Malware Analysis Report

2024-11-30 04:10

Sample ID 240408-bkat8scc87
Target Calabiyau_Installer_Release_0.9.1.396_10439382.exe
SHA256 68cadea3071b42d42bd81a4f84c61609494c9e04d016c070f410111c3b8c8bef
Tags
bootkit discovery persistence spyware stealer
score
8/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
8/10

SHA256

68cadea3071b42d42bd81a4f84c61609494c9e04d016c070f410111c3b8c8bef

Threat Level: Likely malicious

The file Calabiyau_Installer_Release_0.9.1.396_10439382.exe was found to be: Likely malicious.

Malicious Activity Summary

bootkit discovery persistence spyware stealer

Modifies AppInit DLL entries

Drops file in Drivers directory

Reads user/profile data of web browsers

Sets file execution options in registry

Adds Run key to start application

Downloads MZ/PE file

Writes to the Master Boot Record (MBR)

Enumerates connected drives

Checks computer location settings

Suspicious use of NtSetInformationThreadHideFromDebugger

Drops file in System32 directory

Loads dropped DLL

Registers COM server for autorun

Drops file in Windows directory

Checks for VirtualBox DLLs, possible anti-VM trick

Drops file in Program Files directory

Executes dropped EXE

Checks installed software on the system

Checks system information in the registry

Enumerates physical storage devices

Modifies registry class

Suspicious behavior: LoadsDriver

Suspicious use of WriteProcessMemory

Checks processor information in registry

Suspicious use of SetWindowsHookEx

Suspicious behavior: AddClipboardFormatListener

Suspicious use of FindShellTrayWindow

Suspicious use of SendNotifyMessage

NTFS ADS

Suspicious behavior: GetForegroundWindowSpam

Modifies Control Panel

Modifies data under HKEY_USERS

Checks SCSI registry key(s)

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: EnumeratesProcesses

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-04-08 01:12

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-04-08 01:11

Reported

2024-04-08 01:15

Platform

win7-20240221-en

Max time kernel

142s

Max time network

131s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Calabiyau_Installer_Release_0.9.1.396_10439382.exe"

Signatures

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-R5H1O.tmp\Calabiyau_Installer_Release_0.9.1.396_10439382.tmp N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Calabiyau_Installer_Release_0.9.1.396_10439382.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-R5H1O.tmp\Calabiyau_Installer_Release_0.9.1.396_10439382.tmp N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1800 wrote to memory of 2224 N/A C:\Users\Admin\AppData\Local\Temp\Calabiyau_Installer_Release_0.9.1.396_10439382.exe C:\Users\Admin\AppData\Local\Temp\is-R5H1O.tmp\Calabiyau_Installer_Release_0.9.1.396_10439382.tmp
PID 1800 wrote to memory of 2224 N/A C:\Users\Admin\AppData\Local\Temp\Calabiyau_Installer_Release_0.9.1.396_10439382.exe C:\Users\Admin\AppData\Local\Temp\is-R5H1O.tmp\Calabiyau_Installer_Release_0.9.1.396_10439382.tmp
PID 1800 wrote to memory of 2224 N/A C:\Users\Admin\AppData\Local\Temp\Calabiyau_Installer_Release_0.9.1.396_10439382.exe C:\Users\Admin\AppData\Local\Temp\is-R5H1O.tmp\Calabiyau_Installer_Release_0.9.1.396_10439382.tmp
PID 1800 wrote to memory of 2224 N/A C:\Users\Admin\AppData\Local\Temp\Calabiyau_Installer_Release_0.9.1.396_10439382.exe C:\Users\Admin\AppData\Local\Temp\is-R5H1O.tmp\Calabiyau_Installer_Release_0.9.1.396_10439382.tmp
PID 1800 wrote to memory of 2224 N/A C:\Users\Admin\AppData\Local\Temp\Calabiyau_Installer_Release_0.9.1.396_10439382.exe C:\Users\Admin\AppData\Local\Temp\is-R5H1O.tmp\Calabiyau_Installer_Release_0.9.1.396_10439382.tmp
PID 1800 wrote to memory of 2224 N/A C:\Users\Admin\AppData\Local\Temp\Calabiyau_Installer_Release_0.9.1.396_10439382.exe C:\Users\Admin\AppData\Local\Temp\is-R5H1O.tmp\Calabiyau_Installer_Release_0.9.1.396_10439382.tmp
PID 1800 wrote to memory of 2224 N/A C:\Users\Admin\AppData\Local\Temp\Calabiyau_Installer_Release_0.9.1.396_10439382.exe C:\Users\Admin\AppData\Local\Temp\is-R5H1O.tmp\Calabiyau_Installer_Release_0.9.1.396_10439382.tmp

Processes

C:\Users\Admin\AppData\Local\Temp\Calabiyau_Installer_Release_0.9.1.396_10439382.exe

"C:\Users\Admin\AppData\Local\Temp\Calabiyau_Installer_Release_0.9.1.396_10439382.exe"

C:\Users\Admin\AppData\Local\Temp\is-R5H1O.tmp\Calabiyau_Installer_Release_0.9.1.396_10439382.tmp

"C:\Users\Admin\AppData\Local\Temp\is-R5H1O.tmp\Calabiyau_Installer_Release_0.9.1.396_10439382.tmp" /SL5="$400F4,170395914,906752,C:\Users\Admin\AppData\Local\Temp\Calabiyau_Installer_Release_0.9.1.396_10439382.exe"

Network

N/A

Files

memory/1800-1-0x0000000000400000-0x00000000004EB000-memory.dmp

\Users\Admin\AppData\Local\Temp\is-R5H1O.tmp\Calabiyau_Installer_Release_0.9.1.396_10439382.tmp

MD5 dfed274da67e0b3a8b96f094a9560b6c
SHA1 f1962d545fa9c5bcdf72659ab26aee5b88cb1d05
SHA256 9332c50391190257db94f18322f2152068655a2cc3aa43ecf7a59a55287fb488
SHA512 28082f0640184641734a0042d8364fe6df103e1d814128b3f85b4e5335bdd8b150a31d0598f18b3b1d592f741741f70f482c0d039dfb3caade15972335160bf5

memory/2224-8-0x0000000000240000-0x0000000000241000-memory.dmp

memory/1800-10-0x0000000000400000-0x00000000004EB000-memory.dmp

memory/2224-11-0x0000000000400000-0x0000000000729000-memory.dmp

memory/2224-14-0x0000000000240000-0x0000000000241000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-04-08 01:11

Reported

2024-04-08 01:15

Platform

win10v2004-20240226-en

Max time kernel

151s

Max time network

156s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Calabiyau_Installer_Release_0.9.1.396_10439382.exe"

Signatures

Drops file in Drivers directory

Description Indicator Process Target
File created C:\Windows\system32\drivers\ACE-BASE.sys C:\Program Files\CalabiYau\TenProtect\TASLogin64.exe N/A

Modifies AppInit DLL entries

persistence

Reads user/profile data of web browsers

spyware stealer

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" C:\Program Files\CalabiYau\dxwebsetup.exe N/A

