hxxps://github[.]com/Viper4K/malware/tree/master/MEMZ

Resubmissions

12-12-2024 12:51

241212-p3txqavkby 10

12-12-2024 12:43

241212-pycsmswpgq 8

Analysis

max time kernel
400s
max time network
426s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
12-12-2024 12:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/Viper4K/malware/tree/master/MEMZ

Score

8^/10

discovery persistence upx

Malware Config

Signatures

Downloads MZ/PE file

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\raesdfgiuytr.vbs	iutyfghjkoiuytf.exe
File opened for modification	\??\c:\users\admin\appdata\roaming\microsoft\windows\start menu\programs\startup\raesdfgiuytr.vbs	taskmgr.exe

Executes dropped EXE 39 IoCs

pid	Process
4060	software.exe
1600	iutyfghjkoiuytf.exe
4280	iutyfghjkoiuytf.exe
1420	iutyfghjkoiuytf.exe
1844	iutyfghjkoiuytf.exe
4668	smss.exe
4032	smss.exe
4380	0a-PORNOSKI.exe
1992	MasterSlave.exe
4724	MasterSlave.exe
3424	MasterSlave.exe
588	MasterSlave.exe
5844	MasterSlave.exe
5788	MasterSlave.exe
5964	MasterSlave.exe
5628	MasterSlave.exe
6792	MasterSlave.exe
6544	MasterSlave.exe
6432	MasterSlave.exe
6580	MasterSlave.exe
7660	MasterSlave.exe
7204	MasterSlave.exe
8208	MasterSlave.exe
8240	MasterSlave.exe
8980	MasterSlave.exe
9780	MasterSlave.exe
9960	MasterSlave.exe
6808	MasterSlave.exe
1572	MasterSlave.exe
8880	MasterSlave.exe
9644	MasterSlave.exe
10172	MasterSlave.exe
7760	MasterSlave.exe
7312	MasterSlave.exe
7304	MasterSlave.exe
9528	MasterSlave.exe
3088	MasterSlave.exe
6060	MasterSlave.exe
6120	MasterSlave.exe

Loads dropped DLL 31 IoCs

pid	Process
1992	MasterSlave.exe
4724	MasterSlave.exe
3424	MasterSlave.exe
588	MasterSlave.exe
5844	MasterSlave.exe
5788	MasterSlave.exe
5964	MasterSlave.exe
5628	MasterSlave.exe
6792	MasterSlave.exe
6544	MasterSlave.exe
6432	MasterSlave.exe
6580	MasterSlave.exe
7660	MasterSlave.exe
7204	MasterSlave.exe
8208	MasterSlave.exe
8240	MasterSlave.exe
8980	MasterSlave.exe
9780	MasterSlave.exe
9960	MasterSlave.exe
6808	MasterSlave.exe
1572	MasterSlave.exe
8880	MasterSlave.exe
9644	MasterSlave.exe
10172	MasterSlave.exe
7760	MasterSlave.exe
7312	MasterSlave.exe
7304	MasterSlave.exe
9528	MasterSlave.exe
3088	MasterSlave.exe
6060	MasterSlave.exe
6120	MasterSlave.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\NTWRM = "C:\\Users\\Admin\\dane\\0a-PORNOSKI.exe"	0a-PORNOSKI.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SVRNT = "C:\\Users\\Admin\\dane\\smss.exe"	0a-PORNOSKI.exe

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\G:	MasterSlave.exe
File opened (read-only)	\??\G:	MasterSlave.exe
File opened (read-only)	\??\A:	MasterSlave.exe
File opened (read-only)	\??\N:	MasterSlave.exe
File opened (read-only)	\??\Z:	MasterSlave.exe
File opened (read-only)	\??\M:	MasterSlave.exe
File opened (read-only)	\??\O:	MasterSlave.exe
File opened (read-only)	\??\S:	MasterSlave.exe
File opened (read-only)	\??\Y:	MasterSlave.exe
File opened (read-only)	\??\P:	MasterSlave.exe
File opened (read-only)	\??\T:	MasterSlave.exe
File opened (read-only)	\??\M:	MasterSlave.exe
File opened (read-only)	\??\Z:	MasterSlave.exe
File opened (read-only)	\??\Z:	MasterSlave.exe
File opened (read-only)	\??\R:	MasterSlave.exe
File opened (read-only)	\??\L:	MasterSlave.exe
File opened (read-only)	\??\J:	MasterSlave.exe
File opened (read-only)	\??\G:	MasterSlave.exe
File opened (read-only)	\??\P:	MasterSlave.exe
File opened (read-only)	\??\Z:	MasterSlave.exe
File opened (read-only)	\??\E:	MasterSlave.exe
File opened (read-only)	\??\P:	MasterSlave.exe
File opened (read-only)	\??\L:	MasterSlave.exe
File opened (read-only)	\??\P:	MasterSlave.exe
File opened (read-only)	\??\B:	MasterSlave.exe
File opened (read-only)	\??\H:	MasterSlave.exe
File opened (read-only)	\??\O:	MasterSlave.exe
File opened (read-only)	\??\I:	MasterSlave.exe
File opened (read-only)	\??\S:	MasterSlave.exe
File opened (read-only)	\??\M:	MasterSlave.exe
File opened (read-only)	\??\X:	MasterSlave.exe
File opened (read-only)	\??\E:	MasterSlave.exe
File opened (read-only)	\??\A:	MasterSlave.exe
File opened (read-only)	\??\K:	MasterSlave.exe
File opened (read-only)	\??\V:	MasterSlave.exe
File opened (read-only)	\??\Z:	MasterSlave.exe
File opened (read-only)	\??\Y:	MasterSlave.exe
File opened (read-only)	\??\X:	MasterSlave.exe
File opened (read-only)	\??\M:	MasterSlave.exe
File opened (read-only)	\??\B:	MasterSlave.exe
File opened (read-only)	\??\J:	MasterSlave.exe
File opened (read-only)	\??\S:	MasterSlave.exe
File opened (read-only)	\??\Q:	MasterSlave.exe
File opened (read-only)	\??\Q:	MasterSlave.exe
File opened (read-only)	\??\Q:	MasterSlave.exe
File opened (read-only)	\??\A:	MasterSlave.exe
File opened (read-only)	\??\V:	MasterSlave.exe
File opened (read-only)	\??\G:	MasterSlave.exe
File opened (read-only)	\??\M:	MasterSlave.exe
File opened (read-only)	\??\H:	MasterSlave.exe
File opened (read-only)	\??\A:	MasterSlave.exe
File opened (read-only)	\??\L:	MasterSlave.exe
File opened (read-only)	\??\O:	MasterSlave.exe
File opened (read-only)	\??\S:	MasterSlave.exe
File opened (read-only)	\??\R:	MasterSlave.exe
File opened (read-only)	\??\W:	MasterSlave.exe
File opened (read-only)	\??\S:	MasterSlave.exe
File opened (read-only)	\??\T:	MasterSlave.exe
File opened (read-only)	\??\M:	MasterSlave.exe
File opened (read-only)	\??\S:	MasterSlave.exe
File opened (read-only)	\??\G:	MasterSlave.exe
File opened (read-only)	\??\S:	MasterSlave.exe
File opened (read-only)	\??\O:	MasterSlave.exe
File opened (read-only)	\??\Q:	MasterSlave.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
59	raw.githubusercontent.com
60	raw.githubusercontent.com

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
76	ipinfo.io

Drops autorun.inf file 1 TTPs 18 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File created	\??\G:\autorun.inf	0a-PORNOSKI.exe
File created	\??\Y:\autorun.inf	0a-PORNOSKI.exe
File created	C:\Users\Admin\Downloads\autorun.inf	0a-PORNOSKI.exe
File created	\??\E:\autorun.inf	0a-PORNOSKI.exe
File created	F:\autorun.inf	0a-PORNOSKI.exe
File opened for modification	\??\E:\autorun.inf	0a-PORNOSKI.exe
File opened for modification	F:\autorun.inf	0a-PORNOSKI.exe
File created	C:\Users\Admin\dane\autorun.inf	0a-PORNOSKI.exe
File created	D:\autorun.inf	0a-PORNOSKI.exe
File opened for modification	D:\autorun.inf	0a-PORNOSKI.exe
File opened for modification	C:\Users\Admin\dane\autorun.inf	0a-PORNOSKI.exe
File created	C:\autorun.inf	0a-PORNOSKI.exe
File opened for modification	\??\Y:\autorun.inf	0a-PORNOSKI.exe
File created	\??\Z:\autorun.inf	0a-PORNOSKI.exe
File opened for modification	\??\Z:\autorun.inf	0a-PORNOSKI.exe
File opened for modification	C:\Users\Admin\Downloads\autorun.inf	0a-PORNOSKI.exe
File opened for modification	C:\autorun.inf	0a-PORNOSKI.exe
File opened for modification	\??\G:\autorun.inf	0a-PORNOSKI.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1600 set thread context of 4280	1600	iutyfghjkoiuytf.exe	128

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/4280-247-0x0000000000400000-0x000000000046D000-memory.dmp	upx
behavioral1/memory/4280-249-0x0000000000400000-0x000000000046D000-memory.dmp	upx
behavioral1/memory/4280-245-0x0000000000400000-0x000000000046D000-memory.dmp	upx

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
6820	10172	WerFault.exe	421

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	iutyfghjkoiuytf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MasterSlave.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MasterSlave.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MasterSlave.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MasterSlave.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MasterSlave.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MasterSlave.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MasterSlave.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MasterSlave.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MasterSlave.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MasterSlave.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0a-PORNOSKI.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MasterSlave.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MasterSlave.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MasterSlave.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MasterSlave.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MasterSlave.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	software.exe

Checks SCSI registry key(s) 3 TTPs 9 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe

Enumerates system info in registry 2 TTPs 8 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings	msedge.exe

NTFS ADS 8 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 154056.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 676160.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 315030.crdownload:SmartScreen	msedge.exe
File created	C:\VIRUS\:SmartScreen:$DATA	MasterSlave.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 309698.crdownload:SmartScreen	msedge.exe
File created	C:\Users\Admin\AppData\Roaming\raesdfgiuytr\iutyfghjkoiuytf.exe\:SmartScreen:$DATA	software.exe
File created	C:\Users\Admin\AppData\Roaming\raesdfgiuytr\iutyfghjkoiuytf.exe:ZoneIdentifier	software.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 876853.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2196	msedge.exe
2196	msedge.exe
2160	msedge.exe
2160	msedge.exe
744	identity_helper.exe
744	identity_helper.exe
4320	msedge.exe
4320	msedge.exe
4060	software.exe
4060	software.exe
1600	iutyfghjkoiuytf.exe
1600	iutyfghjkoiuytf.exe
1420	iutyfghjkoiuytf.exe
1420	iutyfghjkoiuytf.exe
1420	iutyfghjkoiuytf.exe
1420	iutyfghjkoiuytf.exe
1420	iutyfghjkoiuytf.exe
1420	iutyfghjkoiuytf.exe
1420	iutyfghjkoiuytf.exe
1420	iutyfghjkoiuytf.exe
1420	iutyfghjkoiuytf.exe
1420	iutyfghjkoiuytf.exe
1420	iutyfghjkoiuytf.exe
1420	iutyfghjkoiuytf.exe
1420	iutyfghjkoiuytf.exe
1420	iutyfghjkoiuytf.exe
1420	iutyfghjkoiuytf.exe
1420	iutyfghjkoiuytf.exe
1420	iutyfghjkoiuytf.exe
1420	iutyfghjkoiuytf.exe
1420	iutyfghjkoiuytf.exe
1420	iutyfghjkoiuytf.exe
1420	iutyfghjkoiuytf.exe
1420	iutyfghjkoiuytf.exe
1420	iutyfghjkoiuytf.exe
1420	iutyfghjkoiuytf.exe
1420	iutyfghjkoiuytf.exe
1420	iutyfghjkoiuytf.exe
1420	iutyfghjkoiuytf.exe
1420	iutyfghjkoiuytf.exe
1420	iutyfghjkoiuytf.exe
1420	iutyfghjkoiuytf.exe
1420	iutyfghjkoiuytf.exe
1420	iutyfghjkoiuytf.exe
1420	iutyfghjkoiuytf.exe
1420	iutyfghjkoiuytf.exe
1420	iutyfghjkoiuytf.exe
1420	iutyfghjkoiuytf.exe
1420	iutyfghjkoiuytf.exe
1420	iutyfghjkoiuytf.exe
1420	iutyfghjkoiuytf.exe
1420	iutyfghjkoiuytf.exe
1420	iutyfghjkoiuytf.exe
1420	iutyfghjkoiuytf.exe
1420	iutyfghjkoiuytf.exe
1420	iutyfghjkoiuytf.exe
1420	iutyfghjkoiuytf.exe
1420	iutyfghjkoiuytf.exe
1420	iutyfghjkoiuytf.exe
1420	iutyfghjkoiuytf.exe
1420	iutyfghjkoiuytf.exe
1420	iutyfghjkoiuytf.exe
1420	iutyfghjkoiuytf.exe
1420	iutyfghjkoiuytf.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4980	taskmgr.exe

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
1600	iutyfghjkoiuytf.exe
1600	iutyfghjkoiuytf.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 64 IoCs

pid	Process
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe

Suspicious use of AdjustPrivilegeToken 10 IoCs

description	pid	Process
Token: SeDebugPrivilege	4280	iutyfghjkoiuytf.exe
Token: SeDebugPrivilege	4980	taskmgr.exe
Token: SeSystemProfilePrivilege	4980	taskmgr.exe
Token: SeCreateGlobalPrivilege	4980	taskmgr.exe
Token: 33	448	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	448	AUDIODG.EXE
Token: SeCreateGlobalPrivilege	10148	dwm.exe
Token: SeChangeNotifyPrivilege	10148	dwm.exe
Token: 33	10148	dwm.exe
Token: SeIncBasePriorityPrivilege	10148	dwm.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
4980	taskmgr.exe
4980	taskmgr.exe
4980	taskmgr.exe
4980	taskmgr.exe
4980	taskmgr.exe
4980	taskmgr.exe
4980	taskmgr.exe
4980	taskmgr.exe
4980	taskmgr.exe
4980	taskmgr.exe
4980	taskmgr.exe
4980	taskmgr.exe
4980	taskmgr.exe
4980	taskmgr.exe
4980	taskmgr.exe
4980	taskmgr.exe
4980	taskmgr.exe
4980	taskmgr.exe
4980	taskmgr.exe
4980	taskmgr.exe
4980	taskmgr.exe
4980	taskmgr.exe
4980	taskmgr.exe
4980	taskmgr.exe
4980	taskmgr.exe
4980	taskmgr.exe
4980	taskmgr.exe
4980	taskmgr.exe
4980	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
4980	taskmgr.exe
4980	taskmgr.exe
4980	taskmgr.exe
4980	taskmgr.exe
4980	taskmgr.exe
4980	taskmgr.exe
4980	taskmgr.exe
4980	taskmgr.exe
4980	taskmgr.exe
4980	taskmgr.exe
4980	taskmgr.exe
4980	taskmgr.exe
4980	taskmgr.exe
4980	taskmgr.exe
4980	taskmgr.exe
4980	taskmgr.exe
4980	taskmgr.exe
4980	taskmgr.exe
4980	taskmgr.exe
4980	taskmgr.exe
4980	taskmgr.exe
4980	taskmgr.exe
4980	taskmgr.exe
4980	taskmgr.exe
4980	taskmgr.exe
4980	taskmgr.exe
4980	taskmgr.exe
4980	taskmgr.exe
4980	taskmgr.exe
4980	taskmgr.exe
4980	taskmgr.exe
4980	taskmgr.exe
4980	taskmgr.exe
4980	taskmgr.exe
4980	taskmgr.exe
4980	taskmgr.exe
4980	taskmgr.exe
4980	taskmgr.exe
4980	taskmgr.exe
4980	taskmgr.exe

