Overview
overview
10Static
static
10Malware-1-...30.exe
windows10-ltsc 2021-x64
10Malware-1-...40.exe
windows10-ltsc 2021-x64
10Malware-1-...32.exe
windows10-ltsc 2021-x64
10Malware-1-.../5.exe
windows10-ltsc 2021-x64
3Malware-1-...91.exe
windows10-ltsc 2021-x64
10Malware-1-...ey.exe
windows10-ltsc 2021-x64
7Malware-1-...ad.exe
windows10-ltsc 2021-x64
3Malware-1-...ti.exe
windows10-ltsc 2021-x64
5Malware-1-...an.bat
windows10-ltsc 2021-x64
7Malware-1-...an.exe
windows10-ltsc 2021-x64
7Malware-1-...ve.bat
windows10-ltsc 2021-x64
7Malware-1-...ve.exe
windows10-ltsc 2021-x64
7Malware-1-...ya.exe
windows10-ltsc 2021-x64
Malware-1-...re.exe
windows10-ltsc 2021-x64
10Malware-1-...ry.exe
windows10-ltsc 2021-x64
Malware-1-...ck.exe
windows10-ltsc 2021-x64
3Malware-1-...he.exe
windows10-ltsc 2021-x64
10Malware-1-...op.exe
windows10-ltsc 2021-x64
7Malware-1-...rb.exe
windows10-ltsc 2021-x64
10Malware-1-...ue.exe
windows10-ltsc 2021-x64
1Malware-1-...ng.exe
windows10-ltsc 2021-x64
6Malware-1-...kt.bat
windows10-ltsc 2021-x64
7Malware-1-...o3.exe
windows10-ltsc 2021-x64
10Malware-1-...ey.exe
windows10-ltsc 2021-x64
10Malware-1-.../m.exe
windows10-ltsc 2021-x64
Malware-1-...o3.exe
windows10-ltsc 2021-x64
9Malware-1-...32.exe
windows10-ltsc 2021-x64
10Malware-1-...nf.exe
windows10-ltsc 2021-x64
10Malware-1-.../o.exe
windows10-ltsc 2021-x64
3Malware-1-...B8.exe
windows10-ltsc 2021-x64
10Malware-1-...ic.exe
windows10-ltsc 2021-x64
3Malware-1-...in.exe
windows10-ltsc 2021-x64
10Resubmissions
17-01-2025 20:14
250117-yz7h3s1qfw 1017-01-2025 20:12
250117-yy9l2sslcr 1017-01-2025 17:25
250117-vy9p9sxpez 1017-01-2025 17:21
250117-vw8eesyjfp 1017-01-2025 14:16
250117-rk9ass1rhk 1017-01-2025 14:12
250117-rhv1ds1lds 1016-01-2025 12:52
250116-p4et7a1mez 1016-01-2025 12:50
250116-p29xjssjep 10Analysis
-
max time kernel
900s -
max time network
900s -
platform
windows10-ltsc 2021_x64 -
resource
win10ltsc2021-20250113-en -
resource tags
arch:x64arch:x86image:win10ltsc2021-20250113-enlocale:en-usos:windows10-ltsc 2021-x64system -
submitted
16-01-2025 12:52
Behavioral task
behavioral1
Sample
Malware-1-master/2530.exe
Resource
win10ltsc2021-20250113-en
Behavioral task
behavioral2
Sample
Malware-1-master/2887140.exe
Resource
win10ltsc2021-20250113-en
Behavioral task
behavioral3
Sample
Malware-1-master/32.exe
Resource
win10ltsc2021-20250113-en
Behavioral task
behavioral4
Sample
Malware-1-master/5.exe
Resource
win10ltsc2021-20250113-en
Behavioral task
behavioral5
Sample
Malware-1-master/96591.exe
Resource
win10ltsc2021-20250113-en
Behavioral task
behavioral6
Sample
Malware-1-master/Amadey.exe
Resource
win10ltsc2021-20250113-en
Behavioral task
behavioral7
Sample
Malware-1-master/Download.exe
Resource
win10ltsc2021-20250113-en
Behavioral task
behavioral8
Sample
Malware-1-master/Illuminati.exe
Resource
win10ltsc2021-20250113-en
Behavioral task
behavioral9
Sample
Malware-1-master/MEMZ-Clean.bat
Resource
win10ltsc2021-20250113-en
Behavioral task
behavioral10
Sample
Malware-1-master/MEMZ-Clean.exe
Resource
win10ltsc2021-20250113-en
Behavioral task
behavioral11
Sample
Malware-1-master/MEMZ-Destructive.bat
Resource
win10ltsc2021-20250113-en
Behavioral task
behavioral12
Sample
Malware-1-master/MEMZ-Destructive.exe
Resource
win10ltsc2021-20250113-en
Behavioral task
behavioral13
Sample
Malware-1-master/Petya.exe
Resource
win10ltsc2021-20250113-en
Behavioral task
behavioral14
Sample
Malware-1-master/Software.exe
Resource
win10ltsc2021-20250113-en
Behavioral task
behavioral15
Sample
Malware-1-master/WannaCry.exe
Resource
win10ltsc2021-20250113-en
Behavioral task
behavioral16
Sample
Malware-1-master/Win32.EvilClusterFuck.exe
Resource
win10ltsc2021-20250113-en
Behavioral task
behavioral17
Sample
Malware-1-master/apache.exe
Resource
win10ltsc2021-20250113-en
Behavioral task
behavioral18
Sample
Malware-1-master/butterflyondesktop.exe
Resource
win10ltsc2021-20250113-en
Behavioral task
behavioral19
Sample
Malware-1-master/crb.exe
Resource
win10ltsc2021-20250113-en
Behavioral task
behavioral20
Sample
Malware-1-master/eternalblue.exe
Resource
win10ltsc2021-20250113-en
Behavioral task
behavioral21
Sample
Malware-1-master/fear.png.exe
Resource
win10ltsc2021-20250113-en
Behavioral task
behavioral22
Sample
Malware-1-master/getr3kt.bat
Resource
win10ltsc2021-20250113-en
Behavioral task
behavioral23
Sample
Malware-1-master/iimo3.exe
Resource
win10ltsc2021-20250113-en
Behavioral task
behavioral24
Sample
Malware-1-master/jey.exe
Resource
win10ltsc2021-20250113-en
Behavioral task
behavioral25
Sample
Malware-1-master/m.exe
Resource
win10ltsc2021-20250113-en
Behavioral task
behavioral26
Sample
Malware-1-master/mo3.exe
Resource
win10ltsc2021-20250113-en
Behavioral task
behavioral27
Sample
Malware-1-master/mo332.exe
Resource
win10ltsc2021-20250113-en
Behavioral task
behavioral28
Sample
Malware-1-master/mysqlconf.exe
Resource
win10ltsc2021-20250113-en
Behavioral task
behavioral29
Sample
Malware-1-master/o.exe
Resource
win10ltsc2021-20250113-en
Behavioral task
behavioral30
Sample
Malware-1-master/qOA7iZJcoB8.exe
Resource
win10ltsc2021-20250113-en
Behavioral task
behavioral31
Sample
Malware-1-master/wintonic.exe
Resource
win10ltsc2021-20250113-en
General
-
Target
Malware-1-master/MEMZ-Clean.exe
-
Size
12KB
-
MD5
9c642c5b111ee85a6bccffc7af896a51
-
SHA1
eca8571b994fd40e2018f48c214fab6472a98bab
-
SHA256
4bbf7589615ebdb6c769d6d2e7bdcb26072bac0cda6e225a4133ba8819e688d5
-
SHA512
23cc74b5a7bdf70ba789d1730a0009414cfb9c780544e3d8d841be58782b9a9a089969c4295a0da25d07285505992386486d6ff0524e75605b96bb99cd3aaa1c
-
SSDEEP
192:BCMfc/GinpRBueYDw4+kEeN4FRrfMFFp3+f2dvGhT59uay:AMfceinpOeRENYhfOj+eGdKa
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3982764349-3037452555-3708423086-1000\Control Panel\International\Geo\Nation MEMZ-Clean.exe -
Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\System32\devmgmt.msc mmc.exe -
Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\e5b199aa-0cc4-44d8-9ab7-5fcaac31883b.tmp setup.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20250116125412.pma setup.exe -
Drops file in Windows directory 57 IoCs
description ioc Process File created C:\Windows\INF\digitalmediadevice.PNF mmc.exe File created C:\Windows\INF\c_barcodescanner.PNF mmc.exe File created C:\Windows\INF\c_fssecurityenhancer.PNF mmc.exe File created C:\Windows\INF\c_fssystem.PNF mmc.exe File created C:\Windows\INF\c_netdriver.PNF mmc.exe File created C:\Windows\INF\c_fscopyprotection.PNF mmc.exe File created C:\Windows\INF\c_ucm.PNF mmc.exe File created C:\Windows\INF\c_fscontinuousbackup.PNF mmc.exe File created C:\Windows\INF\c_cashdrawer.PNF mmc.exe File created C:\Windows\INF\xusb22.PNF mmc.exe File created C:\Windows\INF\c_fscfsmetadataserver.PNF mmc.exe File created C:\Windows\INF\c_extension.PNF mmc.exe File created C:\Windows\INF\c_fsundelete.PNF mmc.exe File created C:\Windows\INF\c_smrvolume.PNF mmc.exe File created C:\Windows\INF\c_fsquotamgmt.PNF mmc.exe File created C:\Windows\INF\c_fsencryption.PNF mmc.exe File created C:\Windows\INF\ts_generic.PNF mmc.exe File created C:\Windows\INF\c_receiptprinter.PNF mmc.exe File created C:\Windows\INF\remoteposdrv.PNF mmc.exe File created C:\Windows\INF\c_mcx.PNF mmc.exe File created C:\Windows\INF\c_linedisplay.PNF mmc.exe File created C:\Windows\INF\c_fsantivirus.PNF mmc.exe File created C:\Windows\INF\rdcameradriver.PNF mmc.exe File created C:\Windows\INF\c_fshsm.PNF mmc.exe File created C:\Windows\INF\c_magneticstripereader.PNF mmc.exe File created C:\Windows\INF\c_fssystemrecovery.PNF mmc.exe File created C:\Windows\INF\c_scmdisk.PNF mmc.exe File created C:\Windows\INF\c_fsinfrastructure.PNF mmc.exe File created C:\Windows\INF\c_diskdrive.PNF mmc.exe File created C:\Windows\INF\c_display.PNF mmc.exe File created C:\Windows\INF\c_camera.PNF mmc.exe File created C:\Windows\INF\c_scmvolume.PNF mmc.exe File created C:\Windows\INF\miradisp.PNF mmc.exe File created C:\Windows\INF\dc1-controller.PNF mmc.exe File created C:\Windows\INF\c_media.PNF mmc.exe File created C:\Windows\INF\c_processor.PNF mmc.exe File created C:\Windows\INF\wsdprint.PNF mmc.exe File opened for modification C:\Windows\Debug\WIA\wiatrace.log mspaint.exe File created C:\Windows\INF\c_fscontentscreener.PNF mmc.exe File created C:\Windows\INF\c_swcomponent.PNF mmc.exe File created C:\Windows\INF\c_fsactivitymonitor.PNF mmc.exe File created C:\Windows\INF\c_fsvirtualization.PNF mmc.exe File opened for modification C:\Windows\Debug\WIA\wiatrace.log mspaint.exe File created C:\Windows\INF\c_monitor.PNF mmc.exe File created C:\Windows\INF\c_smrdisk.PNF mmc.exe File created C:\Windows\INF\oposdrv.PNF mmc.exe File created C:\Windows\INF\c_fsphysicalquotamgmt.PNF mmc.exe File created C:\Windows\INF\c_fscompression.PNF mmc.exe File created C:\Windows\INF\c_sslaccel.PNF mmc.exe File created C:\Windows\INF\c_proximity.PNF mmc.exe File created C:\Windows\INF\c_computeaccelerator.PNF mmc.exe File created C:\Windows\INF\c_fsopenfilebackup.PNF mmc.exe File created C:\Windows\INF\rawsilo.PNF mmc.exe File created C:\Windows\INF\c_firmware.PNF mmc.exe File created C:\Windows\INF\c_fsreplication.PNF mmc.exe File created C:\Windows\INF\c_apo.PNF mmc.exe File created C:\Windows\INF\c_volume.PNF mmc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 20 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mmc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mspaint.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language calc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mmc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mspaint.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regedit.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DllHost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mmc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MEMZ-Clean.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language win32calc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language control.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wordpad.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language calc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mmc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language win32calc.exe -
Checks SCSI registry key(s) 3 TTPs 23 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName Taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom mmc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 mmc.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName mmc.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A\ mmc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001 mmc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002 mmc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000 mmc.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags mmc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A mmc.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A\ mmc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 Taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A Taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName mmc.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName mmc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 mmc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A mmc.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom mmc.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags mmc.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName mmc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 mmc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 mmc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 mmc.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3982764349-3037452555-3708423086-1000\Software\Microsoft\Internet Explorer\Toolbar explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-3982764349-3037452555-3708423086-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\Locked = "1" explorer.exe -
Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3982764349-3037452555-3708423086-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\fhcpl.dll,-52#immutable1 = "File History" explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-3982764349-3037452555-3708423086-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\fhcpl.dll,-2#immutable1 = "Keep a history of your files" explorer.exe Key created \REGISTRY\USER\S-1-5-21-3982764349-3037452555-3708423086-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\USER\S-1-5-21-3982764349-3037452555-3708423086-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-3982764349-3037452555-3708423086-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\telephon.cpl,-1#immutable1 = "Phone and Modem" explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-3982764349-3037452555-3708423086-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\SyncCenter.dll,-3000#immutable1 = "Sync Center" explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-3982764349-3037452555-3708423086-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\systemcpl.dll,-2#immutable1 = "View information about your computer, and change settings for hardware, performance, and remote connections." explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-3982764349-3037452555-3708423086-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\accessibilitycpl.dll,-45#immutable1 = "Make your computer easier to use." explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-3982764349-3037452555-3708423086-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\FirewallControlPanel.dll,-12122#immutable1 = "Windows Defender Firewall" explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-3982764349-3037452555-3708423086-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\intl.cpl,-3#immutable1 = "Region" explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-3982764349-3037452555-3708423086-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\devmgr.dll,-4#immutable1 = "Device Manager" explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-3982764349-3037452555-3708423086-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\DiagCpl.dll,-1#immutable1 = "Troubleshooting" explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-3982764349-3037452555-3708423086-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\system32\Vault.dll,-2#immutable1 = "Manage your Windows credentials." explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-3982764349-3037452555-3708423086-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\usercpl.dll,-2#immutable1 = "Change user account settings and passwords for people who share this computer." explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-3982764349-3037452555-3708423086-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\main.cpl,-100#immutable1 = "Mouse" explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-3982764349-3037452555-3708423086-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\recovery.dll,-101#immutable1 = "Recovery" explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-3982764349-3037452555-3708423086-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\sdcpl.dll,-101#immutable1 = "Backup and Restore (Windows 7)" explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-3982764349-3037452555-3708423086-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\timedate.cpl,-51#immutable1 = "Date and Time" explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-3982764349-3037452555-3708423086-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\mmsys.cpl,-301#immutable1 = "Configure your audio devices or change the sound scheme for your computer." explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3982764349-3037452555-3708423086-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-3982764349-3037452555-3708423086-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\netcenter.dll,-2#immutable1 = "Check network status, change network settings and set preferences for sharing files and printers." explorer.exe Key created \REGISTRY\USER\S-1-5-21-3982764349-3037452555-3708423086-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-3982764349-3037452555-3708423086-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\powercpl.dll,-2#immutable1 = "Conserve energy or maximize performance by choosing how your computer manages power." explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-3982764349-3037452555-3708423086-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\telephon.cpl,-2#immutable1 = "Configure your telephone dialing rules and modem settings." explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-3982764349-3037452555-3708423086-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\main.cpl,-101#immutable1 = "Customize your mouse settings, such as the button configuration, double-click speed, mouse pointers, and motion speed." explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-3982764349-3037452555-3708423086-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\system32\appwiz.cpl,-159#immutable1 = "Programs and Features" explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-3982764349-3037452555-3708423086-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\system32\colorcpl.exe,-7#immutable1 = "Change advanced color management settings for displays, scanners, and printers." explorer.exe Key created \REGISTRY\USER\S-1-5-21-3982764349-3037452555-3708423086-1000_Classes\Local Settings calc.exe Set value (str) \REGISTRY\USER\S-1-5-21-3982764349-3037452555-3708423086-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\devmgr.dll,-5#immutable1 = "View and update your device hardware settings and driver software." explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-3982764349-3037452555-3708423086-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\srchadmin.dll,-601#immutable1 = "Indexing Options" explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-3982764349-3037452555-3708423086-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\system32\DeviceCenter.dll,-1000#immutable1 = "Devices and Printers" explorer.exe Key created \REGISTRY\USER\S-1-5-21-3982764349-3037452555-3708423086-1000_Classes\Local Settings explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-3982764349-3037452555-3708423086-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\RADCUI.dll,-15300#immutable1 = "RemoteApp and Desktop Connections" explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-3982764349-3037452555-3708423086-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\srchadmin.dll,-602#immutable1 = "Change how Windows indexes to search faster" explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-3982764349-3037452555-3708423086-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\autoplay.dll,-2#immutable1 = "Change default settings for CDs, DVDs, and devices so that you can automatically play music, view pictures, install software, and play games." explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-3982764349-3037452555-3708423086-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\sud.dll,-10#immutable1 = "Choose which programs you want Windows to use for activities like web browsing, editing photos, sending e-mail, and playing music." explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-3982764349-3037452555-3708423086-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\Speech\SpeechUX\speechuxcpl.dll,-1#immutable1 = "Speech Recognition" explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-3982764349-3037452555-3708423086-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\autoplay.dll,-1#immutable1 = "AutoPlay" explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-3982764349-3037452555-3708423086-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\SyncCenter.dll,-3001#immutable1 = "Sync files between your computer and network folders" explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3982764349-3037452555-3708423086-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-3982764349-3037452555-3708423086-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\main.cpl,-102#immutable1 = "Keyboard" explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-3982764349-3037452555-3708423086-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\DiagCpl.dll,-15#immutable1 = "Troubleshoot and fix common computer problems." explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-3982764349-3037452555-3708423086-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\mmsys.cpl,-300#immutable1 = "Sound" explorer.exe Key created \REGISTRY\USER\S-1-5-21-3982764349-3037452555-3708423086-1000_Classes\Local Settings MEMZ-Clean.exe Key created \REGISTRY\USER\S-1-5-21-3982764349-3037452555-3708423086-1000_Classes\Local Settings control.exe Set value (str) \REGISTRY\USER\S-1-5-21-3982764349-3037452555-3708423086-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\FirewallControlPanel.dll,-12123#immutable1 = "Set firewall security options to help protect your computer from hackers and malicious software." explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-3982764349-3037452555-3708423086-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\Speech\SpeechUX\speechuxcpl.dll,-2#immutable1 = "Configure how speech recognition works on your computer." explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-3982764349-3037452555-3708423086-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\intl.cpl,-2#immutable1 = "Customize settings for the display of languages, numbers, times, and dates." explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-3982764349-3037452555-3708423086-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\system32\appwiz.cpl,-160#immutable1 = "Uninstall or change programs on your computer." explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-3982764349-3037452555-3708423086-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\inetcpl.cpl,-4313#immutable1 = "Configure your Internet display and connection settings." explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-3982764349-3037452555-3708423086-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\recovery.dll,-2#immutable1 = "Recovery" explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-3982764349-3037452555-3708423086-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\system32\colorcpl.exe,-6#immutable1 = "Color Management" explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-3982764349-3037452555-3708423086-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\timedate.cpl,-52#immutable1 = "Set the date, time, and time zone for your computer." explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-3982764349-3037452555-3708423086-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\system32\Vault.dll,-1#immutable1 = "Credential Manager" explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-3982764349-3037452555-3708423086-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\RADCUI.dll,-15301#immutable1 = "Manage your RemoteApp and Desktop Connections" explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-3982764349-3037452555-3708423086-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\inetcpl.cpl,-4312#immutable1 = "Internet Options" explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-3982764349-3037452555-3708423086-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\system32\DeviceCenter.dll,-2000#immutable1 = "View and manage devices, printers, and print jobs" explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-3982764349-3037452555-3708423086-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\sdcpl.dll,-100#immutable1 = "Recover copies of your files backed up in Windows 7" explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-3982764349-3037452555-3708423086-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\systemcpl.dll,-1#immutable1 = "System" explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-3982764349-3037452555-3708423086-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\accessibilitycpl.dll,-10#immutable1 = "Ease of Access Center" explorer.exe Key created \REGISTRY\USER\S-1-5-21-3982764349-3037452555-3708423086-1000_Classes\Local Settings calc.exe Key created \REGISTRY\USER\S-1-5-21-3982764349-3037452555-3708423086-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-3982764349-3037452555-3708423086-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\powercpl.dll,-1#immutable1 = "Power Options" explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-3982764349-3037452555-3708423086-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\usercpl.dll,-1#immutable1 = "User Accounts" explorer.exe -
Runs regedit.exe 1 IoCs
pid Process 756 regedit.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 5092 explorer.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1396 msedge.exe 1396 msedge.exe 464 msedge.exe 464 msedge.exe 4324 identity_helper.exe 4324 identity_helper.exe 3004 msedge.exe 3004 msedge.exe 3004 msedge.exe 3004 msedge.exe 3384 Taskmgr.exe 3384 Taskmgr.exe 3384 Taskmgr.exe 3384 Taskmgr.exe 3384 Taskmgr.exe 3384 Taskmgr.exe 3384 Taskmgr.exe 3384 Taskmgr.exe 3384 Taskmgr.exe 3384 Taskmgr.exe 3384 Taskmgr.exe 3384 Taskmgr.exe 3384 Taskmgr.exe 3384 Taskmgr.exe 3384 Taskmgr.exe 3384 Taskmgr.exe 3384 Taskmgr.exe 3384 Taskmgr.exe 3384 Taskmgr.exe 3384 Taskmgr.exe 3384 Taskmgr.exe 3384 Taskmgr.exe 3384 Taskmgr.exe 3384 Taskmgr.exe 3384 Taskmgr.exe 3384 Taskmgr.exe 3384 Taskmgr.exe 3384 Taskmgr.exe 3384 Taskmgr.exe 3384 Taskmgr.exe 3384 Taskmgr.exe 3384 Taskmgr.exe 3384 Taskmgr.exe 3384 Taskmgr.exe 3384 Taskmgr.exe 3384 Taskmgr.exe 3384 Taskmgr.exe 3384 Taskmgr.exe 3384 Taskmgr.exe 3384 Taskmgr.exe 3384 Taskmgr.exe 3384 Taskmgr.exe 3384 Taskmgr.exe 3384 Taskmgr.exe 3384 Taskmgr.exe 3384 Taskmgr.exe 3384 Taskmgr.exe 3384 Taskmgr.exe 3384 Taskmgr.exe 3384 Taskmgr.exe 3384 Taskmgr.exe 3384 Taskmgr.exe 3384 Taskmgr.exe 3384 Taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 6 IoCs
pid Process 1328 mmc.exe 3384 Taskmgr.exe 1224 MEMZ-Clean.exe 5060 mmc.exe 7736 mmc.exe 1620 mmc.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 64 IoCs
