                                                                                                                  "C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe"
                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                  PID:920
                                                                                                                                                                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=vinesauce+meme+collection
                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                    PID:3640
                                                                                                                                                                                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x120,0x124,0x128,0xe4,0x12c,0x7ffc368846f8,0x7ffc36884708,0x7ffc36884718
                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                        PID:928
                                                                                                                                                                                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://softonic.com/
                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                        PID:5248
                                                                                                                                                                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0x120,0x124,0x104,0x128,0x7ffc368846f8,0x7ffc36884708,0x7ffc36884718
                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                            PID:5580
                                                                                                                                                                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=virus.exe
                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                            PID:3656
                                                                                                                                                                                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffc368846f8,0x7ffc36884708,0x7ffc36884718
                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                PID:5252
                                                                                                                                                                                                                                                                        • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                          C:\Windows\explorer.exe /factory,{5BD95610-9434-43C2-886C-57852CC8A120} -Embedding
                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                          • Modifies Internet Explorer settings
                                                                                                                                                                                                                                                                          • Modifies registry class
                                                                                                                                                                                                                                                                          • Suspicious behavior: AddClipboardFormatListener
                                                                                                                                                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                          PID:232
                                                                                                                                                                                                                                                                          • C:\Windows\System32\sdclt.exe
                                                                                                                                                                                                                                                                            "C:\Windows\System32\sdclt.exe" /foreignrestore
                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                            • Enumerates connected drives
                                                                                                                                                                                                                                                                            • Checks SCSI registry key(s)
                                                                                                                                                                                                                                                                            • Suspicious behavior: GetForegroundWindowSpam
                                                                                                                                                                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                            PID:4788
                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\DllHost.exe
                                                                                                                                                                                                                                                                          C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                            PID:4628
                                                                                                                                                                                                                                                                          • C:\Windows\system32\svchost.exe
                                                                                                                                                                                                                                                                            C:\Windows\system32\svchost.exe -k SDRSVC
                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                              PID:4312
                                                                                                                                                                                                                                                                            • C:\Windows\system32\AUDIODG.EXE
                                                                                                                                                                                                                                                                              C:\Windows\system32\AUDIODG.EXE 0x49c 0x294
                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                              PID:3692
                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\DllHost.exe
                                                                                                                                                                                                                                                                              C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                PID:3932
                                                                                                                                                                                                                                                                              • C:\Windows\system32\svchost.exe
                                                                                                                                                                                                                                                                                C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc
                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                  PID:1144

                                                                                                                                                                                                                                                                                Network

                                                                                                                                                                                                                                                                                MITRE ATT&CK Enterprise v15

                                                                                                                                                                                                                                                                                Replay Monitor

                                                                                                                                                                                                                                                                                Loading Replay Monitor...

                                                                                                                                                                                                                                                                                Downloads

                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                  152B

                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                  584971c8ba88c824fd51a05dddb45a98

                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                  b7c9489b4427652a9cdd754d1c1b6ac4034be421

                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                  e2d8de6c2323bbb3863ec50843d9b58a22e911fd626d31430658b9ea942cd307

                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                  5dbf1a4631a04d1149d8fab2b8e0e43ccd97b7212de43b961b9128a8bf03329164fdeb480154a8ffea5835f28417a7d2b115b8bf8d578d00b13c3682aa5ca726

                                                                                                                                                                                                                                                                                  Download Submit

                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                  152B

                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                  b28ef7d9f6d74f055cc49876767c886c

                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                  d6b3267f36c340979f8fc3e012fdd02c468740bf

                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                  fa6804456884789f4bdf9c3f5a4a8f29e0ededde149c4384072f3d8cc85bcc37

                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                  491f893c8f765e5d629bce8dd5067cef4e2ebc558d43bfb05e358bca43e1a66ee1285519bc266fd0ff5b5e09769a56077b62ac55fa8797c1edf6205843356e75

                                                                                                                                                                                                                                                                                  Download Submit

                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                  2KB

                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                  2d6f414aa7b197bcaf4493b4c1ff380b

                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                  4c2740075e5eabce0cd94dbfc626358a29065164

                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                  d6e51818618f2fa21a7717cf3cc1e047a27617e650f954911000d3b20b4a2c90

                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                  5ce2077135832ba10536a6f824228b75122bfc3972661287c107ed338d32a860c8e129db46f76f74d38cdaf4e7872cf902645b7ba2454d2848aae3c59c2cf4de

                                                                                                                                                                                                                                                                                  Download Submit

                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                  2KB

                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                  b1ab1fe13c6cc83c728fd6eeeb6523ad

                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                  c6a75cc5335a4642d8df629562b805a52603e6d3

                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                  cac516332f89e3a36c55fff9fa5dd95e8c30b9f63b56a3848645413bb1fdd67f

                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                  cc2b484b2223de41b20ba1c0dbad6a31db13dc3583134c8c6cbf6bb6adcbac8af07535c09650eb2cb878b44dcf5b91fb3bfafd4189184fc27271aa709df0f73b

                                                                                                                                                                                                                                                                                  Download Submit

                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                  2KB

                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                  5e4cc177c0139a69f7ddf7a7dd7c90bb

                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                  80aa0db8b8faaca6ea5c77e5c935fb015aa669ec

                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                  ecbf159ed2a1ff8266be132939832b1fb0fa477a498501b6ba4a867b047cc4d6

                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                  52a62373b100c9e85a855f5ae64cb2c7f4a20a76a63c3ea452e3465ff6c70e3d600c07424ad718185f18c5a1bf9bd1a85171399a2364da6e85fa723f8bed5a4b