Downloads MZ/PE file

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\P: C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe N/A
File opened (read-only) \??\W: C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe N/A
File opened (read-only) \??\Y: C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe N/A
File opened (read-only) \??\Z: C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe N/A
File opened (read-only) \??\F: C:\Program Files\CalabiYau\CalabiYau.exe N/A
File opened (read-only) \??\H: C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe N/A
File opened (read-only) \??\M: C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe N/A
File opened (read-only) \??\T: C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe N/A
File opened (read-only) \??\U: C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe N/A
File opened (read-only) \??\B: C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe N/A
File opened (read-only) \??\J: C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe N/A
File opened (read-only) \??\E: C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe N/A
File opened (read-only) \??\K: C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe N/A
File opened (read-only) \??\N: C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe N/A
File opened (read-only) \??\X: C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe N/A
File opened (read-only) \??\D: C:\Program Files\CalabiYau\CalabiYau.exe N/A
File opened (read-only) \??\L: C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe N/A
File opened (read-only) \??\S: C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe N/A
File opened (read-only) \??\V: C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe N/A
File opened (read-only) \??\A: C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe N/A
File opened (read-only) \??\G: C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe N/A
File opened (read-only) \??\O: C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe N/A
File opened (read-only) \??\I: C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe N/A
File opened (read-only) \??\Q: C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe N/A
File opened (read-only) \??\R: C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe N/A

Sets file execution options in registry

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe C:\Program Files (x86)\Microsoft\Temp\EUCFC3.tmp\MicrosoftEdgeUpdate.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe\DisableExceptionChainValidation = "0" C:\Program Files (x86)\Microsoft\Temp\EUCFC3.tmp\MicrosoftEdgeUpdate.exe N/A

Writes to the Master Boot Record (MBR)

bootkit persistence
Description Indicator Process Target
File opened for modification \??\PhysicalDrive0 C:\Program Files\CalabiYau\CalabiYau.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\Control Panel\International\Geo\Nation C:\Program Files\CalabiYau\tqm64\TQMCenter_64.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\Control Panel\International\Geo\Nation C:\Program Files\CalabiYau\QtWebEngineProcess.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\Control Panel\International\Geo\Nation C:\Program Files (x86)\Microsoft\Temp\EUCFC3.tmp\MicrosoftEdgeUpdate.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\directx\websetup\SETCFE4.tmp C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe N/A
File opened for modification C:\Windows\SysWOW64\directx\websetup\dsetup32.dll C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe N/A
File opened for modification C:\Windows\SysWOW64\DirectX\WebSetup C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe N/A
File opened for modification C:\Windows\SysWOW64\DirectX\WebSetup\filelist.dat C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe N/A
File opened for modification C:\Windows\SysWOW64\directx\websetup\SETCFE3.tmp C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe N/A
File created C:\Windows\SysWOW64\directx\websetup\SETCFE3.tmp C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe N/A
File opened for modification C:\Windows\SysWOW64\directx\websetup\dsetup.dll C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe N/A
File opened for modification C:\Windows\SysWOW64\directx\websetup\SETCFE4.tmp C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe N/A
File created C:\Windows\SysWOW64\DirectX\WebSetup\dxupdate.cab C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe N/A

Checks for VirtualBox DLLs, possible anti-VM trick

Description Indicator Process Target
File opened (read-only) \??\VBoxMiniRdrDN C:\Program Files\CalabiYau\CalabiYau.exe N/A

