Overview
overview
10Static
static
10Malware-1-...30.exe
windows7-x64
10Malware-1-...30.exe
windows10-2004-x64
10Malware-1-...40.exe
windows7-x64
10Malware-1-...40.exe
windows10-2004-x64
8Malware-1-...32.exe
windows7-x64
10Malware-1-...32.exe
windows10-2004-x64
10Malware-1-.../5.exe
windows7-x64
10Malware-1-.../5.exe
windows10-2004-x64
10Malware-1-...91.exe
windows7-x64
5Malware-1-...91.exe
windows10-2004-x64
10Malware-1-...ey.exe
windows7-x64
7Malware-1-...ey.exe
windows10-2004-x64
8Malware-1-...ad.exe
windows7-x64
6Malware-1-...ad.exe
windows10-2004-x64
8Malware-1-...ti.exe
windows7-x64
5Malware-1-...ti.exe
windows10-2004-x64
8Malware-1-...an.bat
windows7-x64
7Malware-1-...an.bat
windows10-2004-x64
8Malware-1-...an.exe
windows7-x64
3Malware-1-...an.exe
windows10-2004-x64
8Malware-1-...ve.bat
windows7-x64
7Malware-1-...ve.bat
windows10-2004-x64
8Malware-1-...ve.exe
windows7-x64
6Malware-1-...ve.exe
windows10-2004-x64
8Malware-1-...ya.exe
windows7-x64
6Malware-1-...ya.exe
windows10-2004-x64
Malware-1-...re.exe
windows7-x64
10Malware-1-...re.exe
windows10-2004-x64
10Malware-1-...ry.exe
windows7-x64
10Malware-1-...ry.exe
windows10-2004-x64
10Malware-1-...ck.exe
windows7-x64
3Malware-1-...ck.exe
windows10-2004-x64
8Resubmissions
13-02-2025 01:26
250213-btppra1pcz 1017-01-2025 20:14
250117-yz7h3s1qfw 1017-01-2025 20:12
250117-yy9l2sslcr 1017-01-2025 17:25
250117-vy9p9sxpez 1017-01-2025 17:21
250117-vw8eesyjfp 1017-01-2025 14:16
250117-rk9ass1rhk 1017-01-2025 14:12
250117-rhv1ds1lds 1016-01-2025 12:52
250116-p4et7a1mez 10Analysis
-
max time kernel
900s -
max time network
900s -
platform
windows10-2004_x64 -
resource
win10v2004-20250207-en -
resource tags
arch:x64arch:x86image:win10v2004-20250207-enlocale:en-usos:windows10-2004-x64system -
submitted
13-02-2025 01:26
Behavioral task
behavioral1
Sample
Malware-1-master/2530.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
Malware-1-master/2530.exe
Resource
win10v2004-20250211-en
Behavioral task
behavioral3
Sample
Malware-1-master/2887140.exe
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
Malware-1-master/2887140.exe
Resource
win10v2004-20250207-en
Behavioral task
behavioral5
Sample
Malware-1-master/32.exe
Resource
win7-20241010-en
Behavioral task
behavioral6
Sample
Malware-1-master/32.exe
Resource
win10v2004-20250211-en
Behavioral task
behavioral7
Sample
Malware-1-master/5.exe
Resource
win7-20240903-en
Behavioral task
behavioral8
Sample
Malware-1-master/5.exe
Resource
win10v2004-20250211-en
Behavioral task
behavioral9
Sample
Malware-1-master/96591.exe
Resource
win7-20240903-en
Behavioral task
behavioral10
Sample
Malware-1-master/96591.exe
Resource
win10v2004-20250207-en
Behavioral task
behavioral11
Sample
Malware-1-master/Amadey.exe
Resource
win7-20241023-en
Behavioral task
behavioral12
Sample
Malware-1-master/Amadey.exe
Resource
win10v2004-20250211-en
Behavioral task
behavioral13
Sample
Malware-1-master/Download.exe
Resource
win7-20250207-en
Behavioral task
behavioral14
Sample
Malware-1-master/Download.exe
Resource
win10v2004-20250211-en
Behavioral task
behavioral15
Sample
Malware-1-master/Illuminati.exe
Resource
win7-20240903-en
Behavioral task
behavioral16
Sample
Malware-1-master/Illuminati.exe
Resource
win10v2004-20250207-en
Behavioral task
behavioral17
Sample
Malware-1-master/MEMZ-Clean.bat
Resource
win7-20241010-en
Behavioral task
behavioral18
Sample
Malware-1-master/MEMZ-Clean.bat
Resource
win10v2004-20250211-en
Behavioral task
behavioral19
Sample
Malware-1-master/MEMZ-Clean.exe
Resource
win7-20241010-en
Behavioral task
behavioral20
Sample
Malware-1-master/MEMZ-Clean.exe
Resource
win10v2004-20250211-en
Behavioral task
behavioral21
Sample
Malware-1-master/MEMZ-Destructive.bat
Resource
win7-20240903-en
Behavioral task
behavioral22
Sample
Malware-1-master/MEMZ-Destructive.bat
Resource
win10v2004-20250211-en
Behavioral task
behavioral23
Sample
Malware-1-master/MEMZ-Destructive.exe
Resource
win7-20250207-en
Behavioral task
behavioral24
Sample
Malware-1-master/MEMZ-Destructive.exe
Resource
win10v2004-20250207-en
Behavioral task
behavioral25
Sample
Malware-1-master/Petya.exe
Resource
win7-20240903-en
Behavioral task
behavioral26
Sample
Malware-1-master/Petya.exe
Resource
win10v2004-20250211-en
Behavioral task
behavioral27
Sample
Malware-1-master/Software.exe
Resource
win7-20241023-en
Behavioral task
behavioral28
Sample
Malware-1-master/Software.exe
Resource
win10v2004-20250211-en
Behavioral task
behavioral29
Sample
Malware-1-master/WannaCry.exe
Resource
win7-20241010-en
Behavioral task
behavioral30
Sample
Malware-1-master/WannaCry.exe
Resource
win10v2004-20250211-en
Behavioral task
behavioral31
Sample
Malware-1-master/Win32.EvilClusterFuck.exe
Resource
win7-20240729-en
Behavioral task
behavioral32
Sample
Malware-1-master/Win32.EvilClusterFuck.exe
Resource
win10v2004-20250211-en
General
-
Target
Malware-1-master/MEMZ-Destructive.exe
-
Size
14KB
-
MD5
19dbec50735b5f2a72d4199c4e184960
-
SHA1
6fed7732f7cb6f59743795b2ab154a3676f4c822
-
SHA256
a3d5715a81f2fbeb5f76c88c9c21eeee87142909716472f911ff6950c790c24d
-
SHA512
aa8a6bbb1ec516d5d5acf8be6863a4c6c5d754cee12b3d374c3a6acb393376806edc422f0ffb661c210e5b9485da88521e4a0956a4b7b08a5467cfaacd90591d
-
SSDEEP
192:sIvxdXSQeWSg9JJS/lcIEiwqZKBkDFR43xWTM3LHn8f26gyr6yfFCj3r:sMVSaSEglcIqq3agmLc+6gyWqFCj
Malware Config
Signatures
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 7 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{9459C573-B17A-45AE-9F64-1857B5D58CEE}\Version = "43,0,0,0" setup.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Active Setup\Installed Components setup.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Active Setup\Installed Components\{9459C573-B17A-45AE-9F64-1857B5D58CEE} setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{9459C573-B17A-45AE-9F64-1857B5D58CEE}\ = "Microsoft Edge" setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{9459C573-B17A-45AE-9F64-1857B5D58CEE}\StubPath = "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\133.0.3065.59\\Installer\\setup.exe\" --configure-user-settings --verbose-logging --system-level --msedge --channel=stable" setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{9459C573-B17A-45AE-9F64-1857B5D58CEE}\Localized Name = "Microsoft Edge" setup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{9459C573-B17A-45AE-9F64-1857B5D58CEE}\IsInstalled = "1" setup.exe -
Downloads MZ/PE file 2 IoCs
flow pid Process 74 2860 Process not Found 105 2860 Process not Found -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3311063739-2594902809-44604183-1000\Control Panel\International\Geo\Nation MEMZ-Destructive.exe Key value queried \REGISTRY\USER\S-1-5-21-3311063739-2594902809-44604183-1000\Control Panel\International\Geo\Nation MEMZ-Destructive.exe -
Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
-
Executes dropped EXE 10 IoCs
pid Process 3988 setup.exe 1064 setup.exe 392 setup.exe 5108 setup.exe 2104 setup.exe 5024 setup.exe 1312 setup.exe 4040 setup.exe 1432 setup.exe 5324 setup.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Installs/modifies Browser Helper Object 2 TTPs 8 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}\ = "IEToEdge BHO" setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}\NoExplorer = "1" setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}\NoExplorer = "1" setup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects setup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}\ setup.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects setup.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}\ setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}\ = "IEToEdge BHO" setup.exe -
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
description ioc Process File opened for modification \??\PhysicalDrive0 MEMZ-Destructive.exe -
Drops file in System32 directory 3 IoCs
description ioc Process File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Microsoft Edge.lnk setup.exe File opened for modification C:\Windows\System32\devmgmt.msc mmc.exe File opened for modification C:\Windows\System32\devmgmt.msc mmc.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{DF658AB0-15FA-41A1-BBD5-4DAA560BF5AD}\MicrosoftEdge_X64_133.0.3065.59.exe MicrosoftEdge_X64_133.0.3065.59.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\5024_13383883774009182_5024.pma setup.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{655FBE2F-012D-4293-97D8-DE2D86D137D6}\EDGEMITMP_5473E.tmp\SETUP.EX_ MicrosoftEdge_X64_133.0.3065.59_132.0.2957.140.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\133.0.3065.59\Locales\el.pak setup.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\133.0.3065.59\identity_proxy\stable.identity_helper.exe.manifest setup.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\133.0.3065.59\Trust Protection Lists\Mu\LICENSE setup.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\133.0.3065.59\Locales\az.pak setup.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.59\vk_swiftshader_icd.json setup.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.59\AdSelectionAttestationsPreloaded\manifest.json setup.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\133.0.3065.59\Locales\km.pak setup.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\133.0.3065.59\Locales\te.pak setup.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\133.0.3065.59\Locales\nl.pak setup.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\133.0.3065.59\Locales\pt-BR.pak setup.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.59\Locales\fil.pak setup.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\133.0.3065.59\prefs_enclave_x64.dll setup.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\133.0.3065.59\Locales\bg.pak setup.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\133.0.3065.59\EdgeWebView.dat setup.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\133.0.3065.59\MEIPreload\manifest.json setup.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\133.0.3065.59\Trust Protection Lists\Sigma\Staging setup.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\133.0.3065.59\vk_swiftshader.dll setup.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\133.0.3065.59\Trust Protection Lists\manifest.json setup.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\133.0.3065.59\Locales\ja.pak setup.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.59\Locales\kok.pak setup.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\133.0.3065.59\Trust Protection Lists\Sigma\Entities setup.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\133.0.3065.59\Locales\he.pak setup.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\133.0.3065.59\Locales\hu.pak setup.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.59\Locales\az.pak setup.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\133.0.3065.59\Locales\es-419.pak setup.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\133.0.3065.59\identity_proxy\dev.identity_helper.exe.manifest setup.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.59\Locales\lo.pak setup.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.59\Locales\nl.pak setup.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\133.0.3065.59\Locales\en-GB.pak setup.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\133.0.3065.59\Locales\es.pak setup.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.59\Locales\en-US.pak setup.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\133.0.3065.59\Locales\zh-TW.pak setup.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\133.0.3065.59\AdSelectionAttestationsPreloaded\manifest.json setup.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\133.0.3065.59\Locales\ms.pak setup.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\133.0.3065.59\Locales\am.pak setup.exe File opened for modification C:\Program Files\msedge_installer.log setup.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\133.0.3065.59\Locales\bs.pak setup.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\133.0.3065.59\BHO\ie_to_edge_stub.exe setup.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\133.0.3065.59\identity_proxy\beta.identity_helper.exe.manifest setup.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\133.0.3065.59\Locales\ja.pak setup.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.59\Locales\lb.pak setup.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\133.0.3065.59\133.0.3065.59.manifest setup.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\133.0.3065.59\Locales\de.pak setup.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\133.0.3065.59\msedge.exe.sig setup.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\133.0.3065.59\Locales\ug.pak setup.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.59\Locales\tt.pak setup.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\133.0.3065.59\libGLESv2.dll setup.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.59\Locales\bn-IN.pak setup.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.59\Locales\ms.pak setup.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\133.0.3065.59\Locales\lb.pak setup.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\133.0.3065.59\Locales\eu.pak setup.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\133.0.3065.59\EBWebView\x64\EmbeddedBrowserWebView.dll setup.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\133.0.3065.59\Locales\mk.pak setup.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\133.0.3065.59\Locales\nb.pak setup.exe File opened for modification C:\Program Files\MsEdgeCrashpad\metadata setup.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\133.0.3065.59\WidevineCdm\_platform_specific\win_x64\widevinecdm.dll.sig setup.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\133.0.3065.59\dxcompiler.dll setup.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\133.0.3065.59\Locales\hu.pak setup.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\133.0.3065.59\oneauth.dll setup.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\133.0.3065.59\Extensions\external_extensions.json setup.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.59\edge_feedback\camera_mf_trace.wprp setup.exe -
Drops file in Windows directory 57 IoCs
description ioc Process File created C:\Windows\INF\c_smrvolume.PNF mmc.exe File created C:\Windows\INF\PerceptionSimulationSixDof.PNF mmc.exe File created C:\Windows\INF\c_swcomponent.PNF mmc.exe File created C:\Windows\INF\c_scmvolume.PNF mmc.exe File created C:\Windows\INF\c_fsopenfilebackup.PNF mmc.exe File created C:\Windows\INF\c_display.PNF mmc.exe File created C:\Windows\INF\c_cashdrawer.PNF mmc.exe File created C:\Windows\INF\c_fsantivirus.PNF mmc.exe File created C:\Windows\INF\c_linedisplay.PNF mmc.exe File created C:\Windows\INF\c_fscontinuousbackup.PNF mmc.exe File created C:\Windows\INF\c_receiptprinter.PNF mmc.exe File created C:\Windows\INF\c_monitor.PNF mmc.exe File created C:\Windows\INF\c_fsactivitymonitor.PNF mmc.exe File created C:\Windows\INF\ts_generic.PNF mmc.exe File created C:\Windows\INF\c_sslaccel.PNF mmc.exe File created C:\Windows\INF\c_magneticstripereader.PNF mmc.exe File created C:\Windows\INF\c_fscontentscreener.PNF mmc.exe File created C:\Windows\INF\c_mcx.PNF mmc.exe File created C:\Windows\INF\c_fsreplication.PNF mmc.exe File created C:\Windows\INF\c_scmdisk.PNF mmc.exe File created C:\Windows\INF\c_fssystem.PNF mmc.exe File created C:\Windows\INF\rawsilo.PNF mmc.exe File created C:\Windows\INF\c_computeaccelerator.PNF mmc.exe File created C:\Windows\INF\dc1-controller.PNF mmc.exe File created C:\Windows\INF\c_diskdrive.PNF mmc.exe File created C:\Windows\INF\c_smrdisk.PNF mmc.exe File created C:\Windows\INF\c_fsquotamgmt.PNF mmc.exe File created C:\Windows\INF\c_netdriver.PNF mmc.exe File created C:\Windows\INF\c_barcodescanner.PNF mmc.exe File created C:\Windows\INF\wsdprint.PNF mmc.exe File created C:\Windows\INF\c_volume.PNF mmc.exe File created C:\Windows\INF\c_camera.PNF mmc.exe File created C:\Windows\INF\xusb22.PNF mmc.exe File created C:\Windows\INF\c_extension.PNF mmc.exe File created C:\Windows\INF\c_fsinfrastructure.PNF mmc.exe File created C:\Windows\INF\oposdrv.PNF mmc.exe File created C:\Windows\INF\c_fssecurityenhancer.PNF mmc.exe File created C:\Windows\INF\c_fshsm.PNF mmc.exe File created C:\Windows\INF\c_processor.PNF mmc.exe File created C:\Windows\INF\rdcameradriver.PNF mmc.exe File created C:\Windows\INF\c_fscompression.PNF mmc.exe File created C:\Windows\INF\digitalmediadevice.PNF mmc.exe File created C:\Windows\INF\c_proximity.PNF mmc.exe File created C:\Windows\INF\c_apo.PNF mmc.exe File created C:\Windows\INF\c_holographic.PNF mmc.exe File created C:\Windows\INF\c_fsvirtualization.PNF mmc.exe File created C:\Windows\INF\remoteposdrv.PNF mmc.exe File created C:\Windows\INF\c_media.PNF mmc.exe File created C:\Windows\INF\c_fscfsmetadataserver.PNF mmc.exe File created C:\Windows\INF\c_ucm.PNF mmc.exe File created C:\Windows\INF\c_firmware.PNF mmc.exe File created C:\Windows\INF\c_fsundelete.PNF mmc.exe File created C:\Windows\INF\c_fscopyprotection.PNF mmc.exe File created C:\Windows\INF\c_fsencryption.PNF mmc.exe File created C:\Windows\INF\miradisp.PNF mmc.exe File created C:\Windows\INF\c_fssystemrecovery.PNF mmc.exe File created C:\Windows\INF\c_fsphysicalquotamgmt.PNF mmc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 15 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MEMZ-Destructive.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language control.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mmc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wordpad.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language notepad.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MEMZ-Destructive.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language notepad.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MicrosoftEdgeUpdate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DllHost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language notepad.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MicrosoftEdgeUpdate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mmc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language control.exe -
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 2868 MicrosoftEdgeUpdate.exe 5732 MicrosoftEdgeUpdate.exe -