pid Process 464 msedge.exe 464 msedge.exe 464 msedge.exe 464 msedge.exe 464 msedge.exe 464 msedge.exe 464 msedge.exe 464 msedge.exe 464 msedge.exe 464 msedge.exe 464 msedge.exe 464 msedge.exe 464 msedge.exe 464 msedge.exe 464 msedge.exe 464 msedge.exe 464 msedge.exe 464 msedge.exe 464 msedge.exe 464 msedge.exe 464 msedge.exe 464 msedge.exe 464 msedge.exe 464 msedge.exe 464 msedge.exe 464 msedge.exe 464 msedge.exe 464 msedge.exe 464 msedge.exe 464 msedge.exe 464 msedge.exe 464 msedge.exe 464 msedge.exe 464 msedge.exe 464 msedge.exe 464 msedge.exe 464 msedge.exe 464 msedge.exe 464 msedge.exe 464 msedge.exe 464 msedge.exe 464 msedge.exe 464 msedge.exe 464 msedge.exe 464 msedge.exe 464 msedge.exe 464 msedge.exe 464 msedge.exe 464 msedge.exe 464 msedge.exe 464 msedge.exe 464 msedge.exe 464 msedge.exe 464 msedge.exe 464 msedge.exe 464 msedge.exe 464 msedge.exe 464 msedge.exe 464 msedge.exe 464 msedge.exe 464 msedge.exe 464 msedge.exe 464 msedge.exe 464 msedge.exe -
Suspicious behavior: SetClipboardViewer 3 IoCs
pid Process 5060 mmc.exe 7736 mmc.exe 1620 mmc.exe -
Suspicious use of AdjustPrivilegeToken 29 IoCs
description pid Process Token: 33 2820 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 2820 AUDIODG.EXE Token: 33 1328 mmc.exe Token: SeIncBasePriorityPrivilege 1328 mmc.exe Token: 33 1328 mmc.exe Token: SeIncBasePriorityPrivilege 1328 mmc.exe Token: 33 1328 mmc.exe Token: SeIncBasePriorityPrivilege 1328 mmc.exe Token: SeDebugPrivilege 3384 Taskmgr.exe Token: SeSystemProfilePrivilege 3384 Taskmgr.exe Token: SeCreateGlobalPrivilege 3384 Taskmgr.exe Token: SeShutdownPrivilege 5092 explorer.exe Token: SeCreatePagefilePrivilege 5092 explorer.exe Token: 33 5060 mmc.exe Token: SeIncBasePriorityPrivilege 5060 mmc.exe Token: 33 5060 mmc.exe Token: SeIncBasePriorityPrivilege 5060 mmc.exe Token: 33 5060 mmc.exe Token: SeIncBasePriorityPrivilege 5060 mmc.exe Token: 33 7736 mmc.exe Token: SeIncBasePriorityPrivilege 7736 mmc.exe Token: 33 7736 mmc.exe Token: SeIncBasePriorityPrivilege 7736 mmc.exe Token: 33 7736 mmc.exe Token: SeIncBasePriorityPrivilege 7736 mmc.exe Token: 33 1620 mmc.exe Token: SeIncBasePriorityPrivilege 1620 mmc.exe Token: 33 1620 mmc.exe Token: SeIncBasePriorityPrivilege 1620 mmc.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 464 msedge.exe 3384 Taskmgr.exe 3384 Taskmgr.exe 3384 Taskmgr.exe 3384 Taskmgr.exe 3384 Taskmgr.exe 3384 Taskmgr.exe 3384 Taskmgr.exe 3384 Taskmgr.exe 3384 Taskmgr.exe 3384 Taskmgr.exe 3384 Taskmgr.exe 3384 Taskmgr.exe 3384 Taskmgr.exe 3384 Taskmgr.exe 3384 Taskmgr.exe 3384 Taskmgr.exe 3384 Taskmgr.exe 3384 Taskmgr.exe 3384 Taskmgr.exe 3384 Taskmgr.exe 3384 Taskmgr.exe 3384 Taskmgr.exe 3384 Taskmgr.exe 3384 Taskmgr.exe 3384 Taskmgr.exe 3384 Taskmgr.exe 3384 Taskmgr.exe 3384 Taskmgr.exe 3384 Taskmgr.exe 3384 Taskmgr.exe 3384 Taskmgr.exe 3384 Taskmgr.exe 3384 Taskmgr.exe 3384 Taskmgr.exe 3384 Taskmgr.exe 3384 Taskmgr.exe 3384 Taskmgr.exe 3384 Taskmgr.exe 3384 Taskmgr.exe 3384 Taskmgr.exe 3384 Taskmgr.exe 3384 Taskmgr.exe 3384 Taskmgr.exe 3384 Taskmgr.exe 3384 Taskmgr.exe 3384 Taskmgr.exe 3384 Taskmgr.exe 3384 Taskmgr.exe 3384 Taskmgr.exe 3384 Taskmgr.exe 3384 Taskmgr.exe 3384 Taskmgr.exe 3384 Taskmgr.exe 3384 Taskmgr.exe 3384 Taskmgr.exe 3384 Taskmgr.exe 3384 Taskmgr.exe 3384 Taskmgr.exe 3384 Taskmgr.exe 3384 Taskmgr.exe 3384 Taskmgr.exe 3384 Taskmgr.exe 3384 Taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 3384 Taskmgr.exe 3384 Taskmgr.exe 3384 Taskmgr.exe 3384 Taskmgr.exe 3384 Taskmgr.exe 3384 Taskmgr.exe 3384 Taskmgr.exe 3384 Taskmgr.exe 3384 Taskmgr.exe 3384 Taskmgr.exe 3384 Taskmgr.exe 3384 Taskmgr.exe 3384 Taskmgr.exe 3384 Taskmgr.exe 3384 Taskmgr.exe 3384 Taskmgr.exe 3384 Taskmgr.exe 3384 Taskmgr.exe 3384 Taskmgr.exe 3384 Taskmgr.exe 3384 Taskmgr.exe 3384 Taskmgr.exe 3384 Taskmgr.exe 3384 Taskmgr.exe 3384 Taskmgr.exe 3384 Taskmgr.exe 3384 Taskmgr.exe 3384 Taskmgr.exe 3384 Taskmgr.exe 3384 Taskmgr.exe 3384 Taskmgr.exe 3384 Taskmgr.exe 3384 Taskmgr.exe 3384 Taskmgr.exe 3384 Taskmgr.exe 3384 Taskmgr.exe 3384 Taskmgr.exe 3384 Taskmgr.exe 3384 Taskmgr.exe 3384 Taskmgr.exe 3384 Taskmgr.exe 3384 Taskmgr.exe 3384 Taskmgr.exe 3384 Taskmgr.exe 3384 Taskmgr.exe 3384 Taskmgr.exe 3384 Taskmgr.exe 3384 Taskmgr.exe 3384 Taskmgr.exe 3384 Taskmgr.exe 3384 Taskmgr.exe 3384 Taskmgr.exe 3384 Taskmgr.exe 3384 Taskmgr.exe 3384 Taskmgr.exe 3384 Taskmgr.exe 3384 Taskmgr.exe 3384 Taskmgr.exe 3384 Taskmgr.exe 3384 Taskmgr.exe 3384 Taskmgr.exe 3384 Taskmgr.exe 3384 Taskmgr.exe 3384 Taskmgr.exe -
Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 1224 MEMZ-Clean.exe 1224 MEMZ-Clean.exe 1304 mmc.exe 1328 mmc.exe 1328 mmc.exe 1224 MEMZ-Clean.exe 1224 MEMZ-Clean.exe 1224 MEMZ-Clean.exe 1224 MEMZ-Clean.exe 1224 MEMZ-Clean.exe 1224 MEMZ-Clean.exe 1224 MEMZ-Clean.exe 1224 MEMZ-Clean.exe 1224 MEMZ-Clean.exe 1224 MEMZ-Clean.exe 1224 MEMZ-Clean.exe 1224 MEMZ-Clean.exe 1224 MEMZ-Clean.exe 1224 MEMZ-Clean.exe 1224 MEMZ-Clean.exe 1224 MEMZ-Clean.exe 1224 MEMZ-Clean.exe 1224 MEMZ-Clean.exe 1224 MEMZ-Clean.exe 1224 MEMZ-Clean.exe 1224 MEMZ-Clean.exe 1224 MEMZ-Clean.exe 1224 MEMZ-Clean.exe 1224 MEMZ-Clean.exe 1224 MEMZ-Clean.exe 1224 MEMZ-Clean.exe 1224 MEMZ-Clean.exe 1224 MEMZ-Clean.exe 1224 MEMZ-Clean.exe 1224 MEMZ-Clean.exe 1224 MEMZ-Clean.exe 1224 MEMZ-Clean.exe 1224 MEMZ-Clean.exe 1224 MEMZ-Clean.exe 1224 MEMZ-Clean.exe 1224 MEMZ-Clean.exe 1224 MEMZ-Clean.exe 1224 MEMZ-Clean.exe 1224 MEMZ-Clean.exe 1224 MEMZ-Clean.exe 1224 MEMZ-Clean.exe 1224 MEMZ-Clean.exe 1224 MEMZ-Clean.exe 1224 MEMZ-Clean.exe 1224 MEMZ-Clean.exe 6624 mmc.exe 5060 mmc.exe 5060 mmc.exe 1224 MEMZ-Clean.exe 1224 MEMZ-Clean.exe 1224 MEMZ-Clean.exe 1224 MEMZ-Clean.exe 1224 MEMZ-Clean.exe 1224 MEMZ-Clean.exe 6568 mspaint.exe 6568 mspaint.exe 6568 mspaint.exe 6568 mspaint.exe 1224 MEMZ-Clean.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1224 wrote to memory of 464 1224 MEMZ-Clean.exe 82 PID 1224 wrote to memory of 464 1224 MEMZ-Clean.exe 82 PID 464 wrote to memory of 4144 464 msedge.exe 83 PID 464 wrote to memory of 4144 464 msedge.exe 83 PID 464 wrote to memory of 4504 464 msedge.exe 84 PID 464 wrote to memory of 4504 464 msedge.exe 84 PID 464 wrote to memory of 4504 464 msedge.exe 84 PID 464 wrote to memory of 4504 464 msedge.exe 84 PID 464 wrote to memory of 4504 464 msedge.exe 84 PID 464 wrote to memory of 4504 464 msedge.exe 84 PID 464 wrote to memory of 4504 464 msedge.exe 84 PID 464 wrote to memory of 4504 464 msedge.exe 84 PID 464 wrote to memory of 4504 464 msedge.exe 84 PID 464 wrote to memory of 4504 464 msedge.exe 84 PID 464 wrote to memory of 4504 464 msedge.exe 84 PID 464 wrote to memory of 4504 464 msedge.exe 84 PID 464 wrote to memory of 4504 464 msedge.exe 84 PID 464 wrote to memory of 4504 464 msedge.exe 84 PID 464 wrote to memory of 4504 464 msedge.exe 84 PID 464 wrote to memory of 4504 464 msedge.exe 84 PID 464 wrote to memory of 4504 464 msedge.exe 84 PID 464 wrote to memory of 4504 464 msedge.exe 84 PID 464 wrote to memory of 4504 464 msedge.exe 84 PID 464 wrote to memory of 4504 464 msedge.exe 84 PID 464 wrote to memory of 4504 464 msedge.exe 84 PID 464 wrote to memory of 4504 464 msedge.exe 84 PID 464 wrote to memory of 4504 464 msedge.exe 84 PID 464 wrote to memory of 4504 464 msedge.exe 84 PID 464 wrote to memory of 4504 464 msedge.exe 84 PID 464 wrote to memory of 4504 464 msedge.exe 84 PID 464 wrote to memory of 4504 464 msedge.exe 84 PID 464 wrote to memory of 4504 464 msedge.exe 84 PID 464 wrote to memory of 4504 464 msedge.exe 84 PID 464 wrote to memory of 4504 464 msedge.exe 84 PID 464 wrote to memory of 4504 464 msedge.exe 84 PID 464 wrote to memory of 4504 464 msedge.exe 84 PID 464 wrote to memory of 4504 464 msedge.exe 84 PID 464 wrote to memory of 4504 464 msedge.exe 84 PID 464 wrote to memory of 4504 464 msedge.exe 84 PID 464 wrote to memory of 4504 464 msedge.exe 84 PID 464 wrote to memory of 4504 464 msedge.exe 84 PID 464 wrote to memory of 4504 464 msedge.exe 84 PID 464 wrote to memory of 4504 464 msedge.exe 84 PID 464 wrote to memory of 4504 464 msedge.exe 84 PID 464 wrote to memory of 1396 464 msedge.exe 85 PID 464 wrote to memory of 1396 464 msedge.exe 85 PID 464 wrote to memory of 1576 464 msedge.exe 86 PID 464 wrote to memory of 1576 464 msedge.exe 86 PID 464 wrote to memory of 1576 464 msedge.exe 86 PID 464 wrote to memory of 1576 464 msedge.exe 86 PID 464 wrote to memory of 1576 464 msedge.exe 86 PID 464 wrote to memory of 1576 464 msedge.exe 86 PID 464 wrote to memory of 1576 464 msedge.exe 86 PID 464 wrote to memory of 1576 464 msedge.exe 86 PID 464 wrote to memory of 1576 464 msedge.exe 86 PID 464 wrote to memory of 1576 464 msedge.exe 86 PID 464 wrote to memory of 1576 464 msedge.exe 86 PID 464 wrote to memory of 1576 464 msedge.exe 86 PID 464 wrote to memory of 1576 464 msedge.exe 86 PID 464 wrote to memory of 1576 464 msedge.exe 86 PID 464 wrote to memory of 1576 464 msedge.exe 86 PID 464 wrote to memory of 1576 464 msedge.exe 86 PID 464 wrote to memory of 1576 464 msedge.exe 86 PID 464 wrote to memory of 1576 464 msedge.exe 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\Malware-1-master\MEMZ-Clean.exe"C:\Users\Admin\AppData\Local\Temp\Malware-1-master\MEMZ-Clean.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1224 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=how+to+create+your+own+ransomware2⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:464 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x124,0x128,0x12c,0x100,0x130,0x7ffff55846f8,0x7ffff5584708,0x7ffff55847183⤵PID:4144
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2228,5290569270336411842,225726899868864640,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2236 /prefetch:23⤵PID:4504
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2228,5290569270336411842,225726899868864640,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2288 /prefetch:33⤵
- Suspicious behavior: EnumeratesProcesses
PID:1396
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2228,5290569270336411842,225726899868864640,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2844 /prefetch:83⤵PID:1576
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,5290569270336411842,225726899868864640,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3400 /prefetch:13⤵PID:8
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,5290569270336411842,225726899868864640,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3520 /prefetch:13⤵PID:380
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,5290569270336411842,225726899868864640,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5296 /prefetch:13⤵PID:5064
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,5290569270336411842,225726899868864640,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3516 /prefetch:13⤵PID:3800
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2228,5290569270336411842,225726899868864640,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5828 /prefetch:83⤵PID:3468
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings3⤵
- Drops file in Program Files directory
PID:1748 -
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x248,0x24c,0x250,0x224,0x254,0x7ff684295460,0x7ff684295470,0x7ff6842954804⤵PID:4872
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2228,5290569270336411842,225726899868864640,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5828 /prefetch:83⤵
- Suspicious behavior: EnumeratesProcesses
PID:4324
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,5290569270336411842,225726899868864640,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3548 /prefetch:13⤵PID:1128
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,5290569270336411842,225726899868864640,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3564 /prefetch:13⤵PID:1816
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,5290569270336411842,225726899868864640,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4660 /prefetch:13⤵PID:3272
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,5290569270336411842,225726899868864640,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4800 /prefetch:13⤵PID:4032
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,5290569270336411842,225726899868864640,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:13⤵PID:2508
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,5290569270336411842,225726899868864640,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6048 /prefetch:13⤵PID:1008
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,5290569270336411842,225726899868864640,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3056 /prefetch:13⤵PID:3648
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,5290569270336411842,225726899868864640,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4844 /prefetch:13⤵PID:5056
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2228,5290569270336411842,225726899868864640,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4824 /prefetch:23⤵