Checks installed software on the system

discovery

Checks system information in the registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer C:\Program Files (x86)\Microsoft\Temp\EUCFC3.tmp\MicrosoftEdgeUpdate.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName C:\Program Files (x86)\Microsoft\Temp\EUCFC3.tmp\MicrosoftEdgeUpdate.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\123.0.2420.81\Locales\sr-Cyrl-BA.pak C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{C37DB9B6-EBE4-4BD8-86D5-6CADB730C69C}\EDGEMITMP_E9719.tmp\setup.exe N/A
File opened for modification C:\Program Files\CalabiYau\position\qtposition_positionpoll.dll C:\Users\Admin\AppData\Local\Temp\is-RGH6A.tmp\Calabiyau_Installer_Release_0.9.1.396_10439382.tmp N/A
File created C:\Program Files (x86)\Microsoft\Temp\EUCFC3.tmp\msedgeupdateres_is.dll C:\Program Files\CalabiYau\MicrosoftEdgeWebview2Setup.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate\Download\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\123.0.2420.81\MicrosoftEdge_X64_123.0.2420.81.exe C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
File created C:\Program Files\CalabiYau\UpdateGUI\translations\is-I4ND5.tmp C:\Users\Admin\AppData\Local\Temp\is-RGH6A.tmp\Calabiyau_Installer_Release_0.9.1.396_10439382.tmp N/A
File created C:\Program Files (x86)\Microsoft\Temp\EUCFC3.tmp\msedgeupdateres_zh-TW.dll C:\Program Files\CalabiYau\MicrosoftEdgeWebview2Setup.exe N/A
File created C:\Program Files (x86)\Microsoft\Temp\EUCFC3.tmp\msedgeupdateres_cy.dll C:\Program Files\CalabiYau\MicrosoftEdgeWebview2Setup.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\123.0.2420.81\VisualElements\SmallLogoBeta.png C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{C37DB9B6-EBE4-4BD8-86D5-6CADB730C69C}\EDGEMITMP_E9719.tmp\setup.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\123.0.2420.81\Locales\ro.pak C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{C37DB9B6-EBE4-4BD8-86D5-6CADB730C69C}\EDGEMITMP_E9719.tmp\setup.exe N/A
File opened for modification C:\Program Files\CalabiYau\api-ms-win-crt-stdio-l1-1-0.dll C:\Users\Admin\AppData\Local\Temp\is-RGH6A.tmp\Calabiyau_Installer_Release_0.9.1.396_10439382.tmp N/A
File created C:\Program Files\CalabiYau\is-38Q1J.tmp C:\Users\Admin\AppData\Local\Temp\is-RGH6A.tmp\Calabiyau_Installer_Release_0.9.1.396_10439382.tmp N/A
File created C:\Program Files\CalabiYau\translations\qtwebengine_locales\is-4C5EF.tmp C:\Users\Admin\AppData\Local\Temp\is-RGH6A.tmp\Calabiyau_Installer_Release_0.9.1.396_10439382.tmp N/A
File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\123.0.2420.81\identity_proxy\win11\identity_helper.Sparse.Canary.msix C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{C37DB9B6-EBE4-4BD8-86D5-6CADB730C69C}\EDGEMITMP_E9719.tmp\setup.exe N/A
File created C:\Program Files (x86)\Microsoft\Temp\EUCFC3.tmp\msedgeupdateres_lv.dll C:\Program Files\CalabiYau\MicrosoftEdgeWebview2Setup.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\123.0.2420.81\Trust Protection Lists\Sigma\Cryptomining C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{C37DB9B6-EBE4-4BD8-86D5-6CADB730C69C}\EDGEMITMP_E9719.tmp\setup.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\123.0.2420.81\Trust Protection Lists\Sigma\Other C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{C37DB9B6-EBE4-4BD8-86D5-6CADB730C69C}\EDGEMITMP_E9719.tmp\setup.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\123.0.2420.81\Trust Protection Lists\Mu\Content C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{C37DB9B6-EBE4-4BD8-86D5-6CADB730C69C}\EDGEMITMP_E9719.tmp\setup.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\123.0.2420.81\Locales\as.pak C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{C37DB9B6-EBE4-4BD8-86D5-6CADB730C69C}\EDGEMITMP_E9719.tmp\setup.exe N/A
File opened for modification C:\Program Files\CalabiYau\sqldrivers\sqlitecipher.dll C:\Users\Admin\AppData\Local\Temp\is-RGH6A.tmp\Calabiyau_Installer_Release_0.9.1.396_10439382.tmp N/A
File opened for modification C:\Program Files\CalabiYau\UpdateGUI\msvcp100.dll C:\Users\Admin\AppData\Local\Temp\is-RGH6A.tmp\Calabiyau_Installer_Release_0.9.1.396_10439382.tmp N/A
File created C:\Program Files\CalabiYau\is-VQDLA.tmp C:\Users\Admin\AppData\Local\Temp\is-RGH6A.tmp\Calabiyau_Installer_Release_0.9.1.396_10439382.tmp N/A
File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\123.0.2420.81\Locales\am.pak C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{C37DB9B6-EBE4-4BD8-86D5-6CADB730C69C}\EDGEMITMP_E9719.tmp\setup.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\123.0.2420.81\Locales\uk.pak C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{C37DB9B6-EBE4-4BD8-86D5-6CADB730C69C}\EDGEMITMP_E9719.tmp\setup.exe N/A
File created C:\Program Files\CalabiYau\translations\qtwebengine_locales\is-AGQQ9.tmp C:\Users\Admin\AppData\Local\Temp\is-RGH6A.tmp\Calabiyau_Installer_Release_0.9.1.396_10439382.tmp N/A
File created C:\Program Files\CalabiYau\UpdateGUI\platforms\is-ULBML.tmp C:\Users\Admin\AppData\Local\Temp\is-RGH6A.tmp\Calabiyau_Installer_Release_0.9.1.396_10439382.tmp N/A
File created C:\Program Files (x86)\Microsoft\EdgeCore\123.0.2420.81\msedge_200_percent.pak C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{C37DB9B6-EBE4-4BD8-86D5-6CADB730C69C}\EDGEMITMP_E9719.tmp\setup.exe N/A
File opened for modification C:\Program Files\CalabiYau\Qt5Network.dll C:\Users\Admin\AppData\Local\Temp\is-RGH6A.tmp\Calabiyau_Installer_Release_0.9.1.396_10439382.tmp N/A
File created C:\Program Files\CalabiYau\is-PL6E3.tmp C:\Users\Admin\AppData\Local\Temp\is-RGH6A.tmp\Calabiyau_Installer_Release_0.9.1.396_10439382.tmp N/A
File created C:\Program Files\CalabiYau\imageformats\is-VKUGS.tmp C:\Users\Admin\AppData\Local\Temp\is-RGH6A.tmp\Calabiyau_Installer_Release_0.9.1.396_10439382.tmp N/A
File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\123.0.2420.81\Locales\or.pak C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{C37DB9B6-EBE4-4BD8-86D5-6CADB730C69C}\EDGEMITMP_E9719.tmp\setup.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\123.0.2420.81\copilot_provider_msix\package_metadata C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{C37DB9B6-EBE4-4BD8-86D5-6CADB730C69C}\EDGEMITMP_E9719.tmp\setup.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\123.0.2420.81\Locales\fil.pak C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{C37DB9B6-EBE4-4BD8-86D5-6CADB730C69C}\EDGEMITMP_E9719.tmp\setup.exe N/A
File created C:\Program Files\CalabiYau\UpdateGUI\is-DV7C2.tmp C:\Users\Admin\AppData\Local\Temp\is-RGH6A.tmp\Calabiyau_Installer_Release_0.9.1.396_10439382.tmp N/A
File created C:\Program Files (x86)\Microsoft\Temp\EUCFC3.tmp\msedgeupdateres_kk.dll C:\Program Files\CalabiYau\MicrosoftEdgeWebview2Setup.exe N/A
File created C:\Program Files (x86)\Microsoft\EdgeCore\123.0.2420.81\Locales\pt-BR.pak C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{C37DB9B6-EBE4-4BD8-86D5-6CADB730C69C}\EDGEMITMP_E9719.tmp\setup.exe N/A
File created C:\Program Files\CalabiYau\UpdateGUI\imageformats\is-RROHG.tmp C:\Users\Admin\AppData\Local\Temp\is-RGH6A.tmp\Calabiyau_Installer_Release_0.9.1.396_10439382.tmp N/A
File created C:\Program Files (x86)\Microsoft\EdgeCore\123.0.2420.81\Locales\ka.pak C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{C37DB9B6-EBE4-4BD8-86D5-6CADB730C69C}\EDGEMITMP_E9719.tmp\setup.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\123.0.2420.81\vk_swiftshader.dll C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{C37DB9B6-EBE4-4BD8-86D5-6CADB730C69C}\EDGEMITMP_E9719.tmp\setup.exe N/A
File opened for modification C:\Program Files\CalabiYau\Tenprotect\concrt140.dll C:\Users\Admin\AppData\Local\Temp\is-RGH6A.tmp\Calabiyau_Installer_Release_0.9.1.396_10439382.tmp N/A
File opened for modification C:\Program Files\CalabiYau\UpdateGUI\vcruntime140.dll C:\Users\Admin\AppData\Local\Temp\is-RGH6A.tmp\Calabiyau_Installer_Release_0.9.1.396_10439382.tmp N/A
File created C:\Program Files\CalabiYau\is-SPICF.tmp C:\Users\Admin\AppData\Local\Temp\is-RGH6A.tmp\Calabiyau_Installer_Release_0.9.1.396_10439382.tmp N/A
File created C:\Program Files (x86)\Microsoft\EdgeCore\123.0.2420.81\Locales\cy.pak C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{C37DB9B6-EBE4-4BD8-86D5-6CADB730C69C}\EDGEMITMP_E9719.tmp\setup.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\123.0.2420.81\Trust Protection Lists\Sigma\Analytics C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{C37DB9B6-EBE4-4BD8-86D5-6CADB730C69C}\EDGEMITMP_E9719.tmp\setup.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\123.0.2420.81\MEIPreload\manifest.json C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{C37DB9B6-EBE4-4BD8-86D5-6CADB730C69C}\EDGEMITMP_E9719.tmp\setup.exe N/A