Suspicious use of SetWindowsHookEx 20 IoCs

pid	Process
4724	MasterSlave.exe
3424	MasterSlave.exe
588	MasterSlave.exe
5844	MasterSlave.exe
5788	MasterSlave.exe
5964	MasterSlave.exe
5628	MasterSlave.exe
6792	MasterSlave.exe
6544	MasterSlave.exe
6432	MasterSlave.exe
6580	MasterSlave.exe
7660	MasterSlave.exe
8208	MasterSlave.exe
8240	MasterSlave.exe
6808	MasterSlave.exe
10172	MasterSlave.exe
7760	MasterSlave.exe
7312	MasterSlave.exe
9528	MasterSlave.exe
3088	MasterSlave.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2160 wrote to memory of 2616	2160	msedge.exe	83
PID 2160 wrote to memory of 2616	2160	msedge.exe	83
PID 2160 wrote to memory of 2332	2160	msedge.exe	85
PID 2160 wrote to memory of 2332	2160	msedge.exe	85
PID 2160 wrote to memory of 2332	2160	msedge.exe	85
PID 2160 wrote to memory of 2332	2160	msedge.exe	85
PID 2160 wrote to memory of 2332	2160	msedge.exe	85
PID 2160 wrote to memory of 2332	2160	msedge.exe	85
PID 2160 wrote to memory of 2332	2160	msedge.exe	85
PID 2160 wrote to memory of 2332	2160	msedge.exe	85
PID 2160 wrote to memory of 2332	2160	msedge.exe	85
PID 2160 wrote to memory of 2332	2160	msedge.exe	85
PID 2160 wrote to memory of 2332	2160	msedge.exe	85
PID 2160 wrote to memory of 2332	2160	msedge.exe	85
PID 2160 wrote to memory of 2332	2160	msedge.exe	85
PID 2160 wrote to memory of 2332	2160	msedge.exe	85
PID 2160 wrote to memory of 2332	2160	msedge.exe	85
PID 2160 wrote to memory of 2332	2160	msedge.exe	85
PID 2160 wrote to memory of 2332	2160	msedge.exe	85
PID 2160 wrote to memory of 2332	2160	msedge.exe	85
PID 2160 wrote to memory of 2332	2160	msedge.exe	85
PID 2160 wrote to memory of 2332	2160	msedge.exe	85
PID 2160 wrote to memory of 2332	2160	msedge.exe	85
PID 2160 wrote to memory of 2332	2160	msedge.exe	85
PID 2160 wrote to memory of 2332	2160	msedge.exe	85
PID 2160 wrote to memory of 2332	2160	msedge.exe	85
PID 2160 wrote to memory of 2332	2160	msedge.exe	85
PID 2160 wrote to memory of 2332	2160	msedge.exe	85
PID 2160 wrote to memory of 2332	2160	msedge.exe	85
PID 2160 wrote to memory of 2332	2160	msedge.exe	85
PID 2160 wrote to memory of 2332	2160	msedge.exe	85
PID 2160 wrote to memory of 2332	2160	msedge.exe	85
PID 2160 wrote to memory of 2332	2160	msedge.exe	85
PID 2160 wrote to memory of 2332	2160	msedge.exe	85
PID 2160 wrote to memory of 2332	2160	msedge.exe	85
PID 2160 wrote to memory of 2332	2160	msedge.exe	85
PID 2160 wrote to memory of 2332	2160	msedge.exe	85
PID 2160 wrote to memory of 2332	2160	msedge.exe	85
PID 2160 wrote to memory of 2332	2160	msedge.exe	85
PID 2160 wrote to memory of 2332	2160	msedge.exe	85
PID 2160 wrote to memory of 2332	2160	msedge.exe	85
PID 2160 wrote to memory of 2332	2160	msedge.exe	85
PID 2160 wrote to memory of 2196	2160	msedge.exe	86
PID 2160 wrote to memory of 2196	2160	msedge.exe	86
PID 2160 wrote to memory of 1916	2160	msedge.exe	87
PID 2160 wrote to memory of 1916	2160	msedge.exe	87
PID 2160 wrote to memory of 1916	2160	msedge.exe	87
PID 2160 wrote to memory of 1916	2160	msedge.exe	87
PID 2160 wrote to memory of 1916	2160	msedge.exe	87
PID 2160 wrote to memory of 1916	2160	msedge.exe	87
PID 2160 wrote to memory of 1916	2160	msedge.exe	87
PID 2160 wrote to memory of 1916	2160	msedge.exe	87
PID 2160 wrote to memory of 1916	2160	msedge.exe	87
PID 2160 wrote to memory of 1916	2160	msedge.exe	87
PID 2160 wrote to memory of 1916	2160	msedge.exe	87
PID 2160 wrote to memory of 1916	2160	msedge.exe	87
PID 2160 wrote to memory of 1916	2160	msedge.exe	87
PID 2160 wrote to memory of 1916	2160	msedge.exe	87
PID 2160 wrote to memory of 1916	2160	msedge.exe	87
PID 2160 wrote to memory of 1916	2160	msedge.exe	87
PID 2160 wrote to memory of 1916	2160	msedge.exe	87
PID 2160 wrote to memory of 1916	2160	msedge.exe	87
PID 2160 wrote to memory of 1916	2160	msedge.exe	87
PID 2160 wrote to memory of 1916	2160	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://github.com/Viper4K/malware/tree/master/MEMZ
1⤵
- Enumerates system info in registry
- Modifies registry class
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc704b46f8,0x7ffc704b4708,0x7ffc704b4718
  2⤵
  PID:2616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2028,11853788420522713937,9993413787208016055,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2044 /prefetch:2
  2⤵
  PID:2332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2028,11853788420522713937,9993413787208016055,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2132 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2028,11853788420522713937,9993413787208016055,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2896 /prefetch:8
  2⤵
  PID:1916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,11853788420522713937,9993413787208016055,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3344 /prefetch:1
  2⤵
  PID:2212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,11853788420522713937,9993413787208016055,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3352 /prefetch:1
  2⤵
  PID:4748
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2028,11853788420522713937,9993413787208016055,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5356 /prefetch:8
  2⤵
  PID:2132
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2028,11853788420522713937,9993413787208016055,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5356 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2028,11853788420522713937,9993413787208016055,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5112 /prefetch:8
  2⤵
  PID:5052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,11853788420522713937,9993413787208016055,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5628 /prefetch:1
  2⤵
  PID:3420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2028,11853788420522713937,9993413787208016055,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6080 /prefetch:8
  2⤵
  PID:3528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,11853788420522713937,9993413787208016055,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5908 /prefetch:1
  2⤵
  PID:1856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,11853788420522713937,9993413787208016055,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5872 /prefetch:1
  2⤵
  PID:3052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,11853788420522713937,9993413787208016055,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5928 /prefetch:1
  2⤵
  PID:2884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,11853788420522713937,9993413787208016055,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5512 /prefetch:1
  2⤵
  PID:3452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2028,11853788420522713937,9993413787208016055,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5572 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,11853788420522713937,9993413787208016055,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5452 /prefetch:1
  2⤵
  PID:4444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2028,11853788420522713937,9993413787208016055,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4784 /prefetch:8
  2⤵
  PID:4020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2028,11853788420522713937,9993413787208016055,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4840 /prefetch:2
  2⤵
  PID:1680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2028,11853788420522713937,9993413787208016055,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6304 /prefetch:8
  2⤵
  PID:3664
- C:\Users\Admin\Downloads\smss.exe
  "C:\Users\Admin\Downloads\smss.exe"
  2⤵
  - Executes dropped EXE
  PID:4668
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.youtube.com/watch?v=rAnD5mhYaEY&list=UUuGGBThaGchBKUlZfCqgSPA
    3⤵
    PID:5684
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffc704b46f8,0x7ffc704b4708,0x7ffc704b4718
      4⤵
      PID:7268
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1904,16348643901302182942,16211377991994431966,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2256 /prefetch:2
      4⤵
      PID:9844
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1904,16348643901302182942,16211377991994431966,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2308 /prefetch:3
      4⤵
      PID:2228
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1904,16348643901302182942,16211377991994431966,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2688 /prefetch:8
      4⤵
      PID:4764
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,16348643901302182942,16211377991994431966,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2880 /prefetch:1
      4⤵
      PID:6140
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,16348643901302182942,16211377991994431966,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3376 /prefetch:1
      4⤵
      PID:8312
- C:\Users\Admin\Downloads\smss.exe
  "C:\Users\Admin\Downloads\smss.exe"
  2⤵
  - Executes dropped EXE
  PID:4032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,11853788420522713937,9993413787208016055,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5860 /prefetch:1
  2⤵
  PID:4848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2028,11853788420522713937,9993413787208016055,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=3344 /prefetch:8
  2⤵
  PID:1360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2028,11853788420522713937,9993413787208016055,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5000 /prefetch:8
  2⤵
  PID:4024
- C:\Users\Admin\Downloads\0a-PORNOSKI.exe
  "C:\Users\Admin\Downloads\0a-PORNOSKI.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops autorun.inf file
  - System Location Discovery: System Language Discovery
  PID:4380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,11853788420522713937,9993413787208016055,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3084 /prefetch:1
  2⤵
  PID:1972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,11853788420522713937,9993413787208016055,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3448 /prefetch:1
  2⤵
  PID:3684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2028,11853788420522713937,9993413787208016055,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6480 /prefetch:8
  2⤵
  PID:3664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,11853788420522713937,9993413787208016055,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5604 /prefetch:1
  2⤵
  PID:4104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2028,11853788420522713937,9993413787208016055,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=1776 /prefetch:8
  2⤵
  PID:3756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,11853788420522713937,9993413787208016055,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=904 /prefetch:1
  2⤵
  PID:2876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2028,11853788420522713937,9993413787208016055,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6724 /prefetch:8
  2⤵
  PID:4764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,11853788420522713937,9993413787208016055,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1252 /prefetch:1
  2⤵
  PID:3152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2028,11853788420522713937,9993413787208016055,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6348 /prefetch:8
  2⤵
  PID:924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2028,11853788420522713937,9993413787208016055,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5652 /prefetch:8
  2⤵
  PID:2860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2028,11853788420522713937,9993413787208016055,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5828 /prefetch:8
  2⤵
  PID:4268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2028,11853788420522713937,9993413787208016055,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6340 /prefetch:8
  2⤵
  PID:2936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,11853788420522713937,9993413787208016055,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6216 /prefetch:1
  2⤵
  PID:884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2028,11853788420522713937,9993413787208016055,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6656 /prefetch:8
  2⤵
  PID:404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,11853788420522713937,9993413787208016055,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3760 /prefetch:1
  2⤵
  PID:1212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2028,11853788420522713937,9993413787208016055,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3088 /prefetch:8
  2⤵
  PID:4264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,11853788420522713937,9993413787208016055,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6564 /prefetch:1
  2⤵
  PID:3664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2028,11853788420522713937,9993413787208016055,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4812 /prefetch:8
  2⤵
  PID:1152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,11853788420522713937,9993413787208016055,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3480 /prefetch:1
  2⤵
  PID:3928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2028,11853788420522713937,9993413787208016055,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6248 /prefetch:8
  2⤵
  PID:840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,11853788420522713937,9993413787208016055,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=55 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5256 /prefetch:1
  2⤵
  PID:4852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,11853788420522713937,9993413787208016055,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=56 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6308 /prefetch:1
  2⤵
  PID:4196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,11853788420522713937,9993413787208016055,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=57 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5040 /prefetch:1
  2⤵
  PID:736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,11853788420522713937,9993413787208016055,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=58 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4872 /prefetch:1
  2⤵
  PID:3304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,11853788420522713937,9993413787208016055,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=59 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4720 /prefetch:1
  2⤵
  PID:5092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,11853788420522713937,9993413787208016055,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=60 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1192 /prefetch:1
  2⤵
  PID:3704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2028,11853788420522713937,9993413787208016055,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=6512 /prefetch:8
  2⤵
  PID:3988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,11853788420522713937,9993413787208016055,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=62 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6316 /prefetch:1
  2⤵
  PID:2596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,11853788420522713937,9993413787208016055,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=63 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7164 /prefetch:1
  2⤵
  PID:228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,11853788420522713937,9993413787208016055,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=64 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3448 /prefetch:1
  2⤵
  PID:1096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,11853788420522713937,9993413787208016055,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=65 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6964 /prefetch:1
  2⤵
  PID:4024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,11853788420522713937,9993413787208016055,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=66 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6960 /prefetch:1
  2⤵
  PID:1472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,11853788420522713937,9993413787208016055,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=67 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6500 /prefetch:1
  2⤵
  PID:1544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,11853788420522713937,9993413787208016055,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=68 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4784 /prefetch:1
  2⤵
  PID:3780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,11853788420522713937,9993413787208016055,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=69 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5664 /prefetch:1
  2⤵
  PID:2680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,11853788420522713937,9993413787208016055,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=70 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6868 /prefetch:1
  2⤵
  PID:5308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,11853788420522713937,9993413787208016055,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=71 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5604 /prefetch:1
  2⤵
  PID:5324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,11853788420522713937,9993413787208016055,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=72 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7596 /prefetch:1
  2⤵
  PID:6044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,11853788420522713937,9993413787208016055,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=73 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7564 /prefetch:1
  2⤵
  PID:6068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,11853788420522713937,9993413787208016055,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=74 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5916 /prefetch:1
  2⤵
  PID:5516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,11853788420522713937,9993413787208016055,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=75 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7416 /prefetch:1
  2⤵
  PID:5532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,11853788420522713937,9993413787208016055,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=76 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6916 /prefetch:1
  2⤵
  PID:5356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,11853788420522713937,9993413787208016055,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=77 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7200 /prefetch:1
  2⤵
  PID:2680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,11853788420522713937,9993413787208016055,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=78 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8220 /prefetch:1
  2⤵
  PID:5896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,11853788420522713937,9993413787208016055,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=79 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7388 /prefetch:1
  2⤵
  PID:6272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,11853788420522713937,9993413787208016055,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=80 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8432 /prefetch:1
  2⤵
  PID:6296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,11853788420522713937,9993413787208016055,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=81 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7480 /prefetch:1
  2⤵
  PID:7020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,11853788420522713937,9993413787208016055,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=82 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7472 /prefetch:1
  2⤵
  PID:7092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,11853788420522713937,9993413787208016055,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=83 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7916 /prefetch:1
  2⤵
  PID:6732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,11853788420522713937,9993413787208016055,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=84 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8368 /prefetch:1
  2⤵
  PID:6852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,11853788420522713937,9993413787208016055,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=85 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8372 /prefetch:1
  2⤵
  PID:5496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,11853788420522713937,9993413787208016055,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=86 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8684 /prefetch:1
  2⤵
  PID:6160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,11853788420522713937,9993413787208016055,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=87 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8116 /prefetch:1
  2⤵
  PID:6484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,11853788420522713937,9993413787208016055,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=88 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8680 /prefetch:1
  2⤵
  PID:6292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,11853788420522713937,9993413787208016055,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=89 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8892 /prefetch:1
  2⤵
  PID:7892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,11853788420522713937,9993413787208016055,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=90 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9100 /prefetch:1
  2⤵
  PID:8060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,11853788420522713937,9993413787208016055,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=91 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9560 /prefetch:1
  2⤵
  PID:8256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,11853788420522713937,9993413787208016055,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=92 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9096 /prefetch:1
  2⤵
  PID:8380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,11853788420522713937,9993413787208016055,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=93 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9844 /prefetch:1
  2⤵
  PID:8712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,11853788420522713937,9993413787208016055,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=94 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10036 /prefetch:1
  2⤵
  PID:8876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,11853788420522713937,9993413787208016055,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=95 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9248 /prefetch:1
  2⤵
  PID:8888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,11853788420522713937,9993413787208016055,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=96 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10564 /prefetch:1
  2⤵
  PID:8996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,11853788420522713937,9993413787208016055,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=97 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10140 /prefetch:1
  2⤵
  PID:9180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,11853788420522713937,9993413787208016055,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=98 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10892 /prefetch:1
  2⤵
  PID:9192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,11853788420522713937,9993413787208016055,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=99 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10868 /prefetch:1
  2⤵
  PID:9276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,11853788420522713937,9993413787208016055,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=100 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10696 /prefetch:1
  2⤵
  PID:9688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,11853788420522713937,9993413787208016055,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=101 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10764 /prefetch:1
  2⤵
  PID:2532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,11853788420522713937,9993413787208016055,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=102 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9360 /prefetch:1
  2⤵
  PID:8384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,11853788420522713937,9993413787208016055,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=103 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9240 /prefetch:1
  2⤵
  PID:8828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,11853788420522713937,9993413787208016055,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=104 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10060 /prefetch:1
  2⤵
  PID:8772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,11853788420522713937,9993413787208016055,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=105 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9068 /prefetch:1
  2⤵
  PID:8956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,11853788420522713937,9993413787208016055,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=106 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=11764 /prefetch:1
  2⤵
  PID:10196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,11853788420522713937,9993413787208016055,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=107 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9580 /prefetch:1
  2⤵
  PID:4416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,11853788420522713937,9993413787208016055,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=108 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10220 /prefetch:1
  2⤵
  PID:2612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,11853788420522713937,9993413787208016055,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=109 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4740 /prefetch:1
  2⤵
  PID:9092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,11853788420522713937,9993413787208016055,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=110 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=11660 /prefetch:1
  2⤵
  PID:8840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,11853788420522713937,9993413787208016055,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=111 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10680 /prefetch:1
  2⤵
  PID:9448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,11853788420522713937,9993413787208016055,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=112 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=11700 /prefetch:1
  2⤵
  PID:8132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,11853788420522713937,9993413787208016055,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=113 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10256 /prefetch:1
  2⤵
  PID:8784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,11853788420522713937,9993413787208016055,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=114 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1300 /prefetch:1
  2⤵
  PID:7352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,11853788420522713937,9993413787208016055,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=115 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10652 /prefetch:1
  2⤵
  PID:7716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,11853788420522713937,9993413787208016055,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=116 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8356 /prefetch:1
  2⤵
  PID:8120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,11853788420522713937,9993413787208016055,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=117 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=11412 /prefetch:1
  2⤵
  PID:7888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,11853788420522713937,9993413787208016055,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=118 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2212 /prefetch:1
  2⤵
  PID:5636

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4468

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4076

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1904

C:\Users\Admin\Downloads\software.exe
"C:\Users\Admin\Downloads\software.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
PID:4060
- C:\Users\Admin\AppData\Roaming\raesdfgiuytr\iutyfghjkoiuytf.exe
  "C:\Users\Admin\AppData\Roaming\raesdfgiuytr\iutyfghjkoiuytf.exe"
  2⤵
  - Drops startup file
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  PID:1600
- - C:\Users\Admin\AppData\Roaming\raesdfgiuytr\iutyfghjkoiuytf.exe
    "C:\Users\Admin\AppData\Roaming\raesdfgiuytr\iutyfghjkoiuytf.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:4280
- - C:\Users\Admin\AppData\Roaming\raesdfgiuytr\iutyfghjkoiuytf.exe
    "C:\Users\Admin\AppData\Roaming\raesdfgiuytr\iutyfghjkoiuytf.exe" 2 4280 240653000
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:1420
  - - C:\Users\Admin\AppData\Roaming\raesdfgiuytr\iutyfghjkoiuytf.exe
      "C:\Users\Admin\AppData\Roaming\raesdfgiuytr\iutyfghjkoiuytf.exe"
      4⤵
      Executes dropped EXE
      PID:1844

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Drops startup file
- Checks SCSI registry key(s)
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4980

C:\Users\Admin\Downloads\MasterSlave.exe
"C:\Users\Admin\Downloads\MasterSlave.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- NTFS ADS
PID:1992
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c @echo off
  2⤵
  PID:2416
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c dir c
  2⤵
  - System Location Discovery: System Language Discovery
  PID:448
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c md VIRUS
  2⤵
  PID:808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.youtube.com/watch?v=kSS_tDfeLOk
  2⤵
  PID:744
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffc704b46f8,0x7ffc704b4708,0x7ffc704b4718
    3⤵
    PID:4028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://thoughtcatalog.com/juliet-escoria/2013/12/16-steps-to-kill-someone-and-not-get-caught/
  2⤵
  PID:1440
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffc704b46f8,0x7ffc704b4708,0x7ffc704b4718
    3⤵
    PID:3008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.topgunsupply.com/sig-sauer-p226r-9mm-nitron-siglite-night-sights-da-sa.html
  2⤵
  PID:1760
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffc704b46f8,0x7ffc704b4708,0x7ffc704b4718
    3⤵
    PID:4500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.amazon.com/Disaster-Bag-Body/dp/B0012C9UGK
  2⤵
  PID:1212
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffc704b46f8,0x7ffc704b4708,0x7ffc704b4718
    3⤵
    PID:4292
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c MasterSlave.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2860
- - C:\Users\Admin\Downloads\MasterSlave.exe
    MasterSlave.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Enumerates connected drives
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:4724
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c @echo off
      4⤵
      PID:3748
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c dir c
      4⤵
      PID:4388
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c md VIRUS
      4⤵
      System Location Discovery: System Language Discovery
      PID:464
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.youtube.com/watch?v=kSS_tDfeLOk
      4⤵
      PID:1528
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffc704b46f8,0x7ffc704b4708,0x7ffc704b4718
        5⤵
        