Checks SCSI registry key(s) 3 TTPs 40 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom mmc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000 mmc.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags mmc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 mmc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 mmc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 mmc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001 mmc.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom mmc.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags mmc.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom mmc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 mmc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 mmc.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName mmc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002 mmc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 mmc.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName mmc.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName mmc.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName mmc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A mmc.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A\ mmc.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName mmc.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName mmc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 mmc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 mmc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A mmc.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A\ mmc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A mmc.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName mmc.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags mmc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000 mmc.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName mmc.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom mmc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 mmc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A mmc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002 mmc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 mmc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001 mmc.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags mmc.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A\ mmc.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A\ mmc.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights setup.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{c9abcf16-8dc2-4a95-bae3-24fd98f2ed29}\ = "IEToEdge Handler" setup.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute setup.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\EdgeIntegration\AdapterLocations setup.exe Key created \REGISTRY\USER\S-1-5-21-3311063739-2594902809-44604183-1000\Software\Microsoft\Internet Explorer\Toolbar explorer.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\Main setup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{c9abcf16-8dc2-4a95-bae3-24fd98f2ed29} setup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3311063739-2594902809-44604183-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\Locked = "1" explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{c9abcf16-8dc2-4a95-bae3-24fd98f2ed29} setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{c9abcf16-8dc2-4a95-bae3-24fd98f2ed29}\AppName = "ie_to_edge_stub.exe" setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{c9abcf16-8dc2-4a95-bae3-24fd98f2ed29}\AppName = "ie_to_edge_stub.exe" setup.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\ProtocolExecute setup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights setup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy setup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{c9abcf16-8dc2-4a95-bae3-24fd98f2ed29}\Policy = "3" setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{c9abcf16-8dc2-4a95-bae3-24fd98f2ed29}\AppPath = "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\133.0.3065.59\\BHO" setup.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\ProtocolExecute\microsoft-edge setup.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\microsoft-edge setup.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\EdgeIntegration setup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\EdgeIntegration\AdapterLocations\C:\Program Files (x86)\Microsoft\Edge\Application = "1" setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\EnterpriseMode\MSEdgePath = "C:\\Program Files (x86)\\Microsoft\\Edge\\Application" setup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{c9abcf16-8dc2-4a95-bae3-24fd98f2ed29}\Policy = "3" setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{c9abcf16-8dc2-4a95-bae3-24fd98f2ed29}\AppPath = "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\133.0.3065.59\\BHO" setup.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\Main\EnterpriseMode setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{c9abcf16-8dc2-4a95-bae3-24fd98f2ed29}\ = "IEToEdge Handler" setup.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Edge setup.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Edge\InstallerPinned = "0" setup.exe -
Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}\TypeLib\ setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}\TypeLib\ = "{2397ECFE-3237-400F-AE51-62B25B3F15B5}" setup.exe Key created \REGISTRY\MACHINE\Software\Classes\MSEdgeHTM\shell setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MSEdgeMHT\shell\runas\ProgrammaticAccessOnly setup.exe Key created \REGISTRY\MACHINE\Software\Classes\.htm setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.html\OpenWithProgIds\MSEdgeHTM setup.exe Key created \REGISTRY\MACHINE\Software\Classes\TypeLib\{C9C2B807-7731-4F34-81B7-44FF7779522B}\1.0 setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\133.0.3065.59\\BHO\\ie_to_edge_bho_64.dll" setup.exe Key created \REGISTRY\MACHINE\Software\Classes\MSEdgePDF\shell\runas setup.exe Key created \REGISTRY\MACHINE\Software\Classes\MSEdgeMHT\shell\runas\command setup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}\ setup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3A84F9C2-6164-485C-A7D9-4B27F8AC009E}\EnablePreviewHandler = "1" setup.exe Key created \REGISTRY\MACHINE\Software\Classes\MSEdgeMHT\shell\open setup.exe Set value (str) \REGISTRY\USER\S-1-5-21-3311063739-2594902809-44604183-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\powercpl.dll,-1#immutable1 = "Power Options" explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-3311063739-2594902809-44604183-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\devmgr.dll,-5#immutable1 = "View and update your device hardware settings and driver software." explorer.exe Key created \REGISTRY\MACHINE\Software\Classes\CLSID\{628ACE20-B77A-456F-A88D-547DB6CEEDD5}\LocalServer32 setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MSEdgeHTM\shell\runas\ProgrammaticAccessOnly setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MSEdgeMHT\AppUserModelId = "MSEdge" setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.shtml\OpenWithProgids\MSEdgeHTM setup.exe Set value (str) \REGISTRY\USER\S-1-5-21-3311063739-2594902809-44604183-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\intl.cpl,-2#immutable1 = "Customize settings for the display of languages, numbers, times, and dates." explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-3311063739-2594902809-44604183-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\mmsys.cpl,-301#immutable1 = "Configure your audio devices or change the sound scheme for your computer." explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{1FCBE96C-1697-43AF-9140-2897C7C69767}\LocalService = "MicrosoftEdgeElevationService" setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C9C2B807-7731-4F34-81B7-44FF7779522B}\TypeLib\ = "{C9C2B807-7731-4F34-81B7-44FF7779522B}" setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MSEdgePDF\AppUserModelId = "MSEdge" setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MSEdgeMHT\Application\AppUserModelId = "MSEdge" setup.exe Set value (str) \REGISTRY\USER\S-1-5-21-3311063739-2594902809-44604183-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\recovery.dll,-101#immutable1 = "Recovery" explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}\Implemented Categories\{59FB2056-D625-48D0-A944-1A85B5AB2640}\ setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3A84F9C2-6164-485C-A7D9-4B27F8AC009E}\InProcServer32\ = "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\133.0.3065.59\\PdfPreview\\PdfPreviewHandler.dll" setup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3A84F9C2-6164-485C-A7D9-4B27F8AC009E}\EnablePreviewHandler = "1" setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MSEdgeHTM\DefaultIcon\ = "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\133.0.3065.59\\msedge.exe,0" setup.exe Key created \REGISTRY\MACHINE\Software\Classes\MSEdgeMHT\shell\runas setup.exe Set value (str) \REGISTRY\USER\S-1-5-21-3311063739-2594902809-44604183-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\systemcpl.dll,-2#immutable1 = "View information about your computer, and change settings for hardware, performance, and remote connections." explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}\Implemented Categories\ setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\ie_to_edge_bho.IEToEdgeBHO.1\ = "IEToEdgeBHO Class" setup.exe Key created \REGISTRY\MACHINE\Software\Classes\MSEdgeHTM\shell\open\command setup.exe Set value (str) \REGISTRY\USER\S-1-5-21-3311063739-2594902809-44604183-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\main.cpl,-102#immutable1 = "Keyboard" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.svg\OpenWithProgIds\MSEdgeHTM setup.exe Set value (str) \REGISTRY\USER\S-1-5-21-3311063739-2594902809-44604183-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\telephon.cpl,-1#immutable1 = "Phone and Modem" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3A84F9C2-6164-485C-A7D9-4B27F8AC009E}\InProcServer32\ThreadingModel = "Apartment" setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MSEdgePDF\Application\ApplicationIcon = "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\133.0.3065.59\\msedge.exe,0" setup.exe Key created \REGISTRY\MACHINE\Software\Classes\CLSID\{1FCBE96C-1697-43AF-9140-2897C7C69767} setup.exe Key created \REGISTRY\MACHINE\Software\Classes\.shtml\OpenWithProgids setup.exe Set value (str) \REGISTRY\USER\S-1-5-21-3311063739-2594902809-44604183-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\usercpl.dll,-1#immutable1 = "User Accounts" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MSEdgePDF\shell\runas\command\ = "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --do-not-de-elevate --single-argument %1" setup.exe Key created \REGISTRY\MACHINE\Software\Classes\.svg\OpenWithProgids setup.exe Set value (data) \REGISTRY\USER\S-1-5-21-3311063739-2594902809-44604183-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-3311063739-2594902809-44604183-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\sdcpl.dll,-100#immutable1 = "Recover copies of your files backed up in Windows 7" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}\ProgID\ = "ie_to_edge_bho.IEToEdgeBHO.1" setup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\image/svg+xml setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3A84F9C2-6164-485C-A7D9-4B27F8AC009E}\ = "PDF Preview Handler" setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\microsoft-edge\shell\open\command\ = "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" \"%1\"" setup.exe Key created \REGISTRY\MACHINE\Software\Classes\MSEdgeHTM\shell\runas setup.exe Set value (str) \REGISTRY\USER\S-1-5-21-3311063739-2594902809-44604183-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\sdcpl.dll,-101#immutable1 = "Backup and Restore (Windows 7)" explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-3311063739-2594902809-44604183-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\DiagCpl.dll,-1#immutable1 = "Troubleshooting" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{31575964-95F7-414B-85E4-0E9A93699E13}\ = "ie_to_edge_bho" setup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID setup.exe Key created \REGISTRY\MACHINE\Software\Classes\MSEdgePDF\shell\runas\command setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MSEdgeMHT\Application\ApplicationCompany = "Microsoft Corporation" setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{628ACE20-B77A-456F-A88D-547DB6CEEDD5}\AppId = "{628ACE20-B77A-456F-A88D-547DB6CEEDD5}" setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}\ = "IEToEdge BHO" setup.exe Set value (str) \REGISTRY\USER\S-1-5-21-3311063739-2594902809-44604183-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\autoplay.dll,-2#immutable1 = "Change default settings for CDs, DVDs, and devices so that you can automatically play music, view pictures, install software, and play games." explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-3311063739-2594902809-44604183-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\timedate.cpl,-52#immutable1 = "Set the date, time, and time zone for your computer." explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MSEdgeMHT\DefaultIcon\ = "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\133.0.3065.59\\msedge.exe,0" setup.exe Key created \REGISTRY\MACHINE\Software\Classes\.pdf setup.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 5184 explorer.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3400 MEMZ-Destructive.exe 3400 MEMZ-Destructive.exe 3400 MEMZ-Destructive.exe 3400 MEMZ-Destructive.exe 5028 MEMZ-Destructive.exe 5028 MEMZ-Destructive.exe 1484 MEMZ-Destructive.exe 1484 MEMZ-Destructive.exe 5028 MEMZ-Destructive.exe 5028 MEMZ-Destructive.exe 3400 MEMZ-Destructive.exe 3400 MEMZ-Destructive.exe 1588 MEMZ-Destructive.exe 4060 MEMZ-Destructive.exe 1588 MEMZ-Destructive.exe 4060 MEMZ-Destructive.exe 3400 MEMZ-Destructive.exe 1484 MEMZ-Destructive.exe 3400 MEMZ-Destructive.exe 1484 MEMZ-Destructive.exe 4060 MEMZ-Destructive.exe 1588 MEMZ-Destructive.exe 4060 MEMZ-Destructive.exe 1588 MEMZ-Destructive.exe 5028 MEMZ-Destructive.exe 5028 MEMZ-Destructive.exe 1588 MEMZ-Destructive.exe 1588 MEMZ-Destructive.exe 5028 MEMZ-Destructive.exe 5028 MEMZ-Destructive.exe 4060 MEMZ-Destructive.exe 4060 MEMZ-Destructive.exe 1484 MEMZ-Destructive.exe 1484 MEMZ-Destructive.exe 3400 MEMZ-Destructive.exe 3400 MEMZ-Destructive.exe 1484 MEMZ-Destructive.exe 3400 MEMZ-Destructive.exe 1484 MEMZ-Destructive.exe 3400 MEMZ-Destructive.exe 4060 MEMZ-Destructive.exe 5028 MEMZ-Destructive.exe 4060 MEMZ-Destructive.exe 5028 MEMZ-Destructive.exe 1588 MEMZ-Destructive.exe 1588 MEMZ-Destructive.exe 5028 MEMZ-Destructive.exe 5028 MEMZ-Destructive.exe 1588 MEMZ-Destructive.exe 1588 MEMZ-Destructive.exe 4060 MEMZ-Destructive.exe 4060 MEMZ-Destructive.exe 3400 MEMZ-Destructive.exe 3400 MEMZ-Destructive.exe 1484 MEMZ-Destructive.exe 1484 MEMZ-Destructive.exe 3400 MEMZ-Destructive.exe 1484 MEMZ-Destructive.exe 3400 MEMZ-Destructive.exe 1484 MEMZ-Destructive.exe 4060 MEMZ-Destructive.exe 5028 MEMZ-Destructive.exe 4060 MEMZ-Destructive.exe 5028 MEMZ-Destructive.exe -
Suspicious behavior: GetForegroundWindowSpam 4 IoCs
pid Process 4828 mmc.exe 408 MEMZ-Destructive.exe 1968 mmc.exe 2108 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 64 IoCs
pid Process 2108 msedge.exe 2108 msedge.exe 2108 msedge.exe 2108 msedge.exe 2108 msedge.exe 2108 msedge.exe 2108 msedge.exe 2108 msedge.exe 2108 msedge.exe 2108 msedge.exe 2108 msedge.exe 2108 msedge.exe 2108 msedge.exe 2108 msedge.exe 2108 msedge.exe 2108 msedge.exe 2108 msedge.exe 2108 msedge.exe 2108 msedge.exe 2108 msedge.exe 2108 msedge.exe 2108 msedge.exe 2108 msedge.exe 2108 msedge.exe 2108 msedge.exe 2108 msedge.exe 2108 msedge.exe 2108 msedge.exe 2108 msedge.exe 2108 msedge.exe 2108 msedge.exe 2108 msedge.exe 2108 msedge.exe 2108 msedge.exe 2108 msedge.exe 2108 msedge.exe 2108 msedge.exe 2108 msedge.exe 2108 msedge.exe 2108 msedge.exe 2108 msedge.exe 2108 msedge.exe 2108 msedge.exe 2108 msedge.exe 2108 msedge.exe 2108 msedge.exe 2108 msedge.exe 2108 msedge.exe 2108 msedge.exe 2108 msedge.exe 2108 msedge.exe 2108 msedge.exe 2108 msedge.exe 2108 msedge.exe 2108 msedge.exe 2108 msedge.exe 2108 msedge.exe 2108 msedge.exe 2108 msedge.exe 2108 msedge.exe 2108 msedge.exe 2108 msedge.exe 2108 msedge.exe 2108 msedge.exe -
Suspicious behavior: SetClipboardViewer 1 IoCs
pid Process 1968 mmc.exe -
Suspicious use of AdjustPrivilegeToken 16 IoCs
description pid Process Token: 33 3988 setup.exe Token: SeIncBasePriorityPrivilege 3988 setup.exe Token: 33 3120 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 3120 AUDIODG.EXE Token: 33 1432 setup.exe Token: SeIncBasePriorityPrivilege 1432 setup.exe Token: SeShutdownPrivilege 5184 explorer.exe Token: SeCreatePagefilePrivilege 5184 explorer.exe Token: 33 4828 mmc.exe Token: SeIncBasePriorityPrivilege 4828 mmc.exe Token: 33 4828 mmc.exe Token: SeIncBasePriorityPrivilege 4828 mmc.exe Token: 33 1968 mmc.exe Token: SeIncBasePriorityPrivilege 1968 mmc.exe Token: 33 1968 mmc.exe Token: SeIncBasePriorityPrivilege 1968 mmc.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 2108 msedge.exe 2108 msedge.exe 2108 msedge.exe 2108 msedge.exe 2108 msedge.exe 2108 msedge.exe 2108 msedge.exe 2108 msedge.exe 2108 msedge.exe 2108 msedge.exe 2108 msedge.exe 2108 msedge.exe 2108 msedge.exe 2108 msedge.exe 2108 msedge.exe 2108 msedge.exe 2108 msedge.exe 2108 msedge.exe 2108 msedge.exe 2108 msedge.exe 2108 msedge.exe 2108 msedge.exe 2108 msedge.exe 2108 msedge.exe 2108 msedge.exe 5184 explorer.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 2108 msedge.exe 2108 msedge.exe 2108 msedge.exe 2108 msedge.exe 2108 msedge.exe 2108 msedge.exe 2108 msedge.exe 2108 msedge.exe 2108 msedge.exe 2108 msedge.exe 2108 msedge.exe 2108 msedge.exe 2108 msedge.exe 2108 msedge.exe 2108 msedge.exe 2108 msedge.exe 2108 msedge.exe 2108 msedge.exe 2108 msedge.exe 2108 msedge.exe 2108 msedge.exe 2108 msedge.exe 2108 msedge.exe 2108 msedge.exe -
Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 408 MEMZ-Destructive.exe 408 MEMZ-Destructive.exe 408 MEMZ-Destructive.exe 408 MEMZ-Destructive.exe 408 MEMZ-Destructive.exe 408 MEMZ-Destructive.exe 408 MEMZ-Destructive.exe 408 MEMZ-Destructive.exe 408 MEMZ-Destructive.exe 408 MEMZ-Destructive.exe 408 MEMZ-Destructive.exe 408 MEMZ-Destructive.exe 2552 mmc.exe 4828 mmc.exe 4828 mmc.exe 408 MEMZ-Destructive.exe 408 MEMZ-Destructive.exe 408 MEMZ-Destructive.exe 408 MEMZ-Destructive.exe 408 MEMZ-Destructive.exe 408 MEMZ-Destructive.exe 408 MEMZ-Destructive.exe 408 MEMZ-Destructive.exe 408 MEMZ-Destructive.exe 408 MEMZ-Destructive.exe 408 MEMZ-Destructive.exe 5648 mmc.exe 1968 mmc.exe 1968 mmc.exe 408 MEMZ-Destructive.exe 408 MEMZ-Destructive.exe 408 MEMZ-Destructive.exe 408 MEMZ-Destructive.exe 408 MEMZ-Destructive.exe 408 MEMZ-Destructive.exe 7128 wordpad.exe 7128 wordpad.exe 7128 wordpad.exe 7128 wordpad.exe 7128 wordpad.exe 7128 wordpad.exe 408 MEMZ-Destructive.exe 408 MEMZ-Destructive.exe 408 MEMZ-Destructive.exe 408 MEMZ-Destructive.exe 408 MEMZ-Destructive.exe 408 MEMZ-Destructive.exe 408 MEMZ-Destructive.exe 408 MEMZ-Destructive.exe 408 MEMZ-Destructive.exe 408 MEMZ-Destructive.exe 408 MEMZ-Destructive.exe 408 MEMZ-Destructive.exe 408 MEMZ-Destructive.exe 408 MEMZ-Destructive.exe 408 MEMZ-Destructive.exe 408 MEMZ-Destructive.exe 408 MEMZ-Destructive.exe 408 MEMZ-Destructive.exe 408 MEMZ-Destructive.exe 408 MEMZ-Destructive.exe 408 MEMZ-Destructive.exe 408 MEMZ-Destructive.exe 408 MEMZ-Destructive.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4420 wrote to memory of 3400 4420 MEMZ-Destructive.exe 90 PID 4420 wrote to memory of 3400 4420 MEMZ-Destructive.exe 90 PID 4420 wrote to memory of 3400 4420 MEMZ-Destructive.exe 90 PID 4420 wrote to memory of 1484 4420 MEMZ-Destructive.exe 91 PID 4420 wrote to memory of 1484 4420 MEMZ-Destructive.exe 91 PID 4420 wrote to memory of 1484 4420 MEMZ-Destructive.exe 91 PID 4420 wrote to memory of 5028 4420 MEMZ-Destructive.exe 92 PID 4420 wrote to memory of 5028 4420 MEMZ-Destructive.exe 92 PID 4420 wrote to memory of 5028 4420 MEMZ-Destructive.exe 92 PID 4420 wrote to memory of 4060 4420 MEMZ-Destructive.exe 93 PID 4420 wrote to memory of 4060 4420 MEMZ-Destructive.exe 93 PID 4420 wrote to memory of 4060 4420 MEMZ-Destructive.exe 93 PID 4420 wrote to memory of 1588 4420 MEMZ-Destructive.exe 94 PID 4420 wrote to memory of 1588 4420 MEMZ-Destructive.exe 94 PID 4420 wrote to memory of 1588 4420 MEMZ-Destructive.exe 94 PID 4420 wrote to memory of 408 4420 MEMZ-Destructive.exe 95 PID 4420 wrote to memory of 408 4420 MEMZ-Destructive.exe 95 PID 4420 wrote to memory of 408 4420 MEMZ-Destructive.exe 95 PID 408 wrote to memory of 800 408 MEMZ-Destructive.exe 97 PID 408 wrote to memory of 800 408 MEMZ-Destructive.exe 97 PID 408 wrote to memory of 800 408 MEMZ-Destructive.exe 97 PID 408 wrote to memory of 2108 408 MEMZ-Destructive.exe 102 PID 408 wrote to memory of 2108 408 MEMZ-Destructive.exe 102 PID 2108 wrote to memory of 2932 2108 msedge.exe 103 PID 2108 wrote to memory of 2932 2108 msedge.exe 103 PID 2108 wrote to memory of 2652 2108 msedge.exe 104 PID 2108 wrote to memory of 2652 2108 msedge.exe 104 PID 2108 wrote to memory of 2652 2108 msedge.exe 104 PID 2108 wrote to memory of 2652 2108 msedge.exe 104 PID 2108 wrote to memory of 2652 2108 msedge.exe 104 PID 2108 wrote to memory of 2652 2108 msedge.exe 104 PID 2108 wrote to memory of 2652 2108 msedge.exe 104 PID 2108 wrote to memory of 2652 2108 msedge.exe 104 PID 2108 wrote to memory of 2652 2108 msedge.exe 104 PID 2108 wrote to memory of 2652 2108 msedge.exe 104 PID 2108 wrote to memory of 2652 2108 msedge.exe 104 PID 2108 wrote to memory of 2652 2108 msedge.exe 104 PID 2108 wrote to memory of 2652 2108 msedge.exe 104 PID 2108 wrote to memory of 2652 2108 msedge.exe 104 PID 2108 wrote to memory of 2652 2108 msedge.exe 104 PID 2108 wrote to memory of 2652 2108 msedge.exe 104 PID 2108 wrote to memory of 2652 2108 msedge.exe 104 PID 2108 wrote to memory of 2652 2108 msedge.exe 104 PID 2108 wrote to memory of 2652 2108 msedge.exe 104 PID 2108 wrote to memory of 2652 2108 msedge.exe 104 PID 2108 wrote to memory of 2652 2108 msedge.exe 104 PID 2108 wrote to memory of 2652 2108 msedge.exe 104 PID 2108 wrote to memory of 2652 2108 msedge.exe 104 PID 2108 wrote to memory of 2652 2108 msedge.exe 104 PID 2108 wrote to memory of 2652 2108 msedge.exe 104 PID 2108 wrote to memory of 2652 2108 msedge.exe 104 PID 2108 wrote to memory of 2652 2108 msedge.exe 104 PID 2108 wrote to memory of 2652 2108 msedge.exe 104 PID 2108 wrote to memory of 2652 2108 msedge.exe 104 PID 2108 wrote to memory of 2652 2108 msedge.exe 104 PID 2108 wrote to memory of 2652 2108 msedge.exe 104 PID 2108 wrote to memory of 2652 2108 msedge.exe 104 PID 2108 wrote to memory of 2652 2108 msedge.exe 104 PID 2108 wrote to memory of 2652 2108 msedge.exe 104 PID 2108 wrote to memory of 2652 2108 msedge.exe 104 PID 2108 wrote to memory of 2652 2108 msedge.exe 104 PID 2108 wrote to memory of 2652 2108 msedge.exe 104 PID 2108 wrote to memory of 2652 2108 msedge.exe 104 PID 2108 wrote to memory of 2652 2108 msedge.exe 104 -
System policy modification 1 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C} = "1" setup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext setup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID\ setup.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\Malware-1-master\MEMZ-Destructive.exe"C:\Users\Admin\AppData\Local\Temp\Malware-1-master\MEMZ-Destructive.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4420 -
C:\Users\Admin\AppData\Local\Temp\Malware-1-master\MEMZ-Destructive.exe"C:\Users\Admin\AppData\Local\Temp\Malware-1-master\MEMZ-Destructive.exe" /watchdog2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3400
-
-
C:\Users\Admin\AppData\Local\Temp\Malware-1-master\MEMZ-Destructive.exe"C:\Users\Admin\AppData\Local\Temp\Malware-1-master\MEMZ-Destructive.exe" /watchdog2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1484
-
-
C:\Users\Admin\AppData\Local\Temp\Malware-1-master\MEMZ-Destructive.exe"C:\Users\Admin\AppData\Local\Temp\Malware-1-master\MEMZ-Destructive.exe" /watchdog2⤵
- Suspicious behavior: EnumeratesProcesses
PID:5028
-
-
C:\Users\Admin\AppData\Local\Temp\Malware-1-master\MEMZ-Destructive.exe"C:\Users\Admin\AppData\Local\Temp\Malware-1-master\MEMZ-Destructive.exe" /watchdog2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4060
-
-
C:\Users\Admin\AppData\Local\Temp\Malware-1-master\MEMZ-Destructive.exe"C:\Users\Admin\AppData\Local\Temp\Malware-1-master\MEMZ-Destructive.exe" /watchdog2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1588
-
-
C:\Users\Admin\AppData\Local\Temp\Malware-1-master\MEMZ-Destructive.exe"C:\Users\Admin\AppData\Local\Temp\Malware-1-master\MEMZ-Destructive.exe" /main2⤵
- Checks computer location settings
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:408 -
C:\Windows\SysWOW64\notepad.exe"C:\Windows\System32\notepad.exe" \note.txt3⤵
- System Location Discovery: System Language Discovery
PID:800
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=montage+parody+making+program+20163⤵
- Enumerates system info in registry
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2108 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x124,0x128,0x12c,0x100,0x130,0x7ffcf2eb46f8,0x7ffcf2eb4708,0x7ffcf2eb47184⤵PID:2932
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,4123416716127706656,13376814664434544194,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2096 /prefetch:24⤵PID:2652
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2088,4123416716127706656,13376814664434544194,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2164 /prefetch:34⤵PID:3664
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2088,4123416716127706656,13376814664434544194,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2744 /prefetch:84⤵PID:4340
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,4123416716127706656,13376814664434544194,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3348 /prefetch:14⤵PID:4164
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,4123416716127706656,13376814664434544194,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3360 /prefetch:14⤵PID:4744
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,4123416716127706656,13376814664434544194,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5088 /prefetch:14⤵PID:3168
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,4123416716127706656,13376814664434544194,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5312 /prefetch:84⤵PID:1136
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,4123416716127706656,13376814664434544194,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5312 /prefetch:84⤵PID:3128
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,4123416716127706656,13376814664434544194,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5376 /prefetch:14⤵PID:1668
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,4123416716127706656,13376814664434544194,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5356 /prefetch:14⤵PID:4912
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,4123416716127706656,13376814664434544194,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3960 /prefetch:14⤵PID:2840
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,4123416716127706656,13376814664434544194,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3976 /prefetch:14⤵PID:1524
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,4123416716127706656,13376814664434544194,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5156 /prefetch:14⤵PID:3748
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,4123416716127706656,13376814664434544194,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5532 /prefetch:14⤵PID:2668
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,4123416716127706656,13376814664434544194,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4648 /prefetch:14⤵PID:4568
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,4123416716127706656,13376814664434544194,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5500 /prefetch:14⤵PID:3068
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,4123416716127706656,13376814664434544194,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5988 /prefetch:14⤵PID:5628
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,4123416716127706656,13376814664434544194,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6012 /prefetch:14⤵PID:5652
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,4123416716127706656,13376814664434544194,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6264 /prefetch:24⤵PID:5964
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,4123416716127706656,13376814664434544194,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3364 /prefetch:14⤵PID:5504
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,4123416716127706656,13376814664434544194,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6000 /prefetch:14⤵PID:4344
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,4123416716127706656,13376814664434544194,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5940 /prefetch:14⤵PID:5788
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,4123416716127706656,13376814664434544194,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6472 /prefetch:14⤵PID:3068
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,4123416716127706656,13376814664434544194,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6064 /prefetch:14⤵PID:5744
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,4123416716127706656,13376814664434544194,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6724 /prefetch:14⤵PID:5856
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,4123416716127706656,13376814664434544194,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6284 /prefetch:14⤵PID:876
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,4123416716127706656,13376814664434544194,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6924 /prefetch:14⤵PID:1108
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,4123416716127706656,13376814664434544194,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2460 /prefetch:14⤵PID:3000
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,4123416716127706656,13376814664434544194,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6684 /prefetch:14⤵PID:1892
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,4123416716127706656,13376814664434544194,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6988 /prefetch:14⤵PID:2160
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,4123416716127706656,13376814664434544194,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7428 /prefetch:14⤵PID:828
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,4123416716127706656,13376814664434544194,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7512 /prefetch:14⤵PID:6020
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,4123416716127706656,13376814664434544194,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6724 /prefetch:14⤵PID:3360
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,4123416716127706656,13376814664434544194,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7416 /prefetch:14⤵PID:6092
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,4123416716127706656,13376814664434544194,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7256 /prefetch:14⤵PID:5000
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,4123416716127706656,13376814664434544194,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5996 /prefetch:14⤵PID:4792
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,4123416716127706656,13376814664434544194,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6360 /prefetch:14⤵PID:4440
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,4123416716127706656,13376814664434544194,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6748 /prefetch:14⤵PID:5124
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,4123416716127706656,13376814664434544194,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8024 /prefetch:14⤵PID:2336
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,4123416716127706656,13376814664434544194,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7740 /prefetch:14⤵PID:3728
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,4123416716127706656,13376814664434544194,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8056 /prefetch:14⤵PID:5648
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,4123416716127706656,13376814664434544194,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6156 /prefetch:14⤵PID:3068
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,4123416716127706656,13376814664434544194,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8004 /prefetch:14⤵PID:1356
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,4123416716127706656,13376814664434544194,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8652 /prefetch:14⤵PID:2452
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,4123416716127706656,13376814664434544194,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6732 /prefetch:14⤵PID:2336
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,4123416716127706656,13376814664434544194,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8048 /prefetch:14⤵PID:2140
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,4123416716127706656,13376814664434544194,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8828 /prefetch:14⤵PID:4892
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,4123416716127706656,13376814664434544194,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7616 /prefetch:14⤵PID:5208
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,4123416716127706656,13376814664434544194,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7664 /prefetch:14⤵PID:4972
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,4123416716127706656,13376814664434544194,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7428 /prefetch:14⤵PID:6616
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,4123416716127706656,13376814664434544194,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9140 /prefetch:14⤵PID:6712
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,4123416716127706656,13376814664434544194,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9080 /prefetch:14⤵PID:7072
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,4123416716127706656,13376814664434544194,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8596 /prefetch:14⤵PID:6856
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,4123416716127706656,13376814664434544194,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7752 /prefetch:14⤵PID:2464
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,4123416716127706656,13376814664434544194,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=55 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8924 /prefetch:14⤵PID:6784
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,4123416716127706656,13376814664434544194,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=56 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9860 /prefetch:14⤵PID:4884
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,4123416716127706656,13376814664434544194,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=57 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3136 /prefetch:14⤵PID:6892
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,4123416716127706656,13376814664434544194,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=58 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6428 /prefetch:14⤵PID:6576
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,4123416716127706656,13376814664434544194,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=59 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9680 /prefetch:14⤵PID:6312
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,4123416716127706656,13376814664434544194,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=60 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7816 /prefetch:14⤵PID:6816
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,4123416716127706656,13376814664434544194,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=61 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7080 /prefetch:14⤵PID:6564
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,4123416716127706656,13376814664434544194,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=62 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10252 /prefetch:14⤵PID:6676