                                                                                                                                                                                                                                                                                  Download Submit

                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                  579B

                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                  a7d1701142cca705f833d70023ef4e1e

                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                  1b76853132abfcddb4fefac42bf9df5d013c9815

                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                  6c92f51e7f056e73c407228fc280cb7ca4d00ab02674d1dda4eafd7dc9f070f7

                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                  806b7ccb375cc6116e64a9fa15229d783615d13b54cf40251561d9b664f0925915c5375ad88f5ca8d061e01367de239c29da79adf693559af53eeb7d9b1ba1a0

                                                                                                                                                                                                                                                                                  Download Submit

                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                  496B

                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                  406d40f57c41b87d19b999ebfe5296fc

                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                  7d6ce47afbb25a87565cebdaf0a1a2f4af4bfc10

                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                  0d179bd1f38ad65839441984c85dac651e393eb75c561885911cb8cce8be6974

                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                  a763d98c4e196a8f81244761848a52ab25cf2b4dcc91ff8a977828a7f3639f05248463828221b575942a4c99dc5b720703339e4cb59e11a301fefa6236e660fa

                                                                                                                                                                                                                                                                                  Download Submit

                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                  1KB

                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                  d54362ac1377e89a135192dede3e4a9d

                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                  e899df81a2d181fb152ad663b0fd79856f222e2f

                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                  2694e3bd483591c84dec6fa799d7112fd6ff13ac429593d821ab6257c0bd3197

                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                  08571d770d29b87580fa893511f28f4575e5078aa0fd8e66f968ffa763c3068276fac306502d576a62f2f24c2ec609d4be2e35a4b3232a6f9bd55f1a78686f92

                                                                                                                                                                                                                                                                                  Download Submit

                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                  1KB

                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                  f54d5d82fb5a3f662c77a8ed89515ef8

                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                  464fd9948de979962435bc130d1511eb1e87d425

                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                  0195802acc4860490a6c0f9afcd12f9547cd0d006d61e0c7ea9fcba8c2111eb0

                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                  99a23a2959940816284a94e046338ec0ce61aa94f712335d64e0bebb95f2262724a8468b59be3b6d122bf6b188630d99b1fede1b4bb15cf546f15c2225dd8628

                                                                                                                                                                                                                                                                                  Download Submit

                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                  6KB

                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                  4d559a2580f54ec4afdda7ee9599de95

                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                  72b428fef4b707c2b638dbf9d730a90998cde7cb

                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                  a34106b634f540e8aa1f4bc162f410de76f923139ca233feea424750dd28b4c3

                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                  4457dadcf36be3900c4bd940e5cabffc43b10ee7451e271aeedf3df6fac859fd9656efeb410103a39f8491c07e2b6a1dc020ead5fe1409ac026862bb8b871465

                                                                                                                                                                                                                                                                                  Download Submit

                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                  6KB

                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                  c94fd22134947a379446caba234fd04c

                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                  05abad28acf75dafc60e8977a6ee7e78c9719a45

                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                  d77eb17b4f42b222056e2d1276a927eea2fe1c6845e11b7427453bdf40c6bc3c

                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                  d5314ed0d729dd2461422d0f876f1fbb915d6e10cefbc2a7113a615c52ec311c4954752703066c4f737bd9e314e1178726b8981af47ab81b847c253c606c0944

                                                                                                                                                                                                                                                                                  Download Submit

                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                  7KB

                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                  18686f4bca20af47931ba7a8e19a1617

                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                  0832a7fdaaddbe2901124cddd87a4eee8acfd253

                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                  54489ea3d5fdb4f3c20d0f73b57a9b26053215a1eb90d05628cc5fb555ca07a4

                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                  e07832cbc31db0eaf723fd6ce4533eb1f49f025748a630ce7ba788e159b5f75c4db8a5710b37f4bea2321ac88233e7e3f811906b01b3fbee0d0d3e3ea8969733

                                                                                                                                                                                                                                                                                  Download Submit

                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                  6KB

                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                  a181447a6e18c1149e597d52f9aee0b0

                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                  a82fdacd7ddcbe4c2d71bc3e1b5e654c81838bda

                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                  86e0b4f63bb9e2b9327bb34e1073ef0485370bbb8ad5cfe4532ce28146cfb23f

                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                  e9895113c6a4e048bfbdb01c839ba0d6ee2435175ef1f37bdf27db8d35e6db7765e38c53a0149de167798fc02c8ea8062527541cb90c5343610191581ee74592

                                                                                                                                                                                                                                                                                  Download Submit

                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                  6KB

                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                  9a1f5e386239c668907782e4cd7aa5d0

                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                  34f79f474a7c6496c795143f0d8f628d4b8d77cb

                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                  858dbda40ac307be70de8bcf9d39c2b788321aebc522532c63093da733eb9aa3

                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                  f2e30a5c091b117dff54b86027fe615ca4ff7a79ea8d0873d023eecbba1e69b4c50999cb158397b57d3b8add850256bc0a94cd5752194b9293718cce02b85fff

                                                                                                                                                                                                                                                                                  Download Submit

                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                  1KB

                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                  a342f1de5aab6d4f104cadb129067c2a

                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                  3c2a4f2d372083e8f163fd380f1ee19645c73ba2

                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                  e534425c6b6019cce08dcdabb0df4cc074a84662004a927612be3f07114d646d

                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                  ebe002ee56880f9b2fd357b5e7aba28477ecac5a9fdf620cf62cdae3bde031dd1fae4a4ca03cff5ff5bc2b903e234c368b31efe6e728b0d7a0b7b8cb6567ebf4

                                                                                                                                                                                                                                                                                  Download Submit

                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                  1KB

                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                  bae330a64fc45315818c7cdb3ff62df5