        PID:1360
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c MasterSlave.exe
      4⤵
      PID:2488
    - - C:\Users\Admin\Downloads\MasterSlave.exe
        
        MasterSlave.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Enumerates connected drives
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:3424
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c @echo off
        6⤵
        
        PID:2216
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c dir c
        6⤵
        
        PID:2312
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c md VIRUS
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:588
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.youtube.com/watch?v=kSS_tDfeLOk
        6⤵
        
        PID:3460
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffc704b46f8,0x7ffc704b4708,0x7ffc704b4718
        7⤵
        
        PID:3324
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c MasterSlave.exe
        6⤵
        
        PID:3824
        
        C:\Users\Admin\Downloads\MasterSlave.exe
        
        MasterSlave.exe
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Enumerates connected drives
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:588
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c @echo off
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:2712
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c dir c
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:5128
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c md VIRUS
        8⤵
        
        PID:5144
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.youtube.com/watch?v=kSS_tDfeLOk
        8⤵
        
        PID:5224
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffc704b46f8,0x7ffc704b4708,0x7ffc704b4718
        9⤵
        
        PID:5240
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c MasterSlave.exe
        8⤵
        
        PID:5828
        
        C:\Users\Admin\Downloads\MasterSlave.exe
        
        MasterSlave.exe
        9⤵
        Executes dropped EXE
        Loads dropped DLL
        Enumerates connected drives
        Suspicious use of SetWindowsHookEx
        
        PID:5844
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c @echo off
        10⤵
        
        PID:5864
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c dir c
        10⤵
        
        PID:5884
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c md VIRUS
        10⤵
        
        PID:5904
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.youtube.com/watch?v=kSS_tDfeLOk
        10⤵
        
        PID:5952
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x120,0x124,0x128,0x11c,0xf8,0x7ffc704b46f8,0x7ffc704b4708,0x7ffc704b4718
        11⤵
        
        PID:5976
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c MasterSlave.exe
        10⤵
        
        PID:5764
        
        C:\Users\Admin\Downloads\MasterSlave.exe
        
        MasterSlave.exe
        11⤵
        Executes dropped EXE
        Loads dropped DLL
        Enumerates connected drives
        Suspicious use of SetWindowsHookEx
        
        PID:5788
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c @echo off
        12⤵
        
        PID:5820
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c dir c
        12⤵
        System Location Discovery: System Language Discovery
        
        PID:5900
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c md VIRUS
        12⤵
        
        PID:5912
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.youtube.com/watch?v=kSS_tDfeLOk
        12⤵
        
        PID:1824
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffc704b46f8,0x7ffc704b4708,0x7ffc704b4718
        13⤵
        
        PID:5208
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c MasterSlave.exe
        12⤵
        
        PID:5868
        
        C:\Users\Admin\Downloads\MasterSlave.exe
        
        MasterSlave.exe
        13⤵
        Executes dropped EXE
        Loads dropped DLL
        Enumerates connected drives
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:5964
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c @echo off
        14⤵
        System Location Discovery: System Language Discovery
        
        PID:2688
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c dir c
        14⤵
        System Location Discovery: System Language Discovery
        
        PID:5148
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c md VIRUS
        14⤵
        System Location Discovery: System Language Discovery
        
        PID:3320
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.youtube.com/watch?v=kSS_tDfeLOk
        14⤵
        
        PID:5352
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffc704b46f8,0x7ffc704b4708,0x7ffc704b4718
        15⤵
        
        PID:5368
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c MasterSlave.exe
        14⤵
        
        PID:5576
        
        C:\Users\Admin\Downloads\MasterSlave.exe
        
        MasterSlave.exe
        15⤵
        Executes dropped EXE
        Loads dropped DLL
        Enumerates connected drives
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:5628
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c @echo off
        16⤵
        
        PID:5700
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c dir c
        16⤵
        System Location Discovery: System Language Discovery
        
        PID:5736
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c md VIRUS
        16⤵
        System Location Discovery: System Language Discovery
        
        PID:2896
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.youtube.com/watch?v=kSS_tDfeLOk
        16⤵
        
        PID:6192
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffc704b46f8,0x7ffc704b4708,0x7ffc704b4718
        17⤵
        
        PID:6208
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c MasterSlave.exe
        16⤵
        
        PID:6776
        
        C:\Users\Admin\Downloads\MasterSlave.exe
        
        MasterSlave.exe
        17⤵
        Executes dropped EXE
        Loads dropped DLL
        Enumerates connected drives
        Suspicious use of SetWindowsHookEx
        
        PID:6792
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c @echo off
        18⤵
        
        PID:6816
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c dir c
        18⤵
        System Location Discovery: System Language Discovery
        
        PID:6832
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c md VIRUS
        18⤵
        
        PID:6848
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.youtube.com/watch?v=kSS_tDfeLOk
        18⤵
        
        PID:6936
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffc704b46f8,0x7ffc704b4708,0x7ffc704b4718
        19⤵
        
        PID:6952
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c MasterSlave.exe
        18⤵
        
        PID:6520
        
        C:\Users\Admin\Downloads\MasterSlave.exe
        
        MasterSlave.exe
        19⤵
        Executes dropped EXE
        Loads dropped DLL
        Enumerates connected drives
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:6544
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c @echo off
        20⤵
        System Location Discovery: System Language Discovery
        
        PID:6560
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c dir c
        20⤵
        
        PID:2412
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c md VIRUS
        20⤵
        System Location Discovery: System Language Discovery
        
        PID:3120
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.youtube.com/watch?v=kSS_tDfeLOk
        20⤵
        
        PID:3780
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffc704b46f8,0x7ffc704b4708,0x7ffc704b4718
        21⤵
        
        PID:6584
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c MasterSlave.exe
        20⤵
        
        PID:6412
        
        C:\Users\Admin\Downloads\MasterSlave.exe
        
        MasterSlave.exe
        21⤵
        Executes dropped EXE
        Loads dropped DLL
        Enumerates connected drives
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:6432
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c @echo off
        22⤵
        
        PID:6456
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c dir c
        22⤵
        
        PID:6464
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c md VIRUS
        22⤵
        
        PID:6496
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.youtube.com/watch?v=kSS_tDfeLOk
        22⤵
        
        PID:3052
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffc704b46f8,0x7ffc704b4708,0x7ffc704b4718
        23⤵
        
        PID:1720
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c MasterSlave.exe
        22⤵
        
        PID:1420
        
        C:\Users\Admin\Downloads\MasterSlave.exe
        
        MasterSlave.exe
        23⤵
        Executes dropped EXE
        Loads dropped DLL
        Enumerates connected drives
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:6580
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c @echo off
        24⤵
        System Location Discovery: System Language Discovery
        
        PID:3756
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c dir c
        24⤵
        
        PID:5896
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c md VIRUS
        24⤵
        
        PID:5736
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.youtube.com/watch?v=kSS_tDfeLOk
        24⤵
        
        PID:5204
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x128,0x12c,0x130,0xf8,0xfc,0x7ffc704b46f8,0x7ffc704b4708,0x7ffc704b4718
        25⤵
        
        PID:2184
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c MasterSlave.exe
        24⤵
        System Location Discovery: System Language Discovery
        
        PID:7648
        
        C:\Users\Admin\Downloads\MasterSlave.exe
        
        MasterSlave.exe
        25⤵
        Executes dropped EXE
        Loads dropped DLL
        Enumerates connected drives
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:7660
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c @echo off
        26⤵
        System Location Discovery: System Language Discovery
        
        PID:7704
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c dir c
        26⤵
        
        PID:7732
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c md VIRUS
        26⤵
        
        PID:7760
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.youtube.com/watch?v=kSS_tDfeLOk
        26⤵
        
        PID:7820
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x120,0x124,0x128,0xf8,0x12c,0x7ffc704b46f8,0x7ffc704b4708,0x7ffc704b4718
        27⤵
        
        PID:7836
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c MasterSlave.exe
        26⤵
        
        PID:8052
        
        C:\Users\Admin\Downloads\MasterSlave.exe
        
        MasterSlave.exe
        27⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:7204
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c @echo off
        28⤵
        
        PID:4460
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c dir c
        28⤵
        System Location Discovery: System Language Discovery
        
        PID:8148
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c md VIRUS
        28⤵
        
        PID:4324
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.youtube.com/watch?v=kSS_tDfeLOk
        28⤵
        
        PID:6504
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffc704b46f8,0x7ffc704b4708,0x7ffc704b4718
        29⤵
        
        PID:7428
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c MasterSlave.exe
        28⤵
        
        PID:7376
        
        C:\Users\Admin\Downloads\MasterSlave.exe
        
        MasterSlave.exe
        29⤵
        Executes dropped EXE
        Loads dropped DLL
        Enumerates connected drives
        Suspicious use of SetWindowsHookEx
        
        PID:8208
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c @echo off
        30⤵
        
        PID:8236
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c dir c
        30⤵
        
        PID:8280
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c md VIRUS
        30⤵
        
        PID:8360
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.youtube.com/watch?v=kSS_tDfeLOk
        30⤵
        
        PID:8568
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffc704b46f8,0x7ffc704b4708,0x7ffc704b4718
        31⤵
        
        PID:8588
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c MasterSlave.exe
        30⤵
        System Location Discovery: System Language Discovery
        
        PID:4536
        
        C:\Users\Admin\Downloads\MasterSlave.exe
        
        MasterSlave.exe
        31⤵
        Executes dropped EXE
        Loads dropped DLL
        Enumerates connected drives
        Suspicious use of SetWindowsHookEx
        
        PID:8240
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c @echo off
        32⤵
        System Location Discovery: System Language Discovery
        
        PID:8372
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c dir c
        32⤵
        
        PID:8360
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c md VIRUS
        32⤵
        
        PID:8484
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.youtube.com/watch?v=kSS_tDfeLOk
        32⤵
        
        PID:8600
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffc704b46f8,0x7ffc704b4708,0x7ffc704b4718
        33⤵
        
        PID:8660
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c MasterSlave.exe
        32⤵
        
        PID:1600
        
        C:\Users\Admin\Downloads\MasterSlave.exe
        
        MasterSlave.exe
        33⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:8980
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c @echo off
        34⤵
        System Location Discovery: System Language Discovery
        
        PID:9080
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c dir c
        34⤵
        
        PID:9112
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c md VIRUS
        34⤵
        
        PID:9132
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.youtube.com/watch?v=kSS_tDfeLOk
        34⤵
        
        PID:8216
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffc704b46f8,0x7ffc704b4708,0x7ffc704b4718
        35⤵
        
        PID:8224
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://thoughtcatalog.com/juliet-escoria/2013/12/16-steps-to-kill-someone-and-not-get-caught/
        34⤵
        
        PID:8360
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffc704b46f8,0x7ffc704b4708,0x7ffc704b4718
        35⤵
        
        PID:8512
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.topgunsupply.com/sig-sauer-p226r-9mm-nitron-siglite-night-sights-da-sa.html
        34⤵
        
        PID:9556
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffc704b46f8,0x7ffc704b4708,0x7ffc704b4718
        35⤵
        
        PID:9568
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.amazon.com/Disaster-Bag-Body/dp/B0012C9UGK
        34⤵
        
        PID:10108
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffc704b46f8,0x7ffc704b4708,0x7ffc704b4718
        35⤵
        
        PID:8960
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c MasterSlave.exe
        34⤵
        
        PID:8944
        
        C:\Users\Admin\Downloads\MasterSlave.exe
        
        MasterSlave.exe
        35⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:8880
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c @echo off
        36⤵
        
        PID:3668
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c dir c
        36⤵
        System Location Discovery: System Language Discovery
        
        PID:8668
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c md VIRUS
        36⤵
        
        PID:1968
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.youtube.com/watch?v=kSS_tDfeLOk
        36⤵
        
        PID:8968
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffc704b46f8,0x7ffc704b4708,0x7ffc704b4718
        37⤵
        
        PID:9608
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c MasterSlave.exe
        36⤵
        
        PID:5012
        
        C:\Users\Admin\Downloads\MasterSlave.exe
        
        MasterSlave.exe
        37⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:9644
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c @echo off
        38⤵
        System Location Discovery: System Language Discovery
        
        PID:9696
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c dir c
        38⤵
        System Location Discovery: System Language Discovery
        
        PID:2896
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c md VIRUS
        38⤵
        System Location Discovery: System Language Discovery
        
        PID:2480
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.youtube.com/watch?v=kSS_tDfeLOk
        38⤵
        
        PID:9460
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffc704b46f8,0x7ffc704b4708,0x7ffc704b4718
        39⤵
        
        PID:10176
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c MasterSlave.exe
        38⤵
        
        PID:10164
        
        C:\Users\Admin\Downloads\MasterSlave.exe
        
        MasterSlave.exe
        39⤵
        Executes dropped EXE
        Loads dropped DLL
        Enumerates connected drives
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:10172
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c @echo off
        40⤵
        System Location Discovery: System Language Discovery
        
        PID:4048
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c dir c
        40⤵
        
        PID:7720
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c md VIRUS
        40⤵
        
        PID:1788
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.youtube.com/watch?v=kSS_tDfeLOk
        40⤵
        
        PID:6560
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffc704b46f8,0x7ffc704b4708,0x7ffc704b4718
        41⤵
        
        PID:10068
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 10172 -s 1288
        40⤵
        Program crash
        
        PID:6820
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c MasterSlave.exe
        38⤵
        
        PID:6048
        
        C:\Users\Admin\Downloads\MasterSlave.exe
        
        MasterSlave.exe
        39⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:6120
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c @echo off
        40⤵
        
        PID:5440
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c dir c
        40⤵
        
        PID:5984
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c md VIRUS
        40⤵
        
        PID:9096
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.youtube.com/watch?v=kSS_tDfeLOk
        40⤵
        
        PID:3144
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x120,0x124,0x128,0xbc,0x12c,0x7ffc704b46f8,0x7ffc704b4708,0x7ffc704b4718
        41⤵
        
        PID:2440
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c MasterSlave.exe
        40⤵
        
        PID:7164
        
        C:\Users\Admin\Downloads\MasterSlave.exe
        
        MasterSlave.exe
        41⤵
        
        PID:1580
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c @echo off
        42⤵
        
        PID:716
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c dir c
        42⤵
        
        PID:700
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c md VIRUS
        42⤵
        
        PID:8292
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.youtube.com/watch?v=kSS_tDfeLOk
        42⤵
        
        PID:6172
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffc704b46f8,0x7ffc704b4708,0x7ffc704b4718
        43⤵
        
        PID:4456
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2136,17015043144892916029,8954818965365651616,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2128 /prefetch:3
        43⤵
        
        PID:3012
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://thoughtcatalog.com/juliet-escoria/2013/12/16-steps-to-kill-someone-and-not-get-caught/
        42⤵
        
        PID:9224
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xfc,0x128,0x7ffc704b46f8,0x7ffc704b4708,0x7ffc704b4718
        43⤵
        
        PID:7948
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1468,9794128169923046873,13123594484186153751,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2120 /prefetch:3
        43⤵
        
        PID:7896
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.topgunsupply.com/sig-sauer-p226r-9mm-nitron-siglite-night-sights-da-sa.html
        42⤵
        
        PID:10444
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x128,0x12c,0x130,0xf8,0x134,0x7ffc704b46f8,0x7ffc704b4708,0x7ffc704b4718
        43⤵
        
        PID:4300
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c MasterSlave.exe
  2⤵
  PID:7052
- - C:\Users\Admin\Downloads\MasterSlave.exe
    MasterSlave.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:9780
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c @echo off
      4⤵
      PID:9804
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c dir c
      4⤵
      PID:9816
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c md VIRUS
      4⤵
      System Location Discovery: System Language Discovery
      PID:9828
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.youtube.com/watch?v=kSS_tDfeLOk
      4⤵
      PID:9892
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffc704b46f8,0x7ffc704b4708,0x7ffc704b4718
        5⤵
        
        PID:9912
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c MasterSlave.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:9900
    - - C:\Users\Admin\Downloads\MasterSlave.exe
        
        MasterSlave.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        
        PID:9960
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c @echo off
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:8768
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c dir c
        6⤵
        
        PID:3540
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c md VIRUS
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:10068
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.youtube.com/watch?v=kSS_tDfeLOk
        6⤵
        
        PID:6828
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffc704b46f8,0x7ffc704b4708,0x7ffc704b4718
        7⤵
        
        PID:3084
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c MasterSlave.exe
        6⤵
        
        PID:6868
        
        C:\Users\Admin\Downloads\MasterSlave.exe
        
        MasterSlave.exe
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Enumerates connected drives
        Suspicious use of SetWindowsHookEx
        
        PID:6808
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c @echo off
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:8928
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c dir c
        8⤵
        
        PID:10124
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c md VIRUS
        8⤵
        
        PID:756
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.youtube.com/watch?v=kSS_tDfeLOk
        8⤵
        
        PID:4684
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x128,0x12c,0x130,0xf8,0x134,0x7ffc704b46f8,0x7ffc704b4708,0x7ffc704b4718
        9⤵
        
        PID:5760
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c MasterSlave.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:8768
        
        C:\Users\Admin\Downloads\MasterSlave.exe
        
        MasterSlave.exe
        9⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        
        PID:1572
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.youtube.com/watch?v=kSS_tDfeLOk
        10⤵
        
        PID:3664
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c MasterSlave.exe
        10⤵
        
        PID:6292
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c MasterSlave.exe
        10⤵
        System Location Discovery: System Language Discovery
        
        PID:8340
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c MasterSlave.exe
        10⤵
        
        PID:9404
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c MasterSlave.exe
        10⤵
        
        PID:3184
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c MasterSlave.exe
        10⤵
        System Location Discovery: System Language Discovery
        
        PID:8968
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c MasterSlave.exe
        10⤵
        System Location Discovery: System Language Discovery
        
        PID:10136
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c MasterSlave.exe
        10⤵
        System Location Discovery: System Language Discovery
        
        PID:4048
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c MasterSlave.exe
        10⤵
        
        PID:3140
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c MasterSlave.exe
        10⤵
        
        PID:9612
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c MasterSlave.exe
        10⤵
        