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,4123416716127706656,13376814664434544194,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=63 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7752 /prefetch:14⤵PID:5232
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,4123416716127706656,13376814664434544194,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=64 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10540 /prefetch:14⤵PID:5040
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,4123416716127706656,13376814664434544194,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=65 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10328 /prefetch:14⤵PID:7724
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,4123416716127706656,13376814664434544194,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=66 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10080 /prefetch:14⤵PID:8028
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,4123416716127706656,13376814664434544194,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=67 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10228 /prefetch:14⤵PID:4404
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,4123416716127706656,13376814664434544194,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=68 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10720 /prefetch:14⤵PID:7196
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,4123416716127706656,13376814664434544194,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=69 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10908 /prefetch:14⤵PID:7396
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,4123416716127706656,13376814664434544194,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=70 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=11180 /prefetch:14⤵PID:7512
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,4123416716127706656,13376814664434544194,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=71 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=11628 /prefetch:14⤵PID:7988
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,4123416716127706656,13376814664434544194,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=72 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=11792 /prefetch:14⤵PID:3808
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,4123416716127706656,13376814664434544194,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=73 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=12068 /prefetch:14⤵PID:7368
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,4123416716127706656,13376814664434544194,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=74 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=12016 /prefetch:14⤵PID:7460
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,4123416716127706656,13376814664434544194,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=75 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=12160 /prefetch:14⤵PID:7428
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,4123416716127706656,13376814664434544194,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=76 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=12212 /prefetch:14⤵PID:7744
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,4123416716127706656,13376814664434544194,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=77 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10892 /prefetch:14⤵PID:1356
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,4123416716127706656,13376814664434544194,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=78 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10740 /prefetch:14⤵PID:7972
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,4123416716127706656,13376814664434544194,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=79 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=12124 /prefetch:14⤵PID:7508
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,4123416716127706656,13376814664434544194,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=80 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=12108 /prefetch:14⤵PID:1040
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,4123416716127706656,13376814664434544194,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=81 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=12452 /prefetch:14⤵PID:8396
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,4123416716127706656,13376814664434544194,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=82 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=11552 /prefetch:14⤵PID:8208
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,4123416716127706656,13376814664434544194,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=83 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=11192 /prefetch:14⤵PID:8388
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,4123416716127706656,13376814664434544194,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=84 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=12748 /prefetch:14⤵PID:7180
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,4123416716127706656,13376814664434544194,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=85 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=12852 /prefetch:14⤵PID:9140
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,4123416716127706656,13376814664434544194,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=86 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=12184 /prefetch:14⤵PID:8736
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,4123416716127706656,13376814664434544194,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=87 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=12492 /prefetch:14⤵PID:8828
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,4123416716127706656,13376814664434544194,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=88 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=12888 /prefetch:14⤵PID:7332
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,4123416716127706656,13376814664434544194,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=89 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=12752 /prefetch:14⤵PID:7732
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,4123416716127706656,13376814664434544194,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=90 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=12912 /prefetch:14⤵PID:8924
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,4123416716127706656,13376814664434544194,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=91 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=11372 /prefetch:14⤵PID:8196
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,4123416716127706656,13376814664434544194,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=92 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9256 /prefetch:14⤵PID:7824
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,4123416716127706656,13376814664434544194,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=93 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=13492 /prefetch:14⤵PID:8580
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,4123416716127706656,13376814664434544194,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=94 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=13680 /prefetch:14⤵PID:8196
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,4123416716127706656,13376814664434544194,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=95 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=11372 /prefetch:14⤵PID:8768
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,4123416716127706656,13376814664434544194,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=96 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=11524 /prefetch:14⤵PID:6652
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,4123416716127706656,13376814664434544194,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=97 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=13904 /prefetch:14⤵PID:8980
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,4123416716127706656,13376814664434544194,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=98 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=13948 /prefetch:14⤵PID:4580
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,4123416716127706656,13376814664434544194,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=99 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=14016 /prefetch:14⤵PID:9328
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,4123416716127706656,13376814664434544194,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=100 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=12868 /prefetch:14⤵PID:9576
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,4123416716127706656,13376814664434544194,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=101 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=14028 /prefetch:14⤵PID:9856
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,4123416716127706656,13376814664434544194,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=102 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=13724 /prefetch:14⤵PID:9316
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,4123416716127706656,13376814664434544194,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=103 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=13904 /prefetch:14⤵PID:9924
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,4123416716127706656,13376814664434544194,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=104 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=14132 /prefetch:14⤵PID:9544
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,4123416716127706656,13376814664434544194,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=105 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=14256 /prefetch:14⤵PID:9936
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,4123416716127706656,13376814664434544194,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=106 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=14020 /prefetch:14⤵PID:10208
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,4123416716127706656,13376814664434544194,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=107 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=13840 /prefetch:14⤵PID:9752
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,4123416716127706656,13376814664434544194,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=108 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=12028 /prefetch:14⤵PID:5196
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,4123416716127706656,13376814664434544194,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=109 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=13924 /prefetch:14⤵PID:9936
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,4123416716127706656,13376814664434544194,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=110 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=14228 /prefetch:14⤵PID:10188
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,4123416716127706656,13376814664434544194,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=111 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10996 /prefetch:14⤵PID:9432
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,4123416716127706656,13376814664434544194,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=112 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=13548 /prefetch:14⤵PID:6268
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,4123416716127706656,13376814664434544194,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=113 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=14552 /prefetch:14⤵PID:9792
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,4123416716127706656,13376814664434544194,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=114 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=13928 /prefetch:14⤵PID:9320
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,4123416716127706656,13376814664434544194,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=115 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=14296 /prefetch:14⤵PID:10092
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,4123416716127706656,13376814664434544194,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=116 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=14484 /prefetch:14⤵PID:8040
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,4123416716127706656,13376814664434544194,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=117 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=14112 /prefetch:14⤵PID:9720
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,4123416716127706656,13376814664434544194,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=118 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=14420 /prefetch:14⤵PID:9840
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,4123416716127706656,13376814664434544194,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=119 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=14740 /prefetch:14⤵PID:9356
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=internet+explorer+is+the+best+browser3⤵PID:3944
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffcf2eb46f8,0x7ffcf2eb4708,0x7ffcf2eb47184⤵PID:3848
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=virus+builder+legit+free+download3⤵PID:5088
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffcf2eb46f8,0x7ffcf2eb4708,0x7ffcf2eb47184⤵PID:3168
-
-
-
C:\Windows\SysWOW64\explorer.exe"C:\Windows\System32\explorer.exe"3⤵
- System Location Discovery: System Language Discovery
PID:4348
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=mcafee+vs+norton3⤵PID:5548
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffcf2eb46f8,0x7ffcf2eb4708,0x7ffcf2eb47184⤵PID:5564
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=bonzi+buddy+download+free3⤵PID:5440
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffcf2eb46f8,0x7ffcf2eb4708,0x7ffcf2eb47184⤵PID:5456
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=dank+memz3⤵PID:5424
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffcf2eb46f8,0x7ffcf2eb4708,0x7ffcf2eb47184⤵PID:5508
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://softonic.com/3⤵PID:3052
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffcf2eb46f8,0x7ffcf2eb4708,0x7ffcf2eb47184⤵PID:5080
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=virus.exe3⤵PID:4356
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffcf2eb46f8,0x7ffcf2eb4708,0x7ffcf2eb47184⤵PID:1488
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=my+computer+is+doing+weird+things+wtf+is+happenin+plz+halp3⤵PID:2072
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffcf2eb46f8,0x7ffcf2eb4708,0x7ffcf2eb47184⤵PID:5868
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=dank+memz3⤵PID:4496
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffcf2eb46f8,0x7ffcf2eb4708,0x7ffcf2eb47184⤵PID:1284
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=dank+memz3⤵PID:2628
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffcf2eb46f8,0x7ffcf2eb4708,0x7ffcf2eb47184⤵PID:4680
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=batch+virus+download3⤵PID:3856
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffcf2eb46f8,0x7ffcf2eb4708,0x7ffcf2eb47184⤵PID:2840
-
-
-
C:\Windows\SysWOW64\control.exe"C:\Windows\System32\control.exe"3⤵
- System Location Discovery: System Language Discovery
PID:5756
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=minecraft+hax+download+no+virus3⤵PID:3208
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffcf2eb46f8,0x7ffcf2eb4708,0x7ffcf2eb47184⤵PID:5260
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=montage+parody+making+program+20163⤵PID:5180
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffcf2eb46f8,0x7ffcf2eb4708,0x7ffcf2eb47184⤵PID:6012
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=dank+memz3⤵PID:3472
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x120,0x124,0x128,0xfc,0x12c,0x7ffcf2eb46f8,0x7ffcf2eb4708,0x7ffcf2eb47184⤵PID:2536
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=how+to+download+memz3⤵PID:5652
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x124,0x128,0x12c,0x100,0x130,0x7ffcf2eb46f8,0x7ffcf2eb4708,0x7ffcf2eb47184⤵PID:5132
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=how+to+remove+memz+trojan+virus3⤵PID:2708
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0x104,0x128,0x7ffcf2eb46f8,0x7ffcf2eb4708,0x7ffcf2eb47184⤵PID:1532
-
-
-
C:\Windows\SysWOW64\mmc.exe"C:\Windows\system32\mmc.exe" "C:\Windows\System32\devmgmt.msc"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2552 -
C:\Windows\system32\mmc.exe"C:\Windows\System32\devmgmt.msc" "C:\Windows\System32\devmgmt.msc"4⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4828
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=batch+virus+download3⤵PID:4004
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffcf2eb46f8,0x7ffcf2eb4708,0x7ffcf2eb47184⤵PID:1752
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=how+to+code+a+virus+in+visual+basic3⤵PID:4104
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffcf2eb46f8,0x7ffcf2eb4708,0x7ffcf2eb47184⤵PID:5760
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://softonic.com/3⤵PID:6552
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffcf2eb46f8,0x7ffcf2eb4708,0x7ffcf2eb47184⤵PID:6568
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=facebook+hacking+tool+free+download+no+virus+working+20163⤵PID:6812
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x120,0x124,0x128,0x11c,0x12c,0x7ffcf2eb46f8,0x7ffcf2eb4708,0x7ffcf2eb47184⤵PID:6808
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=virus+builder+legit+free+download3⤵PID:6764
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffcf2eb46f8,0x7ffcf2eb4708,0x7ffcf2eb47184⤵PID:6768
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=how+to+create+your+own+ransomware3⤵PID:4816
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffcf2eb46f8,0x7ffcf2eb4708,0x7ffcf2eb47184⤵PID:7032
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://pcoptimizerpro.com/3⤵PID:7072
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x124,0x128,0x12c,0x100,0x130,0x7ffcf2eb46f8,0x7ffcf2eb4708,0x7ffcf2eb47184⤵PID:7048