                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                  28247b56fc9ff00252da18051fd984f3e30880ac

                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                  cbb5271f28bc7a036defbb43e2d84db7a1eb091c1e72b0a39e7f26ea171a3964

                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                  f81763c4cdd359e9920457acd1746414e643cff15f73c941e7b55fee55b197c23597cd4800ce7ed75faaab8503f7101259ded08e2e89779b58c9a67d99ee2c16

                                                                                                                                                                                                                                                                                  Download Submit

                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                  1KB

                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                  ef46ad48b8b986255c781cfdd8e1d585

                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                  857201c009efef69020b6f402b760e357fdb0b94

                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                  ab7cfeba93e99ee132ee027378743685432e9002828623a369ac8cbdd63d87c8

                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                  5da056fe3e851541497b6746efc1136873a7f16af3da49eef55e4034690df13a492c4cd01c7d3977ed08196a68bd8194750118e59c8ba62e237eb357de45631f

                                                                                                                                                                                                                                                                                  Download Submit

                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                  1KB

                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                  fdd3976593b60d983ba27bf1521fc4d0

                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                  3d7e814ba711adcf10424af6558cfc3d90b794ce

                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                  2ebbaa6a64eea17b12b11373ba759f0f05503db0c95a6b651b6a5333001529cb

                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                  7a65846122ec7eb2b29fe3e0bc0d088da96f03bfc794baecf1f23fb7ad8e13bba219f67654acb9e7645d9c954f24043f201b6bb0f431fc0fe0cd92bf27edddc7

                                                                                                                                                                                                                                                                                  Download Submit

                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                  874B

                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                  583de50b68b338e6f5f6c0b5014af71c

                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                  a50c97afb73ff8d242386c63d2710fd843e4abe3

                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                  dfd273dac7e793d0ff30e6f6822c741d9e281be2097b8ad43159d740b99c12b3

                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                  acf4d58d17184b3b34dd25b458651cd6a99ed56f9d8381a1fa34d93533ae068b2451efc752ee4adfa3f150d5754353c65c4f34c9f9b350fdd68e702fd523213f

                                                                                                                                                                                                                                                                                  Download Submit

                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                  1KB

                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                  72b28132da4e1ec01af3ed28588198fd

                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                  19a86c6feee7b76d91f19a1df7c1a4af7278ea6b

                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                  1260832e1ff7f9f4f6c7a4e4995c8ef7033ec2fd16a735475bfa0b9f7bb59251

                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                  4429ee12a8e2724a0bccc5fdd63376f520a919fbeeedfd3a7c8b515090585fa89ffd456f5429a47e1bf692e71fa756bb7085e47684a47c87a49699a576facfe0

                                                                                                                                                                                                                                                                                  Download Submit

                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                  1KB

                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                  817d216362cf410139d0f9b2d2c0550a

                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                  10a578e377b03708fdf76d2d943d6936abce9162

                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                  4b3bf8e02b06a5e7af6403fad7f180b3c8fa9265d0d95e9a60cd70c45f668ba6

                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                  58f75ed7ac48945e4b01bd820c13cc6f6999e4835d1e135f339825fc07ebbfc638aa04acc4e9370a83b3acfecabdc6671dbf7f1e1c69a8f2c183f508e68e178b

                                                                                                                                                                                                                                                                                  Download Submit

                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                  1KB

                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                  0b06cb7b8212bd6c27dfe6ab8a7a3fc8

                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                  8eda72d948cc45ee3f7f1045b0c3560c2f0a5776

                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                  443fe36e47143194f7a4a73dc4707128ac8d353c7d83233663a21206b75f5fbb

                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                  243637b7989dac653d8db6c220a5a30a161e794d6b415ab46f90b47062ba03104a6e3b5350a42fe6aa0009ed0f499c3952789195c8f4412c0d86f431b0240066

                                                                                                                                                                                                                                                                                  Download Submit

                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                  1KB

                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                  89d96be23c335eae8b62386ca1365032

                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                  cab9d49e267d583f282d61189f37febf5c7cc551

                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                  40c589be7a995c2d76ad6ad0e5a76e2d550497aaa495e125e946b13668851b6f

                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                  5b7f2a38fa815593f9e5893fad097094bd40b4f05ee5ae7d97793639cf895318a7894fe9b582f5f3ad57bd440f55786f6e8ae30457de01848748c4fe3dc4c006

                                                                                                                                                                                                                                                                                  Download Submit

                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                  1KB

                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                  e08dbe292d5d03b0cb49fb49e95e0906

                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                  8cd12584eb6a805385211462fb8665e9f52d4aeb

                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                  067430270029da3f8d29629346783e385e7624a5984ab579aa7eae8e6c643787

                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                  26d5d1a0386c6bd01be41d4bcae8896de5963f4926490f8b5a40e274d19bca16ee1e41033d7360f71324328feca50e93cf83ef9d5559590f408fc64eda314352

                                                                                                                                                                                                                                                                                  Download Submit

                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                  1KB

                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                  899c84a836026a2177b5b462777e9a88

                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                  1df87e0231f14b6c9ed12b7d82fe6fd86a41a254

                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                  5fc74d103de6111cc573fb1bd3b2d0fba2b5d5e989c1a39af3f8869c51c18f9f

                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                  f1bac4cb0534f8ffa522218acbd8559f987747171b6c60bf5f27a9350e85bc40dd59945e4cdae6f591de8b2ce157dbdf85465ef119110a5deb4fd398d9f54e69

                                                                                                                                                                                                                                                                                  Download Submit

                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5c2d41.TMP
                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                  874B

                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                  63341bc4c22276d9e246814da3043625