- Suspicious behavior: EnumeratesProcesses
PID:3004
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,5290569270336411842,225726899868864640,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5224 /prefetch:13⤵PID:5052
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,5290569270336411842,225726899868864640,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6076 /prefetch:13⤵PID:3888
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,5290569270336411842,225726899868864640,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4988 /prefetch:13⤵PID:4136
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,5290569270336411842,225726899868864640,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6484 /prefetch:13⤵PID:2604
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,5290569270336411842,225726899868864640,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6024 /prefetch:13⤵PID:1552
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,5290569270336411842,225726899868864640,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6712 /prefetch:13⤵PID:2876
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,5290569270336411842,225726899868864640,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:13⤵PID:3100
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,5290569270336411842,225726899868864640,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6608 /prefetch:13⤵PID:4428
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,5290569270336411842,225726899868864640,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3876 /prefetch:13⤵PID:3772
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,5290569270336411842,225726899868864640,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6572 /prefetch:13⤵PID:3880
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,5290569270336411842,225726899868864640,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1748 /prefetch:13⤵PID:864
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,5290569270336411842,225726899868864640,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7300 /prefetch:13⤵PID:1528
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,5290569270336411842,225726899868864640,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6076 /prefetch:13⤵PID:5608
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,5290569270336411842,225726899868864640,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7204 /prefetch:13⤵PID:5712
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,5290569270336411842,225726899868864640,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7652 /prefetch:13⤵PID:5336
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,5290569270336411842,225726899868864640,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6580 /prefetch:13⤵PID:5416
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,5290569270336411842,225726899868864640,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1264 /prefetch:13⤵PID:3496
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,5290569270336411842,225726899868864640,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7700 /prefetch:13⤵PID:6092
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,5290569270336411842,225726899868864640,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7940 /prefetch:13⤵PID:3908
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,5290569270336411842,225726899868864640,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7776 /prefetch:13⤵PID:4560
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,5290569270336411842,225726899868864640,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7352 /prefetch:13⤵PID:2956
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,5290569270336411842,225726899868864640,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7396 /prefetch:13⤵PID:5976
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,5290569270336411842,225726899868864640,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7776 /prefetch:13⤵PID:6060
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,5290569270336411842,225726899868864640,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8348 /prefetch:13⤵PID:4812
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,5290569270336411842,225726899868864640,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8096 /prefetch:13⤵PID:1804
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,5290569270336411842,225726899868864640,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8208 /prefetch:13⤵PID:5800
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,5290569270336411842,225726899868864640,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8900 /prefetch:13⤵PID:4008
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,5290569270336411842,225726899868864640,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6628 /prefetch:13⤵PID:2800
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,5290569270336411842,225726899868864640,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8208 /prefetch:13⤵PID:6728
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,5290569270336411842,225726899868864640,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9164 /prefetch:13⤵PID:6836
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,5290569270336411842,225726899868864640,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9320 /prefetch:13⤵PID:6384
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,5290569270336411842,225726899868864640,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9476 /prefetch:13⤵PID:6476
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,5290569270336411842,225726899868864640,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9056 /prefetch:13⤵PID:7160
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,5290569270336411842,225726899868864640,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9052 /prefetch:13⤵PID:6244
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,5290569270336411842,225726899868864640,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9496 /prefetch:13⤵PID:6736
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,5290569270336411842,225726899868864640,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8588 /prefetch:13⤵PID:6964
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,5290569270336411842,225726899868864640,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=55 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9188 /prefetch:13⤵PID:7056
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,5290569270336411842,225726899868864640,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=56 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8500 /prefetch:13⤵PID:396
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,5290569270336411842,225726899868864640,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=57 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8036 /prefetch:13⤵PID:6532
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,5290569270336411842,225726899868864640,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=58 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9072 /prefetch:13⤵PID:6972
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,5290569270336411842,225726899868864640,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=59 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8632 /prefetch:13⤵PID:7068
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,5290569270336411842,225726899868864640,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=60 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9968 /prefetch:13⤵PID:6968
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,5290569270336411842,225726899868864640,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=61 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9588 /prefetch:13⤵PID:1680
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,5290569270336411842,225726899868864640,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=62 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9332 /prefetch:13⤵PID:5724
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,5290569270336411842,225726899868864640,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=63 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10052 /prefetch:13⤵PID:6620
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,5290569270336411842,225726899868864640,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=64 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9124 /prefetch:13⤵PID:2484
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,5290569270336411842,225726899868864640,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=65 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8644 /prefetch:13⤵PID:6056
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,5290569270336411842,225726899868864640,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=66 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10200 /prefetch:13⤵PID:5848
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,5290569270336411842,225726899868864640,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=67 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9816 /prefetch:13⤵PID:7572
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,5290569270336411842,225726899868864640,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=68 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10196 /prefetch:13⤵PID:7664
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,5290569270336411842,225726899868864640,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=69 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10200 /prefetch:13⤵PID:7964
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,5290569270336411842,225726899868864640,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=70 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10780 /prefetch:13⤵PID:2728
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,5290569270336411842,225726899868864640,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=71 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10528 /prefetch:13⤵PID:7316
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,5290569270336411842,225726899868864640,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=72 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=11016 /prefetch:13⤵PID:7836
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,5290569270336411842,225726899868864640,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=73 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=11032 /prefetch:13⤵PID:5904
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,5290569270336411842,225726899868864640,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=74 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10896 /prefetch:13⤵PID:8072
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,5290569270336411842,225726899868864640,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=75 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10536 /prefetch:13⤵PID:8120
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,5290569270336411842,225726899868864640,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=76 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10796 /prefetch:13⤵PID:7372
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,5290569270336411842,225726899868864640,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=77 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10516 /prefetch:13⤵PID:7936
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,5290569270336411842,225726899868864640,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=78 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=11032 /prefetch:13⤵PID:8120
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,5290569270336411842,225726899868864640,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=79 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=11408 /prefetch:13⤵PID:7916
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,5290569270336411842,225726899868864640,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=80 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=11660 /prefetch:13⤵PID:8680
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,5290569270336411842,225726899868864640,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=81 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=11684 /prefetch:13⤵PID:8792
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,5290569270336411842,225726899868864640,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=82 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=11416 /prefetch:13⤵PID:8228
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,5290569270336411842,225726899868864640,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=83 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=11504 /prefetch:13⤵PID:8264