        PID:7356
        
        C:\Users\Admin\Downloads\MasterSlave.exe
        
        MasterSlave.exe
        11⤵
        Executes dropped EXE
        Loads dropped DLL
        Enumerates connected drives
        Suspicious use of SetWindowsHookEx
        
        PID:7760
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c @echo off
        12⤵
        
        PID:7776
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c dir c
        12⤵
        
        PID:7304
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c md VIRUS
        12⤵
        
        PID:7832
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.youtube.com/watch?v=kSS_tDfeLOk
        12⤵
        
        PID:7584
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffc704b46f8,0x7ffc704b4708,0x7ffc704b4718
        13⤵
        
        PID:8088
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c MasterSlave.exe
        12⤵
        System Location Discovery: System Language Discovery
        
        PID:5528
        
        C:\Users\Admin\Downloads\MasterSlave.exe
        
        MasterSlave.exe
        13⤵
        Executes dropped EXE
        Loads dropped DLL
        Enumerates connected drives
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:7312
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c @echo off
        14⤵
        
        PID:9080
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c dir c
        14⤵
        System Location Discovery: System Language Discovery
        
        PID:9084
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c md VIRUS
        14⤵
        
        PID:4760
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.youtube.com/watch?v=kSS_tDfeLOk
        14⤵
        
        PID:1028
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffc704b46f8,0x7ffc704b4708,0x7ffc704b4718
        15⤵
        
        PID:1432
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c MasterSlave.exe
        14⤵
        System Location Discovery: System Language Discovery
        
        PID:7220
        
        C:\Users\Admin\Downloads\MasterSlave.exe
        
        MasterSlave.exe
        15⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        
        PID:7304
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c @echo off
        16⤵
        
        PID:7176
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c dir c
        16⤵
        
        PID:3336
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c md VIRUS
        16⤵
        System Location Discovery: System Language Discovery
        
        PID:5316
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.youtube.com/watch?v=kSS_tDfeLOk
        16⤵
        
        PID:884
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffc704b46f8,0x7ffc704b4708,0x7ffc704b4718
        17⤵
        
        PID:7396
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://thoughtcatalog.com/juliet-escoria/2013/12/16-steps-to-kill-someone-and-not-get-caught/
        16⤵
        Enumerates system info in registry
        
        PID:7644
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffc704b46f8,0x7ffc704b4708,0x7ffc704b4718
        17⤵
        
        PID:924
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1964,1500476650945591394,4535553206662612297,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1972 /prefetch:2
        17⤵
        
        PID:10792
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1964,1500476650945591394,4535553206662612297,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2216 /prefetch:3
        17⤵
        
        PID:10804
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1964,1500476650945591394,4535553206662612297,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2812 /prefetch:8
        17⤵
        
        PID:10376
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1964,1500476650945591394,4535553206662612297,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3460 /prefetch:1
        17⤵
        
        PID:6252
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1964,1500476650945591394,4535553206662612297,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3468 /prefetch:1
        17⤵
        
        PID:7464
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1964,1500476650945591394,4535553206662612297,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4788 /prefetch:1
        17⤵
        
        PID:8496
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1964,1500476650945591394,4535553206662612297,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2424 /prefetch:1
        17⤵
        
        PID:7924
        
        C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1964,1500476650945591394,4535553206662612297,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5272 /prefetch:8
        17⤵
        
        PID:6912
        
        C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1964,1500476650945591394,4535553206662612297,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5272 /prefetch:8
        17⤵
        
        PID:6848
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1964,1500476650945591394,4535553206662612297,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5156 /prefetch:1
        17⤵
        
        PID:7156
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1964,1500476650945591394,4535553206662612297,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3464 /prefetch:1
        17⤵
        
        PID:1776
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1964,1500476650945591394,4535553206662612297,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2424 /prefetch:1
        17⤵
        
        PID:9976
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1964,1500476650945591394,4535553206662612297,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3892 /prefetch:1
        17⤵
        
        PID:11144
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1964,1500476650945591394,4535553206662612297,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5760 /prefetch:1
        17⤵
        
        PID:11152
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1964,1500476650945591394,4535553206662612297,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6016 /prefetch:1
        17⤵
        
        PID:11224
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1964,1500476650945591394,4535553206662612297,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5708 /prefetch:1
        17⤵
        
        PID:6964
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1964,1500476650945591394,4535553206662612297,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5060 /prefetch:1
        17⤵
        
        PID:6056
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1964,1500476650945591394,4535553206662612297,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4952 /prefetch:1
        17⤵
        
        PID:7616
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1964,1500476650945591394,4535553206662612297,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5496 /prefetch:1
        17⤵
        
        PID:9100
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1964,1500476650945591394,4535553206662612297,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5632 /prefetch:1
        17⤵
        
        PID:9648
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1964,1500476650945591394,4535553206662612297,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6484 /prefetch:1
        17⤵
        
        PID:8900
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1964,1500476650945591394,4535553206662612297,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6296 /prefetch:1
        17⤵
        
        PID:10604
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1964,1500476650945591394,4535553206662612297,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6840 /prefetch:1
        17⤵
        
        PID:7184
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1964,1500476650945591394,4535553206662612297,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7056 /prefetch:1
        17⤵
        
        PID:11080
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1964,1500476650945591394,4535553206662612297,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7204 /prefetch:1
        17⤵
        
        PID:2864
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.topgunsupply.com/sig-sauer-p226r-9mm-nitron-siglite-night-sights-da-sa.html
        16⤵
        
        PID:8408
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffc704b46f8,0x7ffc704b4708,0x7ffc704b4718
        17⤵
        
        PID:8428
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.amazon.com/Disaster-Bag-Body/dp/B0012C9UGK
        16⤵
        
        PID:5716
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffc704b46f8,0x7ffc704b4708,0x7ffc704b4718
        17⤵
        
        PID:8760
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c MasterSlave.exe
        16⤵
        System Location Discovery: System Language Discovery
        
        PID:5720
        
        C:\Users\Admin\Downloads\MasterSlave.exe
        
        MasterSlave.exe
        17⤵
        Executes dropped EXE
        Loads dropped DLL
        Enumerates connected drives
        Suspicious use of SetWindowsHookEx
        
        PID:9528
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c @echo off
        18⤵
        
        PID:6496
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c dir c
        18⤵
        System Location Discovery: System Language Discovery
        
        PID:1312
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c md VIRUS
        18⤵
        
        PID:8864
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.youtube.com/watch?v=kSS_tDfeLOk
        18⤵
        
        PID:2868
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffc704b46f8,0x7ffc704b4708,0x7ffc704b4718
        19⤵
        
        PID:3500
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c MasterSlave.exe
        18⤵
        
        PID:3804
        
        C:\Users\Admin\Downloads\MasterSlave.exe
        
        MasterSlave.exe
        19⤵
        Executes dropped EXE
        Loads dropped DLL
        Enumerates connected drives
        Suspicious use of SetWindowsHookEx
        
        PID:3088
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c @echo off
        20⤵
        
        PID:2212
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c dir c
        20⤵
        System Location Discovery: System Language Discovery
        
        PID:1648
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c md VIRUS
        20⤵
        System Location Discovery: System Language Discovery
        
        PID:5448
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.youtube.com/watch?v=kSS_tDfeLOk
        20⤵
        
        PID:3608
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffc704b46f8,0x7ffc704b4708,0x7ffc704b4718
        21⤵
        
        PID:8812
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c MasterSlave.exe
        20⤵
        System Location Discovery: System Language Discovery
        
        PID:4448
        
        C:\Users\Admin\Downloads\MasterSlave.exe
        
        MasterSlave.exe
        21⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        
        PID:6060
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c @echo off
        22⤵
        
        PID:4388
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c dir c
        22⤵
        
        PID:5692
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c md VIRUS
        22⤵
        
        PID:6112
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.youtube.com/watch?v=kSS_tDfeLOk
        22⤵
        
        PID:3928
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x128,0x12c,0x130,0xf8,0x134,0x7ffc704b46f8,0x7ffc704b4708,0x7ffc704b4718
        23⤵
        
        PID:1980
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c MasterSlave.exe
        22⤵
        
        PID:5676
        
        C:\Users\Admin\Downloads\MasterSlave.exe
        
        MasterSlave.exe
        23⤵
        
        PID:3708
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c @echo off
        24⤵
        
        PID:6164
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c dir c
        24⤵
        
        PID:5084
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c md VIRUS
        24⤵
        
        PID:4568
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.youtube.com/watch?v=kSS_tDfeLOk
        24⤵
        
        PID:3508
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffc704b46f8,0x7ffc704b4708,0x7ffc704b4718
        25⤵
        
        PID:4020
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1476,9598271379678488172,7958556963780607433,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2136 /prefetch:2
        25⤵
        
        PID:9788
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1476,9598271379678488172,7958556963780607433,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2216 /prefetch:3
        25⤵
        
        PID:9980
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1476,9598271379678488172,7958556963780607433,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2676 /prefetch:8
        25⤵
        
        PID:11116
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1476,9598271379678488172,7958556963780607433,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3464 /prefetch:1
        25⤵
        
        PID:10216
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1476,9598271379678488172,7958556963780607433,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3472 /prefetch:1
        25⤵
        
        PID:5552
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1476,9598271379678488172,7958556963780607433,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4092 /prefetch:1
        25⤵
        
        PID:11136
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1476,9598271379678488172,7958556963780607433,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4392 /prefetch:1
        25⤵
        
        PID:6320
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1476,9598271379678488172,7958556963780607433,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5156 /prefetch:1
        25⤵
        
        PID:10856
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1476,9598271379678488172,7958556963780607433,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5540 /prefetch:1
        25⤵
        
        PID:836
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1476,9598271379678488172,7958556963780607433,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5548 /prefetch:1
        25⤵
        
        PID:5140
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1476,9598271379678488172,7958556963780607433,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5840 /prefetch:1
        25⤵
        
        PID:11112
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1476,9598271379678488172,7958556963780607433,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6008 /prefetch:1
        25⤵
        
        PID:5452
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1476,9598271379678488172,7958556963780607433,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3936 /prefetch:1
        25⤵
        
        PID:8488
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1476,9598271379678488172,7958556963780607433,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3636 /prefetch:1
        25⤵
        
        PID:4664
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1476,9598271379678488172,7958556963780607433,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=3608 /prefetch:8
        25⤵
        
        PID:7104
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1476,9598271379678488172,7958556963780607433,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3604 /prefetch:1
        25⤵
        
        PID:3180
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1476,9598271379678488172,7958556963780607433,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6224 /prefetch:1
        25⤵
        
        PID:9404
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1476,9598271379678488172,7958556963780607433,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6572 /prefetch:1
        25⤵
        
        PID:5688
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1476,9598271379678488172,7958556963780607433,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6656 /prefetch:1
        25⤵
        
        PID:6204
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://thoughtcatalog.com/juliet-escoria/2013/12/16-steps-to-kill-someone-and-not-get-caught/
        24⤵
        
        PID:9632
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffc704b46f8,0x7ffc704b4708,0x7ffc704b4718
        25⤵
        
        PID:11012
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2132,16093686063813200543,14828671713791486979,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1720 /prefetch:3
        25⤵
        
        PID:7692
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.topgunsupply.com/sig-sauer-p226r-9mm-nitron-siglite-night-sights-da-sa.html
        24⤵
        
        PID:7212
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffc704b46f8,0x7ffc704b4708,0x7ffc704b4718
        25⤵
        
        PID:1956

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3476

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x4a0 0x518
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:448

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5500

C:\Windows\SysWOW64\werfault.exe
werfault.exe /h /shared Global\24bf5a8f9574493686a2a530bdd9e391 /t 6436 /p 6432
1⤵
PID:7292

C:\Windows\SysWOW64\werfault.exe
werfault.exe /h /shared Global\c4c00034ffaf4fa1b6404e5ac1f4e0fd /t 6536 /p 6544
1⤵
PID:7356

C:\Windows\SysWOW64\werfault.exe
werfault.exe /h /shared Global\eaedd41e3b2145638cc5f1bc772320cf /t 6796 /p 6792
1⤵
PID:7404

C:\Windows\SysWOW64\werfault.exe
werfault.exe /h /shared Global\723f101d7b4c456b9ebde4fab7197b94 /t 5324 /p 5628
1⤵
PID:7064

C:\Windows\SysWOW64\werfault.exe
werfault.exe /h /shared Global\5934955335ad4a5185f7560d17ccc632 /t 2368 /p 5964
1⤵
PID:7032

C:\Windows\SysWOW64\werfault.exe
werfault.exe /h /shared Global\de41eb2dd70042eea9c9db7e317a44d3 /t 5780 /p 5788
1⤵
PID:7732

C:\Windows\SysWOW64\werfault.exe
werfault.exe /h /shared Global\b79f0f6051ba4d07ac49172740b6336f /t 5848 /p 5844
1⤵
PID:7972

C:\Windows\SysWOW64\werfault.exe
werfault.exe /h /shared Global\282c2674ca0944a39ccb438f68024021 /t 3304 /p 588
1⤵
PID:7212

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:9052

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
PID:9152

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 1060 -p 316 -ip 316
1⤵
PID:3668

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:10148

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:10956

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:11020

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1444

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:6104

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:7488

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1704

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:9032

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
0a9dc42e4013fc47438e96d24beb8eff

SHA1
806ab26d7eae031a58484188a7eb1adab06457fc

SHA256
58d66151799526b3fa372552cd99b385415d9e9a119302b99aadc34dd51dd151

SHA512
868d6b421ae2501a519595d0c34ddef25b2a98b082c5203da8349035f1f6764ddf183197f1054e7e86a752c71eccbc0649e515b63c55bc18cf5f0592397e258f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b0cafa72565b2fa07ef5df1eb72b00b9

SHA1
d23e84ab26707048b3b1025d6a7fa3a7741cfafc

SHA256
276350672a0224e6a8bf090aa4e2c072fba69bb7668ed0b6c92fd3d9fedb55a2

SHA512
96f3ed200c573c9270ef93dea1652e63f55ef1132ac9d9bd21f4031d84fac23cb2d34e9ab26fc520b640670e32f32231ac52d26a5daab3d0aa2f761b01f5f3f6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
58ffc60f16e2cc5f57693a21a9b6bee2

SHA1
1c89779940df6c4fedbb59a99687990c45015266

SHA256
2f591b201f1603f3847d9d992c01d3e365ab99fbd4981dd9fc8b019f004a212f

SHA512
ac31dd656373abb4cb59624f1f68808ec02748a64613c82bc5b6eefe9c1b9c70a28b95174c8bed36e479dfe6c66bb7b9fbd8fa2d018645332f79c69d1895f4d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
333e272ec0f70f0f8b828582c58c6d01

SHA1
06508bb27f55ea5ea626c06773a3e2d37bed4e6d

SHA256
06caf12b0d5f4545c3373fa575f077f5a49ad72d0d6f5497c3cd47254402f2c0

SHA512
bf763ec6d83444112f370228b2c94bb16394d4ce31b8db18567af5babef5106d27e666f4229e624ce217a933ebcc6764682ee54bca8f7f9551600afbbc19c6dc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
6308ee174543819335c0d565162192fe

SHA1
a08b9d7f982239fa9a1845ceb73801aa22554d86

SHA256
e3c335d20a127a34f0ecb9f0d40e37578f6f5fb8192abed904e844e6fb137ba9

SHA512
0799a0164b8e8e8ad4305943c8e1af79d2d016e0c28f03b165ab476f70bfc6ddeb8eb3f06bd1980e63510f13fa7d0dcda280854312d540710c1b58ec22e138cf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
61cef8e38cd95bf003f5fdd1dc37dae1

SHA1
11f2f79ecb349344c143eea9a0fed41891a3467f

SHA256
ae671613623b4477fbd5daf1fd2d148ae2a09ddcc3804b2b6d4ffcb60b317e3e

SHA512
6fb9b333fe0e8fde19fdd0bd01a1990a4e60a87c0a02bc8297da1206e42f8690d06b030308e58c862e9e77714a585eed7cc1627590d99a10aeb77fc0dd3d864d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\1f942752-0db8-4f9b-9a70-601efdeeeb91.tmp

Filesize
1KB

MD5
b1d4043c5b328a7ff4b736284a61a0d1

SHA1
b8137456959ff3445672f7e391fdeaab41d84336

SHA256
dad418509b80afb88bc7ce8fa9848cc8d8a767f388b37b4f44460b2ddf4d57c8

SHA512
3a5d4716dfe00a9310fa3292f4d7e9b48e28ac9f91886c3c5e55f790b422ea596aa8fc92f6aa6cf66032a7d428f6830d50525b3fdbceb068509cbb97db044ffa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\437c4b71-5ca4-45f0-b7f7-3d0129242441.tmp

Filesize
1B

MD5
5058f1af8388633f609cadb75a75dc9d

SHA1
3a52ce780950d4d969792a2559cd519d7ee8c727

SHA256
cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8

SHA512
0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001d

Filesize
49KB

MD5
c107c51cfe4528231af0bd0b65d14fb0

SHA1
14d634538d16493d43a33785290171bc9c336d78

SHA256
ce331329395cb1ac9c29271b6d3e3f38f1fa53b04c9c576ce40044b74fc1fe3e

SHA512
888e676c2aa461c4b7aea8cd4391d7ce50a9c73d2f14afd088f648f89ba47e4bfe14b7ae641fddec93a619f42d6b0fa9c20bb5ff68896082121354c81d7e6c70

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000022

Filesize
633KB

MD5
b5e39fff1b41f3c27d2ced32be6ef87b

SHA1
9ea211f2adc80394c20a7123377bc2aea817aa9a

SHA256
765559457c52198f1e1692bea1a05943f0a43c9796a6488a08f7bc7680354095

SHA512
babcb1e5303d26698b9404fcd087291d2e81a0d6b5c3fdde3a82e46c03e5529bface22ad635b74d7ccf114181c4063ab53380089596d33931570df22b9b612a4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000024

Filesize
237KB

MD5
08b1c335e6b8ca4e13b4e5effb5b1902

SHA1
69624982235725c77eed01b6a1ad9c295fce1bcf

SHA256
a2f61bcb41cbd76f8f9aab527aea1f587165dc6970deaa130ca535795b0e6193

SHA512
57442e85323f66e34b160e9d1ef54fa412b929e8f892e8a5bcc935ecd6fa7111daf14a05dc1ed1c238136e92cb791e0ba772a0c4bc1cb1eb0aa75243588762f2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00002e