                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                  c141bce45c4fdb66ad369345cc5874133b523153

                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                  98a8dac1301d583cf00398a40927b0a188d9f0525800c235dcbe6c505faae11c

                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                  2c5bcdadc35ab3be56a8b353fdd876bb7829e03a395a4abd8fd2d74060df57301100afba8292d1583bc9fb92b0a2fd7395269e254012e4cdba01a9a07beb1434

                                                                                                                                                                                                                                                                                  Download Submit

                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                  16B

                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                  6752a1d65b201c13b62ea44016eb221f

                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                  58ecf154d01a62233ed7fb494ace3c3d4ffce08b

                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                  0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                  9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

                                                                                                                                                                                                                                                                                  Download Submit

                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                  12KB

                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                  37881735e38fdef26a21b4ed879f002e

                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                  1bcbfa336d46c1fcb9ca5ad5aff75e7be200d6de

                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                  262976afd7278cc3713ac6f90905e0123a5b8cd462d193983ae798232e19c79d

                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                  88a0bb56b39987597448094ae98ecfef27775d15ba3c91ea698bb3ef8f5a3da64e83a1306e65d6192a5528103b844b0c54bd0b29b9c007ec022f5be5b1f3c5b7

                                                                                                                                                                                                                                                                                  Download Submit

                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                  12KB

                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                  dbab3354a94fc6084e006333476547cc

                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                  a73c5d568a64fff5899b9af81b8ef92c7e0b551c

                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                  de88c2d27cb3645a4a1f3a5c361d4fdbc3a3ab0bd555149a9ebbf3b2c43a64d8

                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                  98bd291ef16ec8e539097f4f0fc0069f51850c2d7537f9de19fb8888d5ffd68bd6dbf619d81378a8e02440f4d0aaddf32b37c082f2d1517b5b799276964f014d

                                                                                                                                                                                                                                                                                  Download Submit

                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                  12KB

                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                  5c7d0a2ff19ae6678dfec8034a10653f

                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                  fa59708f7798dec3b5317a612b0002d3e88f6af7

                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                  bd99d722a7373dc41e282e54f073b4ca03405c6e8759899dc70e0e78f04b5b57

                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                  9af48aace69f3b83cfebd2c3aa49c4a439e38bfc420a16b83666c629ec29075116022963c5a2f7d0e3df6e6bc54fbf02f1632246ce1d0f6dbca7d65777ad9ea4

                                                                                                                                                                                                                                                                                  Download Submit

                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                  11KB

                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                  7d86faa8bfc1e672498345d97d3337b3

                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                  4227ecd461978337d1ab90ad86193701fd4ca517

                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                  73128e4c6cd4af3aa455b844c61837003d745a1a6e9f4166a140592382d09a36

                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                  899cc144b95705cc8068b86974edc520859d3abbb66dcd5acf6a2ae41c9adf8208e836b40e948dcdc3d1b67e28558e1001d756883976ca7905c25b975a24df45

                                                                                                                                                                                                                                                                                  Download Submit

                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                  12KB

                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                  3075cd60b5c6a94c4516f72ff3302835

                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                  163e0278242ed5a3d115b3f558297992ca0f81f1

                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                  54d02b2bb1be9d2e915b4cd3aa2824250a3911ceafce1db97841c376dbdaa324

                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                  431291d04b8891f39dc2697623d3767e3d74ec0e7246b03ad634e1dc1967a746e5c03c3a452a678f6dd68522b737258a859dd707655e697aad5286f2659de462

                                                                                                                                                                                                                                                                                  Download Submit

                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                  12KB

                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                  8d12789dff39600edd0512cbf56f537f

                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                  9096596640c3e2d7bde32c2d4e26e5116f1339aa

                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                  c48f5d7be110421bd1c71ffa5edee91819aeb4c6a7c7bc2837a20e9e773ed29d

                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                  1e9aaf197969565d79ba9474be34255d0ca472f109bbf8c5481e56554351ff940bec7d2ec85466a484d850a9ff94da9fd070199a11c4a020107a3d2092fb21fa

                                                                                                                                                                                                                                                                                  Download Submit

                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                  12KB

                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                  6360981d4f6dfa4e33eb783d3a3a3d77

                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                  69f83ac7d7b6ba544ee26cf6dc3572f08cfdb090

                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                  453d63aa4f7882fe4e71b1e445d5a742d4d20a5e3fa9e48155dc3e9e92bde9e7

                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                  ed638d2b2e03b93ea2b2393ca999c84c86c5f82002ecc1ad690979803f7268addd4c4b8b6544f8a1b2e42062ea8e049ad747f055fb688c3c26a0ed8f00d4dc34

                                                                                                                                                                                                                                                                                  Download Submit

                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                  12KB

                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                  20822c194cd8d4d80eca1a1466176bf3

                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                  0575ca2af67d718f56ae69aca3b2fbf5948a7435

                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                  5fb9b1106c559f0b953df70b6e75c0bef848a8ab1ca4a4db8b88770dc1d30739

                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                  e63c4a9d4866dd7b56025dc388ceecfcc0974aae1606a97840e6c0ea5002c79178cd8c1a72f8335f3472a21d720537fe3ee0aa8ce77a9cefdc154cfc0b178e7c

                                                                                                                                                                                                                                                                                  Download Submit

                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                  12KB

                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                  8f1e98a2c87b5de7ac3cbac663db37bb

                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                  0607ea0ab1c228e29840d7c842601630999d856c

                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                  d8aea661887a28ecffbad86b520bcfba8374d979a0ffd13cabbb6e35e55d5d9a