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://softonic.com/3⤵PID:3612
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x120,0x124,0x128,0x11c,0xf8,0x7ffcf2eb46f8,0x7ffcf2eb4708,0x7ffcf2eb47184⤵PID:2376
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=what+happens+if+you+delete+system323⤵PID:6476
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0x9c,0x128,0x7ffcf2eb46f8,0x7ffcf2eb4708,0x7ffcf2eb47184⤵PID:6548
-
-
-
C:\Windows\SysWOW64\mmc.exe"C:\Windows\system32\mmc.exe" "C:\Windows\System32\devmgmt.msc"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:5648 -
C:\Windows\system32\mmc.exe"C:\Windows\System32\devmgmt.msc" "C:\Windows\System32\devmgmt.msc"4⤵
- Drops file in System32 directory
- Checks SCSI registry key(s)
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious behavior: SetClipboardViewer
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1968
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://motherboard.vice.com/read/watch-this-malware-turn-a-computer-into-a-digital-hellscape3⤵PID:7656
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x120,0x124,0x128,0x11c,0x12c,0x7ffcf2eb46f8,0x7ffcf2eb4708,0x7ffcf2eb47184⤵PID:7672
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=mcafee+vs+norton3⤵PID:7272
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x120,0x124,0x128,0xfc,0x12c,0x7ffcf2eb46f8,0x7ffcf2eb4708,0x7ffcf2eb47184⤵PID:7320
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=g3t+r3kt3⤵PID:7424
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x120,0x124,0xf8,0x128,0x7ffcf2eb46f8,0x7ffcf2eb4708,0x7ffcf2eb47184⤵PID:7200
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=facebook+hacking+tool+free+download+no+virus+working+20163⤵PID:8060
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffcf2eb46f8,0x7ffcf2eb4708,0x7ffcf2eb47184⤵PID:6280
-
-
-
C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe"C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:7128 -
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122884⤵PID:7836
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=virus.exe3⤵PID:6444
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffcf2eb46f8,0x7ffcf2eb4708,0x7ffcf2eb47184⤵PID:2148
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=bonzi+buddy+download+free3⤵PID:6328
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x124,0x128,0x12c,0xf8,0x130,0x7ffcf2eb46f8,0x7ffcf2eb4708,0x7ffcf2eb47184⤵PID:3724
-
-
-
C:\Windows\SysWOW64\notepad.exe"C:\Windows\System32\notepad.exe"3⤵
- System Location Discovery: System Language Discovery
PID:8788
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=bonzi+buddy+download+free3⤵PID:7576
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffcf2eb46f8,0x7ffcf2eb4708,0x7ffcf2eb47184⤵PID:2060
-
-
-
C:\Windows\SysWOW64\control.exe"C:\Windows\System32\control.exe"3⤵
- System Location Discovery: System Language Discovery
PID:8828
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=skrillex+scay+onster+an+nice+sprites+midi3⤵PID:7884
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x120,0x124,0x128,0x11c,0x12c,0x7ffcf2eb46f8,0x7ffcf2eb4708,0x7ffcf2eb47184⤵PID:5940
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=how+2+remove+a+virus3⤵PID:9040
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffcf2eb46f8,0x7ffcf2eb4708,0x7ffcf2eb47184⤵PID:8972
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=best+way+to+kill+yourself3⤵PID:6484
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffcf2eb46f8,0x7ffcf2eb4708,0x7ffcf2eb47184⤵PID:8492
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=montage+parody+making+program+20163⤵PID:2832
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x120,0x124,0x128,0xfc,0x12c,0x7ffcf2eb46f8,0x7ffcf2eb4708,0x7ffcf2eb47184⤵PID:4444
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=best+way+to+kill+yourself3⤵PID:8612
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffcf2eb46f8,0x7ffcf2eb4708,0x7ffcf2eb47184⤵PID:8180
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=john+cena+midi+legit+not+converted3⤵PID:8704
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffcf2eb46f8,0x7ffcf2eb4708,0x7ffcf2eb47184⤵PID:1036
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=is+illuminati+real3⤵PID:8592
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffcf2eb46f8,0x7ffcf2eb4708,0x7ffcf2eb47184⤵PID:8928
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=my+computer+is+doing+weird+things+wtf+is+happenin+plz+halp3⤵PID:8600
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x124,0x128,0x12c,0x100,0x130,0x7ffcf2eb46f8,0x7ffcf2eb4708,0x7ffcf2eb47184⤵PID:8552
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://play.clubpenguin.com/3⤵PID:8864
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffcf2eb46f8,0x7ffcf2eb4708,0x7ffcf2eb47184⤵PID:8752
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=mcafee+vs+norton3⤵PID:9788
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffcf2eb46f8,0x7ffcf2eb4708,0x7ffcf2eb47184⤵PID:9800
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=facebook+hacking+tool+free+download+no+virus+working+20163⤵PID:8216
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0x100,0x128,0x7ffcf2eb46f8,0x7ffcf2eb4708,0x7ffcf2eb47184⤵PID:9288
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=how+to+create+your+own+ransomware3⤵PID:9976
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffcf2eb46f8,0x7ffcf2eb4708,0x7ffcf2eb47184⤵PID:9952
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=minecraft+hax+download+no+virus3⤵PID:9368
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffcf2eb46f8,0x7ffcf2eb4708,0x7ffcf2eb47184⤵PID:9444
-
-
-
C:\Windows\SysWOW64\notepad.exe"C:\Windows\System32\notepad.exe"3⤵
- System Location Discovery: System Language Discovery
PID:8624
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=vinesauce+meme+collection3⤵PID:9468
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x124,0x128,0x12c,0x120,0x130,0x7ffcf2eb46f8,0x7ffcf2eb4708,0x7ffcf2eb47184⤵PID:9488
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=is+illuminati+real3⤵PID:10016
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffcf2eb46f8,0x7ffcf2eb4708,0x7ffcf2eb47184⤵PID:10172
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=virus.exe3⤵PID:5888
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffcf2eb46f8,0x7ffcf2eb4708,0x7ffcf2eb47184⤵PID:9688
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://pcoptimizerpro.com/3⤵PID:8700
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffcf2eb46f8,0x7ffcf2eb4708,0x7ffcf2eb47184⤵PID:8044
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://answers.microsoft.com/en-us/protect/forum/protect_other-protect_scanning/memz-malwarevirus-trojan-completely-destroying/268bc1c2-39f4-42f8-90c2-597a673b6b453⤵PID:7996
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffcf2eb46f8,0x7ffcf2eb4708,0x7ffcf2eb47184⤵PID:9648
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=how+2+buy+weed3⤵PID:9492
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffcf2eb46f8,0x7ffcf2eb4708,0x7ffcf2eb47184⤵PID:9452
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=virus.exe3⤵PID:10212
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffcf2eb46f8,0x7ffcf2eb4708,0x7ffcf2eb47184⤵PID:8712
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe"3⤵
- System Location Discovery: System Language Discovery
PID:8820
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=how+to+send+a+virus+to+my+friend3⤵PID:9948
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffcf2eb46f8,0x7ffcf2eb4708,0x7ffcf2eb47184⤵PID:8040
-
-
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3728
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:5112
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuNDMiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuNDMiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7QjM2NjY5RTItQzVBNC00QzUxLUJDRDAtRkQxNUFCRDAwNjZCfSIgdXNlcmlkPSJ7MkZBODI4N0UtQUMyQy00NEVBLTlDRDktMUFDNTVBQjc5MTJBfSIgaW5zdGFsbHNvdXJjZT0ibGltaXRlZCIgcmVxdWVzdGlkPSJ7OUM5M0E2QTAtOTM5OC00ODVELUEzODktODUyQjBFODZEMzgxfSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjIiIHBoeXNtZW1vcnk9IjQiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xOTA0MS4xMjg4IiBzcD0iIiBhcmNoPSJ4NjQiIHByb2R1Y3RfdHlwZT0iNDgiIGlzX3dpcD0iMCIgaXNfaW5fbG9ja2Rvd25fbW9kZT0iMCIvPjxvZW0gcHJvZHVjdF9tYW51ZmFjdHVyZXI9IiIgcHJvZHVjdF9uYW1lPSIiLz48ZXhwIGV0YWc9IiZxdW90O0UreGJBejZZNnNVMTI4OWJTNnFsNFZSTGJramZCVUdUTUpzanJIcjQ0aUk9JnF1b3Q7Ii8-PGFwcCBhcHBpZD0iezhBNjlEMzQ1LUQ1NjQtNDYzYy1BRkYxLUE2OUQ5RTUzMEY5Nn0iIHZlcnNpb249IjEyMy4wLjYzMTIuMTIzIiBuZXh0dmVyc2lvbj0iIiBsYW5nPSJlbiIgYnJhbmQ9IkdHTFMiIGNsaWVudD0iIiBpbnN0YWxsYWdlPSI1IiBpbnN0YWxsZGF0ZXRpbWU9IjE3Mzg5NDU5ODUiIG9vYmVfaW5zdGFsbF90aW1lPSIxMzM4MzQxODQ0NDQzNjAwMDAiPjxldmVudCBldmVudHR5cGU9IjMxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIyMTc5ODYyIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI1MTUwMTIyOTIyIi8-PC9hcHA-PC9yZXF1ZXN0Pg1⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
PID:2868
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{DF658AB0-15FA-41A1-BBD5-4DAA560BF5AD}\MicrosoftEdge_X64_133.0.3065.59.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{DF658AB0-15FA-41A1-BBD5-4DAA560BF5AD}\MicrosoftEdge_X64_133.0.3065.59.exe" --msedge --verbose-logging --do-not-launch-msedge --system-level --channel=stable1⤵
- Drops file in Program Files directory
PID:4416 -
C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{DF658AB0-15FA-41A1-BBD5-4DAA560BF5AD}\EDGEMITMP_0687A.tmp\setup.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{DF658AB0-15FA-41A1-BBD5-4DAA560BF5AD}\EDGEMITMP_0687A.tmp\setup.exe" --install-archive="C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{DF658AB0-15FA-41A1-BBD5-4DAA560BF5AD}\MicrosoftEdge_X64_133.0.3065.59.exe" --msedge --verbose-logging --do-not-launch-msedge --system-level --channel=stable2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Installs/modifies Browser Helper Object
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- System policy modification
PID:3988 -
C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{DF658AB0-15FA-41A1-BBD5-4DAA560BF5AD}\EDGEMITMP_0687A.tmp\setup.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{DF658AB0-15FA-41A1-BBD5-4DAA560BF5AD}\EDGEMITMP_0687A.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\MsEdgeCrashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.60 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{DF658AB0-15FA-41A1-BBD5-4DAA560BF5AD}\EDGEMITMP_0687A.tmp\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.59 --initial-client-data=0x224,0x228,0x22c,0x200,0x230,0x7ff676556a68,0x7ff676556a74,0x7ff676556a803⤵
- Executes dropped EXE
PID:1064
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{DF658AB0-15FA-41A1-BBD5-4DAA560BF5AD}\EDGEMITMP_0687A.tmp\setup.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{DF658AB0-15FA-41A1-BBD5-4DAA560BF5AD}\EDGEMITMP_0687A.tmp\setup.exe" --msedge --channel=stable --system-level --verbose-logging --create-shortcuts=2 --install-level=13⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:392 -
C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{DF658AB0-15FA-41A1-BBD5-4DAA560BF5AD}\EDGEMITMP_0687A.tmp\setup.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{DF658AB0-15FA-41A1-BBD5-4DAA560BF5AD}\EDGEMITMP_0687A.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\MsEdgeCrashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.60 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{DF658AB0-15FA-41A1-BBD5-4DAA560BF5AD}\EDGEMITMP_0687A.tmp\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.59 --initial-client-data=0x224,0x228,0x22c,0x200,0x230,0x7ff676556a68,0x7ff676556a74,0x7ff676556a804⤵
- Executes dropped EXE
PID:5108
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.59\Installer\setup.exe"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.59\Installer\setup.exe" --msedge --channel=stable --remove-deprecated-packages --verbose-logging --system-level3⤵
- Executes dropped EXE
PID:2104 -
C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.59\Installer\setup.exe"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.59\Installer\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\MsEdgeCrashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.60 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.59\Installer\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.59 --initial-client-data=0x224,0x228,0x22c,0x200,0x230,0x7ff696e16a68,0x7ff696e16a74,0x7ff696e16a804⤵
- Executes dropped EXE
PID:1312
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.59\Installer\setup.exe"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.59\Installer\setup.exe" --msedge --channel=stable --update-game-assist-package --verbose-logging --system-level3⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:5024 -
C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.59\Installer\setup.exe"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.59\Installer\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\MsEdgeCrashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.60 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.59\Installer\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.59 --initial-client-data=0x224,0x228,0x22c,0x200,0x230,0x7ff696e16a68,0x7ff696e16a74,0x7ff696e16a804⤵
- Executes dropped EXE
PID:4040
-
-
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x4b0 0x4d81⤵
- Suspicious use of AdjustPrivilegeToken
PID:3120
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{655FBE2F-012D-4293-97D8-DE2D86D137D6}\MicrosoftEdge_X64_133.0.3065.59_132.0.2957.140.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{655FBE2F-012D-4293-97D8-DE2D86D137D6}\MicrosoftEdge_X64_133.0.3065.59_132.0.2957.140.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --system-level1⤵
- Drops file in Program Files directory
PID:2976 -
C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{655FBE2F-012D-4293-97D8-DE2D86D137D6}\EDGEMITMP_5473E.tmp\setup.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{655FBE2F-012D-4293-97D8-DE2D86D137D6}\EDGEMITMP_5473E.tmp\setup.exe" --install-archive="C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{655FBE2F-012D-4293-97D8-DE2D86D137D6}\MicrosoftEdge_X64_133.0.3065.59_132.0.2957.140.exe" --previous-version="132.0.2957.140" --msedgewebview --verbose-logging --do-not-launch-msedge --system-level2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:1432 -
C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{655FBE2F-012D-4293-97D8-DE2D86D137D6}\EDGEMITMP_5473E.tmp\setup.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{655FBE2F-012D-4293-97D8-DE2D86D137D6}\EDGEMITMP_5473E.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\MsEdgeCrashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.60 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{655FBE2F-012D-4293-97D8-DE2D86D137D6}\EDGEMITMP_5473E.tmp\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.59 --initial-client-data=0x224,0x228,0x22c,0x200,0x230,0x7ff6a9306a68,0x7ff6a9306a74,0x7ff6a9306a803⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:5324
-
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuNDMiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuNDMiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7QjM2NjY5RTItQzVBNC00QzUxLUJDRDAtRkQxNUFCRDAwNjZCfSIgdXNlcmlkPSJ7MkZBODI4N0UtQUMyQy00NEVBLTlDRDktMUFDNTVBQjc5MTJBfSIgaW5zdGFsbHNvdXJjZT0ic2NoZWR1bGVyIiByZXF1ZXN0aWQ9InsxMzk2RDI0OS00MDBGLTQ5MkYtOTFGRC1GNjZGQTg2NjQ5NEZ9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iMiIgcGh5c21lbW9yeT0iNCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE5MDQxLjEyODgiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIiBpc19pbl9sb2NrZG93bl9tb2RlPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iIiBwcm9kdWN0X25hbWU9IiIvPjxleHAgZXRhZz0iJnF1b3Q7VlBRb1AxRitmcTE1d1J6aDFrUEw0UE1wV2g4T1JNQjVpenZyT0MvY2hqUT0mcXVvdDsiLz48YXBwIGFwcGlkPSJ7RjNDNEZFMDAtRUZENS00MDNCLTk1NjktMzk4QTIwRjFCQTRBfSIgdmVyc2lvbj0iMS4zLjE5NS40MyIgbmV4dHZlcnNpb249IiIgbGFuZz0iIiBicmFuZD0iSU5CWCIgY2xpZW50PSIiIGluc3RhbGxhZ2U9IjUiIGNvaG9ydD0icnJmQDAuNDAiPjx1cGRhdGVjaGVjay8-PHBpbmcgcj0iNiIgcmQ9IjY2MTIiIHBpbmdfZnJlc2huZXNzPSJ7RTgwOEM0QTYtRTg2RC00MTZFLUJGNDUtMTg1MjlDQTcxRDMyfSIvPjwvYXBwPjxhcHAgYXBwaWQ9Ins1NkVCMThGOC1CMDA4LTRDQkQtQjZEMi04Qzk3RkU3RTkwNjJ9IiB2ZXJzaW9uPSI5Mi4wLjkwMi42NyIgbmV4dHZlcnNpb249IjEzMy4wLjMwNjUuNTkiIGxhbmc9IiIgYnJhbmQ9IklOQlgiIGNsaWVudD0iIiBleHBlcmltZW50cz0iY29uc2VudD1mYWxzZSIgaW5zdGFsbGFnZT0iNSIgaXNfcGlubmVkX3N5c3RlbT0idHJ1ZSIgbGFzdF9sYXVuY2hfY291bnQ9IjEiIGxhc3RfbGF1bmNoX3RpbWU9IjEzMzgzODgzNjc2Nzk4MTYwMCI-PHVwZGF0ZWNoZWNrLz48ZXZlbnQgZXZlbnR0eXBlPSIxMiIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iNTE3ODkzNDA4OSIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjEzIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI1MTc4OTM0MDg5IiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iMTQiIGV2ZW50cmVzdWx0PSIwIiBlcnJvcmNvZGU9Ii0yMTQ3MDIzODM4IiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI1OTA1NjIwNDI2IiBzb3VyY2VfdXJsX2luZGV4PSIwIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIiBkb3dubG9hZGVyPSJkbyIgdXJsPSJodHRwOi8vbXNlZGdlLmIudGx1LmRsLmRlbGl2ZXJ5Lm1wLm1pY3Jvc29mdC5jb20vZmlsZXN0cmVhbWluZ3NlcnZpY2UvZmlsZXMvZmVkNTU4MDUtMmU4NS00MWQ4LWI0ZTMtNGVmNmI1ZWJmNjNhP1AxPTE3NDAwMTQ4ODQmYW1wO1AyPTQwNCZhbXA7UDM9MiZhbXA7UDQ9bmhmdGJxZ3ZxWmVWQ1l5ck00MmJ0VWwxJTJiWncyT0RTZ1V4NklZOGQxOWxWNE10djFlYk5RN3lMaURnVTViWktGbHJ2WVhTZFdGaHVhWnFDOXhkdHYyUSUzZCUzZCIgc2VydmVyX2lwX2hpbnQ9IiIgY2RuX2NpZD0iLTEiIGNkbl9jY2M9IiIgY2RuX21zZWRnZV9yZWY9IiIgY2RuX2F6dXJlX3JlZl9vcmlnaW5fc2hpZWxkPSIiIGNkbl9jYWNoZT0iIiBjZG5fcDNwPSIiIGRvd25sb2FkZWQ9IjAiIHRvdGFsPSIwIiBkb3dubG9hZF90aW1lX21zPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iMTQiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjU5MDU2NDA1OTUiIHNvdXJjZV91cmxfaW5kZXg9IjAiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiIGRvd25sb2FkZXI9ImJpdHMiIHVybD0iaHR0cDovL21zZWRnZS5iLnRsdS5kbC5kZWxpdmVyeS5tcC5taWNyb3NvZnQuY29tL2ZpbGVzdHJlYW1pbmdzZXJ2aWNlL2ZpbGVzL2ZlZDU1ODA1LTJlODUtNDFkOC1iNGUzLTRlZjZiNWViZjYzYT9QMT0xNzQwMDE0ODg0JmFtcDtQMj00MDQmYW1wO1AzPTImYW1wO1A0PW5oZnRicWd2cVplVkNZeXJNNDJidFVsMSUyYlp3Mk9EU2dVeDZJWThkMTlsVjRNdHYxZWJOUTd5TGlEZ1U1YlpLRmxydllYU2RXRmh1YVpxQzl4ZHR2MlElM2QlM2QiIHNlcnZlcl9pcF9oaW50PSIiIGNkbl9jaWQ9Ii0xIiBjZG5fY2NjPSIiIGNkbl9tc2VkZ2VfcmVmPSIiIGNkbl9henVyZV9yZWZfb3JpZ2luX3NoaWVsZD0iIiBjZG5fY2FjaGU9IiIgY2RuX3AzcD0iIiBkb3dubG9hZGVkPSIxNzg2MDQwODgiIHRvdGFsPSIxNzg2MDQwODgiIGRvd25sb2FkX3RpbWVfbXM9IjY2MzAzIi8-PGV2ZW50IGV2ZW50dHlwZT0iMTQiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjU5MDU2NTE4NDEiIHNvdXJjZV91cmxfaW5kZXg9IjAiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSIxNSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iNTkxOTkxNTQwNCIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjMiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjE5Njc1NyIgc3lzdGVtX3VwdGltZV90aWNrcz0iNjYwMzQ1ODYwNSIgc291cmNlX3VybF9pbmRleD0iMCIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIgdXBkYXRlX2NoZWNrX3RpbWVfbXM9IjM0MCIgZG93bmxvYWRfdGltZV9tcz0iNzI2NzIiIGRvd25sb2FkZWQ9IjE3ODYwNDA4OCIgdG90YWw9IjE3ODYwNDA4OCIgcGFja2FnZV9jYWNoZV9yZXN1bHQ9IjAiIGluc3RhbGxfdGltZV9tcz0iNjgzNTUiLz48cGluZyBhY3RpdmU9IjEiIGE9IjYiIHI9IjYiIGFkPSI2NjEyIiByZD0iNjYxMiIgcGluZ19mcmVzaG5lc3M9Ins4MkYzNkIwRS02N0IzLTQwNTktQTk1Ni1CMDY0QUU2RDAyMjl9Ii8-PC9hcHA-PGFwcCBhcHBpZD0ie0YzMDE3MjI2LUZFMkEtNDI5NS04QkRGLTAwQzNBOUE3RTRDNX0iIHZlcnNpb249IjEzMi4wLjI5NTcuMTQwIiBuZXh0dmVyc2lvbj0iMTMzLjAuMzA2NS41OSIgbGFuZz0iIiBicmFuZD0iR0dMUyIgY2xpZW50PSIiIGluc3RhbGxhZ2U9IjUiIGluc3RhbGxkYXRlPSI2NjA4IiBjb2hvcnQ9InJyZkAwLjE1Ij48dXBkYXRlY2hlY2svPjxldmVudCBldmVudHR5cGU9IjEyIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI1MTc4OTM0MDg5IiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iMTMiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjY2MDM1MTE5OTgiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSIxNCIgZXZlbnRyZXN1bHQ9IjAiIGVycm9yY29kZT0iLTIxNDcwMjM4MzgiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjY5MDQxNjc2ODkiIHNvdXJjZV91cmxfaW5kZXg9IjAiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiIGRvd25sb2FkZXI9ImRvIiB1cmw9Imh0dHA6Ly9tc2VkZ2UuYi50bHUuZGwuZGVsaXZlcnkubXAubWljcm9zb2Z0LmNvbS9maWxlc3RyZWFtaW5nc2VydmljZS9maWxlcy9hNDcyZWNlYy1hZTY5LTQ0OWUtYjdhMi00ZTg2ZGZlZTU4YTk_UDE9MTc0MDAxNDg4NCZhbXA7UDI9NDA0JmFtcDtQMz0yJmFtcDtQND1iejRMTE5QVURGZ0dtN09ZJTJmZEpNQUdmTzFMeUx5QktmWFh3SyUyZjVDRDVRbmtwU2tKS3pRTWtnODFTMk95RnVzM2RkOTB4M3N2ZSUyYmE5cHZOeGdkZ0c2dyUzZCUzZCIgc2VydmVyX2lwX2hpbnQ9IiIgY2RuX2NpZD0iLTEiIGNkbl9jY2M9IiIgY2RuX21zZWRnZV9yZWY9IiIgY2RuX2F6dXJlX3JlZl9vcmlnaW5fc2hpZWxkPSIiIGNkbl9jYWNoZT0iIiBjZG5fcDNwPSIiIGRvd25sb2FkZWQ9IjAiIHRvdGFsPSIwIiBkb3dubG9hZF90aW1lX21zPSIxIi8-PGV2ZW50IGV2ZW50dHlwZT0iMTQiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjY5MDQxNjc2ODkiIHNvdXJjZV91cmxfaW5kZXg9IjAiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiIGRvd25sb2FkZXI9ImJpdHMiIHVybD0iaHR0cDovL21zZWRnZS5iLnRsdS5kbC5kZWxpdmVyeS5tcC5taWNyb3NvZnQuY29tL2ZpbGVzdHJlYW1pbmdzZXJ2aWNlL2ZpbGVzL2E0NzJlY2VjLWFlNjktNDQ5ZS1iN2EyLTRlODZkZmVlNThhOT9QMT0xNzQwMDE0ODg0JmFtcDtQMj00MDQmYW1wO1AzPTImYW1wO1A0PWJ6NExMTlBVREZnR203T1klMmZkSk1BR2ZPMUx5THlCS2ZYWHdLJTJmNUNENVFua3BTa0pLelFNa2c4MVMyT3lGdXMzZGQ5MHgzc3ZlJTJiYTlwdk54Z2RnRzZ3JTNkJTNkIiBzZXJ2ZXJfaXBfaGludD0iIiBjZG5fY2lkPSItMSIgY2RuX2NjYz0iIiBjZG5fbXNlZGdlX3JlZj0iIiBjZG5fYXp1cmVfcmVmX29yaWdpbl9zaGllbGQ9IiIgY2RuX2NhY2hlPSIiIGNkbl9wM3A9IiIgZG93bmxvYWRlZD0iNTg0OTgxMjgiIHRvdGFsPSI1ODQ5ODEyOCIgZG93bmxvYWRfdGltZV9tcz0iMjg0NTQiLz48ZXZlbnQgZXZlbnR0eXBlPSIxNCIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iNjkwNDI3MjU4OSIgc291cmNlX3VybF9pbmRleD0iMCIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjE1IiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI2OTEyMjc4MDEzIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iMyIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMTk2NzU3IiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI3NDQ1NzU1NzQ5IiBzb3VyY2VfdXJsX2luZGV4PSIwIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIiB1cGRhdGVfY2hlY2tfdGltZV9tcz0iMzQwIiBkb3dubG9hZF90aW1lX21zPSIzMDA3MiIgZG93bmxvYWRlZD0iNTg0OTgxMjgiIHRvdGFsPSI1ODQ5ODEyOCIgcGFja2FnZV9jYWNoZV9yZXN1bHQ9IjAiIGluc3RhbGxfdGltZV9tcz0iNTMzNDciLz48cGluZyByPSI2IiByZD0iNjYxMiIgcGluZ19mcmVzaG5lc3M9Ins1MTk2ODc5NS0wNjNFLTRDRkQtODEwRC00QzIwMzc4QTA0OTV9Ii8-PC9hcHA-PC9yZXF1ZXN0Pg1⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
PID:5732
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{5BD95610-9434-43C2-886C-57852CC8A120} -Embedding1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:5184
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}1⤵
- System Location Discovery: System Language Discovery
PID:3472
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3724
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc1⤵PID:8164
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Active Setup
1Browser Extensions
1Event Triggered Execution
1Component Object Model Hijacking
1Pre-OS Boot
1Bootkit
1Privilege Escalation
Boot or Logon Autostart Execution
1Active Setup
1Event Triggered Execution
1Component Object Model Hijacking
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD5a43e9ce8d33ed6eb2b8f5133450d64dd
SHA1f2b9a2eab4b80d7bef0a6e076423993b77f66332
SHA25639bace95aa685a42bb379404c0e4f2a11254a7d5ab9a9b5551d311d1dbc05bb6
SHA5129db1c9de9521cd7bd4af5062693d3557ab196fd552bb6000c1d4266426127c9c7c6eada263e90f99bf941fb1c863d10463940e164a03e0742ee070a35fbcdf6e
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{655FBE2F-012D-4293-97D8-DE2D86D137D6}\EDGEMITMP_5473E.tmp\SETUP.EX_
Filesize2.7MB
MD51a59a8af3c58b30ff0fe71db2196b24b
SHA16b0e5ba36f4fc5328ec494272054a50cafa13e68
SHA256ba25974b29a25cb7bc1f58a0990a8ce758354aa6ec5b8b8af210f2c1466ba49d
SHA512f173fe15db8d7aeef4f6fa62a41246550ccee207e6388095a5f87036362d4c95da646e1a7c68764054556e024da80b749646425076e9bfac42fb77be8f2c0355
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{DF658AB0-15FA-41A1-BBD5-4DAA560BF5AD}\EDGEMITMP_0687A.tmp\setup.exe
Filesize6.8MB
MD51b3e9c59f9c7a134ec630ada1eb76a39
SHA1a7e831d392e99f3d37847dcc561dd2e017065439
SHA256ce78ccfb0c9cdb06ea61116bc57e50690650b6b5cf37c1aebfb30c19458ee4ae
SHA512c0e50410dc92d80ff7bc854907774fc551564e078a8d38ca6421f15cea50282c25efac4f357b52b066c4371f9b8d4900fa8122dd80ab06ecbd851c6e049f7a3e
-
Filesize
73KB
MD53901cff488d154149c6c16ebf3e3c750
SHA15e5a3968dab498706eb672c061541d1052b3418a
SHA256100e40ef3bb62ec327aed16d8c98b9d491e1c8173ff3de55b38915b7240166cd
SHA5126d062de39702b136bb0552a0b7399f5860d8931301418a1dd1886916461d4c25a43b8e8cfaa28f9176775c289d3d593af50fa61cd4759ebdd9af6289ef78ac7a
-
Filesize
101KB
MD5a8b40d24e53ce4012f39d10bab489adc
SHA1c5841cc2ca1df41f8fa250a1382ece8cc8978026
SHA256061884e61e04c9406b66ff1e14f5bc57f43915e2506f5dccbe7932304c86e659
SHA512dfb39135f11137d3f9887a8b0ce65f976b2cacb3812b40a1d0ab8772ed915e7397bd5691b795f2cdfdef850816ff1324932dce89c05a14a7539f186a48394aa9
-
Filesize
102KB
MD504ab9db054506d9c7f887140373b5025
SHA1ecef64db9dc685e766f09ee18b04fa837a799653
SHA256dd1d43d1605d9377a81fd3a72cd4dabf7eeb0589953f947180507e08b5566ca0
SHA512d83965070d8c400bcc35d836373205ae831deb274d542eb0395fb3f5532cdafcd7cf2849013b42c7e4a7c4095ab75fc7e43ba3757204485827f55c8f3d6a815c
-
Filesize
104KB
MD55a62a9a6e0a72efb46f9221dde2f8fb2
SHA14c2ab44b2443d997e08a90870ee1186595e538b7
SHA2568ff3cf6aa3933786e62de5136a9faa558ed1c9ead5915d81af1ab16ea41322d9
SHA51211fefecf679053cbfa13dbf661282cdfd61ade9034b99d167c0a2b8b819d684d19dbe7f5290cda265f3b092a8362f52d763e8110c1cfa628206a5955e70a32b3
-
Filesize
576KB
MD55903754279bc96dbcd80c1c6b19ae2a7
SHA1c20ab1d511a67c8dc2c33b112cecc7ff146bec1c
SHA2563032968007163b9576940e9b6b3fd2a05a54a30bffb132a74b9003c607b147bc
SHA5126f62dd09e5d70e1f45a386be1ae5b9eaca70379df972b42af6e6687f0bf25de1a0bf496a26079d952fd412b873f018d61a0d8b3df1979a32973a028a7a2885cc
-
Filesize
152B
MD591aff9098a47bb8e012e47e54f6bceaa
SHA17993f5174f54489cac8b04c1356b7b47da944202
SHA256cc46d5631b8526010ae5e52980fe9fd9b38c4cb27f56cd524b321ab091685cbb
SHA512184defaee159dc93c128c5a7a2ce15e9cbf99bac58ea2372642c30bf6f1f52e178a110e0e86204ba65d82b7a7fd5514cbe7092daacceecb1aab6cc6a208e850b
-
Filesize
152B
MD5a230789a90c3150dde7ed452a9b35a08
SHA1e934d8dce045c99a5d4ce22d6e470f787ca2e027
SHA256b754b918a9236857008c518409ee816120e5f55430218c03a7c9b2af56cdece3
SHA512f258391b4cfa5f4b7537d15af1af661dc58926a63fbf8238fe564e9e80525fc3b4b04719611d1619e036f56808c460363205ae06c835570b77f97b31009371a6
-
Filesize
24KB
MD587c2b09a983584b04a63f3ff44064d64
SHA18796d5ef1ad1196309ef582cecef3ab95db27043
SHA256d4a4a801c412a8324a19f21511a7880815b373628e66016bc1785a5a85e0afb0
SHA512df1f0d6f5f53306887b0b16364651bda9cdc28b8ea74b2d46b2530c6772a724422b33bbdcd7c33d724d2fd4a973e1e9dbc4b654c9c53981386c341620c337067
-
Filesize
71KB
MD5e56d62454dff11b61f910b0fadf7bc36
SHA13ea3a682f6f95d37d04d5c04fa46f1bb1de1166a
SHA2564bfa7a058a1700fa91405421b62398d43e073dde6e36b8a92de0f59419c7d929
SHA51283e641a35bbc9a97116d1c2be311a556abc55d0c385517c125c71232ba006c895c962469be5e9adc2dd98ca725d19894c665440ef479a63fab6b2048d76848a0
-
Filesize
135KB
MD59b01fda08bac00a1bf2fb7ce6a43b0c1
SHA19a7d71415f41bc43da4b74ae7479912f3e0c53ee
SHA256d1aafe5444622b7c19776ccbc84d53a69d539b6309ca27de1f18cdf809485541
SHA51203e173177582a8639f2aac872058cb5e2d32559bc7662eb652e65a251cf2ac478b891ef64e323f369344b5af7fddda0b213427c0fc9b7aec8c442c6a229cb4c4
-
Filesize
16KB
MD568c477c4c76baab3a8d1ef6a55aa986f
SHA14af50379e13514558dd53d123db8ea101ec5e24c
SHA2560364d368abf457d4e70dbc7a7a360f3486eaea2837b194915b23d4398bee91ac
SHA51292b34fe3b7f82f10cf6de8027ac08f4a5b8764fb4e0b31c93da6e3d5bd08e0bc83b79fd70b8207a1066b689583e0b6976fa3c885b0c067ea343e6f2031d55d25
-
Filesize
45KB
MD5a569d4812f94e51f3cab5eed08c825b2
SHA171653b0684bdc6d3659bbf63c9a350aa5ebddf6a
SHA2561248e3e5a89e50a0c3921c0196b747d4e1e617008ccfe21949dbda3c5cc050b6
SHA512316ac6d7be2bde5be032ee45cb2035609f00e22670e3d63a185f0f8e5b1b6a1dc48cf1275b1965bb5796cfa705bc0b34e570baf63f49729d0546c42f1c07f323
-
Filesize
138KB
MD5529515f340c2061bdf4e958e4e7fd578
SHA1dc16a10bd124f439aae2c38e1897ff4a35416b7e
SHA256878c53a810fb927c775c4241e096b7f9db07f3662f4ef6c81f18e7fdbe697923
SHA51265832a1f5fd6456a435da94c46eaf6b5eb49b03b95ad28a81c51c9be03e232c893e3658de21bbd72fbb7822f7d860cb0eb20fcfdf92c80f8cf8ac9bd6e829a74
-
Filesize
129KB
MD5990641bd1a5fc3d7524828f5403834dc
SHA179499ebe8e169ead314f6b45c206c2bbdb174055
SHA2561c7ea4a8ee329207800c298f3fe961b6c2f0de3a5274ef0eb776b9edc27a8635
SHA5129632d40e284e0b8b3b94ad35855a494308961800a26d355e073b056b81df4f49a66fdfa821276abd847236a9147273f6272ac253fb6421e1163f1f4d3e6ab722
-
Filesize
20KB
MD550a5fb0f9130c7c5a14393abe8067463
SHA17b838e376e372bfaeae763d1dea6039a242e6e2c
SHA256285ac034bc4497e8a87ddc798e19d11edb2eeac01f11698434bd82149b229b61
SHA5126f97559254903982b3b1fdc17520ca64fef5bb617dbd65cfdc46c47f71dd732869dc5028a2c4ac6eca8a4401cd11e8fbf5beddbdde2411c8ee087fb82fc5f466
-
Filesize
155KB
MD5fb803d6299928ae6d04f9d2eee75e516
SHA1626cf056bc7f0b13d7c4ce0303c14d63126571c7
SHA256c372e4253c85ac5f138fdc38e0d0edc19e728c2fec641d009b3830b42c1b8fad
SHA5121c1bf063e684adfe726b9ef4fffa2bf53e20f5a26d87e630374f43d3aa4b2ad03286b949b239783bc2447b86eaf7d8ab0e821920a696ce9d40cb89b36135fd8c
-
Filesize
65KB
MD5d9de0cf282a4521618a7e3ea06ab3107
SHA1cb7f93bd8ff5f39bdb3d6dd46d85874c50f62959
SHA2569c2a3331aee4372b271d73625700916e451e0240f40bbe8c4580e090ae235b80
SHA512bff7736039e6aa53cd91344a80e2456379993e4ea3144537bbe7c441018b969a0b9ecc1698e3a8e941df0234b942bdc7eadac18120693cf99beb9c54bdebc641
-
Filesize
50KB
MD57feb924fae493c5e6624a129b3a87756
SHA1835ea3017524ff71ac694e3a71795bacfa8d2cf9
SHA256f7ec7350a369c6b439493de616fb87d17f3737a1c5e3c12f2c0a63fd963f4475
SHA51221397d774d96f0f26093589812da8b8afab2e07063006298611c5f42ae925240fb871e260e7e1e3cc8a7b9770d568af612f288cd5e88f3872db68b9448fc38a4
-
Filesize
64KB
MD5b6b73c429b6f5b1fdc4a136d05909b00
SHA1f8ac3cb308beb33f5f2a6025c5f41b8ed8d569f7
SHA2566a2908455e9d93c50bbf4f9b869b68859a476b04a766549849b31a3acc93d90c
SHA512fdb5fbb29c6267ba3013b98ba79f367c1d43e7dd9a8818d6a826b0b5b2dfbc7d4ee5f351f6f42187405fba70451452154d4f46b59bb91c3e6060b94bca598627
-
Filesize
58KB
MD5f3520a5c8d626ea23f4617229e4ed0e4
SHA11b24a5aed3f6ba3e8fa295963da2cc69c54921c5
SHA256edb7d677286bb00fd4b38782212480fa3f0bf953547ba6ff6a49d3de112dd682
SHA5128c5e0ce6f853848b4312a5bdcc5358a9481e7766cdb69abe12aaf66a087e5e20c91ea41fbd71e700ecc9b057f8483d7e7b47afd035ef430922276d5c57f642fe
-
Filesize
124KB
MD5339f2e8a391ccdace3baf373ea635df7
SHA10adc0d37f7baf4c9a390d895a6e0703d7d2ce013
SHA25632142c3e41194fcb645a13d828345e9d95d5070c7bf6bd377ca9cf4a5ed0b736
SHA5120891aff7fa2f539bc29cec32c15f7ac7f4bd5d40203ee2d2038c309dc9afd9f781c9ae772aed27c6851af421e4b12d5ad911ed2e3f01aed292f9748a4fddab5f
-
Filesize
75KB
MD560ecef8fbc2584737e97cb8f1b9bce28
SHA125925f63ca88ee1cdb39e1b2d2b5fc3aacf05ce9
SHA2562081852fb670127fb8aab551d2fe4a6100c916fd874cab3629c5ba91fda41622
SHA512fcbce1ff5f8255ce4d9f0d7a4a75984220b86902d4652349dc77f94603097eb16a7bb6ba1bf44bbf3ab329b165e57088fb0610af9c7732576700ea396a407c3c
-
Filesize
245KB
MD56bb771bfa3f1b1c3e0ecc0c78a9229a4
SHA1a7a6228f48f4c956d4539fee59eb1653afdd0ce3
SHA256349c59fe454569517cdc468e63c98e51b252b04d5af0718f6a1a67c6ae769bbb
SHA512000b33ef4f65c3219f3f7524ba9176d731c7185085c8d29631c8d15dbe9be4a657c97e2bb5c1d44d06dd6747377c4c97c6c036c9489d5c28d3d2ec60a8f6a301
-
Filesize
354B
MD5c3143ee437ed7cf64c20f4a3a10ee2a2
SHA1ba890eeb96184cd69ed69f6a0fd5a89eda64f6f2
SHA25679fdee210e05d83367310e79a28764a03af3754acf0d0185e450fd43d54041b8
SHA512d691f09b87c5b6751cdeca7b7dfd55cffdd1bba1be251b775b17bfd876db21c033773d57815a916723bf868d86400f713eb7fa2f80fac950cd51819e3314ab41
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize96B
MD572dc61cdd9b6bf186106176fa70df05e
SHA120a47c7a9fbae22bf1fe76ef5a150790c051bf7c
SHA2566da85907691015875e204ebb4f433cc2d81b12d77b50418d0ff4457cd2836a6c
SHA512fa34f81f1d867d50738164da02397f34e6274c03ced73fc2cacd1b1f1f4b589e94732be6c1070ef866ae0d3a9841346e3f22c88a630ad25d3f2af4ac3eb35cec
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize768B
MD580e0904e0d19403853092a62ad3406e0
SHA1952ae291855cf649d0826f1a394c9222b1682ecc
SHA256450816896a9a2fe24a116ed8bcf4fbf3d6c41cea5a222032f8c16aacad538a19
SHA5121d611b04c3f0326fa6776b7eb644cc28bce6c537fe983e32359e34b525f0b2aa1243245d51b3e740871efe32283de4d0bfd288b60de924f529e4c3223833756e
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize288B
MD51661a83296c38725f84498acc4d9d4c6
SHA1ec03ab2cc69972173fbe9206ec04489d7d83c707
SHA256a20892223d5f107a3865b8f1924dbfc398b1afcebe575447e439226da4e8dbbb
SHA5129c2d62ce9b509bf2208495f0932e29296d9596e6fd2922ce1fe200aecbf5e65788d34d07fe9cfb743f514070824d694fc2fd86f47d2665e7adcf8415db3376a1
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize288B
MD5e1f624da73d283ce63d5da481480d8a2
SHA1b0fdaff41eb7eb2761d973df2c15d96f677d7cdf
SHA256726a471936befd4e4a1c734ca1f2833983ec65a15c4c16ac098a29f443627da7
SHA5127012022bead66a7fbfc1b926e51050b3b260b9b3cf8d3e4b75b50872456e91d14c10b177c8f2b4fb84d98316cffd3721a2fe97daf58bd889eccda6cbf29d216f
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize288B
MD52f49af50fe7c448d9d0363b023ed5d03
SHA1155c546ec419a28adc320643f8cec75b6db199cc
SHA25635f6347d09ce676af49b7b63ddca3b171dfb4b3375e59463a2bea64f9f91677c
SHA51290d8d734f98053c5853a7d9ffcde0b24f89138993863977d04cb5bd644f73143397cfd9e4c14f5ed93ef6d058c47bd5b6cbc72b97f29d92d35fc200810448ab2
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize288B
MD5349fb059c28d8ca1f4d81a8ac1df1772
SHA13377192d77bb1b9b8251d15855e5d3a5634e1699
SHA256333870a155a0bec79ee12c65ac525f52d01b04c81fda4deb17b7da514335c5e8
SHA51258f3176e8107a2770571bffa268dd9cbe8917ef4979513cf3a995f8c84fa1f5efd15722321c806dc48904d2c4a42ba7d227fa6ed29b038d9fb0f38ddf6660e82
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize96B
MD59335d1e72d2dc1927129d67bad656ec8
SHA1010717685edf94f2f3d3008cad056e38a4c9a5d6
SHA256307641c0f5e551f0ad74c9cb0cfe7d83dc750b902521d460d1a529ad70c00d0e
SHA5121e4ba77510f521032574f0b0df530052d881b7bf1d08733a0cc8d3e222e5783d153f2550687dd2b5cc31171b1dd07f61b3e36957a455effff845c4a26dc4fda7
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize1KB
MD5e0a07abc1d100141418c4ba7580aa22a
SHA113ebf7cb3ba863d5cdd7e40e9cdd6e06f058df8c
SHA2569b03875205c45d064f0698f857e0e39af00747b0bf678ac2ada63424bb2ddec1
SHA5125ab19f5dacc8056d884d2a5bffa084c2e611bb53416220ecd4ef508ec02b0f540f4500b75db7e6ce07c0a9820b36a85353dacd975f5817c76f1aa7029b8188b4
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize72B
MD58cb4b1041a88cb7ee14ecf57d7a71d04
SHA1030310d24b3387de492835469e282c2d709b47bc
SHA2562a51ae1b145051640080579c29c6c809e44564cb1c1912c807ee00a8cc327419
SHA5125cd372620daa05a9720e9d4aca719a010af5535724ffbc904851dcddcd0484f79f7af9104888eaf1eba6d101b103668e7cbee0933bdaaf76c375315cead47a65
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize96B
MD5c5aa136290bf9d47d365d881712e2c64
SHA1e91de2a7ac60c74f15fe03346aca32fd72cd142c
SHA256235de0a4c13b788d95761a8acb485348d3e330542fc3077a30712a76233cec64
SHA51225b2301625135f4de21ebd21420d90145a31b8bffc9145b415775fee70bacf201117503df3f56964b2d6b98feccd4302d3e53f98c108ad5fa14f910bd72200c0
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize96B
MD5771f4e232181f20da01b79a1d419d756
SHA130e8751f7e7122a2895831230f8e04508cffa728
SHA256036703f53bbcc388f7e22c85e904bfb9e68643b0e17ecdc9babc0c6953930137
SHA5126e90d5bb9aa81ab39c952a3f5aba2f1a1432bd3b0f6a2d66fea133eb8fc07e15696938ab3c740984ff60fe574031c53697bf6fcc1deed507553c1cdc476159e6
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize96B
MD558940a77439daad1d6244b2cfdf62164
SHA1f083698e09aa3ce2e1a1411a52dd537c1cfb4377
SHA256595d286df3c538c0fa7a6a4c3fdf2b978e4b5ed00e9cfd60d2f5fc0c13f5e3f5
SHA512d2c93a85857696c463f650c60e72fcaae605f24b668e3f3fb1a88dc4bcdb43425294d68a8dec7b9a7b627039b09bcac9a5427379c15a597234a4776cb7481ebf
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\CURRENT
Filesize16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
Filesize
3KB
MD5abdeb860b69ed5a31b8bfbedbcd25804
SHA1722dacced16d60215f3aae9a0dd01d7c97a9bfd7
SHA25689c5a028aff4af9817ae35829f3cfb9fadb136b0f4f07da4c37291e50af72762
SHA512de28f79d4a5857d7acbb046ae92978f5cbf63d81bc0fc413e98bbb1f9622e77534a232d1ecf8c34fa2d6227d9da43ed01b6695384e7916d52fb2d569c28e5f22
-
Filesize
3KB
MD5b3d7b1dd2488e57b2327de43f587b990
SHA19022aca9d3561c3247128fa19cae20a93d48d273
SHA25623868c2ba4e738509bc8aa1cd3e20b107ed4386675832c9b2c3bb274fd722e08
SHA512892fc3da92d716c154d944b8c4e198757a17f9383dc07e4f6c5cb2296a7557f6ebd16d22f4dfe22da959501d2bf9051875bbaae7a24f2ff6d942cee57bd30d48
-
Filesize
3KB
MD52e2c5f4b97abd0602ab976449af4f8c8
SHA18bbd1412bd7b9dc8e51511ee746cd867b4a80894
SHA2564c8fb41c557f7f03b31be4a7d851a6ef1b411ff2c8d1615613ac25c14fdaedab
SHA512e7ec90287d8aa47b54bca9ef38daefb0860b4bfd40d7e3b0667f7ae765cf68cb87f953d18c7bce77af482a4c457177d042267bc92c00a9fdca74fdfd2e2bd1a7
-
Filesize
9KB
MD5f9dfb6a19397bf4cba544256f77ae7f6
SHA19af182a067d7be37101a59498a46aef2b957c4ac
SHA25669d4c1edb04e8886fc7a909abfab01c1e777b6c3825568f5d4e9b3092505e971