Filesize
22KB

MD5
778ca3ed38e51e5d4967cd21efbdd007

SHA1
06e62821512a5b73931e237e35501f7722f0dbf4

SHA256
b7e1bfadb8d9c061f17a7234df012df7842ab1aa8fb6f9579fa3f0a3b4a75bc0

SHA512
5f6f02099ca8079305fb7e7f43ae4344d522271fe30379c0854d6a81b7d8adf408a50a4b799b5f52e6ed162ba6ce7fe97e24a2b9719df780e75683d3aa103d09

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000030

Filesize
1.5MB

MD5
955281162210a23206db8aa12c12b43f

SHA1
1f1ed83e496393985624c79f265cf721ef95ae29

SHA256
07f4b22e82099465778617a6aadb76722cb9868ed2012b514ed4aab8ba06afbf

SHA512
6b2bc671bb47fddcd368d167fe6b773d26e2b2e3e5cb33b4b17c6183211579e42ea32bee4bf2d6e975b67b61de6cced9a230cabb9f91c5c6474bab2e5648e5ad

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000033

Filesize
34KB

MD5
7e98dbb6f7b679fecc60238cb5e0cf91

SHA1
e031ff5267169dba7887072ad612584595d42df8

SHA256
a017204ca0669cf160dd395ed85be44e016dac620bd23cfb44f08d20cbc9fd98

SHA512
57d8c5849ec2ac575278ca85a329ffa0acb509781ee668834d7f1db0b9cb5ca7cf35063b4bb2b2b785ff09bf832455cd3b6f4314c9b130b3d12fa9f047b13d77

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000034

Filesize
33KB

MD5
216e22b494d300b6b57a83ed835a3746

SHA1
718bdb6a659bd63bfaa83e60a72e5c43af4f7331

SHA256
1b9ceb889ac5c7fe46842ee257fc6073139140e98e9f63bf33a5876f9902b608

SHA512
75e852045dbb2fcbb363d0967007f11aa3ba272efdfe4a593d8c41258379d76de3aad72a6bb3b1059d2414a40b87a66428f73195d65ae3d001b1bae5b4083a20

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000035

Filesize
18KB

MD5
8eff0b8045fd1959e117f85654ae7770

SHA1
227fee13ceb7c410b5c0bb8000258b6643cb6255

SHA256
89978e658e840b927dddb5cb3a835c7d8526ece79933bd9f3096b301fe1a8571

SHA512
2e4fb65caab06f02e341e9ba4fb217d682338881daba3518a0df8df724e0496e1af613db8e2f65b42b9e82703ba58916b5f5abb68c807c78a88577030a6c2058

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000036

Filesize
20KB

MD5
866b120edb57b42de7b78b99eb8adf63

SHA1
d0cdaeff95ad3fed2fe5c2587ef266d9b8af6f1e

SHA256
1cbb17e20d9a5694a58b5b32d04512882942c7ec9b5551f860e049b788a3f962

SHA512
3806813cf2b169b37b6d987c7cf1645eb0cc774a3f6f074755072471d7af6c19243d86d3a155a32ecf8497ed91f9eb21bf8300548cda90cd1a87cd9a921cd42e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000037

Filesize
41KB

MD5
350fef14b9432c8888714f9d69ba79fb

SHA1
f02876195e3b3628384124d63cbcb3606a06996d

SHA256
dbb362d29b9b4111e7722bae880e8a79ef8efe96db4cdf7869195f5cd0066fc5

SHA512
8fab4f3151a81a2cf0465aaf245d507da97c230eeb86dd6e9cee798e4d8d953aedb2e7e4cc004fdc8a5f7e8af0ded27aeefb4c626ad61c95f38572e13d49d419

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000038

Filesize
18KB

MD5
115c2d84727b41da5e9b4394887a8c40

SHA1
44f495a7f32620e51acca2e78f7e0615cb305781

SHA256
ae0e442895406e9922237108496c2cd60f4947649a826463e2da9860b5c25dd6

SHA512
00402945111722b041f317b082b7103bcc470c2112d86847eac44674053fc0642c5df72015dcb57c65c4ffabb7b03ece7e5f889190f09a45cef1f3e35f830f45

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000039

Filesize
18KB

MD5
c83e4437a53d7f849f9d32df3d6b68f3

SHA1
fabea5ad92ed3e2431659b02e7624df30d0c6bbc

SHA256
d9bada3a44bb2ffa66dec5cc781cafc9ef17ed876cd9b0c5f7ef18228b63cebb

SHA512
c2ca1630f7229dd2dec37e0722f769dd94fd115eefa8eeba40f9bb09e4fdab7cc7d15f3deea23f50911feae22bae96341a5baca20b59c7982caf7a91a51e152f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00003a

Filesize
31KB

MD5
2d0cbcd956062756b83ea9217d94f686

SHA1
aedc241a33897a78f90830ee9293a7c0fd274e0e

SHA256
4670bfac0aeaec7193ce6e3f3de25773077a438da5f7098844bf91f8184c65b2

SHA512
92edce017aaf90e51811d8d3522cc278110e35fed457ea982a3d3e560a42970d6692a1a8963d11f3ba90253a1a0e222d8818b984e3ff31f46d0cdd6e0d013124

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000047

Filesize
215KB

MD5
2be38925751dc3580e84c3af3a87f98d

SHA1
8a390d24e6588bef5da1d3db713784c11ca58921

SHA256
1412046f2516b688d644ff26b6c7ef2275b6c8f132eb809bd32e118208a4ec1b

SHA512
1341ffc84f16c1247eb0e9baacd26a70c6b9ee904bc2861e55b092263613c0f09072efd174b3e649a347ef3192ae92d7807cc4f5782f8fd07389703d75c4c4e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000049

Filesize
31KB

MD5
c815e961ae1a90f785053fea8cdd9072

SHA1
1998091dc37577965067d609983319ad3183b215

SHA256
1d87b6a1535669fbf707a2552dc36f8a9bb5188dbe4ed274a5a24649106141eb

SHA512
9d774efaddee9f5f09c5bef68e58aef12f229b030a078a483b7aa58adc6dd4425962dd64bcab9b61e4e83d6d3b16a8896b212b7ffce378e427dd818bf8de651b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00004c

Filesize
25KB

MD5
2a4b2e55835664a95d237d7fecc14b83

SHA1
c6a822c32d4adeff14677543ea204a012b52e2c1

SHA256
6c0558d278e7ad154dd6214d381688499a485ea392f20fa576ad6866dd1c910d

SHA512
da4b0e923f37614c8e252a3535efa016504a5ca3dcd4fe0e4d56b44a4b43c4cc704b0fb5d717f8d3258092c43961edc328420b401d6021d338c79c512f03fac7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00007a

Filesize
380KB

MD5
1bee618d790d68b5eb8f82534448257b

SHA1
62944625c1e44226a83b42adc1f426c809a9788e

SHA256
1544909cb68e4effdde646abeb3ff8ce24daa03e6f627d2f402c971d92835a83

SHA512
e07aec8c1ec61a1cf380bfc5f7c0422646cb485c82644646ed4264ead4f88b895cecf156d8416de83d09337f59fd9adf985573e80b8fdfa08be3a98a1a41249a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\03a40f457abea419_0

Filesize
279B

MD5
9c195838aac5f1cf01ce164e5933ca35

SHA1
bbf0464b1b8baf9c268948f9242e795c422ed3e4

SHA256
894b404d57293934170a7ec44380208831901a0ba48527bf126aae687a81c75a

SHA512
9887c7f3ef7b6183afa4ab346be53b25ac71ea081a7be57cf3a7b0a21f39021c45b2e6c0d862303c5202617df256b0b7e93f066e73726b256f16483dc4f46f4d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\0b1cfe1f9ccadc66_0

Filesize
25KB

MD5
04203ead74540365165a3c05475799c1

SHA1
978fe298b0136a2cf039c84c2b924c13c45af019

SHA256
04cca30c29db5aa84bae84016f638d744aaae2a34ad3ff37975d189c0dd6cf80

SHA512
96a42d0f32878ffab4725b21413e5227567e046c475867397680dbb349f61f5e5fc9140c3f60d7325f9135071573a6af8141d014bc99c57a8814bb1cedc98a8d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\0d908c02edccde1d_0

Filesize
74KB

MD5
bbb21a622acd724fe564f6b2b7fe720c

SHA1
5d73be20e84e51576b5019e90d8912dca98725de

SHA256
6d284b18e6fab26736cd361dae26c52a61bf2983211209a1c89ec59e8dde6ae0

SHA512
8f088d76e31bc0b29db6b4fc5e53c658cc7c329bbde1663195d7368b85964dd5757513f32cf661bb2dd97ef1ee03948effcf750ea65d9e7732bdf80e4c0d39c7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\0f70db9b00176209_0

Filesize
9KB

MD5
a1eb4aafabff1c6c695686c48cf7f91d

SHA1
62cc8382b8bcf5fa866d8ed8007e24f94fd5ff91

SHA256
e538ab9e0934c57375e98054e14cdbb4bb1edae5c277e4043ba1251c2b62b6af

SHA512
69958e2468afed15308118328c3698f71ebbf048c165f3d24a86c9791ff38e1008180404ae7e61cce5cf4ef0e88b479b32423ed1731bdec984ff12a95223f0a2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\0ff0015f8837ffb0_0

Filesize
220B

MD5
0ba2151fc83dd0f27701d4770cb7bbeb

SHA1
539226f99032a82bb67f0a98d243bbf58d8fe38b

SHA256
3d3312f2c21ac95789c8ecdf48393283d43a7516646794fc0609c188ac8083f7

SHA512
7c6028c41d0e51e21ddac98c4b73c5ec0679fc5f7106222aa023517e03fb0182afb2b2753400884fff41e2d7409cfaf62e94e3564f03c024d027e78e51ad3df2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\2ce274d4df1442fa_0

Filesize
60KB

MD5
bfd562e7c3b7851f64236d98fc469add

SHA1
5023320dab3fdbbf4b9ba82bbec2727617355bca

SHA256
64b17f24a8d02c4aad057738d8db0afb767be2c3109bcff1e0505ad59436f741

SHA512
00ec03d48ee7badd82731d07164786ea0cad13d2c8d83fddd007ebb02685f36af9af87600b036d571bd1cf4fcb612be7074cc2a6104aa95d524f89515dc8561b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\335e69ddec2b9ac6_0

Filesize
7KB

MD5
15b19d7cb85effbb5a287e8055cc86c5

SHA1
b76edd67e18f795c89ffb0ec5fcb205dfd9bcd43

SHA256
a9d177ce247d3b62962aa0bf9e3b65d27323dc83ecc2677644704d6cfe111a17

SHA512
a8e025315b77adcc874357303d6f1da9700f8492ca7c5928b309258e455e97f5ab10c80aaa90f69ea00e80e529ab128f1c06bf5d6c220f73d401532fca657983

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\36f0fadce3c44197_0

Filesize
1.3MB

MD5
2ea3ce0fe36f38951919da9c6c95d935

SHA1
5c5fdfc6b7eb8992d712bfc56a52e71b3c92d0da

SHA256
000cf1001551378bfca5443c51f99fc3d926d4391670833c2496c6909219c177

SHA512
08b55d23db67a53ac38187dc6a2c7de50eb66bb791c20c833d45230a4a54fc734502fa086624f8dc16b86ecb1f33a7228b413a1e545522edcceab6538598f328

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\3f3b9abdb66e63d1_0

Filesize
3KB

MD5
fecf433658b2615cc7ef3dccbeb921c1

SHA1
309f043e657ac85c2f087e1f143290e9b902e993

SHA256
577041304d115fff146e81a1b25d12a2c134e707ac11e1e6c884dfcec42dfc50

SHA512
8d7e3f730916ebec1cdb259c3fff95aed3cd46bb1c93650d35d70c3373326cd43c147ba15f03f409c01c095b94d48ee5ae6bb9b6124a956bf2edb2a37fabf17e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\41e54cda01f9edc4_0

Filesize
281B

MD5
e577dcc6e08b172eb5a1d63693cd10eb

SHA1
165221479a62ef8bbcc29f1b8e86e8e50b4dc238

SHA256
12d298fd82d6146a28cc33483211ce0163928544fa5ae82fe9aacab0b4303adc

SHA512
1bce1bd24d016faa2d8c3124a6535741c8e5b14b874ca27c3fa4cc47750a8d3c6c73f8354aba5c18b075fe051933b32d3b0f6394eed993a493204354d6e2bec2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\4b4957661481a15a_0

Filesize
296B

MD5
dd74045c1cfac7a01b0e5d4e5b7c1ea4

SHA1
61f589739fb3a10812e4dd4f669368d219d6d43b

SHA256
cd66757050e5fd2340d97cb96b57f0ca726d50a54e2bd849487062e1f766bba9

SHA512
04bf558d1b3f9cf3f96e288ecb171efa3146b8cf814d7844b1418cafe7d9d42977c0cbeca65ad95a7a48af961ce10c4d704786640d7c5870b1c6d157de400c58

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\652187b1e3322420_0

Filesize
55KB

MD5
aa788b1378bcf88d584062234fef52c6

SHA1
5fccce3b6dfd542a60c1497990f40fd1b1972871

SHA256
290e645209bf5ccb3e83d6c0d49150c06f99050579c39edd2ca4ea33ec6e21c5

SHA512
9c981887d67e8f9eb3dee5585aee00857029e89ddb73e3c5fa6bfd046bef642623d2e294aa50c41d38199f584beaadaf8c5abc78d9d09f39b69fd2bb0a5b7ce2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\77b34b9375ca5762_0

Filesize
2KB

MD5
5cb80fea19f10cf574e9fd0eee8c1287

SHA1
681a3043a8c96f3ed9ce60c0d2234278794d9fd9

SHA256
475ba13a441b772dd0573737cb510126ac8de5836d32ff76598fd83433fa9d85

SHA512
d1a08f5d8bc6fdb01286c655389f12d4a46fa24496a99ebc3335fc7655023be4b80e900f911e7d58959fde6b1aec21b4a6d3aecc7878661a11b5a67fc5ce3185

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\7c59edc666bb9d0d_0

Filesize
6.4MB

MD5
8920919e2ef4679b1e213601bcbd4bf2

SHA1
a2bad74f060debf66e565930216163680e0e43de

SHA256
7690a154b977d56b3803dcd7da4ce29d5151cce7bd64352a4e650a1d3cbc2241

SHA512
8b95c322c5ad32d7f33861f027ee641a8532330c15cb9e6f5d5eb05c03adbc8aaa2e8dd21a0d8d385142e6fb3a3ec4de2ac51f8f9d3f9e1e8dbf28e2f2b5d807

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\81df8be0535cfbe6_0

Filesize
298B

MD5
2ca598830498b2487f63bac40d216085

SHA1
a040029d29401d3084e8a6e30907a57317fa0b47

SHA256
9279fb28ba2377d8a5a780d1c6205490aa3a4926c30ad1b871699d7d6c738d71

SHA512
e732d1340eead186806813858f11a9be521d0869d304941efb63716e52bfcd6b706e635c2c680a376e06fc35356984e6f4c537015d9329e54273030013910622

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\90827e58c839d8f0_0

Filesize
3KB

MD5
f3bc57e926aef54e7b551f3b5560d76c

SHA1
b781ee7b9e96fe5f3fff9bb7e9f804633ed7538e

SHA256
9a725e2c49ea139ba23b25b7c73f5b54e5e0d6338d079f1808e0a5345b72f235

SHA512
c3f88042e81446f518d0191fe7f24ea5ac546df6f27bda51e825b53547e49795fe350d4107b0f5788f666191298815726e19a80b69a5ffbf95ed1ac1ffe609c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\a33c610c8940a5a7_0

Filesize
40KB

MD5
eec056426660c2beabb04689f80b7a64

SHA1
792c2c685cad8edc298227594eb870b7dfbbaec5

SHA256
7522c9796d91da8935fca071ae5d17214b92c0812eccf629f8ad357ae7ac48f4

SHA512
5bc7d6189ab109dd53a374dc8e751debb2740e45e43149d81eb15ed06c2122e4b54dc2b61d795eb06622ed26767c06c5fd83ca3668ac8090f0a64c34d721fefb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\b4a3bd307b7f5d1d_0

Filesize
67KB

MD5
51470a68dbb459691a5143cd15bb7e3f

SHA1
552f799058965577edce8e320236f37a1d342e68

SHA256
2815aeb572e619be346865f86713468f2adb92ad3d2d3d391c5aae14a32b9cf6

SHA512
c29cd322d4ab2e35d072021b31c8de73d3a51c552206d5fde8bd3b7e6980f0667ab29ae8c8f2db9c3b64a201e89a07147e49072a345ca3ee32250c632200e73e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\b98d83d3b25ed19e_0

Filesize
10KB

MD5
849be0a2c3c8ad54e777be964e501177

SHA1
e1e20e4f669239bea32d4d39895a2f121a1dd792

SHA256
3373ac600159387b0362456aa7571662fa68efb659b5d337a6a94a431bdee14a

SHA512
7c8dd60a331d594e7f7edb333a7b89885016e08321d46784adbce9db992942d7d48989fe77cbb585c9b754f97c0f9d91fd99f47421f902cec8d27f402b748535

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\bda02668eae8da85_0

Filesize
9KB

MD5
0682c8b7d2115a99aca30cc1c72357f1

SHA1
2c198cfc0f2891317e128daad1e4d63ec1899168

SHA256
02160c214b6ececbb1a21829f1bcfcbea8ccd8f06a4841a7c97084968cd7eecb

SHA512
8f724d11f00b55b344cd36ee7672272de419fe38d964aa2ed2d988bce20149cc645e0a9953ee0f88510514fa73e5a4da8fae3b5cd9b629d8eb66b1405d7b7abb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\e9545717e6d151d2_0

Filesize
57KB

MD5
04779194b12cb05c9ff4658f654e9761

SHA1
1be0bd3ce3de1a9744dea552c6b3b03b62b76fa9

SHA256
c48289c2f74e728d89eefbeca97b1c475d64dc4402b32279fac6d78cfea1d544

SHA512
f1df9ef55c53f3bc0ba2c2acaf51b57fb0bc2464979ebf8584869e3c3770090f20f1f70c9f3fea9d5c278bb76cdc6b88b55f68761f713eb72934c30fb9e51413

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
713c5621056ae58f533beddabf31def1