                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                  144f5ee1fc490233460e2a53b209f183b8078e6e7ea756f13c3d5faac213245183c3331f1c34e5a672b3fc13359efb86943e0a70c2b1241e5aa2a579e7d57c6e

                                                                                                                                                                                                                                                                                  Download Submit

                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                  12KB

                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                  2af01ab49cde685cfe32aba53255d08d

                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                  52cc52fa7cfe056d4f363470a20739b4c56072e5

                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                  e3cbed2cc8669784001c86da17de1ef35837b97a91dd3fe1c28fbf0f6a09b381

                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                  7fcc71b134e895831f12d9d88f2ba784f7858174b56f07ba8e5b0d8e2536583703b86b1cb4c78271ccf334e7847743b06fa2ff54252b45f975cbce91c722d14a

                                                                                                                                                                                                                                                                                  Download Submit

                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                  12KB

                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                  293069442d094a0efc8fc78954a693ee

                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                  075054813322ea8cf25683f72a49ac7a0f1e9083

                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                  6c48bd69a2b09f92c0a74337e52e09e0136e26b365bc0000cfbc9d9f4c5daa5b

                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                  0113d19b7b2bd6ec9f8fff2d87cee1de154586091b4e414796dfdbce26b2283ad978511b5d7b8e36814404702af52fad379838f38b86a2ab8546214c8535392a

                                                                                                                                                                                                                                                                                  Download Submit

                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                  12KB

                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                  d11087f4cdf4da19b2e02a6db1cc4247

                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                  ef4a87e31454af8fcf0d8402ab679ab9f3f57914

                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                  997d8bf50c9be705ed1181b2464fd68d5a3b49dfe8792e66c7459ba853f69d54

                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                  9a27c13876d950e7ab44b60b76b619695764afebbdfb3204a3efe8c0da31a5e2583ab2394cb0a9457a74ccf526680fee47310665b0de0deedfb75b8aeb7873f6

                                                                                                                                                                                                                                                                                  Download Submit

                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                  12KB

                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                  d15404d5599fa4d7f790dd7ce7d64219

                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                  1cca1a0d4d9b0f5dd82ac7446efb0a42e62570b2

                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                  06c65892a254f5cb70ca3c3657dfeee05c92bb4b6b725f94b484296a339a6373

                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                  840f8e3bab932e168374afd2888181d4f55b9dad4112cbc9456d38e4ad100142f5e150d0067d8d816153ae2a57de59746892ba4958d699415f50f99dfffd8bb6

                                                                                                                                                                                                                                                                                  Download Submit

                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                  12KB

                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                  24f224148370a7c3d17c84372b61fa2a

                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                  cbd96aef69a32fab69242dfcf8dd50ae2a6fa7dd

                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                  14af57cb62f655f91c54a04513cc9abcca0e37fe8d9d45662bbe392d2fe85a45

                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                  42c2613dc07a3c61b227645f28ae77fce5c22eadf70ef4046c03f9c88ec2b8a9c74c48c0ea038c410c102ba9274f4caf1848ae82f8f2a791459374bcfd0395fb

                                                                                                                                                                                                                                                                                  Download Submit

                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                  12KB

                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                  7b6cc6b96b53ba4c918388e794973b12

                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                  14299abcb6e20b662e71dcef42ffdbb622ff844a

                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                  5dee09d429fdf768b2d670a62c6943433541081d63d0d17ff2dd3212765ad021

                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                  124489724b87e5c4080569c87b9e1d5b32c24a0e0bbbeb409f092779841d8359acd0e3ff1339e5a9baf41c04c4fe627fdd44eae6053fc7d8edaa5fc9912d8285

                                                                                                                                                                                                                                                                                  Download Submit

                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                  12KB

                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                  d068bacf360ceaff942a9bb53a69888d

                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                  a4f23c534d5a7dd39e324b304cff1f16cc678cab

                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                  bfbe2d473aa81de31bf640b2a06a68bc2876345d3d88d7782cccafb94da4592b

                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                  5372ad2fbf4daea3a3ea5d22afe254d2072df9b593d151436355399f3b05f6255f8103145cb45f76c1208b5a95a3a62c6deee33c4aea19dc0f9f6c1d2448ecbc

                                                                                                                                                                                                                                                                                  Download Submit

                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                  12KB

                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                  d3bb77d840165b44073bab54d6d304c0

                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                  3db2f69dac77d6271ceb9a2cbb618f0a7e8cba8a

                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                  97f27ad2d28fb8548c7de239b7161f1fe06ac3b38c40efd18234315f32a89590

                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                  dafd333ce1f6ead5cc727e87f3efc467095a378eb0094bdb392b691933631d5a7744e3c1e031ac08fbd42e70d1ffcf0e3ec13b7d1242286ea0956dd41f625b26

                                                                                                                                                                                                                                                                                  Download Submit

                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                  12KB

                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                  66859eaf58bb0194bf4bc74d680a2fb3

                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                  2fd52f9735404e106f72c0ae46dc66bd3d91a5d7

                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                  d8f34fd53e920b2074f894da707e8f07fbe74b6c853ec7f9381726724990f226

                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                  d21d5a436f7c540c40a5bb70f3f25083588d3032df97f8ca82ecb4cabc4f5165d143af3f8d37e85432ddfb17ada2340a7bf5156b38d5ad9f0f165d3029b4306d

                                                                                                                                                                                                                                                                                  Download Submit

                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                  12KB

                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                  96dd2b7bd53dd126f9e9dd5169d6f703

                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                  2ab3c0f68ee2b648ee981f8fc4fc420294831080

                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                  24c18de63418f8e2e9327c558672903637b465d5e11192c8a3a060b346c51aae