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,5290569270336411842,225726899868864640,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=84 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=11288 /prefetch:13⤵PID:8996
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,5290569270336411842,225726899868864640,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=85 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=11968 /prefetch:13⤵PID:9144
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,5290569270336411842,225726899868864640,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=86 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=11820 /prefetch:13⤵PID:8620
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,5290569270336411842,225726899868864640,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=87 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=12176 /prefetch:13⤵PID:7340
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,5290569270336411842,225726899868864640,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=88 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=11472 /prefetch:13⤵PID:8792
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,5290569270336411842,225726899868864640,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=89 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=12408 /prefetch:13⤵PID:1988
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,5290569270336411842,225726899868864640,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=90 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=12740 /prefetch:13⤵PID:6268
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,5290569270336411842,225726899868864640,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=91 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=11344 /prefetch:13⤵PID:8556
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,5290569270336411842,225726899868864640,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=92 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=12804 /prefetch:13⤵PID:6576
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,5290569270336411842,225726899868864640,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=93 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=12424 /prefetch:13⤵PID:7932
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,5290569270336411842,225726899868864640,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=94 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=12880 /prefetch:13⤵PID:6600
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,5290569270336411842,225726899868864640,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=95 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=12628 /prefetch:13⤵PID:7584
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,5290569270336411842,225726899868864640,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=96 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=12468 /prefetch:13⤵PID:7200
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,5290569270336411842,225726899868864640,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=97 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=13104 /prefetch:13⤵PID:1020
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,5290569270336411842,225726899868864640,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=98 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=13032 /prefetch:13⤵PID:7940
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,5290569270336411842,225726899868864640,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=99 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=13300 /prefetch:13⤵PID:9292
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,5290569270336411842,225726899868864640,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=100 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=13064 /prefetch:13⤵PID:10084
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,5290569270336411842,225726899868864640,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=101 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=13160 /prefetch:13⤵PID:10196
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,5290569270336411842,225726899868864640,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=102 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=13408 /prefetch:13⤵PID:9680
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,5290569270336411842,225726899868864640,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=103 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=11700 /prefetch:13⤵PID:8880
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,5290569270336411842,225726899868864640,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=104 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=13576 /prefetch:13⤵PID:9492
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,5290569270336411842,225726899868864640,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=105 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=14024 /prefetch:13⤵PID:9740
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,5290569270336411842,225726899868864640,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=106 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=13984 /prefetch:13⤵PID:9988
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,5290569270336411842,225726899868864640,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=107 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=14428 /prefetch:13⤵PID:9900
-
-
-
C:\Windows\SysWOW64\mmc.exe"C:\Windows\System32\mmc.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1304 -
C:\Windows\system32\mmc.exe"C:\Windows\system32\mmc.exe"3⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1328
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=how+2+remove+a+virus2⤵PID:1916
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffff55846f8,0x7ffff5584708,0x7ffff55847183⤵PID:2144
-
-
-
C:\Windows\SysWOW64\regedit.exe"C:\Windows\System32\regedit.exe"2⤵
- System Location Discovery: System Language Discovery
- Runs regedit.exe
PID:756
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=vinesauce+meme+collection2⤵PID:3596
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffff55846f8,0x7ffff5584708,0x7ffff55847183⤵PID:2012
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=skrillex+scay+onster+an+nice+sprites+midi2⤵PID:2964
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffff55846f8,0x7ffff5584708,0x7ffff55847183⤵PID:3264
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=is+illuminati+real2⤵PID:1864
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffff55846f8,0x7ffff5584708,0x7ffff55847183⤵PID:772
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=john+cena+midi+legit+not+converted2⤵PID:1676
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffff55846f8,0x7ffff5584708,0x7ffff55847183⤵PID:3024
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=how+to+create+your+own+ransomware2⤵PID:3108
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x128,0x12c,0x130,0x90,0x134,0x7ffff55846f8,0x7ffff5584708,0x7ffff55847183⤵PID:2584
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=half+life+3+release+date2⤵PID:916
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffff55846f8,0x7ffff5584708,0x7ffff55847183⤵PID:544
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=internet+explorer+is+the+best+browser2⤵PID:1324
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffff55846f8,0x7ffff5584708,0x7ffff55847183⤵PID:1852
-
-
-
C:\Windows\SysWOW64\Taskmgr.exe"C:\Windows\System32\Taskmgr.exe"2⤵
- System Location Discovery: System Language Discovery
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3384
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=dank+memz2⤵PID:5540
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffff55846f8,0x7ffff5584708,0x7ffff55847183⤵PID:5556
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=how+to+create+your+own+ransomware2⤵PID:5260
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffff55846f8,0x7ffff5584708,0x7ffff55847183⤵PID:5272
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe"2⤵
- System Location Discovery: System Language Discovery
PID:5212
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=batch+virus+download2⤵PID:4204
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffff55846f8,0x7ffff5584708,0x7ffff55847183⤵PID:1812
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=how+to+send+a+virus+to+my+friend2⤵PID:5824
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffff55846f8,0x7ffff5584708,0x7ffff55847183⤵PID:3464
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=how+2+remove+a+virus2⤵PID:5528
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x12c,0x130,0x134,0x128,0x104,0x7ffff55846f8,0x7ffff5584708,0x7ffff55847183⤵PID:860
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=montage+parody+making+program+20162⤵PID:5568
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffff55846f8,0x7ffff5584708,0x7ffff55847183⤵PID:6040
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://softonic.com/2⤵PID:5932
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffff55846f8,0x7ffff5584708,0x7ffff55847183⤵PID:232
-
-
-
C:\Windows\SysWOW64\calc.exe"C:\Windows\System32\calc.exe"2⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:4048 -
C:\Windows\SysWOW64\win32calc.exe"C:\Windows\System32\win32calc.exe"3⤵
- System Location Discovery: System Language Discovery
PID:1592
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=batch+virus+download2⤵PID:2324
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x12c,0x130,0x134,0x108,0x138,0x7ffff55846f8,0x7ffff5584708,0x7ffff55847183⤵PID:6132
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=g3t+r3kt2⤵PID:6660
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffff55846f8,0x7ffff5584708,0x7ffff55847183⤵PID:6676
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=is+illuminati+real2⤵PID:6316
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffff55846f8,0x7ffff5584708,0x7ffff55847183⤵PID:6328
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://answers.microsoft.com/en-us/protect/forum/protect_other-protect_scanning/memz-malwarevirus-trojan-completely-destroying/268bc1c2-39f4-42f8-90c2-597a673b6b452⤵PID:7104
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffff55846f8,0x7ffff5584708,0x7ffff55847183⤵PID:3336
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=mcafee+vs+norton2⤵PID:7028
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffff55846f8,0x7ffff5584708,0x7ffff55847183⤵PID:2868
-
-
-
C:\Windows\SysWOW64\control.exe"C:\Windows\System32\control.exe"2⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:7008
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=how+to+download+memz2⤵PID:6628
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x12c,0x130,0x134,0x108,0x138,0x7ffff55846f8,0x7ffff5584708,0x7ffff55847183⤵PID:1672
-
-
-
C:\Windows\SysWOW64\explorer.exe"C:\Windows\System32\explorer.exe"2⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:4656
-
-
C:\Windows\SysWOW64\mmc.exe"C:\Windows\System32\mmc.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:6624 -
C:\Windows\system32\mmc.exe"C:\Windows\system32\mmc.exe"3⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious behavior: SetClipboardViewer
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:5060
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=how+to+get+money2⤵PID:6220
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffff55846f8,0x7ffff5584708,0x7ffff55847183⤵PID:6440
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=my+computer+is+doing+weird+things+wtf+is+happenin+plz+halp2⤵PID:5008
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffff55846f8,0x7ffff5584708,0x7ffff55847183⤵PID:5476
-
-
-
C:\Windows\SysWOW64\mspaint.exe"C:\Windows\System32\mspaint.exe"2⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:6568
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://softonic.com/2⤵PID:7500
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x12c,0x130,0x134,0x108,0x138,0x7ffff55846f8,0x7ffff5584708,0x7ffff55847183⤵PID:7524
-
-
-
C:\Windows\SysWOW64\mmc.exe"C:\Windows\System32\mmc.exe"2⤵
- System Location Discovery: System Language Discovery
PID:7708 -
C:\Windows\system32\mmc.exe"C:\Windows\system32\mmc.exe"3⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious behavior: SetClipboardViewer
- Suspicious use of AdjustPrivilegeToken
PID:7736
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=stanky+danky+maymays2⤵PID:7212
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x104,0x12c,0x130,0x110,0x134,0x7ffff55846f8,0x7ffff5584708,0x7ffff55847183⤵PID:6784
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://softonic.com/2⤵PID:7580
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffff55846f8,0x7ffff5584708,0x7ffff55847183⤵PID:7332
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=my+computer+is+doing+weird+things+wtf+is+happenin+plz+halp2⤵PID:7476