SHA1
2144e964b5ddb3fee53bc5318beb3249bd354a77

SHA256
373e55b46cebca9a8b098d6ddb8c04057bbec27582d8a94321b299ac3dffac15

SHA512
3a0434f8d81232faddbf4f64736cf9facf5edfac98b6e3ffb5a735efe7df48d2c55f1d582e77323aa3e890fe1e3f96a220a5352b750dc628b1101058e858cda2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
71a7b6fb90116a2f0ec0a28e33e6dcd9

SHA1
e274b679a2993b8e45b95572a4c404d789b4dfb2

SHA256
13d8d1a3c6ac0b1dd90cca9bc437765790ecc22d047bee3b381c106708b54ffa

SHA512
9016af0fa484ae8375d6f0fc8f450734ae3cf4e5b90ef7f83ac1113093ca6469c867359c86126095dc04090f659010848f791e777948ea135e73f05d7f09dc77

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
f79f6d9243b113afd766e506fe7e4334

SHA1
5f5788e5cba4c86a47b014a5c9edb56c47d68f12

SHA256
1635ee31851698af36d5e66bd13271ebe761b331019cdf99444afcb17c9d4f23

SHA512
0ec0c9576ca27324d1140264767d16db4043acbbaa0494cdd2c6207787a0166da86ef1843f1fa4c721358e0b427ca7d1ee0135fb735c0d2182fa2ee7d3d62f04

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
9a6fbdac91949f5d0aa60976fe48e482

SHA1
f562db8acd486067497df414d7f6c13f5e41fa3e

SHA256
9578ee740007c2408d69b4a4b7e8e7719856dfddac9739d8c692d849bdd0f52f

SHA512
7d82f4144878b101f321b593eb6d49c81766f6e11c3235b9c1244eb238bf769ad6cf1dfd2b583b86e11c144da16e5575105d2f5ff1183bec4fedcd85f01eba46

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\GPUCache\data_1

Filesize
264KB

MD5
3b6036071387a7ac4d865e90eae30738

SHA1
a43a03f21a76fca5ccc68bb86c6858dfad666924

SHA256
2c77de096dfad71a4b9e06919bb7ab1a717655fd0938e01affbb4ba5d8332430

SHA512
293c3e0da26240c4021da6d7c7c402d0b14c65e19fe58b76f8c5890d456e1a272666a9e9542b5299eb9fe9f69e2279e8e5ef3bf36badcd93a967353076ae5cba

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
579B

MD5
ed5f4213c17629776cd75510648fc019

SHA1
ebfa685dca9b7c920cd5ad521c03e4ad0ce435b9

SHA256
e969795f0e63ec8a35cdf34d5bc43867ca0825bebfed9734943e69b34ed2ad87

SHA512
71bcc166ae5a48f7a79aa5de7ecc7e10dce22c39240ca9ffe9d0f9340f40fc2a2429529cfee8b2b5d7082efe94921fa7df3454852d5313ff4093bfdffc189627

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
11KB

MD5
962a162de7ab53cbe380f0efd5157867

SHA1
83e4e0bdc8175fbf1f4e5a2b0d0b1c70a5dc1213

SHA256
9e8b3d4e2363290df3c057251caad5daca26a29f94a373a1a44a17d5e375d6a6

SHA512
4efd7e421a7ecb8fc2d0cf1b42936d23b41c60156362cd97a8aa8768ad74d4e1db28bd17482675f0964153dca280fd13b591d7d66fad8d9e79f4c97764d69c7a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
10KB

MD5
9d0b31b4fab8c3a9dff5f1ed3860b889

SHA1
5de44e0b5bbe8b047006520edde6613d10887951

SHA256
4f73a55ff1951ffd1d53e72afdfd3c91990fb69d96f44779ad40b4de82169393

SHA512
7386ceba11b4b3e2aa2c3e3687687c5d0918164b057459604a97f0abccd4437fb62a9f456bf666d26227fb25ce3162afeebd99b937bd5b0d34911c8662b20147

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
12KB

MD5
597305fc1aaf0c6f5e0a4d7795d29ec4

SHA1
5f6ca216d9a0f865df9147a9479d801bea1efc38

SHA256
12099cd72013a3bcfbf4b6242f406e9e6a08d680d84fe4d45145be673ac8a6a7

SHA512
8b55990411c7e2a531520a336de9a898eb231102eb8451a83586b8bbaadc2080d5fb42ce0d6e740df536e2ce8e2bccc02e8d95a007bd71331f63eb4d327896a3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
13KB

MD5
588f7b2c8f6d52f689f522efc03b3d49

SHA1
4810dd5cecfb7fd73ea0194f29766024707729e7

SHA256
9293396e5419d8315a5d4a423e470446b15acd825f60f7aa3903ae0a2a37af1b

SHA512
c35fe4c17f1a6253eaa0b9255f30c03b9a0fd530822e449c6047a2c742b7cec082665795f3135236dc18007921c8390a3c3fc86e9c6e3abcabe9686cdc15cbaa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
15KB

MD5
364a03e0c43fde617306490275341573

SHA1
ebcc7716de277574c03ddcbff3aaed5e50577429

SHA256
e62e1b4daeacc60480b68f695ff21e39b05d0147b6c608013061e25298234d3b

SHA512
9cfccb8d037432e969fb1d14772e7be20019629570694f015934972f33cb11f58c5402be6e93e95103c4e0c48e229035bfcc8b5b941c679dcb72839a62fc9771

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
5a80f44675de218987a4a67d830835b8

SHA1
5dbd19e56652fe5e1e02330c44aa56ab0240e6df

SHA256
5be29739eacce2c882e3572aa336ca4970374cb4b2c4b418f6cab699c076df48

SHA512
edd431001f2a49197ab22576314d08eac14adc3349108ae9d7580352b5cefa536c06c4baee0b89fbe682627a10ceeef1a25160345228d76a6af813908090a9bf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
10KB

MD5
44cec59786f3eb043b2872f1fc5cb036

SHA1
c529e2bc22bcab5a280df6e1b8d03dcc9cfe768a

SHA256
60dfb48fdca81a5781c13059bf0131be43eaa94f1e27f38d6630e4bfb56bcfef

SHA512
2e729acc49c58d279b21117b93f122ddcaa4e4edcb5dbb467dd7001d1f3edb33cb1d113ccf32f1e196b882141e4b4af1f627c11043b35114f3e0a58090cbc43d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
15KB

MD5
3802f1ee143a4c8d1a2d00e857131847

SHA1
782149947559e355d9129eb759f73b129f20eb09

SHA256
688576437b6c98a7dd4fe421bd927ff661db46ada4e7f84024b18eaa8dc164a5

SHA512
f78ce529f8433174643c1931a3bdeecf8045af3dd188ef499111f3d0a466a67c250c2c1be84264ac00921905978acc69b9020fa510a3be3ab529eaf74120359c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
11KB

MD5
5973b64372ea6fc31021ba1a3c69a093

SHA1
45a918e1aaa81987e360c4f8ba7fbda8fbbb9947

SHA256
d9e9e838fd07b0d6ca4b83f9cd6a58eacf434707b3673761b2d6553f52a8a71a

SHA512
616ea60b52c9a777e2bec076290b92fdf0dff9bc5fac6da66a3b1859b82e1ce5b3940f47c8be32c802dfb48ea4ae53004b90dc309702bf4bfbf5125a310f187a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
15KB

MD5
5d1113d3ca1f2c08cc98582762414976

SHA1
0d14933851d916c02943039d978ec2017063302b

SHA256
9a61918d6dbb59e0e6fac577299ad6af84cc1b521ab17cd35a7b644aa80e2d3a

SHA512
c386acedf268a4f0768f2ebb465cd8b3a5607656b8ddf9e8e01158ec0ef92dc74b5068ff49ebf34a92fe72bc065acdb9f57f7f77bb39ca148acfd0bef565ee51

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
15KB

MD5
be8aca5c546cb4160a458eff68342961

SHA1
07a6e0d26673ea323d4fa2b726a372d400275cab

SHA256
bb022954021d42efab2a1d2ccf83355d0801653f1af78f09b16297c4397535b9

SHA512
a776ebc561e7c45f4b19973f7f5779dfd1319ecc4d57680c8191c24fb1e9bf0574b2d8fcd1690df5b66098ec22c839258daf986176e8179deee6bf8486e92d04

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
15KB

MD5
62a285900992d578f06d35e789646a8e

SHA1
ec911b2bf553648dba5beed43f26442d04d66719

SHA256
aa5ef16a4e8bcc5f947d4e29894fcae75903ddf9840c158398bbf9f972f87275

SHA512
8b56c51bb97e56b4dd100f24ff42cf5903b86e5f591e9506084b8cbcda528ef012ab9c10a2323f00590ddab525791579ffcd451c509e117fcd63abd0e58eebab

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
6ab38aa9b3195566aa66557d59f70391

SHA1
3c32ebb61d871d4ec5e398bdeb14ff0a2c266cb3

SHA256
0e84bc19a1857fa014d87c38a1d2c0eb3d96307dd69ecf47e47a59aa8fe870a2

SHA512
db8bac842678800e64209eece5d7e4a3fac44605202cd878ac5e7abb664bf6fbd5201fc94047e9b73e3d03b9840371550de67a39743ac604bd2f13e4f6190b79

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
15KB

MD5
26cd9ee2c046c24622b84e0cd4ff4cc6

SHA1
685b0ce69d7e57d67282bcf799a5af2b0c06f3dc

SHA256
65dafcf64197160f299e1c57cfa51663cff72751072a9a1a88d708f5377aeef6

SHA512
9d93a00faf257ad665570866aad78acc2a75faee9f8cd8e8c772dce665b330064a85deccb5b9f4e403aac581fc3cb93cc01ee890a2d03d01a7fa66838576548b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
8a07eee07e8a910efb84b3cd39700d36

SHA1
b579b805b2089b41b309e2e22bfbeb7c43397155

SHA256
603e774aa9ba7512850683fcd619ad4a177f561d1ea9fefd331a72ec70b9124f

SHA512
de9d0e95f930c8545a6fc988b84e6a396ce0ff43d5572d6c702dfb3bba8a5c613a29ba0dbb461de7ca5c38bfdf5b934cba8d5ca7cd88d19c8d56dcfb5326c66e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
f691eff2dcb501df311305e52f46b5f8

SHA1
c73deef5cf42f6b271f95f9e62946b5778f210d7

SHA256
6440e116a15f29bda0d8d602bddf7603f242f40b16be482ad06d2f7eb0e806c9

SHA512
acf0aa519e8296da4ef0ded0b3dbd03dd1a5cc661bb5bf19673c0e9c3521316877190ed43946e76b8aae81db856ae94f0a89cf37ed97c3924066143771d351c4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
15KB

MD5
6dc46a4f8ff2955d777f0d95aabc2209

SHA1
9dd49641c238c906e6dde1f63950ff2ef02042b5

SHA256
b1666673e217f9f814b970e64477ddabce91ec96eb4eaad9acbc80c1accf943c

SHA512
f5ceaae7dd3a6071773bcc9d5b8911061076c429d78cad16268f903fcd5ab684edf6d601a7415ca204e8ebdac7a10001cd1bada7703dc6dbe80a4fea3f4d04f8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
15KB

MD5
57a0febc763aece6a89ae595faaa336c

SHA1
a944e82dbbdac42c25d631b4b385c4fe0d35c552

SHA256
42c077bc40889ce0b09fd80ee241e7a7ace28441f26306ef4b8130d1aef255e8

SHA512
2c87bd118a546b564bf175605e41f9e304f83de3bebd00482514956ecababc601f7d1d71154b9fe798568d8a093c57866d18aa8f8fe5e59eaab9c9be4a91f350

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f67b23d3497fda607471fd84e60919e5

SHA1
fe9003910f5f2ce626b6ad76d0b3b36bd9aebdc4

SHA256
83dcacc759fb260302f38ab42483c1db637299ac6d50e0abf027d58187486d48

SHA512
22c67e01e75ecf496e2aa7121acb95f75fab0f383954f3f56b2fd0f356a42ae67ab06073579edd24310925ef338f2307767840ef20f952f3d20accabc97b2f3e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
15KB

MD5
e5617eb7e04ec043a663e95494fd62f6

SHA1
74d2d5c0f7928ecab8b5394f9c3e46ecb44c61bd

SHA256
bf0152e64e247ae164b1f8f3225df6b32065240895fd466ef344890e519dfde1

SHA512
e4bdde47c74b694e6cddb821a2cc9d5f9a3b83cad1a9640df2d782ecaf2d23d0ea48a5698c8a8badc680d8d39b4d5d9a3655bb20fb742c502f31909dcf28c339

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
15KB

MD5
05b334a3f9af0b210b7acf73f3aa0fc7

SHA1
537d2296386a3da9c8a01226ed4a86d7baea81d8

SHA256
589d0fa0bf872190c6846783875ad8504e7ca748584f3a370dd773a9f9dbf1b1

SHA512
335b9651e48ef8088092d736695530782db38a25b443326520fe3675c3e50501587fa0253a7b539b60413771857fb8eff3a582c959bfb8ad3d3ab2d09620f78e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
15KB

MD5
56ee4c4211d5f73981a24888285775cc

SHA1
5ae442421ab969690c175d77817fcfaf826b0fee

SHA256
81a59d0b56a642391c8072fcef71bec594a8b87b378809bcb36da4b63f1734da

SHA512
362f04d5432d78632124fe2a5ed1484fba859165ad4da0f7e1f2e67eb9248953ca7d586af43c98e45cda24f0a5cb3f8c3f452ee615e61368fdec19c65f47c4b8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
15KB

MD5
8902d3c93085961146d1de664e6cecb9

SHA1
77dc294adb4619cb1c7788806e6f3b5bb8f94f87

SHA256
00f47efbd10f246e51430334e4e3bf9eaa6b7fc418989a71b8b9973ed6c261d2

SHA512
cecfc768c59065c3f114d7689927dd1f21b5881a14da5ca94a6c4a220c49ca2ff40ab3c1b2d0ca6b988f8a334507fed47a7b6bd579b8c0fa021bb7d0078f34e3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\1cf8b8f8-c8bf-4fb7-bde9-78a5958fcf4f\index-dir\the-real-index

Filesize
2KB

MD5
7811749c9866025748955699d73de4d7

SHA1
d6714c188d070b083e749c3f3db41a4dec182832

SHA256
2c33d27a634cbdeb06fa724960a729114862a8f97afe926ac8c8db38c779e30a

SHA512
b7332c25a22b1a06bebe558d343b7ebcd67a31a9aa9b2b4197830680b66ca2f4f63a00234b6aef831e3a8a1e95923bc0da727211594beb71d1cba56e99042720

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\1cf8b8f8-c8bf-4fb7-bde9-78a5958fcf4f\index-dir\the-real-index~RFe5bd6c5.TMP

Filesize
48B

MD5
531322d457190fd11bd5420f73c0f48f

SHA1
3e47f4df3018fec35813619f4a7e128357a360c7

SHA256
0619f959065e7acb91661b5108a44e59311458a33cace0f097a3cde9fcef7108

SHA512
3accdb6c536d286437f2845901abf31691cf0515e2bd78c4cce410c128c44cd14fcb9c2f0d5a7ea6a913a9e3ec9e1c9ef30132a8953f0c243d7a30770c797397

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\285a110d-1a44-4202-91e3-a0314d33762c\index

Filesize
24B

MD5
54cb446f628b2ea4a5bce5769910512e

SHA1
c27ca848427fe87f5cf4d0e0e3cd57151b0d820d

SHA256
fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d

SHA512
8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
146B

MD5
2218dac60f7e0dae8660620bff0d39e2

SHA1
efdcccf6c114345c54452186f4626b99a08bb403

SHA256
3fe91613c39ab678736e2c485dc0d42e2207c01756dd57c351254deb6614aeda

SHA512
b9284ea6224243947bdb848d43d2f15bd6d726f50f81a8696fafaeb78267a293a76211619642f50aec7ed0ce629b98ac321a66677f087b47e36031642e56232e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
148B

MD5
0917d77c130c671574da40cbf5cfe5ed

SHA1
b5b6c213b05c22e320656db41e1bb3df7aff2b13

SHA256
48a311ec6fc35cca9fc4baa9994722fef64c64e105a119d4d67c7a264d4fb575

SHA512
699f2f08e27e1105dcd927e14b8727c32d54a7abe0ee2df25025bc2bf748d324f195052b40c2f2829e2969ca6dcfbae5cf1e6bba454ab8bd1bd8bae80e9cec75

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
148B

MD5
9e9e2753f16acd7e97c9c731c8514195

SHA1
eb2c339c176f1970f75aaef4fd1832d017d37128

SHA256
0653be493f13a16a5614f0a882eaa84d1b9c14fd10f971ea3ce79aa1ca2c7889

SHA512
78f0b5c21234d70fae9798158273f5a67de574c67c80abb535e6691001df8cd14fe9eb7ba0fa73bdb2d84bec2c8d01ef10eb95351695f8569079d0f89ca9e4f7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
148B

MD5
59ecb06d7348a7012be4752eb25cb1e9

SHA1
913793ae8910c02c00c1de259813d4269d2b6bda

SHA256
a001fab53a90d4b74c60866db0cda4fceeae5ece98c7c3a0b324930b013c8007

SHA512
db81fcc2fa724718df76753acc27a68b1b20c5ebdf6d173b2cf9b8abb1575c01c761498e4e6463cb37c08e716cb49cc6f1fabfb172f3a87587b81886856d5ec6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
148B

MD5
bf00f76e6f367d3a13403c4a482f187f

SHA1
25fd905058139263e76d2b196b65e5998d308860

SHA256
34fdc1c62f5ee5c29c2d47ac23757e498ab97af6f96bdce5115a050b605b7549

SHA512
9c61764f3f54fe1fb92d1088ab65694326c3e54f94b9f8742c96527cd12eee7fdc6c99b818634dbb392ea226713e0d68b0ee85da3bbf9c8710777fac37657aa4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
148B

MD5
2efb0f421f71ace82e5baeb27dcf7cad

SHA1
903c7dec397099bf01882ef8d6b97cd7f6097194

SHA256
9b57b5636d8175a97a35045801c0d613dca99bf77a6d6fb86e49fe4a37080612

SHA512
e67a307d8f0ae868d46e2b99423d912896e74a87c9735d27e1ae7e09ae553f7cff2a68942ba995f3889771149e860caf5fe35f72f55d6a8b31cc6ddddd87b784