SHA5128293c72f2b0a462e7964e4e0fd371bd2c83f435490ac29643a12aa3639ffb77cd9536d2399d3a27909cd86d98d032c26d172bc1b2ac05510995e62306cfaaee0
-
Filesize
3KB
MD5e3c7b46e63802d7b21ef19fb3f31c491
SHA1aecfac92c10e1c78307155280bfba82ae2840e7e
SHA256f3a1d40380014ba8595f0d7c0bfe1e7f0b75364588bcf5826f7cc0100964169e
SHA51260209b44ef33f20fd3d08885119e79eedb337d558155759a2423029bcf9e7c5c7285c796aee804a95798bdf6218e549260d178bae229f5135c6dc0db05a57885
-
Filesize
5KB
MD53c6282632ef5075626cb4c4785650003
SHA10082fc6e6370a56c5ff05248daa75d90e5ab78a4
SHA256aa4cb611815ba45fc22bc96fe358075672db6f1c003b75678d5d8c7da94a5f2e
SHA512910aec5ac212727a41e96ae6606a1601e1fc21c91379f523782b4ec26c9047e7929ebfc812af4de21268990c33cfbc9651e3f96c4524670cb5d6a672e7d6786d
-
Filesize
9KB
MD51cd531f0f5bcadbb26090f668c4e635c
SHA103dbfd7904ae0f76ae9d3dc53ecec2463423913f
SHA2561ee702148b607206e11c6d4f04a31def630a4a6a46e370bccc4a4c97c1ff9a3e
SHA5121a8665e20d038d310a0388654fb1ed211e79dc13665f4cd4b59e9226a05c225400f952de8fe1c06b549a0ba8ca9e8a588084d78e490c5adc2c8fd4cd9de90f38
-
Filesize
1KB
MD5ea828df0b1b14fa8fc94337fc705606f
SHA1c1e235a3281bad8258502a6da6cf3afad175506f
SHA2562bd794f0e462efd861f46cf5d038b5b380fe10fc9fb6a6a2144cab74b5fe756f
SHA51210d379fdcf51b00b5ac9c55cee2176c5749ee1f877c3c3553697c3ea19f55d23f77187b8c401c2f1f31f8761aee9f94d952162795b9b6205af57991472752a99
-
Filesize
1KB
MD5fb644aac5565b64ac280a9061dd3df3e
SHA1e773cc41e4c872d419ef5d9a3d9252904efc6711
SHA2564cc5b9a2a890177f4f83eb09d4817f2f1cc926ca890d4261dd2ff03392a88dfd
SHA5125f06c1eba0ec87a5cb3fa466b93bc46fd0e3f61e7a23dde1aeb2f8f9aed4c6ef5a4ea1ae151656b108c6bf0b2bd0fba22500d0346e4865c4b87b634d92b377cb
-
Filesize
12KB
MD5031a14183d73aba2c6ac0e97ccaeb336
SHA1e8c7df353dfcb2c6d115ce59e82e2ad22f4d98fe
SHA256c46c337c7801c9ec96fa083a4db08d2768b07357cb629473c5be01b6d7e6317a
SHA512c27bc50ca1fd54b3c2df40de4e6cd58d12420ef1b9674cd3c3c3f19bafd33626cc166411fb9e88dc0b694889f2b95d1d74e77e549d87d523a2ca6d77a03e262b
-
Filesize
7KB
MD592607c4cda66cad99fed3dcd7c5380ac
SHA178eb1b43cc5eca7f32a9e4cd4b86b8d7ef5ebf56
SHA256e9d6a372fb14bad4cf494c4571eb191f532e391ae8c1fc250555a247a5629fa2
SHA512c9180a94e7c71f2237e39d4a66346a844e2a66e2d3b4d5a29de5951447b0f3f9058b84c6b22fdd0f29388564b894007005e2ad7d3d1eafda468847e51cd6a39d
-
Filesize
7KB
MD56504b03921ebc2ae513c00b29904fd67
SHA1b5a30ca9a5e76abb3a2c254fc9d5161dd39f80f2
SHA256e8f2f72582947a8eae3e8647d3699476faf7157e5563ce906b04dc5789bb73c1
SHA5122da847d9feca13379691bad56037701605ce866b7409a464bdba38dafedd439f96724ceb4d3e27327d1ff23699c2c1c5a7d574936b3dab1614c80499181d951f
-
Filesize
7KB
MD5f992b448526e5d54cd475e572dac595b
SHA12086745da8fd339d1e63398a72dd30fab85f5b4a
SHA256710975be6e1d25a2ab22900bb5e5073b16697643e7a35246714ba64783a6456c
SHA51251d7f985d067393aa8645694a2e75474c99aeed72e7311201e2a6651200cc2d867b7e90ec1343d9958d10370dde988476fda7643baf80d4f681b6d00dfca62af
-
Filesize
8KB
MD554648cf45cd61ffc09b31cd8bdf01674
SHA1a4ae51583e14d7c82ee2a84f45bb07983eb636a3
SHA2562cc1c9e457851683c7298d4ae2b77e641be38dabdd4f120e5a91df9570345131
SHA512b17b18e88e2d113d06844d3596bc95ea305dffcece26dd0e31de87f8184e3cde0ec87f4b22d71ad67c1dd6ea9ed737b4fb5787d2ca08e7e809569dec4f5f69fb
-
Filesize
9KB
MD5825e499c4baea616f303b1329d7e0a0b
SHA187d08ccacd520b1ee53e569666c1932c8a5cd8aa
SHA25691f71b099bf65723ce77eb377a9d6c99ba3a2b3cdaf6b5d6d5d5fb452afe3b74
SHA512e9cc435797c8c26190746ae1fa712ab96edc7251f84fb10c6429e71d83f6eca3e20236d8a44be10e7d4baf029f9eda7ac00ec7c905aed67ff641c978a3fe50dd
-
Filesize
7KB
MD574845452ded2f83ff8d6afea413786ce
SHA1676a552a831015592e8e55fe24e017235afb5355
SHA25646ff2bd0849204baa2c298b95ec66c782bd401147452e9d2f929d5e279a979c7
SHA51238d5e3ec8d8b2a026bc8d2d207662f4edd2fc0da5499f3870e84c61e8dd351c048d93d870c074a80152c0f46fe3b505258223f69ced0ad15518fa3fe7e9d2752
-
Filesize
7KB
MD5625245ab500e863ad93d6847cd67df26
SHA1ef52d5a5486cf4ec34463a062e0da41e76c1c092
SHA256cf237fc67b9e6c36926cff1819a4935ebe73cb8cb5327c20f2fbc140c7e74604
SHA512c5659609e39738cc6b73ff417d59e77e84fb6486844278786dfec14a7acb757bd072a84824b6e383a0942db99865497c02bd53d883bcc20b53ae646bcbadccdb
-
Filesize
7KB
MD5d04a5337f40d11386a5250c358123fd4
SHA1f07967db8f29e121ca7b8cb86575ca64261932c0
SHA2562e4477645105e1751184ec6124672e289bf720b399d45933f9c661543ad8923c
SHA51288af918356e1978a6f7d66a7a800ea460fbcc3a7a6409dd060af51254b5ada335a7ef70e4e8769bab6f993e65cd3a96793612c4d0c2c9f93be716753c6b7f52c
-
Filesize
8KB
MD51a91a98d0298e6721a02a75ef6a7ee30
SHA12061a95014e2bb2480a6a7a94e4b723366a1b019
SHA25628d43512d6b18fff3816111715e590bf478d760ee836a5c6fa18a15479583da5
SHA512eb8e227ae90e1f07340fb14ebbd301c326925d842ed0f1947953b070fa6dec84d377a95fea4d700a83139ee81edd4131e0795ec1bfefd6b08acf6d31ca3c70f4
-
Filesize
8KB
MD579b72d88bc00e77e4478328ba08d88c3
SHA14e616c5bbf404e6d629fd73920a22cac46a2104e
SHA256e964e1cf89fce3873cbbbcbaa41487c980f50a8fdd82ff8458d4b05935c28c2a
SHA5129de990f90af57011d7109374e89f83cfe42e48a2a6afe7f488ed333b2957b7714f11e4cba72236686fc52a6ae48539beeaa518ef430e1c1daad37da200b4b5f2
-
Filesize
7KB
MD5b1ed20cf143e7e5a3d0c96a39f097326
SHA1a94c1753a6b752af4055ab6a801eaf9070b8124b
SHA25675332e6a45f8d978536f50b5ca07a73ae512db584cf820e6767cbef9acd7c3ab
SHA51215e68cf7b878c5c3a7a12d2e5722fd44447247ca1b4f4ef08e0f5f974bf44889338a1eb8742dffb6d1e56173611ba4a5364461b33548bce233e5d810b591daa0
-
Filesize
7KB
MD5da2f3bbcc7b3246c8740e2c555ed154a
SHA1cd93e0a49a392f9828ca483d6d99510dfe19bcc3
SHA25652fa275826d7e9b87494390340e9681405a00a036aa325b58efe6c591c459108
SHA51221abcb2c5763980bb17c5038d01743fe2dafeef4104c2b2fe0088ac4a29e5c39451522c4f64f3e5e1e597100b5f5f0b5d2ba6a0889a3d438b5374ed8567d86d7
-
Filesize
7KB
MD53e23ac0c257fb8d4e493cd45b91bc759
SHA15bc766433a9475bb3c1fc3cf0d7743f8073197d8
SHA2569d5ea42a8579fc9e929f7216dd8c9f71d00f5ea3c08694cd35264ce6110c0433
SHA51256a2cc61271442c4790b3e0f82c7ac441c315098a948b75eec57a37316d8db225936407ef6215981aaf60912e0fd160f11c0c037a5f936eb73c720f8fc34b389
-
Filesize
7KB
MD50a19e66d2d9c4ed57166406d392f1fb0
SHA1ed6c131ad8319984e083aac0e97b6b76b85bb86b
SHA2567d8c83e31570f1582bb70e153525011ef9115da4a6f077205428969ca1ae9d87
SHA5123f18b420613184f4918d22512ece98334488b8e90c20cbd8f5eaeee8c14f553fa418bac1a01890ebfbd81879701e757ed0d18272400a0a2ca34344f225405ef0
-
Filesize
8KB
MD51e5db71fa785951287517e00c88bb8c4
SHA1d7cd0e5bfe6828c1e5905194a1b4f006108e2449
SHA256e454696efb2f897f0b594287e2a768d3ce2957c33d7caabc4cbb88f44aeb2bf4
SHA5128b0464c91b2d436cecc597bc26f811722b1b09425962d85cb6285d3c2d0a7b9d2dc6ac2f0c7598c9a8bae57aaf4d92a713d9ca07b532a9884a2fe87a68ea6295
-
Filesize
12KB
MD56e40eed8902fdaf263d6b38f29e5a0ce
SHA19bd8a5185ff0853133e2b3e5d7715e6f6054d127
SHA2564342c39e59c4f30116564bbc558553d7778d19ae4c63115e938b793e14a7a53f
SHA51268c38c133fa225b0adc81e4e01321371a528179c3cdffcd33044f18ee9b6bdea8af23c9ce2ed55ae6b6973945e51be07318ab645c03b264046310aab06ca41bd
-
Filesize
7KB
MD5c200557c69fb8b8ccacd39edf71bc571
SHA1f32fccf3285bb7c4c2c8c9a84d1621062c85f7c7
SHA2568356f1f8d4f511cbc47541de898d675e4d7eda8723d3d4f518fa582b0ed4358d
SHA512e2b288de6a0a800f9b5f23c0f102a580aa05c309494872f59c0c73d29d2c70bd8fce58d4e3dc8014cea5e720871201b645f7a4291604454f0bc586d423effced
-
Filesize
7KB
MD523af717b0f07c7e3875e3f334346aa5f
SHA1a5ce91dbebf3227cb552981f00afb84441a00255
SHA256734272342cc2fe20e5295147ef578fcde3bd8063ab2b2b28c786f9a01b82bce9
SHA512d181d3abb751856588a39e8eb0b29d5646166852e209b2d2ea3246e2a4a4547e98f6bb8919e2d4c7d2a268a6b80235661ae3eee7a7f5b15718f07da027723a1a
-
Filesize
7KB
MD57c70a522142ceb804fcec8cddf52a49c
SHA1282b93ad64ca5b8ac891fa7e45e05dd6ae7568c5
SHA2567b995eb492871bef49ca2086d784502d1cf43e6adb5778f1f4583eb2b1170ac9
SHA512dc2a1b372a1016502ae43ffcec11e3fcb25ba4cbc81d5147205d26981e6b8e8ea0fd2e310face6721139737cba603f191dc1d9da6352b506448dbca0cb7b2db6
-
Filesize
7KB
MD54986325bf2ec7cdef6d72b81c3374bdc
SHA1923e85523f68fe7ab54ce5e29953172d7972286b
SHA256ba6f93da4cf20de5b5477add1b11175742e6d8e0b052de6f1aed5ee0d6dc79f0
SHA512b81895c6c2424d1d3f61b853566302b23c08533d5e7dbb34d28f2b2b5bb78af7b9caece3bf84a957437f10070b903a5f7e4ad4b9afad8b52be7537bacbd5788d
-
Filesize
7KB
MD5da3dca128ff3f26648362aa6115b6fd5
SHA1e2a37720d40dd224e2171a0d4aa5b5a4e20b4e46
SHA2563b531d51a3cb930cd52c207eb6ce92b207e71f21f6f7b88c4696f247a11928ed
SHA512763449dbe7d44df23c01d29a00f9860f1963dd8527a7d4aec6f2a67b4a8e9f3b793631ac21ed5ae5c6291264b4f845b5f63246d0c1fa18e64e90299a894df754
-
Filesize
12KB
MD53d484f40370eab33653bbb45d8041f32
SHA1fcacc19534465d65e9c81c20478ce3fecd9fcc9b
SHA2565db9fcd8449021305ff4570b785d20358cd2253acb953ff6bdc0ef972d0f827d
SHA512a59cee91c318334393bbac8ef72a3aaba3b0acc97f73c6752d00302e050e79c4dd8836ebb6f7f9b8090c6c94324c7d19d2c46d8e4c707019b430b6163bb5956a
-
Filesize
12KB
MD5d96c90b5cb93e92bdcaa577b32b7970c
SHA1fd5333d8c4d7dadbaa7f40ea7c06e264bdf25d1e
SHA2562dcb4d64c9ef2a70837361abf00e27d1057a8b1bf4bf66ac09eaf7d57e070342
SHA512f0ded7714a3adbe750e93bb7f932f5d2ea145b8fcb7af789e1f0ce20d9911078c18abc505a9ef7eac485fba290fc342ade314092d27d84935bef8af95f120f4d
-
Filesize
12KB
MD50ffaae0b6e404093a495095c79f94c21
SHA1ebaf2f786673dffe328d8af6c0dd84ee93e4e548
SHA2561f95adc198cf13b179312d84c784703c681617a6f8f01d392d4dd489dbb42398
SHA512991046110dc84ec0d63e43922fb9b09c84bcdab826ca35a721bb06ba9259f6f8f47c206e31817c9f1714cdb15c3dc57f59eea74df3d01be8afee569ee93059bb
-
Filesize
12KB
MD58247b96d69d9212b031e47aa77f4359c
SHA1c29596adbb8f4c35a3e2de2a52c2d379b3ef8b4a
SHA256adf5dfdcd5b1a14db4104a2292b52ee9a9b7545ebb026438ac88832b8eae57c2
SHA512e19885aa5578de80decc5d4a1a9fd84653a378cc33e6bfceba75799e8fcbb9874e7d0f47ff69aae7e1fc261af9c492ec5708c1fe8af307cce9a0eebf21d47f6a
-
Filesize
12KB
MD5851f00c3d44a43e3c421454c01d70981
SHA16cb0345cce4c7b31e730ef20011124a1da5e407e
SHA2569e8db1f972c5a2fdc1f0c4f46af2e9d67568dd63ad195fdaeeaffe328bd8b103
SHA512dc9484fa7fc9810a79f935a0d30bd107c932c0a8d7c4a3ae83fa85c40693f093eeff9d22f63bc83bf217fed5a90785ff55b457842ba2a2993a6b9b195e0e18c5
-
Filesize
12KB
MD543cb1f6572c5f8a575937643056b7f37
SHA1ed0038d5b049152cb08d4ece2ef97f99816cd24b
SHA256c27dc7274e5c4fbe168bcaf78aabd85e399909a34770908f9b40e06370ef9ec5
SHA51217ce3624b7a86acee8fe12cf3dcd6623d508def7ee1063d1b50239f48d11da3dbeadd035289856f7501cfa614fd1b156b51013c57a50682021ffbb1687f2305f
-
Filesize
8KB
MD5894c0886ca8b9b80485a3bb648f61abc
SHA19059f1d0434aad4f0af3a101bd8b8b48e36567ef
SHA25606c9974f97399561ca85d2e90776a607e76b45539101eda2761f33ecccd2b2b2
SHA5122809cd92e29922a2d6cb8a8377c105ca9000eb5450306fe1ca08d5682c77cddac58158acc0daf5dac469738e5a25519cd83374d5d82ed2c97a37938aee3a8ab5
-
Filesize
12KB
MD5020477bcf46698b8421ed8525dcf743e
SHA19ac8716a7a9dd6348da69e2181928bb6a754b94e
SHA2560f7278a5fc781b972f46ae9f945dd79cfb916f512299d54b744be1562d277e27
SHA512179b1d88083de8d40278b8fbf33bb16b205e9a2a8b5d63401a9403628a97420bb6558b34c8af0921bc3ec11a0922603bc68d0d42275578ff74c74294193127ae
-
Filesize
7KB
MD54c480c22098e89171dd7ee8e845352ec
SHA1c064dc8196086db5ed38b058eda8ac5393737fb7
SHA25637a8b261d0678ffd150dfeffaae7fdfb2562b92998a37c90bfb69acceeda266e
SHA5127a4416e47706ee0bfc98fb3c80ab9a2203e946c58bd5c6480da249b9e6215a2ecaf6abd136b5efa8bdcdc9ff2dbf7349dec79f4826d6c1fa43f0978b540b0f87
-
Filesize
12KB
MD58d526ea37134c4024f885f9480f8dc84
SHA1736b112b0bfc574d1235fa6de44599c3573fcb56
SHA256895dcd1f2704061d51b9cf227fe5ea1bfc543740c3be3dca95f2fcecb4544312
SHA5125dd79c2f0ff440a1c08bfa1592b7f78fe8e93ea1b2a816789c8765d4d863b61720a0f5119a312a2f4f6cf965958ec7009e98c4d071486885324a72dcd1466032
-
Filesize
12KB
MD5dca1896736c2fd191f4155c0703c6001
SHA11966acb283046b8462c5347af5ce1b20d0c25b5f
SHA2561fe5b5252499a0e64f8e5b8703c81475464537fc415841870ec3797b70281338
SHA51254f620060db5df6695e861b1e79c17af4ead89fb3a3df275f8902a097ea0cfbb257dd55b14507222daeb2d236c8dfda223ca5c232b7b8e064d91aad1db323312
-
Filesize
6KB
MD5c5808b2997fd030b63539bdf06ab8e82
SHA105c2d7af8cb2f5736ed7bae9cbe1db6acbffc004
SHA2565d777b0b46ba14eabd4b8613f7938f01f60cdbaeb2b1e4f7a6d4ed3b61e6e9bd
SHA5128d7758fe78a87991ebc184959aaa342c8b39d95c52b61ee12708be25e1dde665b7c5beb1259f36bc425c58b09ec0a96256ce494b5adc4f71a5a238e6b15874ec
-
Filesize
12KB
MD5b542ac60ce2b6be8c9c342ad6f781b13
SHA13c3129783cc9f1380f3211e03ad8b2695d2bb973
SHA2561c26f4f1c13c52ab19c2b791d8ff2970f140a147d2069749933f7f19593200a8
SHA512d66687c02805a75df0263aaaf07550388f046854dd946cdb1a393ad95713b979d052288814ef3f3a63396cdbb494dc3fea5796176f561bd713db13b43da81de9
-
Filesize
7KB
MD528b5d1941038c9ef4345edbd815c4e8c
SHA19ef887926fa1cb08519e97f8a23f68daedc83914
SHA2562281ddcb8b2f659acabd418adcf8e7ddc6491591edde3c686dc869c843f6b6f0
SHA5125d14f96892c4694b430ad6e0bebd09c8ca9e54a721ceb01d707c6f2f954a7acdc13b8942bff97b897373ead8fe14d049a63421470976a455a69e7b3b58161160
-
Filesize
12KB
MD5c95e9f4d9da3681915edf7ed5d389c20
SHA190b309e85660debe0034a6fd2df34a839aac00d1
SHA256ef4128eee61f295a8e3368e02a1c5b9379a8d7cd9f83d80b44146ca1ad60f693
SHA512e150076cefadb7ff8b0599f022eac0200091c20ab6e1498072e6fa83ed3836a0cb341ab92c032e2c1da27e6801fd7a0c417490102848b48547bf91255e6b2cb8
-
Filesize
6KB
MD51b29e90830282dd5b37d821858bcd72a
SHA12fbcbed1132587678ddc3bdd1346f391a5386e17
SHA256fa6643a8572209043908e8da6d85fe6c3ddeb820caaa5a394a1cadf5cb5668aa
SHA5122bdbc3e6d7176a8a40745362ac596a14d7f3cd71a1e600fe54d0bad24ef51d4a51e442d60e7c6eade480fcf1b9ef56cd0e67c24ccd101aa3df64db96060cffc0
-
Filesize
12KB
MD5996bb9378c30650f2e4dd5ad1879ba72
SHA102f457b2a07ea64f9e35e49b04ce1684193d1afa
SHA256e18b2510a258c6bf4a080af74efda9c1175ed55fca17b2ea43fe951b2ca17a9b
SHA51238ed84085e3b277f563bb51d5e6351f428e377a64a1c43f17c251716c14e3750c3b8e8779c04f19f6376f0cb2c12bc92a435e25aceb9371dcc2f2f28429d8dbd
-
Filesize
7KB
MD5d1c7a645db980b4bf5bc10b92504d2aa
SHA19edbbf8ec135659fa5fd5d661284b7c871ef58f7
SHA2561bea10bea1c860c8c4f07ec59082f140d9d7e1b17e7cb4de12ba966bc0656ed4
SHA5122db9fa7bfa5f7e9dfc98eb3fbe58259dd6fe41a5a68290a5701570d72a21535de92ca7e66d5656f77b49f9a9912cb837e92763702299dc7a30c54735f09aa812
-
Filesize
12KB
MD5553215351cae1f0412072f14fb65ed70
SHA1b44014eae2e2d17353f1c856aefa7974f4314b4f
SHA25682ae4bf13e4f78b95655de43367f01b6ae72f40f4d9b08b37ec1012be1d5d83d
SHA5120d97c51c51cd782e4e8c1ab7a9cfea3061a46d0e142681148fe5a448a8b27d5d8aa562128bce412adf0fee73df1dc4f1c7013b026d96ecc8bddebb5a7306edcd
-
Filesize
12KB
MD589091f307beca04c93ef0e47ea79406a
SHA12e13e423ae296a747dd3dca06d0b23e861833861
SHA2563e635990d604b98b55cb30cb9e31b5ab05ecb59511b4fd9b7be5f200d7148180
SHA512ac5d6f29e1eb6205163878bc7d188b5a3d7e83ff3626453cad48500f87db2df78316b99e6ca2ac6caded49e720d216d516cb5d4798ec971f07f7b04b8b0a77ca
-
Filesize
12KB
MD5b121e0b43adc1c867cc03d2969cc0f12
SHA128e915aa0d0c96f910d8bf7b4ce4d55cb9b8ba2e
SHA2563b4836f39dc7461121c2bbf5ffe94504b1c46099a01e2ab7d7d6add13685fff4
SHA512d0e4fcdd7908b606a964a4684038588f7d30ae05934b62d5278b609dbb7dfdfa043a8645bdbe8ddd34e3935d54e2f1281a15eb01030a573577a1b786b6a2e9c4
-
Filesize
12KB
MD5bf6992d6e003d56e601890aa65f7b092
SHA1efd4842d8f8d444c14991e842ff6e3f6c4cdf764
SHA25617ad8801de4652a4ee4bbd9f47acbc2a4f30c64bc2278c82ff9fa37a2c25d4f5
SHA5127bf6ca8cd22cedc7a44ee6c4f93ff6ee5e4c2765523f7268b4d1f0b95fc52dae07f0091b7abd703cd04fb0decc7cccedae67a84d417367687173444b1a61f994
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Filesize26B
MD52892eee3e20e19a9ba77be6913508a54
SHA17c4ef82faa28393c739c517d706ac6919a8ffc49
SHA2564f110831bb434c728a6895190323d159df6d531be8c4bb7109864eeb7c989ff2
SHA512b13a336db33299ab3405e13811e3ed9e5a18542e5d835f2b7130a6ff4c22f74272002fc43e7d9f94ac3aa6a4d53518f87f25d90c29e0d286b6470667ea9336ae
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt~RFe60d323.TMP
Filesize90B
MD534df14f3bf6e29ffbfe21147894a539b
SHA1de51331cfe6b3bc3a1fbe4edad2aaae465dfc417
SHA256bbba0bd2b6a939eca611f0f5fd2c838f6b670d26340b8ec6276ea429a345dc4f
SHA5120560090ef7180585072f1d4e2b49c42dc836812369b0b2e9959833505cba6e2aa1a4bba944c9ed03da1d290d69f69236d42e0b95e7f4c3676608f60b710640fa
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Filesize72B
MD538598f1cb9b77b74a6a32d5554f48321
SHA1ec19981a42e93a24ddfe70afeb2576064421fde1
SHA256723f6f3d906a7ca13bdf02b50c91c7575d9d2d503e7632dca91247009f4804bd
SHA51297497e3917048328a70a0744e087ab95a2f05a877de4a1dedbab7ac7eb2f9705f18cd7e277f61f8b97366c1c0b947f9aa7771220bd86fcb292d2b976e7085ec2
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5f6fe9.TMP
Filesize48B
MD5a378cd82a10bf3a9de9b459a10a9d613
SHA14d99cfe5f225f39182c0e9a0f1fb8a7430842994
SHA256f5be8de89fd1db4c8009b40639e72af76b87b788fda32fecf89a674939511024
SHA51280b3c77c04a700f30a8c8b8f7050f4de08c4803a2478c5dfe9ca36b627b07c12b0fd7ba0ba272b1f9ed8f7af000e31dcc108e19975dbe19f9a8ecebe36f17ee5
-
Filesize
2KB
MD51b45147716f5aa3692a8a4204ea7d240
SHA1fe3f2b26afc983147cef12bbf4adaaf10316f86a
SHA25669e01acab14240774d3aa0ac4d9ed661b946c27afe2afbcc2f42a11c7874feaf
SHA512ceb55f959b5b25f14ebd4734769bdaefcecd6be4de68d5dc3e89a0dd584f72dcb228d166e27d95bdf1cc186db111745904ea49f0439b9d6e4db76505ac6ad187
-
Filesize
1KB
MD519e0792dd5435781b919bd9d3e76a3b7
SHA1f1385775bea4f513c0dde7d5490b5904d975d943
SHA25688445af6fe0fc96dfaf52dd85c4196a534b4d2f3b81c7464241ef20ee4e5385a
SHA512203b72fc1b5f17914cb1f7f7a9b2c09f61beff3eb162550eafcb1d0c733f034bf0cf618317fdf1e8d75548c2608135814a018551fb7be8d18354f9cc567e7e0e
-
Filesize
1KB
MD52ee0d6ab3814583afbf119459b930f1c
SHA1781fa80c838481f979493d7e8aefd1620be8703c
SHA2567e956ccc4068b29faf42d709cf3c464a02a96b659d60be33f37ec83d259dd216
SHA5123dc911f4140170e7c63dc223d0430292a97cb3c8835159ddfd1dc239bf0ecf8c373ff1916030fec11a10322376411ad60535d34128d25398a32c3ea926ccbb4c
-
Filesize
1KB
MD536c240a06e9c022010da58671606b0c4
SHA1070b8881c639caaf347ae678bfbe77761cb1262f
SHA256125dad2aeb8b9b5673b030000e0da1a9aa1ac41f87e0e4b2467e97ca270ffcb9
SHA512b70ca5483d62f8ddf495a8dd7863215e7c790a597c04b68ee488523e6f7e4a9feb4ba54314b1faf1a952e9ebc7d66f8a836e2ce0c7b1649f12f593ecbf899a67
-
Filesize
1KB
MD5199cc8164b33e1aa8ed9ce96c894312a
SHA19bbaf81db48546c5f12f46fde047d403e80f6ac1
SHA256e67ea344bb05c40c7f0aea2cbefc61ab570036adf79621a6c8179d1beaa1dfda
SHA5120789f543c8e7901e69c50694245d0ff2e1f76a27dbfd219704ca8a95976dc7e032ca42585a0df49533bf738d8cb275c8aece719caf26f596f462ad4630280ba9
-
Filesize
1KB
MD51ed187c7f9a9bac753e41ab4250d5a84
SHA16392faa30dd3fb8625875525afdfa7ffc6f2c33e
SHA2561a0c45d90456579ef2065dbcaff61c09abaaed27729dd57783c97a7ab4521cc7
SHA512d2f1cbac8af049afe72523f89d98c66f1351f1a4e11ac46a6c0e9d91c8b8027c67d5af9fb6474718a28ebb1273482ecab166bcc74cc1805a0ecbbdda36089948
-
Filesize
1KB
MD5e07b623b2d44f5eb3ec8c703e27c120a
SHA16c86fcc3b898e7b8ad7a5c90cf4fd342ff2a408b
SHA25683601fc2b7d3fe1b826f06653d5239b3b29b24096365108400dc894ebd91fb8a
SHA51284428b39345fb455afbe99f25eeb543ae95d4773befe2359a5719eabc67bd813dc921351f656bf1e864e09456f18da3bbde033b2e6fbb67fb8c34990b8232dea
-
Filesize
1KB