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x104,0x12c,0x130,0x128,0x134,0x7ffff55846f8,0x7ffff5584708,0x7ffff55847183⤵PID:7704
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=how+to+get+money2⤵PID:6232
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x10c,0x110,0x104,0x108,0x134,0x7ffff55846f8,0x7ffff5584708,0x7ffff55847183⤵PID:2008
-
-
-
C:\Windows\SysWOW64\Taskmgr.exe"C:\Windows\System32\Taskmgr.exe"2⤵
- System Location Discovery: System Language Discovery
PID:6952
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=internet+explorer+is+the+best+browser2⤵PID:2484
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffff55846f8,0x7ffff5584708,0x7ffff55847183⤵PID:7744
-
-
-
C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe"C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe"2⤵
- System Location Discovery: System Language Discovery
PID:7140 -
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122883⤵PID:4828
-
-
-
C:\Windows\SysWOW64\mmc.exe"C:\Windows\system32\mmc.exe" "C:\Windows\System32\devmgmt.msc"2⤵
- System Location Discovery: System Language Discovery
PID:7240 -
C:\Windows\system32\mmc.exe"C:\Windows\System32\devmgmt.msc" "C:\Windows\System32\devmgmt.msc"3⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious behavior: SetClipboardViewer
- Suspicious use of AdjustPrivilegeToken
PID:1620
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=how+to+download+memz2⤵PID:8616
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x12c,0x130,0x134,0x128,0x104,0x7ffff55846f8,0x7ffff5584708,0x7ffff55847183⤵PID:8628
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://softonic.com/2⤵PID:2780
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffff55846f8,0x7ffff5584708,0x7ffff55847183⤵PID:4804
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=vinesauce+meme+collection2⤵PID:8832
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x130,0x134,0x138,0x10c,0x13c,0x7ffff55846f8,0x7ffff5584708,0x7ffff55847183⤵PID:8940
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=is+illuminati+real2⤵PID:5252
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffff55846f8,0x7ffff5584708,0x7ffff55847183⤵PID:6552
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=how+2+remove+a+virus2⤵PID:7460
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x110,0x12c,0x130,0x104,0x134,0x7ffff55846f8,0x7ffff5584708,0x7ffff55847183⤵PID:8852
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=dank+memz2⤵PID:4476
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x108,0x12c,0x130,0xd4,0x134,0x7ffff55846f8,0x7ffff5584708,0x7ffff55847183⤵PID:8480
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=best+way+to+kill+yourself2⤵PID:2168
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffff55846f8,0x7ffff5584708,0x7ffff55847183⤵PID:1988
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=how+to+remove+memz+trojan+virus2⤵PID:8568
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffff55846f8,0x7ffff5584708,0x7ffff55847183⤵PID:5036
-
-
-
C:\Windows\SysWOW64\calc.exe"C:\Windows\System32\calc.exe"2⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:8368 -
C:\Windows\SysWOW64\win32calc.exe"C:\Windows\System32\win32calc.exe"3⤵
- System Location Discovery: System Language Discovery
PID:7672
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=how+to+remove+memz+trojan+virus2⤵PID:5960
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffff55846f8,0x7ffff5584708,0x7ffff55847183⤵PID:9000
-
-
-
C:\Windows\SysWOW64\mspaint.exe"C:\Windows\System32\mspaint.exe"2⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:7444
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe"2⤵
- System Location Discovery: System Language Discovery
PID:8352
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=half+life+3+release+date2⤵PID:7152
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffff55846f8,0x7ffff5584708,0x7ffff55847183⤵PID:8448
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=virus.exe2⤵PID:10020
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffff55846f8,0x7ffff5584708,0x7ffff55847183⤵PID:10036
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=stanky+danky+maymays2⤵PID:9576
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffff55846f8,0x7ffff5584708,0x7ffff55847183⤵PID:9616
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://motherboard.vice.com/read/watch-this-malware-turn-a-computer-into-a-digital-hellscape2⤵PID:9340
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffff55846f8,0x7ffff5584708,0x7ffff55847183⤵PID:8456
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=dank+memz2⤵PID:9344
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffff55846f8,0x7ffff5584708,0x7ffff55847183⤵PID:9508
-
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x47c 0x2fc1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2820
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1584
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:920
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{5BD95610-9434-43C2-886C-57852CC8A120} -Embedding1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of AdjustPrivilegeToken
PID:5092
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}1⤵
- System Location Discovery: System Language Discovery
PID:6152
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService1⤵PID:5484
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc1⤵PID:3764
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:9488
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD550a139aba944ca85ab4a0c154b01bc63
SHA1e5b50e94fbafe168b3ece75fd6b750565c54f5df
SHA2562653e90df1430a4f72648a6244c4477cdad72b6cdf600915ff6901239d3ff470
SHA512cb041355dec7d56f1e1d3461aeba3ff54ab02bfb5249920e7cfcf669a4ccf72b66c0126abf867059c2886f0b2d0ca8764aff65a97e610b6ef33ef94b992333ea
-
Filesize
152B
MD58b16630717cf81f638bae67ab57f5e76
SHA15767a40e7011584c074743df3ddca48d05c833aa
SHA256687f4722fac01dbddcee3ad0b9bb4c5483d21a83538b049818fb3ea9f2b52cfd
SHA5123718b25f887b0112db461060ee647ad4240bad91d82816e48659e15b9f1c94b4a637665ac258b025fdb6b3ae0349bc26802e4b6d8215846ebc01777ed5a6f771
-
Filesize
152B
MD51ab523be0df47b9c44c0863d39e9402e
SHA1a41f981235db6719a25988be3f650f0dd44c5803
SHA25665223a518625d4525c42fa0a46e7bc62cfbc9f4eed6570a7c10f639ccbb907ac
SHA512865d0e948b80b911c029f4782d31bed455d6ae405823db137fe5582674f556312db9182f04417f876a4c04326183d97759abe5b114230a939417c9fe87449e6c
-
Filesize
215KB
MD5d474ec7f8d58a66420b6daa0893a4874
SHA14314642571493ba983748556d0e76ec6704da211
SHA256553a19b6f44f125d9594c02231e4217e9d74d92b7065dc996d92f1e53f6bcb69
SHA512344062d1be40db095abb7392b047b16f33ea3043158690cf66a2fa554aa2db79c4aa68de1308f1eddf6b9140b9ac5de70aad960b4e8e8b91f105213c4aace348
-
Filesize
134KB
MD5aa48b2482ba58e373c693ecc957b87b3
SHA15c6d03179fb8b5e79f5a8a814f4eed1e9e72f203
SHA256052e4f1a779c49739510609a95ff393bf7de46f7dd75a20615a14ebb23000113
SHA51203233c601c4e9d923eb34115e8e6d57a8cb195fb911903bc14b14efb2f73afa2a6ba5307cd89d589dba1fadf2d1f75e6a92bc4e76133ac2b9d0586bbd88e8ae6
-
Filesize
16KB
MD568c477c4c76baab3a8d1ef6a55aa986f
SHA14af50379e13514558dd53d123db8ea101ec5e24c
SHA2560364d368abf457d4e70dbc7a7a360f3486eaea2837b194915b23d4398bee91ac
SHA51292b34fe3b7f82f10cf6de8027ac08f4a5b8764fb4e0b31c93da6e3d5bd08e0bc83b79fd70b8207a1066b689583e0b6976fa3c885b0c067ea343e6f2031d55d25
-
Filesize
43KB
MD5dafca83f1009b6bf0cece80d01816dd3
SHA193f8bb99ceb70306cb2d94abed0edbd2b459f577
SHA2567169799a3263667b4b25df2a36aafb5204e13e09649f0d18a41cb9830c5f48d6
SHA512c51a91ce6d9fb9aa9832fbf4169cf8b3fdbd158aead27d4f9bd0c2e23940b1195e922aff68fa921d86f0375aac21da19561f3e2ae00c8b137f95f1ee43da2414
-
Filesize
20KB
MD535e7f38567cf6977e6a2b77a4ef0de0b
SHA141b3b8a8bbb1b888f695e62bc464561094bb6b22
SHA256efec2e67bd876ac3b00b4fb6c93c5f09f1487f5651aa74196e2de529c9975e40
SHA512cb8042f83335a16c66765ede6b8bcd13add0c27710d74bada2f0aac91ccf4ad120931439e421449c5deaf9517431db78f0ccbcd94e28317723052d512f772e53
-
Filesize
151KB
MD51531735841266d57348b135beb768070
SHA1d0efafb4bfeec12f2668a49611d3aaa553989c99
SHA256af74aaa313797d506fd97d6c5cf327e5e7e1b6fe1fe7763e381bc0cbdefa6c59
SHA5127a33ccd321e3f7fd0c967d7280e280df29ee0955b4eb6a18ccc8944c04061d3ef31eebbef36598b8f0d09822981842076105732d26116cceee18180aa43a5240
-
Filesize
139KB
MD5d70f41ed0825c97f04c3b962a8e7e2e2
SHA1d2ae04955c2113b54aaa7b7e9a14aea57d8a6086
SHA2564845c654ff7e9cb944a921779e30e7269d98b13e4e09939c6319d9f870f3602e
SHA512f0b0ace43659df2c6c88004bc5f7f815afaf743813e2a1fc2902da95497a8f7ff4ddd2ff90c7d40e2112b65c5b9c0c3ea4dbebbc2eabde1924c8406082497eed
-
Filesize
126KB
MD538a5f9fd757908df0fd8a7a7d3a16aa8
SHA111fbe85d055d0519aef1bad6661706e55bf2ce9d
SHA256562d42348e686e4c3917870daf9edfd25141534eb1feb69453578a3e570fbb36
SHA512b34b91bdd043586c47da60f0d1379e7889681eee968608cfb5a6d0eab59def18597e0383e5f14405b8bda5f14c11223c9f12355e6a03dd71e0fdc5a420dd852b
-
Filesize
59KB
MD5092ca1efe85d1dc05606cfe797a0653e
SHA1403d9ace1e084388a3cbb04c471fc7e570a7c340
SHA256fcd3a5c5c55564741a2c1cf70e9ea866d477fe3f67b47c5b5a93a64403778e5c
SHA512e53bc67d03c7e435954cdc93548e6702d3982a47fbdc31ef472f1b9195174f89b8c83682b2b0f56e054191af8b3a26402ba09bf6d8fcdac1e60efbfe2bde7391
-
Filesize
415KB
MD503395da3c95810915e550aaf2d919db3
SHA1e69c8a7a2cf11a068a2c54b54bddecdbe879ce3c
SHA256f1453cde7c6cef3225d345d253a5fb4b6f4f09c9725ee7554113703541c68067
SHA51229a0d90518f912f526220309495f917ca69d85ab4b0fed3d195eb7b024ebacb3737100aa82a61d6032e4c8fd160e5dfbb2ef6a5f58fc358174096f55527c7812
-
Filesize
19KB
MD5db96864ba1f334544678995753cc6bbb
SHA1a3d3fa39e79d3cacee02c82ec5b280891610d820
SHA2569e647a689ed4ee312b1fc4ef34ec0380ca12035751acf820c4c5945b9098ce2e
SHA512119f16026511c6d39b0bf58934e69a46f2094f5008958f2c141333f6c0ffea39fef4d887e6045bbf60cc9d0702c354ab857c9ed034736bbcebf748b56683ecf2
-
Filesize
288B
MD51083996eeab1da4b1c7e4d5bc4414eef
SHA122ecf29215e9f2e10c79e271ac5f2d0bcbe81d36
SHA256395c212eee570cc70fa60bb9ee90c7fde6158ec018f61f5d49d3fbc7087bfc4a
SHA512e3b5dd9823efe87350849abedcc780e55b405758acbaa189d5e8aee89265685f60a4629d457d0cf17e571a327f87009004a07f7b8e3bfbc84dfd654c4b310ebc
-
Filesize
168B
MD54daa8485098f5df0675f8bb779452bb6
SHA174a691b5a2c1c7eae5a8fdbd2addea6736543bee
SHA2565aaed6530ead28476d23f14dd2647f70ae110b5ca661191d398efbd7254dbf92
SHA512866e5572b22f342658ae3f98902479dee3410f3fb00c2ac789785f06648c8f2104d91ff9b3c3b66ea678204444a81e452a0be3ece6dd3aa27cc18aa8dbe4b4a1
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize168B
MD53e88debf9cd5412f879b331a8eb6b7bf
SHA13c4c750ca79167544342704311cce1206b39d950
SHA256b387f27f4d6ecca15fba111318695af9d42155cad9091a4502f8b3d7a02bde00
SHA512640a515fee380026bb8aed21aaae6fa064b6d5f02e2f86e9806cc81544cbec56781a6f407c945ad1b950a72e229020bd58941ccba24a9152729f46e8bfdb6f6e
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize168B
MD5adae3f0a5443159be75a0af6af39f86b
SHA187cda7c248b3f56953b50fdb61d6b766c2de552d
SHA256cf63c2d8734545aa3c712c7e5b7c0ece5210503a9218976aa988ffd8185bb13d
SHA512c8d2cc850a769631149ba873831efc91aff5c2bf5f9356971e7579c05e5092016445dca8908651daed557fba31657b96cd3f6fd19edbe608a53dbe21c41a0bfe
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize168B
MD5228f85861bac2d128620fa42c7976d44
SHA102b0eb3321b6cf563342ed10d0d88b09a2a62a3e
SHA256525dc06c83a2e1af71672fb460b8aecafbab239e1373df4f35f8254467f89ae1
SHA5120de834b0c4c5d746cdb27dfe7d18ebd39baabf1c152528e86ffaa24c3c0a96ab0b07be6a498f39982284ddfc47e7b63c4424cc01fe5f8e9f4a8b8905627c0e48
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize816B
MD5cc0d9135f35dcb1c3e31edff2f8a2b0c
SHA15d232215a00d4a5dd3fb71547c2adfaaa5a8e9ee
SHA256eedd681161f19d3968139fcce46888764a20d3c3f9e045f072b580b255db7634
SHA51260a6ca8ae81832be9742f132802966aad116f33ec69e3f2ffc70bd3293b891472c8cf62453baca22213d8d742114b6a7c8260c095c2a25534dd85c84891ce40f
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize960B
MD51154ffe09d36662914187ead2f7d7ae1
SHA1ff54c46318a371814bda967148bb1db05e6966b7
SHA2566d935234845091073f13c295f2e11e675978a715939f7dc0a6561ad1d5db88e0
SHA5129197325989f51a4430a6ef4afa9da7d3457f2582d4049f93dfaae02a79e7feeb293379b65ecf1b5738c1e2d1e4e0569478aa485e6b90033d6025990efafdf894
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize168B
MD5c21b402b219b09f9c07603a2be22b97c
SHA1512a7b0c93940e86557d8d5b3866827e4dbced8f
SHA256f9ae1bf97a37f529c69c1b37455e9ee6761d5acff4edd80dca977d097039a73e
SHA512abc978bce951312e9aa915ee833f748b8ee247cb77f298fdf8daae950bce2c42d029bb42f373526a458ea1ea6c51d58379d4d8390167197f555991632f5a35a5
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize816B
MD5a6a71b99fad0ca1f4acc04bf70c50671
SHA1e665f5633fdadb338a18ddcc5e6624fc73a98f00
SHA2567453be9e7a2c69a9530c1b894960cee6060155c598aba0921af8a323dd18cf3b
SHA5127df4cd564134e5c12f79ba56c9b8ed9bf227edf860a8b2607f01485344a02db419de5a1bf1d8b3d79b4112d05c028e0bfa287612acc8caf4860db4521a1f8cc7
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize144B
MD5624bd72790e9f9442660069bcaa9d7b4
SHA1f94f0ce594a9190acc7a5b3670915bf1550cd6a3
SHA25686683d733020b7a837f8000a3b96daee1013dbb2d8beca8fac054943d27e4869
SHA512956659596a1db2d13dc9e55d9d6b8ed9036dfa70dbc60f40633159ac5bee04f7b12f8e410596fcbab21f23b826f4e6d6323104b824b3d5d36dfcdce34357a74d