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
148B

MD5
7e5a095f6cee84853d6d97cc62ec207e

SHA1
4e7c72e0b3720ec2b150ac0595c294d0bf0cbe07

SHA256
785fb43251fcb94f4da85870e679313445852b8160947367ebf89fb79aba7893

SHA512
05480210374a45dc7da8a4aeaa5d619399febc0a37ef398dca8ad7fbcee7936b5302ff9f66023508dc48e392b427ecbaf5fdb14b00abd4b4b31a65dbc164151b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
148B

MD5
b1ead4890f10b4e4f6390ef315d69503

SHA1
621e95d7db45faeb2a4fdce2fb00d263a6ddd3d9

SHA256
2b66a7c7e1aa0e3f3951e818d9a2445d3f13b06e009ac94ddefdeef950d22968

SHA512
acad9e6d98f1f7d2f4599be5286f9f470100be319d116c5ec9eb5037a6960c2dd1d10c5637aada63c7cb8f220c943a76d193f1531496a20fa72f351c0461f4fc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
148B

MD5
62915db18cb00bcfbce92aead98c0f85

SHA1
86269a51f84d6ab2d4608c7b19d876ca6ca74453

SHA256
9dfbabb90ff12bbb2e2adeeb0ca649ef788bf51299b2bc16ac3d75f97b49c468

SHA512
f71a2cf8d27e4c81af3d1a3f641f8af41bfa2eb65f858cc3dfbf8d36b702402c00b18ba7f98a691327d7c3a408d191abf0540d27d19289eda8179b2774461dee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
148B

MD5
6c1ebe1868cccbf68dc0ce8744eb2333

SHA1
26ae550c49dd109743edb694a98a589cb133c1e4

SHA256
52fccc94e2f13573d412dd13609f7e23c2fba5942947ddb02f66acd0f1581039

SHA512
9f3d6280dc6a5db3c7f0226c1b2d1822c714e59c29f8bf574ee922c6010466fbe6421be70baecc2a848b4ffc85169d49dd6e1b210e6a5cf8b091d32c0c8733bc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
141B

MD5
bb9db7d711d4206276860864f6c55f59

SHA1
a3e5bcd3358cf60e810218dbf19e43982d506697

SHA256
491a6ebf6d72b599dbba46263492f29aef4ad5d88ac9ad64ce8a5af18dd127d6

SHA512
d8fc856f4e4dfd1f80b2171252ad51c329a1e5882393a56a43d2781a20359594f090e172a682a53beebd4c18852462afad42fde28872ec92f60a14fdad4cbf8c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
82B

MD5
a716d1821d64cdfde8e7a1614dc693e8

SHA1
48e80696b40ecc55f00da4c64e6edf7a141ef278

SHA256
fe2c465aa7a201d2f8bf97ead7e2f9c6b54fa3abc954f998f7119d8f80b0369b

SHA512
4005160bc72822b88eedeb9001b2c82450626d7299a12179df92d6331b6a682d1e779df2800fe1849d040bc06d42dbbb74b56116f1ae5415b4da90198211d771

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
84B

MD5
6d8a048d9b8d2bada117700591df5cc2

SHA1
ac3aaa89de0a3dac19a874fa69396a1a61f73871

SHA256
795191f83972d94ce25be60672a9436588c0f9a8b0df7f90a166ee779b1ad188

SHA512
3a9f8aa036710016ddf99d7d03cfe03a03e9ec2cfe0faa60195aa804fbb6749ab77dccbe69c004f0a487734b21d114c84e67fe13f06812b6851765ea46fc99c5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
148B

MD5
9b04fb818b4b865adefa78fde13ffc6a

SHA1
fdfa8282027e29aa3dc2e23e456ad32504bc603c

SHA256
066d98c3728a3a2b2d3162791bc5b182773f5d15a54b5b93377d2deacd0706ce

SHA512
23663e24f38d5629e8acebaee961f7c098006a1e3ebb95ab035cf474d9d8039de481d48eb7735da2a8cc88c58e41fe2bff64605c3923f29736ed3eca9c228cf6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
148B

MD5
b55d457f4b76295b3a6770441248801e

SHA1
f84c505cb565673f5ee7007eb8f79a13560761fa

SHA256
bbfadf7a5fb0e3699db75f791cecd490c46be343ba62cc102b6d42415e4b9e75

SHA512
5e207f2e7689c417f6151a480975018c93d58734ac1420c16bf26aa78cc043e6e2852ff8e80af1e879b2fd6ed5bcc945a440937efdf6d8628191436dc252ca8c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
148B

MD5
c19e486a861d79373ef4ee1a2bdeaf93

SHA1
839e00cf8cd3d4eff9be6c90c1454adec646a756

SHA256
d0215f2a5063dd1ebc9671fd42da3f6cb9a454806b73e7978123863ff199ca9b

SHA512
709524b0d068e19c4ad7bf3d70db2f4e6ab9b1c4cddd8f8733896d11a543ba2a312c56e2028b7e405da099274e9e74777ba4b8b43ea2cf97d11c4839f2df77ca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
148B

MD5
2765e7335a1407ab8471c28d5291ef31

SHA1
7cd82cb161d3a3f1de62d993cdb13ea199590535

SHA256
09d98a22a34a2922517c34a7af3ba8380728071ef1a72cdd220dae3ed64661f4

SHA512
7628275f099f04a2648b0c86e56389546a5e12fb9487825f82de86f2622704b58e81da5a85736748198bd358b822780cb620eed5dbb280e1703c4614bc2f2cf1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt~RFe5ba2a5.TMP

Filesize
89B

MD5
143217018d64eb79530a81651f3f1c68

SHA1
10ef0ef4c0024c6a97035175b1868fbe737b868d

SHA256
e60ea661e9796b790cd0d9a4a69bdffe6172648258684c73b742811604c78ec7

SHA512
781b544c972bdee9d44e59bf3a70f7239d6822862066b4604c119fd3b66445f6062bf4fc17eeb3142b51f9fd39623d4faa939bf4c1cd77947bb28bc25c2dbdb7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
96B

MD5
9a365087b71105bc9068c99a13394d2c

SHA1
f6fae11ca088951b6126393e03f6e8ad3f85c46a

SHA256
b4047a91b591c4034149131f69c985018273994affbd27fcfb98731a6cdbc9c4

SHA512
22ece882d169c0a2e2b5610ad6d792e97815e36e37c5d842f8065a2139c3af8b43321e3eac6261e7404aac6be1134b233667dbfbe45bc5f01169c40635248605

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5c5fea.TMP

Filesize
48B

MD5
728864d2f742db18e195ddd819d9d7b1

SHA1
85daa317a1e6894ecd2f812954e31bdd80058a97

SHA256
99867a1b5aafea4b2184db2d1b68259b53fc8d99f1a894ae5dffcd3af36ad236

SHA512
3aa47b4fe0f1eb05bc8b9d6d61a04fd9e28d6510307abb98ccaa5b86bab7584f458431064c0e165112f0bba9d7627e28b55e2f1f375de802a781e7a9e0cbb940

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
6KB

MD5
5faf390529e2814e60f133ebd07c8a92

SHA1
522f2c4b321ab8812e5ff0861f9b2951b807595d

SHA256
6bdb3439fbf7004949b1446bce5e8f9462055ad06329629d9ee1d204b34c3a0c

SHA512
a354a8b3428ba7d44e77856e5b700bcfcb88fc63a0ae3bc723c7785f1adc1a936f0964b4e455f9ce8cc5e472023b0b7ca13ab522b8b1f764f3260f032e8cda4d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
5583bc4fe82705966119ef4e02866824

SHA1
4aa8c781e7c8336e8a9ef872904ac788076f07e7

SHA256
0d273c96b6c11d1b65be68f292437075d53df6f7084a2b24530bf049f663253d

SHA512
d86a6bc28207e688b78666a5ab0e21e0d19a3e6bf4349f912748d5ecf4ae188c9ebb2562df10e324bf3b9996158156e700131273aa73cd051634966f36e3561c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
86df9545ed946d9e14b1505f059b87bb

SHA1
01f3e6813f55ce639dbebe76ce5404185b7d2ccc

SHA256
9f90f0b4e1e1bf527c3cb67e3c220fda576d23fd5f9e168ca88c432a3463fede

SHA512
6782e8e196d029099dd100fb07c127535c58e1b87bca03eb5d2b88d9438c559dca6dbde7240c5e1f4271b83150569503bf186b2ff04d399722a4f024c6fd327e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
c8c4505d6eed9cd904d26515e21df45c

SHA1
656c7136c5394a1deac3efb303b82a9b2a755631

SHA256
34f94b12ef439672853f7f37859101d7658bce1ce2ddee18a49fff4a461cbdbb

SHA512
30cf05b7c081cbbb4d6f361c18bfee585926a4aee182db7d0c4f51c3ccfd11be3383d4c3737d5f8fe5e7afebb70afeb5b4516f88818b40c6a9b53b98b0cfcb06

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
59f9380b52bfd359504177c373349f11

SHA1
e1e5e648d7f79498427b7a1a83faa077c84fa51d

SHA256
1345ab0e084a878cb95f8064fc663994d7501ac5dec1c1a60cf01ed5ade4cd70

SHA512
206bb53b0f96ea0c60d6090045214eccbfef242c7689a78a2cdd82b3a23a121a5e5332a834ae6fbdefa5fe122242ae7a98bec1c85bd89bc4c461729c98f1baf4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
438704bbe90ba0eee838c3a7e66daa17

SHA1
257111bba84a8e90185918d798689e508b601ac4

SHA256
8ceb978ab618300d826bc0d5af91a09ab03f08b1643cd1d4c53ab4ea26686c4b

SHA512
7aa5aba56c6b9099f1792bcc585e1ec87872124c5cd1addc39aa882c66a47310e4b8242f120acdca789712e21c9495e5f8f191dccf0fc7595fb744fd1aebbd00

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
032882590eb6af4ea2889c5370b4096c

SHA1
f40ffd3f2c0ff673aa5174205d6e44eff396f5a7

SHA256
df9925038936e500c98a8bd2496449f95da02869513d6132e48cf5a9ec2fe3da

SHA512
c12366bb7e0128ac7927907c2853be046d8a87a25c94d330c4801ad326c5ca33f19a5c8473c99772364af415541b984302278833fcb65c812c5311d1326415ff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
b134524ad7c510c6f2033026910d7c34

SHA1
84300100f22f772bf68e86dc1ee7c32130a5b5fe

SHA256
69f408094839d7a71f8f898e7b6c5354eeed6a03b46afa83ca3e8b1eecfc499f

SHA512
e9d01443ddf0e6b18495d12e28a19362e75e89081089b9077de8457f21592c19e1a07652b67835d2fe3384e57dae7a45d9077d4fd8cb0e6f0c7c0e3ae97bc1e8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
6KB

MD5
430676e597662f8e386172c37973838b

SHA1
b239334c3aa24b31aa70a7a55b5d50c817a19ae0

SHA256
31a6759b9486f741b698677b3bb96ceeea42b3b8c454dae9ea6026ca3da69c49

SHA512
0d66399206085fdbfb64f5e530ea574353eb1770f56a7eccbc289de019c7b8d7d73168e8cea64a038544b806949fe08b406ec585e4b33af2c44439d94c1632fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
245caf54e16789ff488e9155247c842b

SHA1
391da06e07902eba0a24b816cdda1657b81e2fe7

SHA256
e1474c0364045db77b34d3aa7ff2d843e529f17226c70a64a8a985dc38800d77

SHA512
19a47d944397f393afdd41f50eee63cc73f87ac773a398062929125cc772c96665f6adea8cf5f48f01b6a20024212d64015c48001f8ab1323ba2404e8b554850

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
6KB

MD5
be6fa81bb3848f8769e42a4e05fc8653

SHA1
11bbab8281c3f4c8820c2bf5b481ab7ab214ed5e

SHA256
d41879b15299801618cae75d387f7152da4a9f64596f38987b0f10f7bada400e

SHA512
008db33a283f2f842cbe98bbd9201ae267140a23e0bbc33628d9dfac32c73daf86e80bc01ac0bbc658fd6619ab1fdb33c3129d232ea66b333228b4f0d05de0dc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
6KB

MD5
cdaeb09740bd1c44b319c8840ea0a278

SHA1
4d6d34c44862f97184446330404b601c4410397f

SHA256
6befe7faf5d5a46224c415786c0c30e2b75cc740d024b00c8333345b2ea31207

SHA512
72919849f1e69175fb6a778fd460bba547815701c28e1eed4445a2887e5407ff5db5bb703b55ab15a9129c787534a48b716585e07a20fc995561acf6ec325420

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
010e7defd99e4d897859addd1b21ea35

SHA1
44891c18567cb466fcd286f4e0e9589b13463abb

SHA256
0f0c623f1064843f6e53b59e284904a0b194eecd86e05b4e4474cec899560877

SHA512
9e344993d94f6fbab864594c7ebf5278ccc8464a62590e078863279176d426d9a0118aa8b4f158af1076af82aede63af9822d69bb7c466862f5fd68034dcfb5d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
6KB

MD5
d81f52c3f14513691da7555ba64d95ee

SHA1
113f7eecbb27b0692d51459e6b2b64a5d873cc13

SHA256
2cf54fd6f84155523b340246045ca30144e4c1688e9157c775f7a0fa51ccce32

SHA512
2cfc546d3b2426d7031c01525399e94499ee4fc727684c18ebabd066a3f3835b108d1040e301b532e3072fb33cda27668a0dbb84d67679892397d8ab8029d620

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
fdcfd2b7b034ae59898eff2582cca0ac

SHA1
5bc6153e6e4723bd37e5165af87ef5974902408d

SHA256
11c0445f72de3434bbbcdc0d8c2ce34a458ecd9e5472e58ae444e4a927054661

SHA512
d883d7758601b36ce876e2599f31bd1816b783b19f0c306718811bc6bdd02e7b330430213b2e69c7ac92dd50a895e97c528ee80e56a8085b67a473c3272af8fa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
6KB

MD5
c215bcfd9d0ea3b81fd9409752e29100

SHA1
095d98a3ef6fe762bed57c59c3466d5c02672a7d

SHA256
c1848a5d722630334453ade3392e4930cf6be50b2dc421b8f76a30ce5d79f324

SHA512
992ad877f0a4e5f4123750682e314e72cbb91fdbc27e055bfb2dc7c45859583910c6be903d446b11c211b9b73f8ac9e9aaac7c6deb7a4ad93f1ed402e0461def

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
6KB

MD5
984193555bc88117a4ff93beab5010c0

SHA1
0f2adf8458c221b237797c4ac4c0bb33ee317970

SHA256
82992e705f295cb87682a03621d44b81d1c1a9cccfbdcb61b554047ddbfa0bf3

SHA512
e2133abca88d47a5e5349c2190d9b279565830fb204b95bb62f1bc936aa130100996133e7752e109fbebb62483cb961fd89f02beceaf80b0e6e7dd00cd1fd939

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
6KB

MD5
980a55945dd34a6da51f86527c623dcd

SHA1
9532e7aa1637b97edccedb5447c752920cf45660

SHA256
a3f75d74fc80696a0629ac0c46e10bbc6e7af51195e3f7aca9831120248fe045

SHA512
c00cb150a4bcb5810310b1797a9bad1c124ec6ba5e63f2514d908cd201f00fd5fd69082983086bf11a7865711741f5d03aaae761365f4c76bcc56956ef0b9c45

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
6KB

MD5
cad128826688a6663b28fb4273fe9307

SHA1
dce89728d1f28425bc71ee914ae999f3c9f7277c

SHA256
6315aae0d01f13ca37e787f8a443679f150fa1f89b6c94ae1fc287a48ae048e7

SHA512
9608453adbb548158d63a9af65390274c548b30dcf35b7ce117a5451cc6e0882693ce95e016c0df7ef965e17ab60ae6e6515ac92a481172a6787b8613440c94a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
b0329345c2b99e40ed7a397cefb04bc5

SHA1
a410558e0ddff835c9e136c16aa96c5618519b5c

SHA256
e075f5b3ae3a8411a7f00cf55c1d4059396cb09367e800b15b6ee90c529b9a81

SHA512
9ca42f40a27c7f3866cf613ce7f0bb227ef1e2d51470e9d4d20e055eb8292d0f4b1661c6a38442778b8ee0d3d98da2c421f7d1852a996372c1b36d2074d1019b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
6KB

MD5
d9a2981a038395f469d681c48dda7662

SHA1
43a2d27e183e3a573878aa46050780e6759ad698

SHA256
f28f4ade4c9247cd1e5dc59292b04a0526a2ed36a0edcd12edecf0b53798768d

SHA512
7e7bae258a906c9f74b5d4d9c459256276f3f58eae69c9c1f5411c1b406ede98ec4931aab0d3d9da5a9764ebbb4835ed2381cd84b47e490dec08ffb2a2252447

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
44dac29b2e1b59fb418f832fdc7b1b1d

SHA1
8690e18024ac43e53ba3aaa9a1adb9b4655ca58a

SHA256
cc1b03802011acb75b4f78edd859f1661db5aaac10eac70e03498da38d4b145e

SHA512
bc95f7d77d4064aa29727756dd83f8692dc1d9a29e276924ac9e21f2185afaba00dfc7160d4c18e8c0cb88efe2263740f27f40fd8b71ca2421aaffa7aea38a19

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
df491710d60376afe7b4401ee3c95170

SHA1
8533cd59ec948d214e4666eba6cbef5d387e96b2

SHA256
4ef23331e573434eb022f865a7ea63af06fa232e313564a214ca65f73933ef32

SHA512
4b7bc3a10875acbfa5c74a487f9a90be0a6c22fd75fa695e6e7015f0475a2ee6258096ed0a2c9f66f013874b3add831d23793c23325f156ed81807d3aa3e7cc6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57ce1d.TMP

Filesize
874B

MD5
b033a8976c79f07b61348064fc37d2e6

SHA1
3de4b8a67d07afff9fadc0e5936bf2dab5c0bac9

SHA256
7bc8f1d3469956b9c622d0ebd3cdba68a69cf074d5fac1490867fbd1fffe419c

SHA512
848be8e919cf020e9ec56169f0ff37fc74a133c945f7c914ed4494afc7ed39f123d40ed21b711b6171341b029a682396a8589198ac20c7dd0ccf6db00012867a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
aefd77f47fb84fae5ea194496b44c67a

SHA1
dcfbb6a5b8d05662c4858664f81693bb7f803b82

SHA256
4166bf17b2da789b0d0cc5c74203041d98005f5d4ef88c27e8281e00148cd611

SHA512
b733d502138821948267a8b27401d7c0751e590e1298fda1428e663ccd02f55d0d2446ff4bc265bdcdc61f952d13c01524a5341bc86afc3c2cde1d8589b2e1c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
caa8bad671d84b19d2380f0c213aed7c