                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                  f81f3afc72cedd26fc5eb4dba52ab3324af9cf03e028ae51d8a2b08fcb3555a0aebdcda1ce423198e17e49f992c2802e0e1c53f4c1d1af34f2a09923cc9d6f20

                                                                                                                                                                                                                                                                                  Download Submit

                                                                                                                                                                                                                                                                                • C:\Users\Admin\Downloads\MEMZ.exe
                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                  14KB

                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                  19dbec50735b5f2a72d4199c4e184960

                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                  6fed7732f7cb6f59743795b2ab154a3676f4c822

                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                  a3d5715a81f2fbeb5f76c88c9c21eeee87142909716472f911ff6950c790c24d

                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                  aa8a6bbb1ec516d5d5acf8be6863a4c6c5d754cee12b3d374c3a6acb393376806edc422f0ffb661c210e5b9485da88521e4a0956a4b7b08a5467cfaacd90591d

                                                                                                                                                                                                                                                                                  Download Submit

                                                                                                                                                                                                                                                                                • C:\Users\Admin\Downloads\Unconfirmed 240036.crdownload
                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                  5.6MB

                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                  40228458ca455d28e33951a2f3844209

                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                  86165eb8eb3e99b6efa25426508a323be0e68a44

                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                  1a904494bb7a21512af6013fe65745e7898cdd6fadac8cb58be04e02346ed95f

                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                  da62cc244f9924444c7cb4fdbd46017c65e6130d639f6696f7930d867017c211df8b18601bfdaaee65438cee03977848513d7f08987b9b945f3f05241f55ec39

                                                                                                                                                                                                                                                                                  Download Submit

                                                                                                                                                                                                                                                                                • C:\Users\Admin\Downloads\Unconfirmed 594141.crdownload
                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                  22KB

                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                  31420227141ade98a5a5228bf8e6a97d

                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                  19329845635ebbc5c4026e111650d3ef42ab05ac

                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                  1edc8771e2a1a70023fc9ddeb5a6bc950380224b75e8306eb70da8eb80cb5b71

                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                  cbb18a6667b377eb68395cfd8df52b7d93c4554c3b5ab32c70e73b86e3dedb7949122fe8eea9530cd53944b45a1b699380bf1e9e5254af04d8409c594a52c0e7

                                                                                                                                                                                                                                                                                  Download Submit

                                                                                                                                                                                                                                                                                • C:\Users\Admin\Downloads\Unconfirmed 604953.crdownload
                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                  233KB

                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                  20fa439e1f64c8234d21c4bc102d25f8

                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                  ba6fc1d9ba968c8328a567db74ef03eee9da97d8

                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                  2f10f1384f3513f573a88e1771c740a973a5a304387e23aa4bf310794532fa8e

                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                  19e9d62a852293ffa99a412ba8fa5dd0336a7753af4975e06cd53c02ee6f0058485160f8f8a64a8bca19d88eb426a4a2785885c02a494f33f2b6e383204a7f39

                                                                                                                                                                                                                                                                                  Download Submit

                                                                                                                                                                                                                                                                                • C:\Windows\INF\c_diskdrive.PNF
                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                  6KB

                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                  8affec593b46802c31cfe7e4b2973346

                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                  5007b7a347f0d68ea0233a278f9d6f496f7ea0af

                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                  239c3ef057558b8b77c9cf0416dbe3c4af810d5203d9b40f25e48ab92070ad58

                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                  c7a39a6d500dfff3aaf74e62c935354eb71074e6de084fc222004702024b77ce27b1a2a40302858912b6be9c9dd7062c8f15ddc4a19afcac7138fb16cfc09937

                                                                                                                                                                                                                                                                                  Download Submit

                                                                                                                                                                                                                                                                                • C:\Windows\INF\c_display.PNF
                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                  8KB

                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                  716a1b21d16beae0405cc08d35d137cd

                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                  a013a0d39efd59a831edfe5194dd182af25109aa

                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                  e3170e44d159d924bd7884c4e0fd6b590ffd93b0ce2c1eebd0d68606039f7df5

                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                  bf6664be664c1675b1038afe91d108a0d0f487f158cf6d0b183ab5ac5cf10836270c71687b69a220bd7ef8383bd2aa1cc9715edcedd4fde1735c7af50ac103f8

                                                                                                                                                                                                                                                                                  Download Submit

                                                                                                                                                                                                                                                                                • C:\Windows\INF\c_fscontentscreener.PNF
                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                  ae30cd132bafbddc34e2c241fa89cf78

                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                  e4a77358961d2f98cde0b1f3ed08e34c41763a1b

                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                  1a3f5c7dd11a67e640948cf3f5eb6ca1baaa94bbb458b29f06bf99ccd96aacac

                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                  9fa0fffb70b02577335f9c1428dce46811ebb2feb3fca9291cb3746595a4690d9e1a70ffbd943d54726425f2d30e5337c5f88ced773c1366491eb9e61567ad04

                                                                                                                                                                                                                                                                                  Download Submit

                                                                                                                                                                                                                                                                                • C:\Windows\INF\c_fsreplication.PNF
                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                  757565d72c1b1cd041d2c5b790f3797c

                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                  a04c3a8fad82a46d7f240c7ef15e2b5ec18354d7

                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                  1919acf2f8e0f93887dcac9771a9d3e73832465405d588baf1f0fa633dd82929

                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                  0a4a5b8181818724995666f1d1153e70489970ca0a7949dd8863f1af289f1e7395793918fd72056408cbb6ead49b7b0adf6926e97c0e8c32f5a65cc69fb409c9

                                                                                                                                                                                                                                                                                  Download Submit

                                                                                                                                                                                                                                                                                • C:\Windows\INF\c_fssystemrecovery.PNF
                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                  1c20b551c8177c64891f1c20f38141ca