File created C:\Program Files (x86)\Microsoft\EdgeCore\123.0.2420.81\vk_swiftshader_icd.json C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{C37DB9B6-EBE4-4BD8-86D5-6CADB730C69C}\EDGEMITMP_E9719.tmp\setup.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\123.0.2420.81\msedge_100_percent.pak C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{C37DB9B6-EBE4-4BD8-86D5-6CADB730C69C}\EDGEMITMP_E9719.tmp\setup.exe N/A
File opened for modification C:\Program Files\CalabiYau\SDL2.dll C:\Users\Admin\AppData\Local\Temp\is-RGH6A.tmp\Calabiyau_Installer_Release_0.9.1.396_10439382.tmp N/A
File created C:\Program Files\CalabiYau\translations\is-I63P4.tmp C:\Users\Admin\AppData\Local\Temp\is-RGH6A.tmp\Calabiyau_Installer_Release_0.9.1.396_10439382.tmp N/A
File created C:\Program Files\CalabiYau\UpdateGUI\is-8TGI8.tmp C:\Users\Admin\AppData\Local\Temp\is-RGH6A.tmp\Calabiyau_Installer_Release_0.9.1.396_10439382.tmp N/A
File created C:\Program Files\CalabiYau\translations\qtwebengine_locales\is-FK86K.tmp C:\Users\Admin\AppData\Local\Temp\is-RGH6A.tmp\Calabiyau_Installer_Release_0.9.1.396_10439382.tmp N/A
File created C:\Program Files\CalabiYau\UpdateGUI\is-OTATE.tmp C:\Users\Admin\AppData\Local\Temp\is-RGH6A.tmp\Calabiyau_Installer_Release_0.9.1.396_10439382.tmp N/A
File created C:\Program Files (x86)\Microsoft\EdgeCore\123.0.2420.81\Locales\et.pak C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{C37DB9B6-EBE4-4BD8-86D5-6CADB730C69C}\EDGEMITMP_E9719.tmp\setup.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\123.0.2420.81\Locales\eu.pak C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{C37DB9B6-EBE4-4BD8-86D5-6CADB730C69C}\EDGEMITMP_E9719.tmp\setup.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\123.0.2420.81\identity_proxy\win11\identity_helper.Sparse.Beta.msix C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{C37DB9B6-EBE4-4BD8-86D5-6CADB730C69C}\EDGEMITMP_E9719.tmp\setup.exe N/A
File opened for modification C:\Program Files\CalabiYau\Tenprotect\api-ms-win-crt-heap-l1-1-0.dll C:\Users\Admin\AppData\Local\Temp\is-RGH6A.tmp\Calabiyau_Installer_Release_0.9.1.396_10439382.tmp N/A
File opened for modification C:\Program Files\CalabiYau\UpdateGUI\D3Dcompiler_47.dll C:\Users\Admin\AppData\Local\Temp\is-RGH6A.tmp\Calabiyau_Installer_Release_0.9.1.396_10439382.tmp N/A
File created C:\Program Files\CalabiYau\translations\is-41QKM.tmp C:\Users\Admin\AppData\Local\Temp\is-RGH6A.tmp\Calabiyau_Installer_Release_0.9.1.396_10439382.tmp N/A
File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\123.0.2420.81\Notifications\SoftLandingAssetDark.gif C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{C37DB9B6-EBE4-4BD8-86D5-6CADB730C69C}\EDGEMITMP_E9719.tmp\setup.exe N/A
File opened for modification C:\Program Files\CalabiYau\UpdateGUI\imageformats\qsvg.dll C:\Users\Admin\AppData\Local\Temp\is-RGH6A.tmp\Calabiyau_Installer_Release_0.9.1.396_10439382.tmp N/A
File created C:\Program Files (x86)\Microsoft\Temp\EUCFC3.tmp\msedgeupdateres_ms.dll C:\Program Files\CalabiYau\MicrosoftEdgeWebview2Setup.exe N/A
File created C:\Program Files\CalabiYau\config.ini.szTNoj C:\Program Files\CalabiYau\CalabiYau.exe N/A
File opened for modification C:\Program Files\CalabiYau\ucrtbase.dll C:\Users\Admin\AppData\Local\Temp\is-RGH6A.tmp\Calabiyau_Installer_Release_0.9.1.396_10439382.tmp N/A
File created C:\Program Files\CalabiYau\Tenprotect\is-9F6PU.tmp C:\Users\Admin\AppData\Local\Temp\is-RGH6A.tmp\Calabiyau_Installer_Release_0.9.1.396_10439382.tmp N/A
File created C:\Program Files (x86)\Microsoft\EdgeCore\123.0.2420.81\identity_proxy\internal.identity_helper.exe.manifest C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{C37DB9B6-EBE4-4BD8-86D5-6CADB730C69C}\EDGEMITMP_E9719.tmp\setup.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\msdownld.tmp\AS58A886.tmp\dxupdate.cab C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe N/A
File opened for modification C:\Windows\msdownld.tmp\AS58A886.tmp\dxupdate.cab C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe N/A
File opened for modification C:\Windows\msdownld.tmp\AS58A886.tmp C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe N/A
File opened for modification C:\Windows\Logs\DirectX.log C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe N/A
File opened for modification C:\Windows\Fonts\mstmc.ttf C:\Program Files\CalabiYau\CalabiYau.exe N/A
File opened for modification C:\Windows\twain_32\C_1033_TMC.NLS C:\Program Files\CalabiYau\CalabiYau.exe N/A
File opened for modification C:\Windows\tracing:? C:\Program Files\CalabiYau\CalabiYau.exe N/A
File opened for modification C:\Windows\msdownld.tmp C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-RGH6A.tmp\Calabiyau_Installer_Release_0.9.1.396_10439382.tmp N/A
N/A N/A C:\Program Files\CalabiYau\CalabiYau.exe N/A
N/A N/A C:\Program Files\CalabiYau\tqm64\TQMCenter_64.exe N/A
N/A N/A C:\Program Files\CalabiYau\dxwebsetup.exe N/A
N/A N/A C:\Program Files\CalabiYau\MicrosoftEdgeWebview2Setup.exe N/A
N/A N/A C:\Program Files\CalabiYau\TenProtect\TASLogin64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe N/A
N/A N/A C:\Program Files\CalabiYau\QtWebEngineProcess.exe N/A
N/A N/A C:\Program Files\CalabiYau\QtWebEngineProcess.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Temp\EUCFC3.tmp\MicrosoftEdgeUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{C37DB9B6-EBE4-4BD8-86D5-6CADB730C69C}\MicrosoftEdge_X64_123.0.2420.81.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{C37DB9B6-EBE4-4BD8-86D5-6CADB730C69C}\EDGEMITMP_E9719.tmp\setup.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{C37DB9B6-EBE4-4BD8-86D5-6CADB730C69C}\EDGEMITMP_E9719.tmp\setup.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Program Files\CalabiYau\CalabiYau.exe N/A
N/A N/A C:\Program Files\CalabiYau\CalabiYau.exe N/A
N/A N/A C:\Program Files\CalabiYau\CalabiYau.exe N/A
N/A N/A C:\Program Files\CalabiYau\CalabiYau.exe N/A
N/A N/A C:\Program Files\CalabiYau\CalabiYau.exe N/A
N/A N/A C:\Program Files\CalabiYau\CalabiYau.exe N/A
N/A N/A C:\Program Files\CalabiYau\CalabiYau.exe N/A
N/A N/A C:\Program Files\CalabiYau\CalabiYau.exe N/A
N/A N/A C:\Program Files\CalabiYau\CalabiYau.exe N/A
N/A N/A C:\Program Files\CalabiYau\CalabiYau.exe N/A
N/A N/A C:\Program Files\CalabiYau\CalabiYau.exe N/A
N/A N/A C:\Program Files\CalabiYau\CalabiYau.exe N/A
N/A N/A C:\Program Files\CalabiYau\CalabiYau.exe N/A
N/A N/A C:\Program Files\CalabiYau\CalabiYau.exe N/A
N/A N/A C:\Program Files\CalabiYau\CalabiYau.exe N/A
N/A N/A C:\Program Files\CalabiYau\CalabiYau.exe N/A
N/A N/A C:\Program Files\CalabiYau\CalabiYau.exe N/A
N/A N/A C:\Program Files\CalabiYau\CalabiYau.exe N/A
N/A N/A C:\Program Files\CalabiYau\CalabiYau.exe N/A
N/A N/A C:\Program Files\CalabiYau\CalabiYau.exe N/A
N/A N/A C:\Program Files\CalabiYau\CalabiYau.exe N/A
N/A N/A C:\Program Files\CalabiYau\CalabiYau.exe N/A
N/A N/A C:\Program Files\CalabiYau\CalabiYau.exe N/A
N/A N/A C:\Program Files\CalabiYau\CalabiYau.exe N/A
N/A N/A C:\Program Files\CalabiYau\CalabiYau.exe N/A
N/A N/A C:\Program Files\CalabiYau\CalabiYau.exe N/A
N/A N/A C:\Program Files\CalabiYau\CalabiYau.exe N/A
N/A N/A C:\Program Files\CalabiYau\CalabiYau.exe N/A
N/A N/A C:\Program Files\CalabiYau\tqm64\TQMCenter_64.exe N/A
N/A N/A C:\Program Files\CalabiYau\CalabiYau.exe N/A
N/A N/A C:\Program Files\CalabiYau\CalabiYau.exe N/A
N/A N/A C:\Program Files\CalabiYau\CalabiYau.exe N/A
N/A N/A C:\Program Files\CalabiYau\CalabiYau.exe N/A
N/A N/A C:\Program Files\CalabiYau\CalabiYau.exe N/A
N/A N/A C:\Program Files\CalabiYau\CalabiYau.exe N/A
N/A N/A C:\Program Files\CalabiYau\CalabiYau.exe N/A
N/A N/A C:\Program Files\CalabiYau\CalabiYau.exe N/A
N/A N/A C:\Program Files\CalabiYau\CalabiYau.exe N/A
N/A N/A C:\Program Files\CalabiYau\CalabiYau.exe N/A
N/A N/A C:\Program Files\CalabiYau\CalabiYau.exe N/A
N/A N/A C:\Program Files\CalabiYau\TenProtect\TASLogin64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe N/A
N/A N/A C:\Program Files\CalabiYau\CalabiYau.exe N/A
N/A N/A C:\Program Files\CalabiYau\CalabiYau.exe N/A
N/A N/A C:\Program Files\CalabiYau\CalabiYau.exe N/A
N/A N/A C:\Program Files\CalabiYau\TenProtect\TASLogin64.exe N/A
N/A N/A C:\Program Files\CalabiYau\CalabiYau.exe N/A
N/A N/A C:\Program Files\CalabiYau\CalabiYau.exe N/A
N/A N/A C:\Program Files\CalabiYau\CalabiYau.exe N/A
N/A N/A C:\Program Files\CalabiYau\CalabiYau.exe N/A
N/A N/A C:\Program Files\CalabiYau\CalabiYau.exe N/A
N/A N/A C:\Program Files\CalabiYau\CalabiYau.exe N/A
N/A N/A C:\Program Files\CalabiYau\CalabiYau.exe N/A
N/A N/A C:\Program Files\CalabiYau\CalabiYau.exe N/A
N/A N/A C:\Program Files\CalabiYau\CalabiYau.exe N/A
N/A N/A C:\Program Files\CalabiYau\QtWebEngineProcess.exe N/A
N/A N/A C:\Program Files\CalabiYau\QtWebEngineProcess.exe N/A
N/A N/A C:\Program Files\CalabiYau\QtWebEngineProcess.exe N/A
N/A N/A C:\Program Files\CalabiYau\QtWebEngineProcess.exe N/A
N/A N/A C:\Program Files\CalabiYau\QtWebEngineProcess.exe N/A
N/A N/A C:\Program Files\CalabiYau\QtWebEngineProcess.exe N/A
N/A N/A C:\Program Files\CalabiYau\QtWebEngineProcess.exe N/A
N/A N/A C:\Program Files\CalabiYau\QtWebEngineProcess.exe N/A