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize360B
MD5b52ee78dc8e5747f7f7a145181a4a249
SHA16a4c1b0649f08d27a66de6f9463db02f52c95fdf
SHA25616bd63063d9fdef2bd8c5e97b0ef11f29a7dadb2fc50014e1ba88c6a905cc86e
SHA51296cc7c7ab68b0aab0f90fd0b3f19464176ce17ed117a01f5a03887bb41da8a38fb4c8b959898ace79ffc7bf1dc7202e49cc7bb3390a9899e36ea9a63a14be8d9
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize168B
MD53f960893a7d448bdac1bae85bc0d6c48
SHA1c0438364f936abf513dc78aec23ddfa8841fc73e
SHA2562b9fe25060aa1c58165e19d1f0bdfdbe8b62810ea882fb771ecdbc414b27e353
SHA512458503c3de3e692d7802df9d1e12c32382e608f9481ad57fdbb5ec96ff5e8bcfa9dff13b54b0565de01c77ec90c79a00d8ee17d5a28a55895fbc5b5c5623b0c3
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize168B
MD53bc70212efe69dbcdb04e201591594f8
SHA123c18958548e30cc9438304430f5b1e45d144de6
SHA2562295cac4689841813e1fdce531e8382134129c580bce1812b333ffe520188d20
SHA5128e63a240f458ddfad2d476eef15db84e8c035ef8303835dba874c9a7c13c66daf3c3d7151f8ed309ed299a2f89cafeef92c030e1504d49a876f4ba9361affbf3
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize960B
MD5bdc877557327501beaff7feef57e265f
SHA11d2cd3bd12eb0c8fafaa389a98807ba0eb6efc2d
SHA256101990d13bbe846fcde175a6505a0720e3eea93f6858cdd93dedc8b088431564
SHA512b36f4b7d7ced3bf8ebbe63831b8a45884496d57a63d2338ef7636daac44f9c59970095bed04e0bfb6634aa5e5179f58d88f583c7b1938419d6fe59b210d188fc
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize960B
MD5c1eccdc5f8a91fab5d4ebf0793af6483
SHA19e1c87f61cd6c837b71f18ae189af35be5c4043f
SHA2560845a8b1ac85f990c1070fba41d437095919a34c7e47552b726df24c9b9ad243
SHA512a775a2a6479cfb74084aa21ee6b3bd58e934b318ad65ac0edff1288ae5595befe395a2de7f4e1a2321a3d62b419fd1e0b31aafa65075465b41de44de1829371e
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize960B
MD5e2a0c387db83fa988cd27cc86f28ca73
SHA15cc3c721a5224657755ebebfc21592d4823d2a2b
SHA256d3d443117d1b45153020d3a168adb51fdb927140aab157f7b23c032a6a165b9e
SHA512a0e4c8889f56740107f1a1cce27c424e0d275dc3dd7f9a7da05473b38990af5aad67001be6d7b37530c248a9268be761090fab308a401e5d3ae0683d17743de5
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize168B
MD55964c38d0a231528fd85369186e001f7
SHA1668045a66ebb77012c638d78f1a8608094784f9b
SHA25656444d4b46f490e50f69167713bb41342ae11eb62aeee7210f13e9d36b447dfe
SHA5129a3ee12aef676db17f86103d96aa89782c428cd0fe7fa78c4234d04e7c9e8d76cbb873ac21413a1f43c800df44d026f26161899cfe3a7d9f01f942388d78fd69
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize816B
MD58c8e78734a488cd2fa3f4595b6414bdb
SHA1489d9b70d37a8f8f75118d94aaa234e21ea0f2c8
SHA2567d60899bb99ce0964590c6c49791fc1205274af27344a69956bf949fa98b17f7
SHA512dce97d498ac30c46f5f8f828fe6d8861ebcdfc5e7757eec4c17f465c2120efa890b6c4fb14d55bc4fc7b22ffd35496d47a3a2966a53334513f46080f1c7ac6d4
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe587cad.TMP
Filesize48B
MD50b9d94b80410858a822f8c49d7f7d98c
SHA195c0b406656a4a72bf2abc660fa64dec367ac9cf
SHA256c1b91001b316775c9f4ed8ef60a7b43b0fbb52e0cf3fb18297450f3c7b320a29
SHA512a946501a0865c48b4e4345aa46bcb3e979cc073708cc0cb6b20ca0ab19410356e3c5c458ab4ee452a770ff5e333205f2b011ffeaad980e0c8a40f6b23abf7a80
-
Filesize
70KB
MD5e5e3377341056643b0494b6842c0b544
SHA1d53fd8e256ec9d5cef8ef5387872e544a2df9108
SHA256e23040951e464b53b84b11c3466bbd4707a009018819f9ad2a79d1b0b309bc25
SHA51283f09e48d009a5cf83fa9aa8f28187f7f4202c84e2d0d6e5806c468f4a24b2478b73077381d2a21c89aa64884df3c56e8dc94eb4ad2d6a8085ac2feb1e26c2ef
-
Filesize
815B
MD564ec4dcca5b8bdd329b53e1c6e38f9ee
SHA161f964edeb4f7c9fb55e21c7e08fad57ae46861a
SHA256018c4bff4d5dbf73b738662b0461c2467574296839b03c194550a664ba353c92
SHA5127666c0a5499d530127e22504c79aaa5e10f4d7a68a718cfc9365467dca35d75b15d53782429fd79c9dd3a1b457ee8353465c343d3766f68e98f048c6aea160a1
-
Filesize
4KB
MD5d0e9c36b7044924c14a4ce592ecd7a90
SHA1df72e1019e60b3a31f893620544092e58cdf7c17
SHA2569beaa37b52af68f7e7204afb11b32953489d7f8622e41f3aa8f2689f1969f1eb
SHA5127e5c964a50f168d475ae70a3664afbf2352a11cd528e8fd126523c45f3973c6f0454ba825adfa7968ad3ca0d9f6ada82c91cd94eb9159b56495aed34197725b6
-
Filesize
815B
MD54e1619e9d1af2064dc3cd45b95891b3b
SHA134e2b6acd427fd5109f2b1038b7247a4f48cacc6
SHA25600522eb870081faa6a1ccbf4b2bbfa15d71fff5259b8e6a2c0faa558d2dbba2b
SHA512a6f54ef826f90cfbce8008a011ee366e2225ae620f8e7449df9243784efed7810f1305cbaf407cfef625b834499a8cb5827728f12d644a347f8a80008e0fa51f
-
Filesize
2KB
MD5512321b9341aea365ff0f201fea513ac
SHA16ebfe9bd34b1f0bc35d3edd2a59fe99715d76dc3
SHA2567497b07f9ae1f45899ad2c9dafca91367ddf5818ca46a802d1b9276108fd2a60
SHA512feb581885b4524dca8997650a35b6304ad1863adbe0efd88525f09c299e48dae234bdb9898353b46fdc68783e599216d143ae98e4c32ed4f28500e878713f2c2
-
Filesize
815B
MD5dd6392465d2401e7b5380021f5256b90
SHA19edb4e2618d26e276c3eeada6944b37f49b22ab5
SHA256766352c62a5e0aaa20a8d31d8ff42383150e7a64531c59c69ed435aedae956f4
SHA5121acf08705378b7c2e7fdc60b1b0ed46e0f747c3a017bf2eda980ca5da04b84483d1d3b1245611a15a6a7ce4b4530e26f48379e3d4c46fd704fc1f1cb4dd0560c
-
Filesize
4KB
MD5edaddc689c0a26d87c1e2a82d4a81b73
SHA1308eb1f36984c0628ecde140863df1accd00dfd4
SHA256e298cbeb719b58c51cc9b8e9fb1deeb2180b93d4c96c542d17831d7d65b3c664
SHA51277170b58d9f0821a0f2b13b2a471c01e210e959927731c4358907a0167863ad05a321d6d1ba6506c84b04cb0bc193be8aac315f97b001ecfe6b991bd852a777b
-
Filesize
4KB
MD55dbb9009f052b721ea1aebe84e4d0d0b
SHA1333fdb0186f22fc886844f1d2b2133717bfbde69
SHA256c0423e6de2814f19b1c0bc420fef6b5eb4523b24f0f9b16d3721e74712d513f5
SHA5123e6a72d930b2b8136c0e0b6c5c98a92f39c0d5f6d39f0d3d71914c53e18c4f09e7dfc0bd05edbd830d8c534b5dbadb0d7f3412e4b6032404fd7cb22e63ac4e8d
-
Filesize
3KB
MD58af71608966fb5d6022ae16d87b51e49
SHA1300ae07d0c225f198d29af7f76ab3c040a7f8f22
SHA256656ec22881ba7e69ea262ee6c989279f316b077be6d507f05adf0e0925f8bc8b
SHA5120756cf1d03f57473841dd14784268ca72dc52a1d5e47380e5773bccb611a4b005af584a68009aa89f0d0a369e9932903be763ebcbc4b35545521a4914cb7ec17
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State~RFe593acd.TMP
Filesize59B
MD52800881c775077e1c4b6e06bf4676de4
SHA12873631068c8b3b9495638c865915be822442c8b
SHA256226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
SHA512e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
-
Filesize
5KB
MD5e484f444d5f1942afe42fca1ab84fcb3
SHA11096e145104d205c088ad2f7cb3511da78c8f61f
SHA2561747314ab9c1d07af97bf2e11f5d334443171d9d6b6f11ce7d8bd2cecaf9128d
SHA5122828b189ffd7c1166bac8e72a814917646b77df22d7f27992fda174a9e62148209648eca4def52a3e6a2186d98a16d921dc497259dbf5420fd91e52c1e702c0a
-
Filesize
5KB
MD5a3917db425b16732d3f1525601950f6a
SHA1654907da41c3a65bcc6c3c4d5febcf06e47a5f1f
SHA2561651b0b2fe39d40068d359bf2b53b653fac741f6e5c58f463f701dd64a4d97a6
SHA5123d5ad844191d1d8781f4d1af58e485d9e53b02671e80a621a96bc8bdeae6b9db9138de3fbd45ea2c18c433c61d77d964532f8e2baf5514d12bf1bc937e418d99
-
Filesize
6KB
MD54a670026f3e1c023b982a89f016926ff
SHA14ec0e8d462e5eb87688e768992d6ee2b02a9a4db
SHA2561e12dff8032a3c3a06168932432efd0edebee84fd308df46899adbb53c5d3107
SHA512d2bfecc6ec9bac832b21b9e097c766ec14b5d53ffafe19380cb61e44c8cdabf5b68b8fe5250aacb80f014c7ffd2e8c8130fca0d48dc1568ab6f9caa2bde58f1c
-
Filesize
7KB
MD562f83cf3099310270c0d2f194cb1b709
SHA1b3b7cd541204599d9948dfe6b98aed4ff90ec5c4
SHA256b58ce09a2c8f392d6e55f3f113171e1e5012ab63a15fad8b2a145bdf5fc1d088
SHA5126975b2aaba297b0e4a8ea45bdfca0a41a6796cdcf49033ec83688fa85b20174384579d7b8f9c1d61c3922f8c43c65f3b9092dc4db148b0031e1e2b9ac67bd5da
-
Filesize
8KB
MD54ad1eab44f428b6d47fd542999550948
SHA1817b8cfd7d4d9135d86d40536433488490bc9852
SHA25663eb309cc4fb047ef4ba4bb8894ff1ed9cd392f5d2acc9f3bf3429940ac6b064
SHA5124c59ecb4b81a0e189811eae753dfec3e06568741bc34f4e6966813bb50faaed5a0e58b9331312262b3e164ab9391cad1ed0fe8bb377b61bdb9a065b37da7f92c
-
Filesize
6KB
MD5c0a9d020c46652083414b46f5d26ff55
SHA1688d35f5432964051404367aef7d9ec9ebddd4a0
SHA2561a192dfa0b960c9908f1261fe1ad5c08a65e90c6434423a1b4d80281c1317bc6
SHA51239fe98338d062e681e8679b6ce73fcc26e39037787f94ca8cfe3c982a2b8145d1320343aa2d6793742b70787e5c56826d5de6fa9757e79495e7c09482c4130a0
-
Filesize
6KB
MD547988fcef920a62210ffb3c09cb8acf3
SHA1c5e6298ebb9d5429ee5e87dd4a9e5a4eab7092f6
SHA256ae5ae8508ea7f03a4f692687c9ddc1440d42c7a86dc3d30929ece7b4bb14d561
SHA5126e32f22e0e66c4cad4adb10a77c80896787178c66b4cf6300462d1278be13b88acedce2bd569741a5d8a65cd0c0ddfb82a41e840cc8006c9ff6a7a34bd9d2de3
-
Filesize
6KB
MD58c2432607c8dd92a14f9e03f9509a10d
SHA12a9f8013048fcf45935991890429ad8f601eb103
SHA25686d4055ef2c5b1dae464bf34aa30cfeea2f4533e20c5619df8ecc8aa73b8d879
SHA5126c690f8b44b41b89b6cc0b93f23a277755bca08b2bead50da3293d05c28fccb845e701fc611766901d73039ff43dd132a335edb5b986ad70e4ba96018f67f0b0
-
Filesize
6KB
MD5949af1c28d4bcdf8223d8f411dadba7b
SHA11b55cd745908e6a0eb83e9c4383330e4852428b8
SHA2569914a5af8fcbae269e9922048367e09ae95e359c384037f2d5d78416a5715c3f
SHA512ecb672bf5f94fcb493ddb97bb79699750dce19dee173e782ab5411cdcc2cb579259fb5b296c2ab2900da35ea7d37b1a59a9dd5d307922b402f33e43af7bde1a0
-
Filesize
7KB
MD51a0558790710ec60b88ec7819b3c3610
SHA1be1f5cea14abfcca334316a05e218d1f272ddc92
SHA256ab3991ad3e1d1084a7c6589b5d1373a392c835bba1145ed23508e1ee4fdbb888
SHA5123af636afc48175cc3b4fa4f1b67d120f2183295753cae371f6101701be697ebf861f152666b23f46dd437e38e3646f8bff410192a111a572877054e141d41782
-
Filesize
8KB
MD5b90afa31b0d593c7233f775dea322d03
SHA1fa9fd314073be134a571867f51d31ec3397ca01f
SHA256296207c425acf6bf619876c03196f73329e08be075c10012526b76d60814c444
SHA5127a892d5a101b590d6546b0d79cd622760e5361f87639adc127354da9a27639a04ce37f63317603727f8da5d00aad833b52c17199a840a11225443b751e7250c5
-
Filesize
8KB
MD52d33bb09e940ff77c9efb7c92412c990
SHA16efcd7844d65813a8ef2f8516b69d086e0b07312
SHA25609a3a98fd64be111abb656f1569b40eb7b4d7b897ec40ddd490a32aa1f88e5a1
SHA5121366ab7acf8ed13bd270f4314d0c38bb9f4cd1bc527af62ac6a82ffb3a69a8fe443e4236c8f7893192ec16ffcd743c06b28a06de75df9e34e20319fb8addabd7
-
Filesize
11KB
MD51005e70ea365d241fad22ae792cca989
SHA1e2315547723c33923a7d961e7871027b5a0bb748
SHA2562be640b254633f198ad2ac3477b0748522a3cba062beaf83252e2155f8f128ed
SHA5120da4aa13f1d90d205bff80bfd7584dd8b58abf6a116dee5506e227e42cbc1510050a311e05a26b270bfa6e07a93d9c478204074da0c5cb81dc4c5451c583fcee
-
Filesize
8KB
MD5818bcbf53a03337832a63928afc0ad35
SHA1d56a449e9f5e70754a012a66800414a60450fb2f
SHA256ec0aff9985109675de55fe0cd4caf5be6fff89f62d6332da5eb2a17cceb7cb9a
SHA51271486f7167fb52906a64fdc4a9dfaa2ea6b3befe299a167f95b96a2aa87c642170a93f44b3636ef40b4dc8421ed42967e8226693745ad17be13e4f2be37ee0b1
-
Filesize
7KB
MD50bc6d8e2d1e27244e774cb7661f13666
SHA12550814e7ab70957cd462263b2c508fff6a3074b
SHA256e2affdfdc39b0e5622fde81dc13f0cfb57a4087d9191771270e74a1eee6e25da
SHA5124f5fb0585081d38eb27158e16dbcb25f9474c891a0e2418eb01897b01d2cd7cfce1e1573fe987f937117932e29c70eab2512037bc5c97cbe30930ac615959fd5
-
Filesize
8KB
MD593f2caedc6fd0a5c6b6e00145c3d2a27
SHA1dcccfa214ccbab9949b7a73d81c38bf69e8be836
SHA2562fad8ce315660132a972f8e6eb10d365185900cc9b5393a3d9d16b53ef4abae8
SHA512a5e134131a2372f5fe18a51f9061b07dc1998ec5d04b90915dfffdd7333d541d8a34fd80457b16fc2a858aa94a086246c70bc0365661b09f5b1b9e48bafc1094
-
Filesize
8KB
MD55be7524b5eb33305fbb5fd0dde8945b6
SHA114e044fa5011b7d9b8808bfec447e20a5ed844f0
SHA2567f0e7cc2e3593b36bc2029deeb2b4b357f3542dee09190c26b3961f57daa95ef
SHA5129ae473ec7ece982ff27f148d651cde776608aa0ed4af7ed12db0cdaca210a4174f28cb2a28d9987469dab6947e874f271c6cb7cecbaa469b7962d8d73587d31a
-
Filesize
8KB
MD5bbd4c418af8511ff28b242b41af92e2c
SHA1bd27617b1bd48b8e7f3b03ec44e08060bed961f0
SHA2560fba6379a8f84e6d92649c46ce1dbe25c0e0a8d90830c02a1e4a40eef051e71f
SHA512d0cbd820994e3b987f45c67b2b285a070cbfa40636f0f6becfbfb733f3086e6a860fd621e1f25a76df0fe7a4b8b461c3ca5dfe17534b0c86c6bc55d10d634f9f
-
Filesize
8KB
MD588d76890bcf0fa05de5b59c9e4c98806
SHA19c2a9fea91def1a4eab24689791cf27cfe3d8e6f
SHA25607d1d10a104c79c119f56998b7789e5e5e220d7798b90c4bdefe49927cb48551
SHA5127426584f3040670bae48125685f68dc63db3bfc45ab05be8e8d3834be91c90d578da9c96adfdc49c4f24d33d9a4311aca7b3e879f43610d960f851683fa7a92d
-
Filesize
8KB
MD5b71a81236de5be0471085fc49dc0a8d3
SHA1e7d8195e00825194fa2db53bbbc4dca278244f07
SHA256300a2e07cdb2df2ba4ea728bd78b596148648ca0739bc7bf2e9dba3a2d4d976b
SHA512c52d41f82d0bb7a91b056ea615c4eed65fdc34da849d6c0dbcbc91d5c1e1f8e86243f83405e143101968d6745bfd41e078a085dd629ecc582e2e0375294ef830
-
Filesize
6KB
MD5bc5267e75705aa6dcf1f7125039f9f30
SHA1084de9e4857f824072b6c4ce1301cdde8e0353a4
SHA2564eb2f512081e84b614594622da214a6658d71498911c2167bfa56c7d9ff52450
SHA512975feb2c8d3b6a261308be85a3f11cc588112debd1052a57117aecc431521e255e15365dea5343c888930a3dcd8e7bf7c61d5b1052277e673091d798e6ff0589
-
Filesize
6KB
MD5740aedb253f68333f7f681673d340bfb
SHA184277c540fbe660bc410ab64eb90b004c9c292a0
SHA256b963ffda88011926b295ddd52a33a590e932b42af292462711debe2fef17ff0b
SHA512ba47a50655077ba837ffd624088a11b43117df258f6e942045aa6f672cc4dd51747781552151ca3a8d803092cf11ca50db81ff98403bb4be1bab6a0fc26268e7
-
Filesize
7KB
MD58b49b69135b5cfc97dd0aeaa6f36fa5c
SHA1aa36d1680670a3bba3d16c74395461aae093e238
SHA256f65b1f9a8d20f6bdc7b6857effc27704b8c546d993d20b62bc09095ddd84cd34