SHA1
a6c2adde34abb28d8dd5f1292ad373630b7b698c

SHA256
488d674291d19d1d7ff18b44d0b1308c9ff09be9bf54fe70737309d3643c106e

SHA512
a63fe21ea3a7cc845de88b089a556fe8c3095a2c53e3766aa1bd8b4917cafa7374f9b4e7372ec9d3941579848805732dbbb203497e54ee38bb41629ed02d4e83

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
96ff5a53ffe7d6387df23f68d0bc2d02

SHA1
d6b3cb7cd883c1560a1cbea586da36e2044b5afe

SHA256
bab7a10f1ab9b947115384ac07ec5925522ab77a0ce8addece452a6fca8088f1

SHA512
7922ced32dea4bac32a69313acd46836fae60b3e9284357adeac36791c893c19b28fa1e062a710781efdc449ea9c7edd0098ff99d9d60fc2ea231e88277aae05

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
baf1f0874bbc7b0f34191ce6ee5df664

SHA1
e96ba73db59c3003aa3be9e61013ed21c23d8ac4

SHA256
9adb3244d2ae2786643b62cf824421cd8949fc68bd44ff655b061a8b81214b25

SHA512
d6420d0c3bd0d680c690e0f29cf04ba5c96430b4a9232ae78d99168b97eaed2205000d6ece666dde719958623748ec7e5d1500d55543289db27d7b37b717c525

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
66bb89373dcf8d9aa1e3b31d7d170e0f

SHA1
944f087c9c2857230f72d664aab90d0544807baa

SHA256
30ef2f52afa4f5b94383462324aed45cc85736fe10de9f1ddb611678ba4ffd22

SHA512
ceb3222dfef47c0e8957cd2f70be4e070e0369c2550dde4e54dbf9aa531315d6e8bd8588ad05ca90080438474fdf151241af34a5bccaea7910a99febf94266a6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
c10e3e7f9ccfcbc5d833b8cda821bb7d

SHA1
005c7a30f3ae4f1f0aa0e22bd5a56a7cf899a229

SHA256
6553c1c7faccc1dbee91a9c42f980f47699f8783e8dbab0a34465615f35e2edb

SHA512
d56138ec80647947a99cd52169354b83e401421fb763e7e7bae6b7849239b83f3fb49143afea68d73e0721b9fb4eb58a7cafafd9aa4954bd646789a5eea1e220

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
4e90888e141c98e24ef093b56f57218c

SHA1
54c5146ac19165588a3b9168eb9ab49aa21480a6

SHA256
d3bf12fcd7e464eee42e3f6dbe27034a59b1bac5734c6558026e1cb956b9459f

SHA512
f1ba93b0e444a6952621eb7b1324ae4d522b507c692eac87a2b535f57cb976ad2deba32c5700be85c9415f797f942ece50cb16994ef6c71ab977827f176d303f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
7aad7ef0c0069342ceda8176dbbed30c

SHA1
024d547a5a900a3ec88a83ea66ca310ac6e55ae0

SHA256
569e4a9807c2e7f17ee16fe25ce50e9be47cbf1175b3f2808622b2b13c5a8ef4

SHA512
2f85b088bda65c224b3b8583cb805a5eea08af7bcf127c9f69bc03d2dda133196cfbc4ffc8ed132aae87184c3826cca110206a79ffbe516f61ac1dadf0f7572d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
3ce1e739e074c9861e86c6717b304ae0

SHA1
0f7dbff34eebc2b5b9016665e277d69896351aa9

SHA256
3dbde8bfffaba2598a72e8878cdf8a05329bae7d389c0be43cc39df8f65500b5

SHA512
9e91ad3c421696c325679516163a4990199cd4673449189a18f7fcd378348911dfe6c00142776dd9c50b954f2235593aa74237b43eb96ba13e0b53dbd0b380c7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
3be11749f9ba240fbd930300a25ae805

SHA1
d6abfd84bc77c2a5bc1f4fa7951c8ae2fd98fb20

SHA256
e56035f7ae91f24308b01be2148699025517b66d1e4fb2236ba89dd478f5ec50

SHA512
009121194f6347dd7702239b27c0ed81131922a504d774766256a86a24d29a84ad6cecd473b14984ad99ffad08bd9203d88cfbb787a2246b05f228ea44618ad0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
75dd6647db60fbf6fbe60cda4c73edff

SHA1
e94c536a0825d6e2c5a397c1a21641c8448a0a85

SHA256
dc946182e97719b02b6d4a5d1018ed524e1bf0b40426fb5ce43860b1d84e8d8d

SHA512
be038431e30f319b6acbc1a437f7c8098711090fbd8c71bff77cc7a4ed2b5ec42bcacb6c0c961a71c3e9dcea75d7240bd8362ff458614a879cc438e879893381

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
10KB

MD5
b006255177a266afcf87e2172df498eb

SHA1
4980da55b72d6fc619864e85f07429c940082472

SHA256
ea4d364a16ce637e3fea7478eaeea4477d933be83ab311525c058e87f2b6adec

SHA512
0fe663ced053463275e58ce8a2594db2f80b3168666ad6f16be00bbfacfda8b1b65e19f306c66623e8d3177d6466b530f8be874c2a1c5715ceff6cfecd6f2b75

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
10KB

MD5
9e2b44eea38317938f7225b0b138427a

SHA1
57f6a0e21e599c668f8fb49935c797df72702948

SHA256
c453c8cbcbede330e56ba458bcfbb1659ea00e5ef7daf528d70b7a961662bdd7

SHA512
702da9f019e5e3792550f498d85253c2468732d54e56d162009e768889ffb0950235bd82aa0c85e922d15c4dc13bd2a5961c7efc3e15f73003491b4a2a6433b2

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
10KB

MD5
c65df47b27485cebc132a1e462f7bb9c

SHA1
0a303bcf15d34d603519d99734a7438abe1b20ba

SHA256
bb7932b9395cdf21552710ebbb399a8bb55cb7a8ab18686add86f1047d201272

SHA512
bafe22cadac454b30fcec444b8e8ab5a79f747e40d15f24ddb0bc2de1eed24facae56eac89792e93a68ad11d7117d03ebf281de7963fc6466eadd2c537d6b03d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
10KB

MD5
563899178451fe83ec141e0e7a6e6f63

SHA1
77f2e98295546ec63dad053cb0982e821d335001

SHA256
7ee0c4867e7c9e4e1a03433282628d98160483c9ea63fb75cb32f4f06c9c52dc

SHA512
7cab253b5a9c677b8fa73eb6d7c80cf8c70535444094ee9cbcc5cb8903bb19171a09d3a6d4d5019acac2e20eb825ede42c09e88172f11db9f3d6b92da6981c09

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
10KB

MD5
4ebe9ab621335c1e2c908975ac2f99a4

SHA1
89699fa0eb69c610a9585f506346b391a26bc3c0

SHA256
159fb5be9d450673ec175cf1bc0859fd1439f52be38ca71e851460e03625dd5c

SHA512
7f38f8b4d70a11baa0a657f0a638493c5001de4d78fc67fc2b4bf70fd6a30ecba09a0ce94ccb94e25370d81a1c099f1d99505bd218c95b2651ee9277d32a7545

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\raesdfgiuytr.vbs

Filesize
143B

MD5
1563546e300f2189a1cf2a512804a3c5

SHA1
f7363a1601433c73804f88adcad2136cf4a38a8c

SHA256
111773250959f1dcf3439aa51ada396119530046932cd176ab78a4358144e4b7

SHA512
b37b8fc72a9524375f53504c3f60bff243b72c436065e997958130ff13853c0afc20475d390c797e2b40872dc992e56fa37d2638498345066942fb956470bfbf

Download Submit
C:\Users\Admin\Downloads\1.bmp

Filesize
650KB

MD5
71ba87e70cbf4b518de7d8b9d1d5fa08

SHA1
16ba4b2bb3fb7b1096e1972bd3b5a0ba0210c4ad

SHA256
205d5fec67b906d8784b3535c672ed8f28a84ba66c9f4fd8d4b84c2cf6ff2bff

SHA512
b43c05eea15518cb85e827a069dfdc552c4f32f5cd39654c41f6e9e17e095b4c68a97781c2c0b11695bc51c5fe6023c1b7e7dce5b4b32472fbbdd15fee28512b

Download Submit
C:\Users\Admin\Downloads\2.bmp

Filesize
932KB

MD5
881d544c9176890da3649908df77bffb

SHA1
8d336950c95b0e29a48ef9b2cc68b08b87039d8e

SHA256
7b76b6475419e63ba4ec20ad17d98a212eb538ec5d5ba9c38a62af387e0f652a

SHA512
116842a1062b3d5d29475eb7ec83f9e876dbce37fc8c7908069887d7616bedc6a2c22cfd9e1e527cd344682107e3c25ce95e0dcfefbdae290b1f8da38ac0315a

Download Submit
C:\Users\Admin\Downloads\3.bmp

Filesize
501KB

MD5
bfae89315e251fbfd77402428954b034

SHA1
7ce701f0429f2ef09a3a5910b0476205af531708

SHA256
a3384038c5cfa13c5f256d1973f31321a357a51f7bd51ae7d5ecbc38519e38ee

SHA512
79ee1ff03f55d223c105ce2887c61ca5d6dd7b1b1db0ab6ff7d9ef731b5d6da0ad02cd9aea5e3a5c0bc47469029a76ae9b00bee1ca461a3fb3f580fad6145864

Download Submit
C:\Users\Admin\Downloads\4.bmp

Filesize
326KB

MD5
58d544e012a40e944efefdc1efd1212b

SHA1
1ff7a89d0a9e77523b389609a1c88445d4e748e3

SHA256
71342f84cd0ab2c3e9d0292a43162626c8559217d02249336c3719151dad7d49

SHA512
730f403cbf514743ab58ed91911ffa821d82e9073cb20142a31c64035b59885fd781b9ed2a3e5f0994465beb2f5b4c6559ea8047dac1d5b2b4546d54a840646b

Download Submit
C:\Users\Admin\Downloads\5.bmp

Filesize
1.4MB

MD5
385f056cea93bb2270df785f60104309

SHA1
0fd2b13858224faea2fd8244176b7c57965d08f5

SHA256
dbdf5bb1c63dfc1a80bd793e220f5a7fbbb5c83762b90b73351f27197356c493

SHA512
fe94e5d65d5273c0823567f3152ca99a05fafd3ff136eb86ec0cf95a85c825a9e3d565cafb03daacda8c81b6dd22aa477c68ba70ee1ed78e90b9ca4a31090b13

Download Submit
C:\Users\Admin\Downloads\6.bmp

Filesize
634KB

MD5
6e6c68e8868aaae57295fd7428c723a2

SHA1
6494c74abd3bc26f7e2e64333090dbce348c1e7c

SHA256
aa0742c09dd699a403039d3e8e07e5ac00f9cc0974cceea059d06959d53121e3

SHA512
2646f355685840874c6b02457f6f8d44412d248adf506762a359708de345a74f9583de563f171a0be06e9ccc53757ceefb6b1634bbc17c44a29931685af2f213

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 154056.crdownload

Filesize
1.6MB

MD5
c14240799b42bb8888028b840d232428

SHA1
e42d3933a959f55983141a568241cd315ae60612

SHA256
0e69c2a9fc7bac1133becbdbcee3d3c48aaece55efa7abd42071009098c29f7b

SHA512
ae515275895c9a741b422c63feea725f150f5b28c1d9da635933a9b1b523d40230d319b1b53ad1a7a27fa39625244862b2ce89e8fc2da7a48303c032bbcfb591

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 309698.crdownload

Filesize
713KB

MD5
d2c1d7f0003cfc2d3fc7696da1bf0311

SHA1
421eeb723e176975074c5147fad897d568fc728e

SHA256
2c8da65cafc883c75bf3f15c3e3dcbe519aebd71759832812c2ac2695d31286d

SHA512
d573671befb8549c94ded777150e63935d18d53325338a92623c78a7162338d4ce6d3ca7f6a413e30927d72f3a510fc39fbaa0ac6dc6ece1ae7e7baab88a3ce7

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 315030.crdownload

Filesize
296KB

MD5
7bff3da476cdcf86242962026bc43e7f

SHA1
75df814438566ea911cdcf9124d52c3ca094eb26

SHA256
01105e403dd259c4a2965fc94d290feb2c445f89602f4778c82dfe6d59ce3f58

SHA512
ff3890ca0e0360d6ae4e1e8491f692cae943f07c7f1dbcb712fc824e20f852c4a20cdfefcbb8c849d88d58db14b5a03b93127e06881f39c1bba950a9033543cc

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 676160.crdownload

Filesize
5.4MB

MD5
6f4775e31e40ae00c24728b56ab6dd21

SHA1
c8eebc1307dba98f8b6f45a20735ae17c640d969

SHA256
29167a3d63902cfc36c056d90ecdcaad12148796aea5c58361c0b0a0aa6aae5b

SHA512
6e4b72d5a8087635b2129cffc2efdf06febe2fab6d0d9535867ba70876e09f1755b4be34ec7b57d9741302c3b915f64ac5936f347d3149f22a623d50bf5188ee

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 676160.crdownload:SmartScreen

Filesize
7B

MD5
4047530ecbc0170039e76fe1657bdb01

SHA1
32db7d5e662ebccdd1d71de285f907e3a1c68ac5

SHA256
82254025d1b98d60044d3aeb7c56eed7c61c07c3e30534d6e05dab9d6c326750

SHA512
8f002af3f4ed2b3dfb4ed8273318d160152da50ee4842c9f5d9915f50a3e643952494699c4258e6af993dc6e1695d0dc3db6d23f4d93c26b0bc6a20f4b4f336e

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 876853.crdownload

Filesize
1.7MB

MD5
8be846798bb140858d4f8e5017b5690d

SHA1
fc27e85ad2441582644cbb04aebfd18faa7bdc4c

SHA256
2062694652a5d8a4b61c43c3c82f99f249c27f054d4a93cb690738e7b235abc2

SHA512
e7abbf1abc1fa79b4336c928e28c598a0575270302f1ab1f823decefeb523b077fe7df82e15b801d4dc6d7dfe72b9d13888bfd23aa59b848f1c532446a78d71c

Download Submit
C:\Users\Admin\Downloads\cursor.cur

Filesize
4KB

MD5
926aa3bf52940cafa263c0da0ce65cda

SHA1
b042c24de5263a033b9651e7e2f55015aacdcf7e

SHA256
35be5d02438602fa9e4cecf60eaa523fc29ea05b952f530dd6f542631197d6bb

SHA512
93d8745ad8ddcad08d08ccb1df295cb64c1a73eec227cd83117de996fa123b8c6eccfb8fdc6d8b0ad878508a19852ad3883bca7a8c3e71af735654d8b3cf7070

Download Submit
C:\autorun.inf

Filesize
114B

MD5
791c22422cded6b4b1fbb77e2be823bb

SHA1
220e96e2f3a16549228006b16591c208b660b1bc

SHA256
3354db19957d91b855470eb17ce933e4f10066ea25478a10b69a27e8fbca6f60

SHA512
b5f9bd9ca51efc9e8166ca1604d511e36e99fc02ccfd3e686f1dfec7bf777fb0f7b6492bdd1b75640790893857c69cfcf254fd6f6e0ff2839241b94f8c9e0b87

Download Submit
memory/588-1945-0x0000000000400000-0x0000000000907000-memory.dmp

Filesize
5.0MB

Download
memory/588-1946-0x0000000068100000-0x0000000068159000-memory.dmp

Filesize
356KB

Download
memory/1420-278-0x0000000000400000-0x00000000004B9000-memory.dmp

Filesize
740KB

Download
memory/1600-251-0x0000000000400000-0x00000000004B9000-memory.dmp

Filesize
740KB

Download
memory/1844-339-0x0000000000400000-0x00000000004B9000-memory.dmp

Filesize
740KB

Download
memory/1992-1195-0x0000000068100000-0x0000000068159000-memory.dmp

Filesize
356KB

Download
memory/1992-1194-0x0000000000400000-0x0000000000907000-memory.dmp

Filesize
5.0MB

Download
memory/3424-1879-0x0000000000400000-0x0000000000907000-memory.dmp

Filesize
5.0MB

Download
memory/3424-1880-0x0000000068100000-0x0000000068159000-memory.dmp

Filesize
356KB

Download
memory/4060-242-0x0000000000400000-0x00000000004B9000-memory.dmp

Filesize
740KB

Download
memory/4280-245-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/4280-277-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/4280-247-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/4280-249-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/4280-250-0x0000000000800000-0x0000000000830000-memory.dmp

Filesize
192KB

Download
memory/4724-1782-0x0000000068100000-0x0000000068159000-memory.dmp

Filesize
356KB

Download
memory/4724-1781-0x0000000000400000-0x0000000000907000-memory.dmp

Filesize
5.0MB

Download
memory/4980-288-0x000002CF7E480000-0x000002CF7E481000-memory.dmp

Filesize
4KB

Download
memory/4980-287-0x000002CF7E480000-0x000002CF7E481000-memory.dmp

Filesize
4KB

Download
memory/4980-274-0x000002CF7E480000-0x000002CF7E481000-memory.dmp

Filesize
4KB

Download
memory/4980-276-0x000002CF7E480000-0x000002CF7E481000-memory.dmp

Filesize
4KB

Download
memory/4980-285-0x000002CF7E480000-0x000002CF7E481000-memory.dmp

Filesize
4KB

Download
memory/4980-286-0x000002CF7E480000-0x000002CF7E481000-memory.dmp

Filesize
4KB

Download
memory/4980-275-0x000002CF7E480000-0x000002CF7E481000-memory.dmp

Filesize
4KB

Download
memory/4980-284-0x000002CF7E480000-0x000002CF7E481000-memory.dmp

Filesize
4KB

Download
memory/4980-283-0x000002CF7E480000-0x000002CF7E481000-memory.dmp

Filesize
4KB

Download
memory/4980-282-0x000002CF7E480000-0x000002CF7E481000-memory.dmp

Filesize
4KB

Download
memory/5844-2034-0x0000000000400000-0x0000000000907000-memory.dmp

Filesize
5.0MB

Download
memory/5844-2035-0x0000000068100000-0x0000000068159000-memory.dmp

Filesize
356KB

Download