Registers COM server for autorun

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8B15189E-5465-4166-933D-1EABAD9648CB}\InProcServer32\ThreadingModel = "Both" C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32 C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8B15189E-5465-4166-933D-1EABAD9648CB}\InProcServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.171.39\\psmachine_64.dll" C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8B15189E-5465-4166-933D-1EABAD9648CB}\InProcServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.171.39\\psmachine_64.dll" C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8B15189E-5465-4166-933D-1EABAD9648CB}\InProcServer32\ThreadingModel = "Both" C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32 C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ThreadingModel = "Both" C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8B15189E-5465-4166-933D-1EABAD9648CB}\InProcServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.171.39\\psmachine_64.dll" C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32 C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32 C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ThreadingModel = "Both" C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8B15189E-5465-4166-933D-1EABAD9648CB}\InProcServer32\ThreadingModel = "Both" C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.171.39\\psmachine_64.dll" C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\INPROCSERVER32 C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\INPROCSERVER32 C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32 C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.171.39\\psmachine_64.dll" C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32 C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32 C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ThreadingModel = "Both" C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32 C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32 C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ThreadingModel = "Both" C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ThreadingModel = "Both" C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32 C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8B15189E-5465-4166-933D-1EABAD9648CB}\InProcServer32 C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.171.39\\psmachine_64.dll" C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.171.39\\psmachine_64.dll" C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8B15189E-5465-4166-933D-1EABAD9648CB}\InProcServer32 C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.171.39\\psmachine_64.dll" C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.171.39\\psmachine_64.dll" C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ThreadingModel = "Both" C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8B15189E-5465-4166-933D-1EABAD9648CB}\InProcServer32 C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe N/A

Enumerates physical storage devices

Checks SCSI registry key(s)

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000 C:\Program Files\CalabiYau\CalabiYau.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\LocationInformation C:\Program Files\CalabiYau\CalabiYau.exe N/A

Checks processor information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Program Files\CalabiYau\TenProtect\TASLogin64.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Program Files\CalabiYau\TenProtect\TASLogin64.exe N/A