                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                  5698b6c521d66a0c19ef1400bd05797f2d0dbdeb

                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                  9e7a415f05f5ef98ed2afc3cb9b3af80970bdb80b00abaed19c89c6d4a2f3df9

                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                  401c6e105ca2571202a1f2c4e7cd6e9b0e86db8122d45fde55ef3f84ef515938f516854fe5f665fd4934b4e39a61fd7700d65da6d95f3f1f54d0dade235ec3f5

                                                                                                                                                                                                                                                                                  Download Submit

                                                                                                                                                                                                                                                                                • C:\Windows\INF\c_linedisplay.PNF
                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                  3KB

                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                  2cdb8750cf4d771d4b645b1f7f7f86b3

                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                  f55f5b770bbc742c345e540865cd705c7189305d

                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                  da71d267e72aa379063aa4bbc0c4e8c12f02b0f51c86c68303483d8ea9414886

                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                  c358e452236429f2ec91e64fc513a0210302e48396a90cddb0ff5241114f47b48e1aaa5cb4cc8b0589d1bd0ddce5dcb1e9d9c993aad44c2e615008ab3b3c5015

                                                                                                                                                                                                                                                                                  Download Submit

                                                                                                                                                                                                                                                                                • C:\Windows\INF\c_magneticstripereader.PNF
                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                  3KB

                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                  b19015e21e1bc2886b0b674d2f450bd1

                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                  540de50a0d3b98b6abbc084178ba05e4704321be

                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                  a1bc54e853d96acf8279a0a7f98de870e6d217d281b1119aad865816659b1eff

                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                  cfe69151364ff1227b2eae37420ae70f34760150ca78b2e5dad9a83cd0538f6e1ce2798b4f31ee6fd9b9e17e020d738c7ec3805796e8d40bad1cbaa3914350b6

                                                                                                                                                                                                                                                                                  Download Submit

                                                                                                                                                                                                                                                                                • C:\Windows\INF\c_mcx.PNF
                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                  1b909c8deb042ba17243934d48b3ee41

                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                  928e854f9097ac311fc5ce458fd6909d812f7d96

                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                  20781e9cd4f11ab6dcc3cfd6df92e0c70f55ff043165f1681bea6e48e45eda03

                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                  088c1db3e9b55fbb46cdfa4ff18040deb5c1a1347b7f6366b8bbcbf6a1d42ec74aa9e167fb021210ddd613a55c8fc223d99ce2f39974dab1eb301d4f3d1ede9f

                                                                                                                                                                                                                                                                                  Download Submit

                                                                                                                                                                                                                                                                                • C:\Windows\INF\c_media.PNF
                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                  12KB

                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                  36e3216e6979454d23d8ead3a5dba787

                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                  59aee8fd30c74f5b722b97c6e242944c9e5a9026

                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                  205433ab6ca8fec73f3fd24c73461a06133b5a03158c38117dee635658261cc2

                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                  7fb1d984570baa87c81affc0f54fc4e763d50eb1a9cff4a63419e5455f51a1fabbf908ca93b898cf0623b0973a820ce2654f5839991e72996d1cfc59df8f49c2

                                                                                                                                                                                                                                                                                  Download Submit

                                                                                                                                                                                                                                                                                • C:\Windows\INF\c_monitor.PNF
                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                  6KB

                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                  f780cf05c66e76b0e7fd96e15a25b1b5

                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                  4d2cb2ef664e433d7e975007c9a7214e2120e9eb

                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                  1e2b8358aeeaf5c99606907c775e2e9e04e1244f6c2ae00d29afcfd71f26845f

                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                  4a030895d42bea4184e7a8c1601c495b9abd1cddbc002069f782362ea8a647f262a98fdd16105e6acd7e2de7059337a3f277e5584eea06f718c97557cab584dd

                                                                                                                                                                                                                                                                                  Download Submit

                                                                                                                                                                                                                                                                                • C:\Windows\INF\c_processor.PNF
                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                  5KB

                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                  912a021ec384a1d66b47a2de39a6b7c2

                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                  2dee665f515d8b5f42c7c9dd4721a18ba5f17c62

                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                  3b5b240cfa3af80c010220d02c027c5264467ffc4b40e8da0989ebc5e71aea1b

                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                  fe9c811de43100847c0073f74b9479012340ab3cb2676edd308142135289e7aaf1cf96a8e173d5821af5e02586fa9939e6dcc1ec54ad67b92f287c3849007f1a

                                                                                                                                                                                                                                                                                  Download Submit

                                                                                                                                                                                                                                                                                • C:\Windows\INF\c_scmdisk.PNF
                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                  6KB

                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                  c4d689faefd0f20799d6620c7503a953

                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                  c8499567230076ad8b177086110adf550eb32329

                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                  fe7cab0a7b4fe1366d3f19ecaa7b6e8b6c45f184fff674b73c04293d38a74aac

                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                  e55ba49dff3b3911da4015ff79fe855509de55feded9e8c0590e80390fcd2cc1d0ec638af77136b0162a76371edf9066f4131ba29e5e536d4d985b7b29763d25

                                                                                                                                                                                                                                                                                  Download Submit

                                                                                                                                                                                                                                                                                • C:\Windows\INF\c_smrdisk.PNF
                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                  6KB

                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                  3b7998636d725f18b8999b4ba0b5d50c

                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                  f69297e1f831e4c13d75d39f3ea3db117b1c71e9

                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                  55f521e972a2224f31fd920aa2d5e1ee79cafc5bcf2d52f9b2288ab276b45590