SHA51290ce7007d2d8d9c142687546a8861a5e48b668bbd11a42abb71c75e11c32bf0979126a8baacfeeb5582282fc18f7196109060910ceef3d6965ecb943a192c150
-
Filesize
7KB
MD5e6a9ce1882aaaa4d1ea2a030e3ec854d
SHA1ee659a8cd2a3408703410562be1ffe9e8b8770bc
SHA256fef06b5e4555124fc0b2031c88212f5726087c768987c15db85c6ea90ae159ae
SHA5129abb271d42f4e2070a78eeea7ce48700058f64aa81c041765342d59df2d58aff5e10da5a773feaaba1eeb157304cc7d73c2e43907310c12ca4cc0daec4c1efb0
-
Filesize
7KB
MD585e98f297e82ac0eb3527797d7fd1252
SHA1a966a0e4b867e5a9d2a1b6f013b4efb27d2b56cb
SHA25681fe4e7857672b1b48bb108ef29a23dcfc9ab1aae9a68d7759c74c320ff2de06
SHA512ae5f742e8de914c9fa863607f9950675060c1c8c61aec573be00802709f4d7fa6f437fc96db80d8286844ad3b6bdf60773f202b98cebd970718749daaace9ef2
-
Filesize
8KB
MD58bc20c6dfdbac3d5a328f092f5c7d541
SHA1b080dbe0965dc97cb698a6d1fe29234b070ef11c
SHA256acebd33d2dd4ec5aba81528979bfd0e536af694352511467c330c4e7590d405c
SHA51296f94c979d2891d762ff43d2a1c8cd895ca2470867dc159530503242d39674ba56738381864d6c7b640c675ffae99edfb5afdb40714a28e87246312604a77bec
-
Filesize
8KB
MD5b0a81dd7cd8c3b4b92a4a29a54cbccfc
SHA1d2697b71c3d8558315652b2a6e20d7548427170c
SHA25637aa48c4f3b56bb9da85ce94dae0a7fec0e7d5ec4999dcde38ee45396fad55c6
SHA512df01ebb70bce69a0c97183d49e6542f187ea06b162ffd4d88ce77434e71652937dd4cde90a8688c27a89280a0d39470c6026ebc790fe29fc49921f0132688575
-
Filesize
6KB
MD5cf6dc4240c536e472b3f0f465987bad2
SHA1767126cc4afc6c351220a019b280bd8ca92226eb
SHA256aa54289f9374885d470618c5e19d791b90bbdd02fcb816840c8f5627e29233aa
SHA512334866536784ddec5c9dfa630c7eb93ecb4e2951f0465cdfb76f2288960bf3b817ece9b350086ba49483c2632e8cb7002a3f3163cd747bc4481c0ca3508f3927
-
Filesize
6KB
MD5e4bf964717deac911bfd48ad586d38f6
SHA1e865bf1e3d94e6582f869a8ca42321fef1d9898b
SHA2569d34eb537a79e3d072d1678915f6c68f24a7585cec7afcaa29039def64fb72f9
SHA512cab69059590912a049824222867afe7f0dca7dc849d18f30dc501cb258c2a5adf1bb94e89b20d87b1fbee8adb581fac9dfa392f63d4b6c260ba58aa6bb3fd1be
-
Filesize
6KB
MD543bbffa3b65e758f02553a525f3f6be5
SHA1c0aac59dcd4cf1de1ecd028370dbb4acf84421ce
SHA2566186faef996c54ab3efdf07ce7988fc03bd2a3f1ae2b12416b4c6d974bba0e6a
SHA512cdaaac91cffb0d48f11ba3cd8ed1f0ccae762b2e24f5d100c84fccfdf8797a8de28a256dd5fe60b5122f51cf4839fa68fe072162e33eda171e4bd35a0610593a
-
Filesize
6KB
MD5057e77267bcab7080e481bec39ec62d4
SHA1e49f0dbdf3402f91669eab1134271fcdfc6b34f4
SHA256b5cfd21b93f4a63d9bb12e55984d98d6f0449a634347164f563e533d49069fd6
SHA512eb35f0d5aa98cbac245e344c41825a7010b96273d5ff21760b5f239d85cd144345febca483b1beb72626afed5487602f5321513ab3892837a6fbda1f302ffd43
-
Filesize
7KB
MD5251171a8eb45ef5b9cadd40139c4a702
SHA1d780163a56595bed64793b243aa7ccb96d51d3fe
SHA25608b9b0eaa652672894ebab059e567a427f37f720d58c3430bc0086d16dd1768d
SHA512256f96f7b81e9c2913715319cc7db282a64732de7b30e8c76dfee23a1337efd9d851526d44fe5744bc1d631414856973ebf81e7cac22075efd3c25305d7e24db
-
Filesize
7KB
MD5f97d98d30937fc469bdd8df142f05ad7
SHA148fbffbc26704ae239450026f1a9fedf0f23ffd5
SHA256d31b84ba7fd6c2cbf6b15d909eb85b2dbf959bdf0e13950045c53adc908dcb89
SHA512166994924c3c36614ae05bfa974a8fd44284678a19842935146c6f7399fc27733e08d14cd5f6839f274be4c7d90bf32da6c059d83b2d879fe13c2fb01f1f15f2
-
Filesize
8KB
MD59e37cf640f8105d7c52e21c8d7520582
SHA13945a8b8de30c547450b7676c4a17556dd692a42
SHA256d33af6d88f8195a00a68c6df4ba6b7f1c2b91c4fc91128469f964c8675e315c9
SHA512ab82d165f8d2cb966014f790fd14b1b235b5b98c5355d3c55a2c23386bb228fdc1fab879ecb14cea513faddb248aa2289bd42e33a7ce33574636a9662b739ea2
-
Filesize
8KB
MD56758b27d521d779e259916214d1d9b26
SHA1553c492b8dda4bb6db5a9e0e33d9f6498aa29693
SHA2565b84cf6c94531d0721691a4f6ce5b776db42f47edc60a43f3ddc6c7de8be53ad
SHA5128cfe6159c321a55932d09144b1b37ec40ae245a2437071f5e6f778722df9aab84a7ccba7b689538ad862d987e16428c2445a8050d2366b0a82f40a41abaca1dc
-
Filesize
7KB
MD5cbcb9e4f3bc241750377c05ee69e5a0f
SHA1b9b1cf277096c7abcfedc5a77b785ac30d60d3e4
SHA256f0719b2afd4d381665773b84c7c4d3f0103d565b8d6ea00f98a89faa25e61fe5
SHA51294e58d71032df5dfa0ad08a257ef7743faf30adef8352bbe33cd695e540b61165eb578087d964446e67e5dd4d0128d40fe998980cb7de8fd4c4f07f486947e33
-
Filesize
6KB
MD5973eca3804b19d1314607355078b1fee
SHA11078847dad82c2d425d7a0c0a6b99ad77fb0fc6e
SHA2569f62679c1d945769a8026631bb1dbf6033de97e73df4d4b3240d57f0f14e5119
SHA51251f037b3a0aa8801f9dd7e7540b6b19a61567da6becb822327779498caa1cb31d1e9b29b32004524bb065a3fc68f916a289f3fbd1a71bfc81df3d7bb711f8225
-
Filesize
6KB
MD56bac961a56249257d33743f00a1b6dbf
SHA1683745ee1eba2e99950b4d026e96c8dcbbb8096d
SHA25693db8629738c56a86764f8775a66fa95856dfe346b1b8015a9ef116d7fe5c1c9
SHA512a97cbc37d2166650d2585fe5f2053518ada03411b9719760aebc10c7d65f5a13fa211a318437831d94e04669a886a83984e7c02628fc601f45eceff8c22cdefb
-
Filesize
8KB
MD5d58ab8c28382f1dfbb56a057156c7d1b
SHA17c519d7bf6a4789b8051450a140e1707e0e856de
SHA2563160f6f536d264860d048956f708ac21a4e9cd6fd30c5a2130a73f86f2097c8f
SHA5122084c31f464fb676ebfcbabdd8be8905acd15266d70a9e5fe2f0eebf74ac351ed0c1a6228077f39d5bb175e9b78ab255dc6eefee7a4f4e405f978356a560314a
-
Filesize
6KB
MD546eb0b8b206e5af22a7e585522383f34
SHA17291314058537b43c64810999f6cef3d2a833c9c
SHA256df855875b4c530f75f77845f7b760218585890c24a076c8b7576ea06a22f4b9e
SHA512c168f4d6855e089f54237361118fc7332810c716e7c69fb58bb3fbb83f2ebf9e53e3f019eb4b6a5e302dbcf5ca33da5b25190c6b6affa523f1d2b5f0c63ebfee
-
Filesize
6KB
MD5b88f8b0cffdbf4f2760fd837c7ab0235
SHA1802b66e4c54cb7f336110561fc03710e3e7fbbae
SHA25618b59b196c6c5b82a7d35aa0e585f73b682c094b821bb97286ecf3b97869ac78
SHA5127f7c73a678e3799b2c4385eaafb44c86b70cf88dfb697f4b42d37a99b5838958beb1c829add244f8bdf81920a051acbf17865750a04681509598e171029ae189
-
Filesize
8KB
MD5098098ff83f1fe647f7b8b41ab2ccb2c
SHA15ef15fd2c600b9e5b1b1b3bd5ab0db458cb83d9f
SHA25645ecfafd161d34f65892ec69119ab6a788413209cae72b0e942d92c66feeb28f
SHA512b642d2433cc68d9c53b5bbd8375a1ff768865ff711ff57e2e36f0bb4d105e8d36b4a23a5bf8ef6957f4a533e76cea7fa012dd0e0084f2a23f887dbc1ab1edba5
-
Filesize
8KB
MD5594e0c86380a56ee7dcd4506b14add6e
SHA12a31708294be8f7229ddbefbba6ada81e1978235
SHA2560f68e084f022014507f98488ee0875bf6921841c1e922f53ddca0c20b1570b73
SHA512cf3bb5779452698e9858ef2fb336c3de06c3e178d137454153b3a70b04f34d7d97436a53b1a7d58b9fbf71bbd653b5ff26272dc7dcbb8620c69e5dd54d18de30
-
Filesize
24KB
MD5d590b705436b349074c9730516c56716
SHA1545dae2c594f8dd63eebc19fabd55900b7a001cd
SHA256da4e0974a427913f72174b1fa4fc560396d987ed41ed691409916cb42d914413
SHA512e11e7aa45fe3b931bbdf7956379dc61f845e19a087eac8e5ebe4783c5ca3d2a602016271e8f1ea4bd2ef9dacca444b93f1fcab0373921246e2ed7350f48cb9d3
-
Filesize
24KB
MD599315c72c0078122aea1e2e0e41a26e8
SHA11d04494fd6fd5bc394405c02e23f8df323394d4a
SHA2562dcf01b803332137a3a4925f7fc2878c3c6b8be4be77ef359e7f658811446b97
SHA5127a5404b86f6b5cdddcc12fb9c0f23f4264049ae784faf0be2ff16277eddc09759bcd4f62a6652c87f956255de49f12b12c32dbb5dd228cb99574a963c26ab605
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Filesize26B
MD52892eee3e20e19a9ba77be6913508a54
SHA17c4ef82faa28393c739c517d706ac6919a8ffc49
SHA2564f110831bb434c728a6895190323d159df6d531be8c4bb7109864eeb7c989ff2
SHA512b13a336db33299ab3405e13811e3ed9e5a18542e5d835f2b7130a6ff4c22f74272002fc43e7d9f94ac3aa6a4d53518f87f25d90c29e0d286b6470667ea9336ae
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt~RFe654283.TMP
Filesize90B
MD575ea20a068245a7f5fdd43bf024ead91
SHA1651ed592bd35d6f9c7450a20285ff03d37617366
SHA256b67c117877fc60a252b2e9c1727d13d5d412f150d791181eefbbf8fb3d471798
SHA51245ad9b6f5177b06317a66d7809a53b929803cdbb72e46ec58f664a37118be90834eff14203686a827f49f71e34b01deb16d3a077d61dd0089d5d0287c4138394
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Filesize72B
MD5beea4ec9c19e7a9f5e938ce3d3e9485c
SHA132b805381bae1c130a81a098f40a222d9a7dfb00
SHA256473f4fad9114ce10e04b5d8744007aa5fc5fb762ca15205a9bff7604a9953e35
SHA51203bc3886a38bc7655c12263617726cbd69cc4fc469eeeb7acfa632dd3777e0d90138fea98f3a084cc25967a67eb672a49b64b05fe7580268c02f5034b02defa7
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe618193.TMP
Filesize48B
MD503547571a96423b409a601d1a7fe8964
SHA161538ee050a2ec2a169ba32bed3a40cfa2b35881
SHA25647c8ffc0e054f7fe95a5f8fb1efbd74d1d07df9444038259e06a74547ab4aefa
SHA5126b8c2eeb57095419c71bebd465c857bf95cca93b0e08bb9b823f953558376d2355ea0c330be214bc2a6a62e0ab3fe59a2348ab1f6f1dfc543400504722904be8
-
Filesize
2KB
MD5ef47333c60be57e45e14a73bd290b3ca
SHA16fa67dda42273272cb2b3d0df202bf144bab824d
SHA256bc0da5110ef49478e755033fcad5be36a78afa27efd141e98eab071910eeb8d8
SHA512e14f1d57a5971b58c55710bfcef9521940dc30d24cdaf9c480e510623368fa2fd632a5e028c781bf42048c643bb27f74942ad78c3f9281af27fa32232066c0dc
-
Filesize
2KB
MD575190bc174ed8c1570b18a751c57e341
SHA1bf4ce3210295850b83a90c055a9074d602bd6b24
SHA256d974205ea5f83bb556cd8e8a9620078f2fd4b44cc1064b7c7ad6c4f6dea99125
SHA5127a3a89768ece8aae7f9574d20672b28b6ab80e8986b346f932df1ac81ab7108c5448947acadf19fe2ffd648a350cf0e227a7ed1e35288d7aa7493597544122ab
-
Filesize
2KB
MD5ac95298e2a43486588ee49a1dd817fed
SHA1c3001c45585446c595f6d6689c7a6de025389561
SHA256fef393f9652ae73a9755d50bea2d933a0f4e348c89b99e24484c338fa7d621f9
SHA5122cdb513cdeef341efdf72c32128782209cf9f68cd99efebb06fa2f77a276b55b41c31748edeea72d9cd5238cbb3dfc6c6382e8a809294e3d70a93e0905705779
-
Filesize
2KB
MD5cfe397d2a9f69ff798a7a10a8399a89d
SHA11a8215f88145dd29a98bbfd26ce6505b99eb1d41
SHA256efd61ac94443b7b9f628aaded03eaf7f67a4833030acc076899c1a08dc791e33
SHA512319d27623dbb15b1d373613f8a884bd3179d049bafb2ffc2297690334ee348961dcfa69a8075a21753ef8bc640731ffa845248dc3510bcf2b942cfeb1b9ef68a
-
Filesize
2KB
MD54597848bbc16663d6ce174dde07f78d4
SHA1b09642ec87525b527e8f9cf1ae6d6ed2e18f2733
SHA256c6ba0c16b3e89fb686c1aeef256c5e6f7d86a2f0744f1a96bf5c3f0ed976f0ac
SHA512e441110b4be28ea7f394fd0abe985cc937ead08707d50aaa67103479d9026fe7ab03abd61ad92020acc8e476873f16bbf8e5f3308217fd0641ea4eb798c09bba
-
Filesize
3KB
MD5c3d89ac32e9298180b4035a2ba6f2574
SHA1a52603c0ad18f31be116f51a7b94f6316ac55afe
SHA2567751ba093dc814d2e56c902c0301776fc69353cb0ae76851353d888008eaa831
SHA5120dec5e39dd7ccfa34f1bc95d861cb28cc7e1fb502de35fbe20138a540806fc0659e1a29280deac54f1607fd5ea01705ed25271cec441894c46f88a6d9ff04033
-
Filesize
2KB
MD51b2c947474b94a1fe2928dbff80cff23
SHA17dde9073abead89cbbab969e97e7814e31f9fe6f
SHA256a39caf194b75af50bf2a6add2360ed5c322983c41667d36ced0d537181d18066
SHA512dc029d273aeb28859e1de1f1872d9e99f5895e8fe611abf3aeb19a30e65268038d4e2943b732abbf437d2f05d6219e732280657dded36a3606f243366c715b96
-
Filesize
1KB
MD5e75a5ff2d91bacc98cd87f38987cb6d6
SHA1642cd02b96b719fe923fa5c1ff03fea67614cec6
SHA256303256b78ee968524615d96ea1746905e019a0e6c64542860ff4c9ae943fcd6c
SHA512c5afe2e7ef637de3a914c9a1234442c1a551e000694321e5670f69ec78171b0d33b06c3a5dec5a1e4e527481da85740edc98872e724ac576256d3fb1eec88998
-
Filesize
16B
MD5206702161f94c5cd39fadd03f4014d98
SHA1bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA2561005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA5120af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
-
Filesize
41B
MD55af87dfd673ba2115e2fcf5cfdb727ab
SHA1d5b5bbf396dc291274584ef71f444f420b6056f1
SHA256f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
SHA512de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
-
Filesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
Filesize
8KB
MD5a870a3bc11d960a76e2b1a93519f962a
SHA1f87d211c6aab7c93d678a0328d18030e096fd9f1
SHA256fd98258814613ffbff69c288acbc4230081ff1a80915b326923d7ed53669d11c
SHA512262959856370f7d95463ce3c7a1292c2ac6ce9b37dd6ac53155449821aa4f4a5ff44061fd3580c4edfa42750c20e35b15316918bff8ad43457d2d5182f88e3d2
-
Filesize
11KB
MD57fa493425740fed2b3a4dfcb3c1553a5
SHA12ad24a12ac025ee16614e4e4503445ff2785d1ab
SHA256d9277f9b3176a98b907aa4fe66855c910e445dbd67a7d25eb4298cdc1fd94bd0
SHA51265359403c23725994d8b69bbcc710001e8ccfe038e6808eac236ac0dd7d5a49a4466f1be708db4b4bdcf0ec9a4048e58c6760b46bd2df9f6e527ea3c952d748f
-
Filesize
11KB
MD52de50664082f5dd11a9892a69fe34cef
SHA13b306042ba3fc19b715dc00c78430bd99fd1c15c
SHA256ef37735aa711d96d8d28d55b9b0176c0ffe3dc9dfa672d7189b326802794d0bd
SHA5129958bb2b9525cce22fa58823b1cc9d7666b04a749b246235425d327f8278664bd740d76df43e102c06e26513945ac32f842601e63e3819c72b74a822f2c311b2
-
Filesize
11KB
MD5f7dcf86776e81ceeca1022d2a7e37eab
SHA173d1b80ca4c211a81c17055ff17586330060f7fa
SHA256747a7c2214e06cdf41fb7da6f366367e4db775c96ab15dfeade64b5d5261f107
SHA51243d7ea87ac64d6560440db196830f0f0d36ce75d8f59b1a72b797624ddebb498ad082658edd8b66b0f5b9748e9e0bd2e7e7bc7a693d37c0d8289861c977d6efd
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms
Filesize3KB
MD572176ecb7cbc673181a0565dfeeae927
SHA1d8672c6915e53877f97b72e410f1048a8a2da247
SHA2564b762512bed95867ee225917c31a3bf53f628a7e2d865afb8a0e39cfb8191637
SHA51209ed5eada8f80d2f4f5fe8353d3e4dcf2dd74c063ec9e0682b26c1d2adf565f24d52f17397313bb38652022dd63461d4d755bb97326959cef3ded9072057c489
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms
Filesize3KB
MD5461cb0f074099afad0987d0da101a896
SHA1ec7d3b4174cd1ed5b56133a5389d3e188dd791f7
SHA2561029524c739e7f73a67a55ae198e308786ab83c0bb9d2411750219d4516f8d2a
SHA5128056f5316746bc023627ba0a6d5961c04027a9463959a89e999df0b3ae07ab51b0d14aa0a0b5970b78581de2054298d43681c70c9e5835fdd37e3c00c1379183