Modifies Control Panel

evasion
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\Control Panel\Desktop C:\Program Files\CalabiYau\TenProtect\TASLogin64.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\Control Panel\Desktop\LowLevelHooksTimeout = "25000" C:\Program Files\CalabiYau\TenProtect\TASLogin64.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26} C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9A6B447A-35E2-4F6B-A87B-5DEEBBFDAD17}\ = "ICoCreateAsyncStatus" C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{CECDDD22-2E72-4832-9606-A9B0E5E344B2}\LocalService = "edgeupdate" C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.OnDemandCOMClassSvc.1.0\CLSID\ = "{A6B716CB-028B-404D-B72C-50E153DD68DA}" C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8B15189E-5465-4166-933D-1EABAD9648CB} C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5F9C80B5-9E50-43C9-887C-7C6412E110DF}\ProxyStubClsid32\ = "{8B15189E-5465-4166-933D-1EABAD9648CB}" C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9F3F5F5D-721A-4B19-9B5D-69F664C1A591}\AppID = "{A6B716CB-028B-404D-B72C-50E153DD68DA}" C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F7B3738C-9BCA-4B14-90B7-89D0F3A3E497}\ = "IPolicyStatus4" C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9A6B447A-35E2-4F6B-A87B-5DEEBBFDAD17} C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DDD4B5D4-FD54-497C-8789-0830F29A60EE}\NumMethods C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{837E40DA-EB1B-440C-8623-0F14DF158DC0} C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1B9063E4-3882-485E-8797-F28A0240782F}\ProxyStubClsid32\ = "{8B15189E-5465-4166-933D-1EABAD9648CB}" C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.PolicyStatusMachine.1.0\CLSID\ = "{B5977F34-9264-4AC3-9B31-1224827FF6E8}" C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F7B3738C-9BCA-4B14-90B7-89D0F3A3E497} C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EA92A799-267E-4DF5-A6ED-6A7E0684BB8A}\VersionIndependentProgID C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A5135E58-384F-4244-9A5F-30FA9259413C}\ = "IProcessLauncher" C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{FCE48F77-C677-4012-8A1A-54D2E2BC07BD} C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9A6B447A-35E2-4F6B-A87B-5DEEBBFDAD17}\ProxyStubClsid32\ = "{8B15189E-5465-4166-933D-1EABAD9648CB}" C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{60355531-5BFD-45AB-942C-7912628752C7}\NumMethods C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{CECDDD22-2E72-4832-9606-A9B0E5E344B2}\PROGID C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26} C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FCE48F77-C677-4012-8A1A-54D2E2BC07BD}\NumMethods C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{837E40DA-EB1B-440C-8623-0F14DF158DC0}\ProxyStubClsid32\ = "{8B15189E-5465-4166-933D-1EABAD9648CB}" C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{837E40DA-EB1B-440C-8623-0F14DF158DC0}\NumMethods\ = "24" C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3A49F783-1C7D-4D35-8F63-5C1C206B9B6E}\NumMethods\ = "17" C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{A6B716CB-028B-404D-B72C-50E153DD68DA} C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{EA92A799-267E-4DF5-A6ED-6A7E0684BB8A}\VERSIONINDEPENDENTPROGID C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C212C770-8604-4EE0-8189-F88C3FC539D0}\InProcServer32 C:\Program Files\CalabiYau\CalabiYau.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{A6B716CB-028B-404D-B72C-50E153DD68DA}\ = "ServiceModule" C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2EC826CB-5478-4533-9015-7580B3B5E03A}\ = "IAppCommandWeb" C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8B15189E-5465-4166-933D-1EABAD9648CB} C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5F6A18BB-6231-424B-8242-19E5BB94F8ED}\LocalServer32\ = "\"C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.171.39\\MicrosoftEdgeUpdateOnDemand.exe\"" C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{99F8E195-1042-4F89-A28C-89CDB74A14AE} C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C06EE550-7248-488E-971E-B60C0AB3A6E4}\NumMethods\ = "43" C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DDD4B5D4-FD54-497C-8789-0830F29A60EE}\ProxyStubClsid32 C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{837E40DA-EB1B-440C-8623-0F14DF158DC0}\ProxyStubClsid32\ = "{8B15189E-5465-4166-933D-1EABAD9648CB}" C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.PolicyStatusMachineFallback\CLSID\ = "{77857D02-7A25-4B67-9266-3E122A8F39E4}" C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DDD4B5D4-FD54-497C-8789-0830F29A60EE}\NumMethods\ = "10" C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E4518371-7326-4865-87F8-D9D3F3B287A3}\ProxyStubClsid32\ = "{8B15189E-5465-4166-933D-1EABAD9648CB}" C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{99F8E195-1042-4F89-A28C-89CDB74A14AE}\ = "IJobObserver" C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7584D24A-E056-4EB1-8E7B-632F2B0ADC69}\ProxyStubClsid32 C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{AB4F4A7E-977C-4E23-AD8F-626A491715DF}\ProxyStubClsid32\ = "{8B15189E-5465-4166-933D-1EABAD9648CB}" C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AB4F4A7E-977C-4E23-AD8F-626A491715DF}\NumMethods\ = "41" C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E4518371-7326-4865-87F8-D9D3F3B287A3} C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CECDDD22-2E72-4832-9606-A9B0E5E344B2}\AppID = "{CECDDD22-2E72-4832-9606-A9B0E5E344B2}" C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7B3B7A69-7D88-4847-A6BC-90E246A41F69}\ = "IAppVersion" C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2E1DD7EF-C12D-4F8E-8AD8-CF8CC265BAD0} C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{5F9C80B5-9E50-43C9-887C-7C6412E110DF}\NumMethods\ = "11" C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AB4EE1FC-0A81-4F56-B0E2-248FB78051AF}\ProxyStubClsid32\ = "{8B15189E-5465-4166-933D-1EABAD9648CB}" C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{D1E8B1A6-32CE-443C-8E2E-EBA90C481353}\LOCALSERVER32 C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{99F8E195-1042-4F89-A28C-89CDB74A14AE}\ = "IJobObserver" C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.CoreClass.1\CLSID\ = "{8F09CD6C-5964-4573-82E3-EBFF7702865B}" C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ThreadingModel = "Both" C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E55B90F1-DA33-400B-B09E-3AFF7D46BD83}\ = "IProgressWndEvents" C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1B9063E4-3882-485E-8797-F28A0240782F}\ = "IGoogleUpdate3WebSecurity" C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\MicrosoftEdgeUpdate.exe\AppID = "{A6B716CB-028B-404D-B72C-50E153DD68DA}" C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.171.39\\psmachine_64.dll" C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DDD4B5D4-FD54-497C-8789-0830F29A60EE} C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{450CF5FF-95C4-4679-BECA-22680389ECB9} C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E3D94CEB-EC11-46BE-8872-7DDCE37FABFA} C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7B3B7A69-7D88-4847-A6BC-90E246A41F69}\ProxyStubClsid32 C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{99F8E195-1042-4F89-A28C-89CDB74A14AE}\NumMethods\ = "13" C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FCE48F77-C677-4012-8A1A-54D2E2BC07BD}\ProxyStubClsid32 C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe N/A

NTFS ADS

Description Indicator Process Target
File opened for modification C:\ProgramData\Microsoft\Windows\Caches:? C:\Program Files\CalabiYau\CalabiYau.exe N/A
File opened for modification C:\Windows\tracing:? C:\Program Files\CalabiYau\CalabiYau.exe N/A