                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                  193cf44267d3342d70604d940e1d3a495c8b6f1363fa3e0d62d149249b14249d10b17c0c87ba2d41e3f4435c9eedd00aa01bf3f19776b4773092b69fb8b852b1

                                                                                                                                                                                                                                                                                  Download Submit

                                                                                                                                                                                                                                                                                • C:\Windows\INF\c_smrvolume.PNF
                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                  86eb9857de5ae768888cc56812a44c66

                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                  79434793c16f952dba5bd81550416e490c67d332

                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                  de99f69a5fa16b29cde5593e2c4c1d6443ac4fbaf614aa109bfcaf2f7b5ba7d4

                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                  9a898da122063c993c49d7479682a5b9b36c9b307da1811f24f77e234fc31b5dfa1a42ebdfee124efd9383889f577dc5254277d620fe570d6cbd46f3c625cdf9

                                                                                                                                                                                                                                                                                  Download Submit

                                                                                                                                                                                                                                                                                • C:\Windows\INF\c_sslaccel.PNF
                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                  a5b60198ed9c83074babfa86f60c1e4b

                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                  2f3e922d885fec14b965d9138ec90a1571125e8a

                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                  024d245e7af8409c38f53bd91cf4ede6c11dad6a192a27351ce027db7fdcbb03

                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                  47571c1995d026e90114bea355d67842e8e77ab003e906f7f5b247c1fe50743609165b944368f7b92759082c78f5b0ef020023c45bb712ede8e408979a7bbd00

                                                                                                                                                                                                                                                                                  Download Submit

                                                                                                                                                                                                                                                                                • C:\Windows\INF\dc1-controller.PNF
                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                  14KB

                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                  afd1d30a6aa27084c2f0d0a3768955f9

                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                  695ba33d4c0af658558c60c0d3ac9ac22492ea0e

                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                  846e3ea525e13fd2bcb4f335f3d4ca0b5a6063c4084b8058096d79e91792a1f1

                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                  fd1ec50085d4765448fe513490d22c1b9cf6714400723ceb5f730e46246a951b0729e5c1f36d86633658a1218f5ef0539ecba861cb72c9bbf31589e7c423db6e

                                                                                                                                                                                                                                                                                  Download Submit

                                                                                                                                                                                                                                                                                • C:\Windows\INF\digitalmediadevice.PNF
                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                  7KB

                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                  45fbb02d3a3afa90798b5fb7de0d02ff

                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                  347e02d2d2062cc90f72b1933ea2fa5799f17a4b

                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                  8ea890549b49937a39644fae35302210065a04d498965c5bf5346d9440f964f4

                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                  cc8971ceab889dcd701b6cda101d1d5d9b63ebcb01dd54f26c8748fc289528a048b600750b61918a763d802be89dd1170ba45cd99cf177413871f6ee1faad818

                                                                                                                                                                                                                                                                                  Download Submit

                                                                                                                                                                                                                                                                                • C:\Windows\INF\remoteposdrv.PNF
                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                  8KB

                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                  f5d38fe8febc0949470e902dd4001552

                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                  c627908a306270f62893a5a70deb6918e887024b

                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                  a03ad0aa54e8bbcfa9ec21e7c3e6d73fb3aeec5fa945a8cd95b75d8390be8596

                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                  5fa9cf3c04c3bb2678c0293cd9a3f67ad7a8984d0499f33d023710f97843cd29df5eb5aaf558d37bf21236b458740146d0a5437e2cfc7a3e555d184628aa8811

                                                                                                                                                                                                                                                                                  Download Submit

                                                                                                                                                                                                                                                                                • C:\note.txt
                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                  218B

                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                  afa6955439b8d516721231029fb9ca1b

                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                  087a043cc123c0c0df2ffadcf8e71e3ac86bbae9

                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                  8e9f20f6864c66576536c0b866c6ffdcf11397db67fe120e972e244c3c022270

                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                  5da21a31fbc4e8250dffed30f66b896bdf007ac91948140334fe36a3f010e1bac3e70a07e9f3eb9da8633189091fd5cadcabbaacd3e01da0fe7ae28a11b3dddf

                                                                                                                                                                                                                                                                                  Download Submit

                                                                                                                                                                                                                                                                                • \??\pipe\LOCAL\crashpad_3500_RGWBUAYJXFIICLEM
                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                  d41d8cd98f00b204e9800998ecf8427e

                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                  da39a3ee5e6b4b0d3255bfef95601890afd80709

                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                  e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                  cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                                                                                                                                                                                                                                                                                  Download Submit

                                                                                                                                                                                                                                                                                • memory/2964-560-0x0000000000400000-0x0000000000440000-memory.dmp

                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                  256KB

                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                • memory/5940-1532-0x00000000060C0000-0x00000000060C1000-memory.dmp

                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                • memory/5940-1528-0x00000000060C0000-0x00000000060C1000-memory.dmp

                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                • memory/5940-1533-0x00000000060C0000-0x00000000060C1000-memory.dmp

                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                • memory/5940-1531-0x00000000060C0000-0x00000000060C1000-memory.dmp

                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                • memory/5940-1530-0x00000000060C0000-0x00000000060C1000-memory.dmp

                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                • memory/5940-1529-0x00000000060C0000-0x00000000060C1000-memory.dmp

                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                • memory/5940-1527-0x00000000060C0000-0x00000000060C1000-memory.dmp

                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                • memory/5940-1521-0x00000000060C0000-0x00000000060C1000-memory.dmp

                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                • memory/5940-1522-0x00000000060C0000-0x00000000060C1000-memory.dmp

                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                • memory/5940-1523-0x00000000060C0000-0x00000000060C1000-memory.dmp

                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                                                  Download