MD5fc70bacaccf01dfc6cd23f2a59c93366
SHA17bbff3ebca73aa85cef888ca6a01e3087458ac36
SHA256616ad57b944dad36e8cb858040c5c0d72cffb8e33088ce0f96a135e05f4b2680
SHA512732bf9b36d529a6cf53523c54c8933f5d55b806a2e517042ca7125bb928614b6cab2482cc7e22a189a19d87e50d6315a880ef542ba7135baeefa3e58bbfb4be0
-
Filesize
2KB
MD50039439005a60f21e69b945863516a76
SHA168f29a3c76a6364b43c4439fcfa86c60f13fe5e9
SHA25661c2010d1914f1b543ae516ad187ff072b0649ca87ae46cddd5e8bfd7ed27611
SHA512b79042b8d743ab5c2d637e13dc4629510d2ab184c4e7ef1050fc8e4d78343283457e52452eb15d9d52108f5fe7a0bd058271cc637256407a9b2ff451a78d2bc5
-
Filesize
1KB
MD5785f3163bee053e4f89caf09346ed0bd
SHA1beedca5ab91bb8e62492241a505acecd7143fbf3
SHA256afd3e2e8399a31ae085db56c0716fc84f9fb35e33f73824a7f59faf3292ed9f7
SHA51201631baa3a3e822d6fb026d513b43a05c3cd401e67c57e3c42040fe0fd045e587c9b0623eb736f0309a40a507919d85cdd3c14eaccb0a921f64e82b92a6adb19
-
Filesize
3KB
MD512a92b44394bf501037eda5037b920c4
SHA16a00b2cda6bb9ad250de5c84222b9680b7a957a1
SHA256d15cdf0f2decff3a97b60f00fd7f509b0c4e7c3e8a46cc55154fe8a7c7559c68
SHA5123a7792d0c0b5c35c91883c7cf82c46e89bfd06725cffd7851fe09258deb7db21e222955f54bd318ff9bbfb5c10a6bd8390bd75e3a008d017570e05b6dd8a6b88
-
Filesize
1KB
MD59928858dd0cc93fbd6396df21cf5c1cd
SHA124496831fb7fb4c0ce3c09837e63f5061bb6c576
SHA25665c16b09a0a130da282ed11102e9bb669db54e149c8de8679d936403dbcd5628
SHA51251359bf39c1af4bd7681fe6c36b267cf9b77d21c3a0cd8ea7e14928601b7d4173c1465f7f45486f97c1fea98cf4ed5b03ef117fdba9c3ea024aea547e05d19d6
-
Filesize
1KB
MD55838b46a6212754452fc327659630ae2
SHA1b6eca0ed84259f01252031f4f648da3f90ccd97a
SHA256555ac3c5842aa9a39ccb842f5ced5e003cfccd3d9b3ed2d41e0cb6139313c549
SHA51237674e3e0ced523971aa161f888c80938bcf5e3324506e6d308073b6b98c75a75f6f03b90c553805f080573457a635c161ed2dc53aae4edb5b0c534522ca75fa
-
Filesize
1KB
MD5ddba84240bd2ac7095bc41d034fcb60a
SHA163c4c345a541b6dd95e13c36236c71586934a6be
SHA25607b221fdf63e43b7103886264955325b7015b4b927c9e3e7baf90e767acc2809
SHA512d8c88899ba8c5bb7ff1d8003ee74a6f85206ee5ed70ddd73e52223f3d7ef9652aab34b948b2ee55fe9e7d5f654f2ea8be553883f664c4bcd6f0cf2660eb714cd
-
Filesize
1KB
MD5bc37d724f1b30983468edec8e3b4cc3b
SHA1653db2d81d41568ea9cae6ebe44ab17c963e01e2
SHA256e58507e76b7883dd121b7a3bb46d669d8e2e5c620474e8b5524fda07ad21a6dc
SHA51253211b53ee6053457ae2f342e3a3b978ff0e565aba1714ea0080cba72ea8aa47ee74f0efc0318f9d114bf0b84043ec7c9688df1fe59a198b7c68d3b4275d6e22
-
Filesize
1KB
MD57822d286bf7c8a2c6dfcc5d1a5d90c9d
SHA175825d0dbc2361e6c54d197e09b18ca6be9b801d
SHA256d612cdbeedd4921c063b587d03ec4d78367dea92c1024f0f794916c29594cb2b
SHA512fcb8dc78af1e5b2bd3f8d460428e07295f96b07b7260c8f1f43d7f23a84c9c639d32674b9132dd3f77e20565298171906428349adcb1df7f9a246fb0adeddfbf
-
Filesize
1KB
MD5e984882fcb5abb869e9e2328a9c40544
SHA19310d090caaae1c63a12cefeea933235289c70a9
SHA2568df4ecbb7b59fccf3d35ff8e6c142cb561aa7318451506648a59de79079efc35
SHA512fd7e489c0986aa594458816312f5fcf8d50907bef3a2e96fd83a96a1d171b20bb02ab0e135bc93525f07fe0a2ba3b9d1a518b4c73d0a8417edb1040027a949c0
-
Filesize
1KB
MD5be6c5a2380a8c0593bcde9c03cb270f4
SHA15bfcf188f30a07f8e1d27bfb54e46924796bf99e
SHA256a86ca9eefbb360c5dff8fec4d3dd98e3f00368cda8588d96b07fd670301b6b83
SHA51213bf7deb2b2332209ede5f84ecb6d098a390ab82543e60da4a049678d71cda7359be3668d4432e6309bfab8073643dc01e944674c4999cabae55f74d1e8039c5
-
Filesize
1KB
MD5e69062eaa970e365c2d7958e4133b4d9
SHA1f450665d34405248e844ae726b6562b5eac71e2c
SHA2567d650155ec2d94454428325da3ed9ca2356a96af2290b3a418f8d4a9a042a857
SHA512ecabc1c8552eb68d9082d59ccf4d7dd4274952182d83b1ea2b26a17f94d0893ec1a298542173609ebe1db71b00bc9fc51f09534a356c9bb8eb60fd96d5e00309
-
Filesize
3KB
MD56184ca2b548f09a44d431a63ccc62244
SHA1694d9c642a0de2d02be64c4f8ae44ccb8086245e
SHA2567864d3992160ef92eb28cc25001f707271263faab095abbe082d178fede1ab9a
SHA5129c79556c4d4ce334e75bae584e01c538ff2e7a8c04e0066762c26c14a11c4c463dd208f327df59791874e23ed420dc298854b779eba90604146659103adfae6f
-
Filesize
204B
MD53d483c49fa29ddcb6ca28bab29b86384
SHA1c25248ef687ee11b295c6d7f549cf10fd31ab6e4
SHA256c587285e76d7227dbb27b21bd281bef973f8568ede2d837bd8b4d086e470865d
SHA51244966ac9813534f0765341055257d48fd42c4fc735834e0343fb068fae79e826aba83753bc4fcac35a9e328c96baca70ef3f2ed6cf7e617aec50154d521b60dc
-
Filesize
3KB
MD55fc078a1b669c192299b60d3d03f5b1b
SHA1a28278d23de3a82165898d6b6e06498a9e24e81b
SHA25609ee0aaa6d8881621cd97ec22a10299db52328d76fd64e5c5ae6115673f4c496
SHA512585d67241a2d0d972c709a3e042c368278ab737c486e1dcb0546c21c473340b75569986190b22a8595ec6b038a2395868a9e36f9baebd8f3ab7e3a479d36f8dc
-
Filesize
4KB
MD5f7315db0bb7342dc9879eb04c344c74e
SHA149fba0d37da82e0c6239cf2862ad1f56610d77d9
SHA256d375c95326a775c0e60e4b3ccfd3d2f36506e9b6e4aa1df55a3861225962bc45
SHA5124f69e11c42109b99550850240e632732973d92ccc35cee4008014b61ef65dbe909a607499a85a5c6d27a723012b2891259364be65e064519e4382640c65be7c8
-
Filesize
1KB
MD51a68735bd9efd4639dae08b45d9398d9
SHA143ab8d628bb3b338946b788226185cc168ef67a6
SHA256c6fe91dbd9445ae3db1eb370eafa03f95c114a6cab5216f97cc8161099ad6829
SHA512488333a422e1eeb666538c48454e94aa5827212e080bb9d4733d5e9c80b8f7af80f4506a7dd206b1408c8c23f168d94bb7b5efa4ea33d9ebd053c8b074ea3be6
-
Filesize
3KB
MD5962172e9127e7c74f31af9df2037339a
SHA1ba493dd2f5a4716077257d74a990eef05751e27f
SHA256293b80f30388fc3516e6ff6f361918b137a730bcc7a65031c743731935f6cd96
SHA5122503570d0a74b2d5213609b42cd16e88dfe5cc849014fac22df82ec9cdf838f6bc88ba3cf1c062e9bd5ce960e21a63f76291e2658a27199ac7f7dd2cd2aabb34
-
Filesize
204B
MD5aa8f7b9ee74414e6f32dc0b6de5ef8ab
SHA1df80cc4239d2de1d4d8c0e1f56fa2e5f6d57937b
SHA25676afd36a94ada293aa1fd8c202d324f47153d061e77caf8ef46a16c638f372f1
SHA512e846b1f5176664620e8e4291b2cefb5dd4c527ef70533db84c5451cb113a2dd3f40aed865808de755b0606678037afbff36ae69e0a4f2c334b360a5e16e8660c
-
Filesize
3KB
MD52bfe5313f61fc555028551d4f57b221c
SHA11c937bb1ac973ef70e4393d53ae3a3e7a357d8d1
SHA256876e39834607318a0e83291e055430effd78c63d73f96d364ea17351add7c0db
SHA5120fc5322f0bb29c2897ce17bbe5e31cce186a8f257c761b5cf49db315dcf70eccf5f5aba96554ccf9bb9fd8743feb81de588ede1a4d667863907dbc4dadc6cb3f
-
Filesize
1KB
MD510313c452b12e381995377bccf0da513
SHA1318f0c16802eb94c56b15d5eb5695cb065d182d6
SHA25669f4398c513c4066bb1ab2481b9095cf86ce28756e9549179a6cffa730629165
SHA5120aaabd9fb42cb4621ee4959f7f6195ddbe755f9baa2cd10afe5e26a490805476f2d53d1ed4c1e67d4d8aebecac34e3251019b397a44806ac1a7ef2eb90241c37
-
Filesize
3KB
MD556b836fb5f8e9498f74756d356ee9f5f
SHA15b4f98726a624afe50b690325f162ae5a4568541
SHA256cd65979bdd4025752ba4b74504536e54fd5a951c6095f0b3376e136340d83ab2
SHA51266f2bafef1e4c84a033fdf1b47fa3f0248742ef08d2b6986e54cf7b53fc5ddbae4851a4c1fe47dd5582318583b3e4734f8dea98561a68fd7bebe1ddc25e8fe51
-
Filesize
1KB
MD58a2d11d0dec533534d413768484c4978
SHA191040e92318539155eae43fbb393f8983ff125d6
SHA256265da65783125b533ffac67ea215576c7101ee5e14506799dc359607ea2a49d6
SHA5128e02a1167d90aa0850633d2d694fa60c56e16310b4ae37a1709208e52d9826715640d446b974ab202e2b1b1fab92008cb831b39db33b7601ca09f58a91062a5c
-
Filesize
204B
MD54a418723da13e04316c98711478b00fa
SHA1b8c2e2c35e818423ba644848424c52b249f322ae
SHA256a9435ffb80c989ce6f30e0d9dd6a62f2740fc5dc255b0f2a6e964236cf1c6430
SHA51259d947c92f02a048ad6f46024eca42a3af9a17f96d068ada7040fd51636f108e4c13c38d83dda4046bf3e26f0239e5f8876510c449d85159c459082389a52496
-
Filesize
3KB
MD5c644c3c56b7819d0cb4d6bad7983033e
SHA1506be5882e111f8635c54ede6ca9f8ac2d72c96c
SHA2567f4102d429a11df66bc27fb702663d8faaf6e53c50f2a2fc34ba593bc0acdcb3
SHA5123e8034c26029a7d9b6337725620c900d9c6afc7bb7accdc0dd03de025d834b59cab627ac93f6f32d9b66926239a367a7baf05471cb015500906a841bfaf35a14
-
Filesize
3KB
MD5c0dcbcf60a13f6510cac6e0d2e96c1f8
SHA164bbc85e0e84e888b8c911e71a1e8712d022afa3
SHA256519a68c93b7beb02db97f59ef1db51dd9041f18a812edbdb7550d9cb76a9c644
SHA512f41decb263cee207f09e7581c05f16f5530daa72e4614d22d7d7b445336ddef3779151d091da781d95c5f7ec8eacc534059b8ebb8f37f0817997b4801a26bd55
-
Filesize
3KB
MD5150dd09333f76687abdd4c93e3d1ea54
SHA142965edca8b15a47c44d7fe789125e6c76d69aeb
SHA2567238cf9efc27646f91a015c29e1fb6d3cadbda508ec258d28bda8b44bb40e6aa
SHA512b0061372502fa6158370497de42e0226c914e0b43ba8360830930877b3167353b1ce6f431f6e6c6cc644353ef3fa67acf8ef71edde1f0e9f470c6a27f299aa0c
-
Filesize
3KB
MD5713d6ae10e8caee6a9d525c4122ec13b
SHA14aa032a9e896b541fe2d3c9dbafa3044e37e6898
SHA25635fdf111643b6fa85b3b5528c9f76ba5489a6ce8c7beacf90bab1e3ab2a7623a
SHA512d0c705bc4c142e88254dee555030f0dedc9debb012a08bdf50603e45fb9fde69761e51dbc4e8bacc214481bff6fa67b3c4887ce1e95de1dae3417a78d09949b9
-
Filesize
204B
MD53b967ed20d1c013930928009124557ad
SHA11198404f8dddc15edcdda135549d53dc0d0d3fe5
SHA2563ada3146d019b8970c4f9f41cedf6968e5742f91bc977a59465caf1692bd1100
SHA512dc7963ad00ec71b004cfb3587b800bb13377ced2aca904190fd26bbc2f8f223c8a2843af309fed3f42293e58fa88dde76641d60640f7288ab3a43ba316748e6b
-
Filesize
3KB
MD56b37a5b8116bb6965c99145bb40b084c
SHA1a63326d4e542bd68d977f8a8a4dfe7c432cb49ce
SHA2560d71b28a79b73ed1ff8e91b66965b02c5eb2a592b8e34bce2d15c27e08ecb8ad
SHA51225c20b54d840ed69c754302abea45fcdbbcdbcfe0286089e8a83b2c92581d84dac2b032959325c1a082666782806c0054b639127ecc8c2dd4c672fab1c7a04c2
-
Filesize
3KB
MD5a451e4359d28a89d4be6c78ebf540021
SHA13fcec734f895ae7a18cea9a11ccfec9b120f2345
SHA256a69d3e95151ec416cdb461bbb561ead4931905b3e21149e0b71ff889a4ce6ce0
SHA5124abe9a1daa9cc1dcc6b8a09d0f1cf7d4366eb38a465426f2a8dc31329fe9d2752c95f14b2d41b16be63bf7d756ab62841c47a143121fd9807798102dfb6f6b5d
-
Filesize
204B
MD5da53d8c31870df8e6ac33b3232f2fbfc
SHA19810e5465decbcafe6900e3dd65fdcb0962be58d
SHA256a7fd2d9cc71080f5e9d4462f0c4b454783f45fc799aa63182ca326864e096d44
SHA51272e3ff0438f993412d69b56819ceef409d127bc6654d0c32e601c56f1552b92993600024fa28c3a85b305ebf0c07204ccd25a23436befc45ee211c0fd0600212
-
Filesize
3KB
MD52df1a64d08e8669bc84aad2e7cb2d689
SHA180181ec82648c7305be1344c4e2b994eb0fa83b5
SHA256632476480cc439545d06504116722c738e8bfdb79db144e014ca65f153547aae
SHA51284853a7061caf8027167ccd933a4922e0d134fde01cf9bf7ef3866593d7e1d07180d7f9b6e4ac7ddefef6afa31ad647b72d84cdfb94b3f97ec82f3cad28d50ca
-
Filesize
3KB
MD59ac699e5f3ccd6d8b7754c0a0355cfe5
SHA1090dace97242875492a549fb95088b39be8b7ab4
SHA256bf47560a8f4de5692c163a716d77b982d6299eb5db5dcdc5545518142e7b9474
SHA5128e64101bfe721e0cb12f1efd3aaefb3ae6f4e73fa64ea9a7e9e5be5a6aad5debf5ff248a326a4f729a14fbc98311c4195d5f97756e5f2c6b4f75f49e3b2fa964
-
Filesize
3KB
MD5041cbae9388d8f313b656240986c83a1
SHA1662d896120129f3b86d0be4a0792a99db2999f34
SHA2562ed4f097b6c9192a6fd82a63c8527c59e590ef240e864278ad633d92822c2f07
SHA512c23186bff47fdecb68aa7ef42de38ca963cd52079cb89fa9988dad6805b4ae10e32af3ec01d68a605693a4021baa2ed227cd0b8cdd1c3610d26fcbdd2906be60
-
Filesize
204B
MD50c1a4959669d83b29a0882710cbfdb29
SHA1b6961f8751458e41a85ba56667606d9319921d53
SHA2563c013c529b2f6bd96f0aace657f2304b3f2b769de4c1b99ca1361d8c7fe34f01
SHA512c5c406d60902f5dab8bd719397c1809659beb4fa4d88c40bdd277cf01474b7b9099b93379f854917907f42804c15b8bd63e136a46805bacbac267fb52168064c
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
11KB
MD57a2a4ddb06f4924023b13aacaf7dc29d
SHA1b72264bd2198cae9036d7c812c474c7404f83736
SHA2562c361d88b9adc859d55dae3c3c6180d846105f257b4b16af34321738745fe082
SHA5127d04d5641d368d85dc56487b083318a8b96f966c5ae63bbb04be56468db6abf2d08767eb32d10b73a18218f473880b9af3643c5e3647a939fc03f0fa859f70dc
-
Filesize
11KB
MD5dbe4ec39f99759a3fb45f8569f3658c5
SHA168fb9ff487267daf3f72f8523ae7486269226ced
SHA256c36cf995fecdc92b4594ce7a4c03b14be7fb68bd165e68218ebf1fa3d0e0693e
SHA512f53313824748b3875dee51711b0ac2e89441c155843a81de96de070b6eec52cea995a4ee9a24c175a2decd7b08a59108218ba1d21a7bbbc6ae1f977c931291e2
-
Filesize
11KB
MD5b1329b70ba804fc2f38e25d6c92f3808
SHA186a942d74f7d85c5c93bf82d70655af7bf19379f
SHA25682d4772c92605bbcd913ea1f340b780b01f2d7e6746387439f4f95b1bdc2cc52
SHA512ec9bdb860856a14a852026e3d2fe8bff8166f2faa95a8d3c47e68c789675a5d6b58631a185809ee13fc6d4b28cf3153cddd67b6e5321b3a7a1795e366214d24b
-
Filesize
11KB
MD527a0da6b623ecf7538d4441d38b295f2
SHA18ede75b79d182854311958e25958061e37dfe71e
SHA256bbe3c9f0569e939bef2c468edd7e30383bb538848a92b3641b6eb154e3bbee25
SHA5124f292dff53ef91d8dbf8e67dd1764b161c74272d3b52c2fb4ac18295ea3529d650d258fd3c5d7735c09cc47ff9d8e86758c6af52b624ca8b3fa2326b9da27801
-
Filesize
11KB
MD5e079805b2e72e701cfed4aa7d928cbac
SHA155bd68258af892e4b45fd8e8507d0a237dbdb321
SHA25627b58afa0666d8ca2aaa41a63a509102ff461599f915d3083264fdb33a9a1925
SHA5120c3c54527af607b5b8f9ead8d1271b2370341a16dca4cc5d86609fffebd08d0aaf9afee3396dccfbeb5cc3b84643b8ef1f9e4caf02100b2378b1166d2cad80ac
-
Filesize
11KB
MD5f7f7b1e306308ee1b04b7c2bbb12a0fb
SHA11452afc487c9d83d0e6edef7f134166bf08e7ff5
SHA256f5752c6909c6e35f47018ef2ddb582cd2f40cc08c86d344ea9481851060bee97
SHA512ac1ec7137c0759750f7af0498dc40354ae4474dbcfa66f32d0967b1c75e6f09a38acafc85a9fc4bbde821feeb61d322a8159c5755b1605939d9d6ec4fd484642
-
Filesize
11KB
MD551f905a6271b8252fd97ea2e432863a1
SHA1703f2f2b6959f1020dad43ce39408fb55a93931a
SHA25685c6baa895c5b0616a8687166a4daee826a998da788b2474a973a2dd087f5fb4
SHA51206347d18cf14c9c212844736341321e86606f5a9d673e00d79467488e4c2789cba4730c002afdd8324d432fcd9c521451fee3595c8989c12ab7ff6da6f132db8
-
Filesize
11KB
MD5aaa411958ac21d90e6617ab297b1d339
SHA1a2baeea463b3c0cc03921fe0f7631341733853aa
SHA25675df7c7856c7834c85480f635b9ac3e3244cacbb3b83e23a729138873747fbed
SHA5126a813ec8735dc3a6b5652539fc4e1a66b6c36fd82612dbe3d765d220954b763b433a64ab71eb3733938e09cd7f6ec243e8b756e7e59203152263a2eeeac761bf
-
Filesize
11KB
MD5a68c94235902a48a97be0be2a6749b96
SHA1afcf5cbc60bbbf11566792f8d9b289dedda798e5
SHA25686435d99860c560c75e18bc93c81b9e6640f793076bcd481a29f2d9dd5cbee10
SHA51249f83eadaf659d96efa3a4f2cfc20bd452fa706d27ad1bd01a3a12f8449241fb34f74051c18952cf6918ac384eeb05ae9de68db0d76edf44cc85f7e861853e23
-
Filesize
11KB
MD5e3b0a3f158b3b67423be78e98548b3d3
SHA123eeea26659fb01491035b573cb251058f241ab1
SHA2565314c4a09fd26b7becf070bad22ef411e0fec2e0b01d0c59dc6fd7200d492eb3
SHA512a8f005baf8bef8eefa3eeda95d74ec60c67e72fcda6a22e5c3525d8da030a93418a08d8cb923e2b3684fa26f5fcb5417159f613490760856cd2825352bb975aa
-
Filesize
11KB
MD5cc2f8b30bad1709d1e72ab0b4f7170f3
SHA104fedba6ebb5ca778b810c30afd441a5ed4077c6
SHA2562d0e7901278a1cba0f0a1f5c6304491a26ac306279bddbed34ee3bd92e06ba2e
SHA51284b7638da31156fab9b267d6afdedcf1ee058b5c4f2e829c118dc9c10f618bb6f3352f4d3b1c67313b108112e5f22428342512a89bf5354cc80c8a6483609d3f
-
Filesize
11KB
MD53e49e200b05301a171f8ce66ef8d5f02
SHA16355211ff2d42927ed012599601edb43015fa014
SHA256e548a65c542e825154d39f8f5785ab4c41da9cf7ca4c06e7d274ace268e6e7b8
SHA51266481a28484c67713a116ac77c82d362e94a90d3a9af59e2dfb105c8692b0184d97aca69698f6e3503483598168c2a97bc9e8e4760d33c80eac6be1ed23c7fa7
-
Filesize
11KB
MD5505586a5ada943d44a50230527b3e2d8
SHA1807515314076b7785dcc977e0c2dd283279f2149
SHA2569e251271f28471d83f97fff2ed11a346cd63042ec025033fc97e75b9db08a7fa
SHA5126e34cb64d6a80d138e7e33fd502a8078a5c3235d3a5335b57221ebcd1889227d06062103df7facd1d8d248d31921531eb785db4ead1c891eddd579d19a736799
-
Filesize
11KB
MD5d2d883c8bb0dfb59073e0ce36e5debd0
SHA1c02be1966c9059b8f8bd17d1ea89c8191c17ee5b
SHA2561369f7901c95dde0d29927df747aceaf4dbdcfd013bc83e302b2457bef88f3df
SHA5126557836904b481b65d964b1052df549a26855f154849a6518f8018a6f80a6400953c497a9d104f50154c0b8670ed0e5cb3b8bb382815ad87c587820deccc985b
-
Filesize
11KB
MD5a93a8147a95e8bf5200a7d9a82bc88b6
SHA1e0d728f4d4b8d4929486ef99c35ce973f72a4aff
SHA2569392a7c9ceb84a027c40076e677c006fc916fa2762e97eb4d590eebdf148c72a
SHA51253865eb60549a1055e803a87fa8ef09418d4fde47cc2a9d0fb9a5bb1bd8077fa3f7a5b0c0e8c612339278ca5d58c7a39446cfe44337aa177741313fcc7fd4570
-
Filesize
11KB
MD520555fda4e4b16b769044674229cd0b2
SHA1b3f2a9ef50146e74a425dc32d17efb34067af620
SHA2569f51d2ebb752f679e06168ce9fc92b0d1ffb0763a0e69bdcafb1860d49559da5
SHA512b4e68f1515f9e9179e18be4bc168c09a3efb2468f14de47270abccc49911f4b1bafb2fcd198dd4ce4f94390764488b5e5a764a1ed1f2aa99d4bc1ac28eceaf18
-
Filesize
11KB
MD567db59cb37757c9d58649b72a4d4bc62
SHA112379015474ff42e3b02d919087ba8743ce9549d
SHA256b01e4fa553875c4e843eb9ed423fe7566d22be3e5b748b16f825c2c93b8117fe
SHA5123bdbc7bf91b3687dfe853fb20eb278c803a46b2a875d4b4a966b353918c41dd653c6c64772447f82cdd01756bf60c6c2a30fb75cc75fad0bdc9ab75cc3cf3db5
-
Filesize
11KB
MD54668f94f769ce36e4b4b04184c8099f3
SHA12c1a7962c51d71ea6cf837f141efe23f9e5ea839
SHA25602ba6f53a419e735e4c2f0d882f9762ae0d2e05614ec58db7acdbf5e810af902
SHA512585511b337f2e4689e90a6412acdf7557dfa07046650dca0856c2538e5ae58fd3f8c6be66f4e0ad1805413c53790b77a7ef1986fe1a8c484d7e7df9b1b5a37f6
-
Filesize
11KB
MD5f78a7baf440618e2e7cab7df2fe3f80a
SHA12ef2c0bdab01dc79f5683fe9d9558b720e3ce0e1
SHA25663df5083279df6ee26ebf8a9b04e92d24e59f24b818792f9d1931ac25b5228b8
SHA512a4ef503e315447d84e74a2f3a12a832439194278ed762c5a57831548f42625ccce7dfe0d5d144908bf34ffac872d8e13ace49863e5cff8c4d7cd9e9fac198ef8
-
Filesize
11KB
MD5a40f04830aa3e20c98357e8d97fe9b61
SHA1f4b57582ba3942ab39c374ece47954c5416a12dc
SHA25610c2c23cf9e237a0c1f115a10d82ddbd0fe21e5885b5037e635f4b5b3e3146d0
SHA5124cfc076d3f7ad8bfdd3fb9d8cb6c0d2add4a17ac523baa0bf6084d57dc7db47d5e88b38d2a9cceaa656fd0236c6c4d79ef98903bd754da0ea623490b073913f2
-
Filesize
11KB
MD51f57ce508722d6ddf38f0ef9e232cee5
SHA1b08556d39a402116628ef17eb1f4d762446b1807
SHA256d06634d36c827d8e48bdc00c5938d678b6df3cb00c2f2bfd901139c7dd12d0f1
SHA5122555df3cca0883d4dac859a057a6387a4939fbff28ed91c4ae15ac5bf19d37f794cbb6df820dbfccd740e6bb08c9ef606d4018b4ae2b7be97a877f0c9469bd57
-
Filesize
11KB
MD5cf31ad27a14501a42a2d19f82707b83e
SHA1d8178f5521ab69a48d32a6c78bb873d0df1fdff4
SHA2565f56f1671291572e46d5cd7d8ce441180611aa7f9a1e04db470a1ce55bf8d355
SHA51244d82280f638f56c7420a5e1c0d430d4deab7b59d3c04c044f8aedb0aeb77285d044165c231255f965c800062b850cc7da00af8b26ae93b919aeaffb3317f781
-
Filesize
11KB
MD5d21f90c6461ccccaf2aae61fbade015d
SHA17dfde7e0f25dbe0cebe93b5e3377b818d7271cec
SHA2560e2b6bd44ba428899d69e91fbbe02583ed4447528ec59cb3ee84e7949dc97bfb
SHA51291adcbfb4290d50fb2b38ffffef861284e1a5fd75565a4259cdb91adf41297cbe98c6a9a407ea291dd030137a050b6a5b2d3ce0aca5feb59a40e7dde9234e69c
-
Filesize
11KB
MD5ec85035b1c562b5e4c5070acd5d51b32
SHA183f924545c75ca133e10ab9fa5e7acccc1527165
SHA256fc0d4c6a7f3a03429f8a83045adde35b3394a57abbaee9ca3b9c1d96bf39382f
SHA512d902adeb951da655e98313c4ec80f3a6997adf0fc24ec1c4a9ed0f440dbf74ab13fd4559ec55bd1e9d7f38b3b8686b65d9320fcd3ff8b400a2b61d2a90dd1b57
-
Filesize
218B
MD5afa6955439b8d516721231029fb9ca1b
SHA1087a043cc123c0c0df2ffadcf8e71e3ac86bbae9
SHA2568e9f20f6864c66576536c0b866c6ffdcf11397db67fe120e972e244c3c022270
SHA5125da21a31fbc4e8250dffed30f66b896bdf007ac91948140334fe36a3f010e1bac3e70a07e9f3eb9da8633189091fd5cadcabbaacd3e01da0fe7ae28a11b3dddf