Suspicious behavior: AddClipboardFormatListener

Description Indicator Process Target
N/A N/A C:\Program Files\CalabiYau\CalabiYau.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-RGH6A.tmp\Calabiyau_Installer_Release_0.9.1.396_10439382.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-RGH6A.tmp\Calabiyau_Installer_Release_0.9.1.396_10439382.tmp N/A
N/A N/A C:\Program Files\CalabiYau\CalabiYau.exe N/A
N/A N/A C:\Program Files\CalabiYau\CalabiYau.exe N/A
N/A N/A C:\Program Files\CalabiYau\CalabiYau.exe N/A
N/A N/A C:\Program Files\CalabiYau\CalabiYau.exe N/A
N/A N/A C:\Program Files\CalabiYau\CalabiYau.exe N/A
N/A N/A C:\Program Files\CalabiYau\CalabiYau.exe N/A
N/A N/A C:\Program Files\CalabiYau\CalabiYau.exe N/A
N/A N/A C:\Program Files\CalabiYau\CalabiYau.exe N/A
N/A N/A C:\Program Files\CalabiYau\CalabiYau.exe N/A
N/A N/A C:\Program Files\CalabiYau\CalabiYau.exe N/A
N/A N/A C:\Program Files\CalabiYau\CalabiYau.exe N/A
N/A N/A C:\Program Files\CalabiYau\CalabiYau.exe N/A
N/A N/A C:\Program Files\CalabiYau\CalabiYau.exe N/A
N/A N/A C:\Program Files\CalabiYau\CalabiYau.exe N/A
N/A N/A C:\Program Files\CalabiYau\CalabiYau.exe N/A
N/A N/A C:\Program Files\CalabiYau\CalabiYau.exe N/A
N/A N/A C:\Program Files\CalabiYau\CalabiYau.exe N/A
N/A N/A C:\Program Files\CalabiYau\CalabiYau.exe N/A
N/A N/A C:\Program Files\CalabiYau\QtWebEngineProcess.exe N/A
N/A N/A C:\Program Files\CalabiYau\QtWebEngineProcess.exe N/A
N/A N/A C:\Program Files\CalabiYau\QtWebEngineProcess.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Temp\EUCFC3.tmp\MicrosoftEdgeUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Temp\EUCFC3.tmp\MicrosoftEdgeUpdate.exe N/A
N/A N/A C:\Program Files\CalabiYau\TenProtect\TASLogin64.exe N/A
N/A N/A C:\Program Files\CalabiYau\TenProtect\TASLogin64.exe N/A
N/A N/A C:\Program Files\CalabiYau\TenProtect\TASLogin64.exe N/A
N/A N/A C:\Program Files\CalabiYau\TenProtect\TASLogin64.exe N/A
N/A N/A C:\Program Files\CalabiYau\CalabiYau.exe N/A
N/A N/A C:\Program Files\CalabiYau\CalabiYau.exe N/A
N/A N/A C:\Program Files\CalabiYau\TenProtect\TASLogin64.exe N/A
N/A N/A C:\Program Files\CalabiYau\TenProtect\TASLogin64.exe N/A
N/A N/A C:\Program Files\CalabiYau\TenProtect\TASLogin64.exe N/A
N/A N/A C:\Program Files\CalabiYau\TenProtect\TASLogin64.exe N/A
N/A N/A C:\Program Files\CalabiYau\TenProtect\TASLogin64.exe N/A
N/A N/A C:\Program Files\CalabiYau\TenProtect\TASLogin64.exe N/A
N/A N/A C:\Program Files\CalabiYau\TenProtect\TASLogin64.exe N/A
N/A N/A C:\Program Files\CalabiYau\TenProtect\TASLogin64.exe N/A
N/A N/A C:\Program Files\CalabiYau\TenProtect\TASLogin64.exe N/A
N/A N/A C:\Program Files\CalabiYau\TenProtect\TASLogin64.exe N/A
N/A N/A C:\Program Files\CalabiYau\TenProtect\TASLogin64.exe N/A
N/A N/A C:\Program Files\CalabiYau\TenProtect\TASLogin64.exe N/A
N/A N/A C:\Program Files\CalabiYau\TenProtect\TASLogin64.exe N/A
N/A N/A C:\Program Files\CalabiYau\TenProtect\TASLogin64.exe N/A
N/A N/A C:\Program Files\CalabiYau\TenProtect\TASLogin64.exe N/A
N/A N/A C:\Program Files\CalabiYau\TenProtect\TASLogin64.exe N/A
N/A N/A C:\Program Files\CalabiYau\CalabiYau.exe N/A
N/A N/A C:\Program Files\CalabiYau\CalabiYau.exe N/A
N/A N/A C:\Program Files\CalabiYau\CalabiYau.exe N/A
N/A N/A C:\Program Files\CalabiYau\CalabiYau.exe N/A
N/A N/A C:\Program Files\CalabiYau\CalabiYau.exe N/A
N/A N/A C:\Program Files\CalabiYau\TenProtect\TASLogin64.exe N/A
N/A N/A C:\Program Files\CalabiYau\TenProtect\TASLogin64.exe N/A
N/A N/A C:\Program Files\CalabiYau\TenProtect\TASLogin64.exe N/A
N/A N/A C:\Program Files\CalabiYau\TenProtect\TASLogin64.exe N/A
N/A N/A C:\Program Files\CalabiYau\TenProtect\TASLogin64.exe N/A
N/A N/A C:\Program Files\CalabiYau\TenProtect\TASLogin64.exe N/A
N/A N/A C:\Program Files\CalabiYau\TenProtect\TASLogin64.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Temp\EUCFC3.tmp\MicrosoftEdgeUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Temp\EUCFC3.tmp\MicrosoftEdgeUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Temp\EUCFC3.tmp\MicrosoftEdgeUpdate.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Temp\EUCFC3.tmp\MicrosoftEdgeUpdate.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Program Files\CalabiYau\CalabiYau.exe N/A

Suspicious behavior: LoadsDriver

Description Indicator Process Target
N/A N/A N/A N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Program Files\CalabiYau\tqm64\TQMCenter_64.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files (x86)\Microsoft\Temp\EUCFC3.tmp\MicrosoftEdgeUpdate.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\CalabiYau\TenProtect\TASLogin64.exe N/A
Token: 33 N/A C:\Windows\system32\AUDIODG.EXE N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\system32\AUDIODG.EXE N/A
Token: SeDebugPrivilege N/A C:\Program Files\CalabiYau\TenProtect\TASLogin64.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\CalabiYau\TenProtect\TASLogin64.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\CalabiYau\TenProtect\TASLogin64.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\CalabiYau\TenProtect\TASLogin64.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\CalabiYau\TenProtect\TASLogin64.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\CalabiYau\TenProtect\TASLogin64.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\CalabiYau\TenProtect\TASLogin64.exe N/A
Token: SeBackupPrivilege N/A C:\Program Files\CalabiYau\CalabiYau.exe N/A
Token: SeBackupPrivilege N/A C:\Program Files\CalabiYau\CalabiYau.exe N/A
Token: SeBackupPrivilege N/A C:\Program Files\CalabiYau\CalabiYau.exe N/A
Token: SeSecurityPrivilege N/A C:\Program Files\CalabiYau\CalabiYau.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\CalabiYau\TenProtect\TASLogin64.exe N/A
Token: SeSecurityPrivilege N/A C:\Program Files\CalabiYau\CalabiYau.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\CalabiYau\TenProtect\TASLogin64.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\CalabiYau\TenProtect\TASLogin64.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\CalabiYau\TenProtect\TASLogin64.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Program Files\CalabiYau\TenProtect\TASLogin64.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\CalabiYau\TenProtect\TASLogin64.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\CalabiYau\TenProtect\TASLogin64.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\CalabiYau\TenProtect\TASLogin64.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\CalabiYau\TenProtect\TASLogin64.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\CalabiYau\TenProtect\TASLogin64.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\CalabiYau\TenProtect\TASLogin64.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\CalabiYau\TenProtect\TASLogin64.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\CalabiYau\TenProtect\TASLogin64.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\CalabiYau\TenProtect\TASLogin64.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\CalabiYau\TenProtect\TASLogin64.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\CalabiYau\TenProtect\TASLogin64.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\CalabiYau\TenProtect\TASLogin64.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\CalabiYau\TenProtect\TASLogin64.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\CalabiYau\TenProtect\TASLogin64.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\CalabiYau\TenProtect\TASLogin64.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\CalabiYau\TenProtect\TASLogin64.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\CalabiYau\TenProtect\TASLogin64.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\CalabiYau\TenProtect\TASLogin64.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\CalabiYau\TenProtect\TASLogin64.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\CalabiYau\TenProtect\TASLogin64.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\CalabiYau\TenProtect\TASLogin64.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\CalabiYau\TenProtect\TASLogin64.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\CalabiYau\TenProtect\TASLogin64.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\CalabiYau\TenProtect\TASLogin64.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\CalabiYau\TenProtect\TASLogin64.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\CalabiYau\TenProtect\TASLogin64.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\CalabiYau\TenProtect\TASLogin64.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\CalabiYau\TenProtect\TASLogin64.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\CalabiYau\TenProtect\TASLogin64.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\CalabiYau\TenProtect\TASLogin64.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\CalabiYau\TenProtect\TASLogin64.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\CalabiYau\TenProtect\TASLogin64.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\CalabiYau\TenProtect\TASLogin64.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\CalabiYau\TenProtect\TASLogin64.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\CalabiYau\TenProtect\TASLogin64.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\CalabiYau\TenProtect\TASLogin64.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\CalabiYau\TenProtect\TASLogin64.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\CalabiYau\TenProtect\TASLogin64.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\CalabiYau\TenProtect\TASLogin64.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\CalabiYau\TenProtect\TASLogin64.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\CalabiYau\TenProtect\TASLogin64.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\CalabiYau\TenProtect\TASLogin64.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-RGH6A.tmp\Calabiyau_Installer_Release_0.9.1.396_10439382.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-RGH6A.tmp\Calabiyau_Installer_Release_0.9.1.396_10439382.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-RGH6A.tmp\Calabiyau_Installer_Release_0.9.1.396_10439382.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-RGH6A.tmp\Calabiyau_Installer_Release_0.9.1.396_10439382.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-RGH6A.tmp\Calabiyau_Installer_Release_0.9.1.396_10439382.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-RGH6A.tmp\Calabiyau_Installer_Release_0.9.1.396_10439382.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-RGH6A.tmp\Calabiyau_Installer_Release_0.9.1.396_10439382.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-RGH6A.tmp\Calabiyau_Installer_Release_0.9.1.396_10439382.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-RGH6A.tmp\Calabiyau_Installer_Release_0.9.1.396_10439382.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-RGH6A.tmp\Calabiyau_Installer_Release_0.9.1.396_10439382.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-RGH6A.tmp\Calabiyau_Installer_Release_0.9.1.396_10439382.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-RGH6A.tmp\Calabiyau_Installer_Release_0.9.1.396_10439382.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-RGH6A.tmp\Calabiyau_Installer_Release_0.9.1.396_10439382.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-RGH6A.tmp\Calabiyau_Installer_Release_0.9.1.396_10439382.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-RGH6A.tmp\Calabiyau_Installer_Release_0.9.1.396_10439382.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-RGH6A.tmp\Calabiyau_Installer_Release_0.9.1.396_10439382.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-RGH6A.tmp\Calabiyau_Installer_Release_0.9.1.396_10439382.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-RGH6A.tmp\Calabiyau_Installer_Release_0.9.1.396_10439382.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-RGH6A.tmp\Calabiyau_Installer_Release_0.9.1.396_10439382.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-RGH6A.tmp\Calabiyau_Installer_Release_0.9.1.396_10439382.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-RGH6A.tmp\Calabiyau_Installer_Release_0.9.1.396_10439382.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-RGH6A.tmp\Calabiyau_Installer_Release_0.9.1.396_10439382.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-RGH6A.tmp\Calabiyau_Installer_Release_0.9.1.396_10439382.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-RGH6A.tmp\Calabiyau_Installer_Release_0.9.1.396_10439382.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-RGH6A.tmp\Calabiyau_Installer_Release_0.9.1.396_10439382.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-RGH6A.tmp\Calabiyau_Installer_Release_0.9.1.396_10439382.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-RGH6A.tmp\Calabiyau_Installer_Release_0.9.1.396_10439382.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-RGH6A.tmp\Calabiyau_Installer_Release_0.9.1.396_10439382.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-RGH6A.tmp\Calabiyau_Installer_Release_0.9.1.396_10439382.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-RGH6A.tmp\Calabiyau_Installer_Release_0.9.1.396_10439382.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-RGH6A.tmp\Calabiyau_Installer_Release_0.9.1.396_10439382.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-RGH6A.tmp\Calabiyau_Installer_Release_0.9.1.396_10439382.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-RGH6A.tmp\Calabiyau_Installer_Release_0.9.1.396_10439382.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-RGH6A.tmp\Calabiyau_Installer_Release_0.9.1.396_10439382.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-RGH6A.tmp\Calabiyau_Installer_Release_0.9.1.396_10439382.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-RGH6A.tmp\Calabiyau_Installer_Release_0.9.1.396_10439382.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-RGH6A.tmp\Calabiyau_Installer_Release_0.9.1.396_10439382.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-RGH6A.tmp\Calabiyau_Installer_Release_0.9.1.396_10439382.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-RGH6A.tmp\Calabiyau_Installer_Release_0.9.1.396_10439382.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-RGH6A.tmp\Calabiyau_Installer_Release_0.9.1.396_10439382.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-RGH6A.tmp\Calabiyau_Installer_Release_0.9.1.396_10439382.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-RGH6A.tmp\Calabiyau_Installer_Release_0.9.1.396_10439382.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-RGH6A.tmp\Calabiyau_Installer_Release_0.9.1.396_10439382.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-RGH6A.tmp\Calabiyau_Installer_Release_0.9.1.396_10439382.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-RGH6A.tmp\Calabiyau_Installer_Release_0.9.1.396_10439382.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-RGH6A.tmp\Calabiyau_Installer_Release_0.9.1.396_10439382.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-RGH6A.tmp\Calabiyau_Installer_Release_0.9.1.396_10439382.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-RGH6A.tmp\Calabiyau_Installer_Release_0.9.1.396_10439382.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-RGH6A.tmp\Calabiyau_Installer_Release_0.9.1.396_10439382.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-RGH6A.tmp\Calabiyau_Installer_Release_0.9.1.396_10439382.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-RGH6A.tmp\Calabiyau_Installer_Release_0.9.1.396_10439382.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-RGH6A.tmp\Calabiyau_Installer_Release_0.9.1.396_10439382.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-RGH6A.tmp\Calabiyau_Installer_Release_0.9.1.396_10439382.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-RGH6A.tmp\Calabiyau_Installer_Release_0.9.1.396_10439382.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-RGH6A.tmp\Calabiyau_Installer_Release_0.9.1.396_10439382.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-RGH6A.tmp\Calabiyau_Installer_Release_0.9.1.396_10439382.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-RGH6A.tmp\Calabiyau_Installer_Release_0.9.1.396_10439382.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-RGH6A.tmp\Calabiyau_Installer_Release_0.9.1.396_10439382.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-RGH6A.tmp\Calabiyau_Installer_Release_0.9.1.396_10439382.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-RGH6A.tmp\Calabiyau_Installer_Release_0.9.1.396_10439382.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-RGH6A.tmp\Calabiyau_Installer_Release_0.9.1.396_10439382.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-RGH6A.tmp\Calabiyau_Installer_Release_0.9.1.396_10439382.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-RGH6A.tmp\Calabiyau_Installer_Release_0.9.1.396_10439382.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-RGH6A.tmp\Calabiyau_Installer_Release_0.9.1.396_10439382.tmp N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 368 wrote to memory of 1980 N/A C:\Users\Admin\AppData\Local\Temp\Calabiyau_Installer_Release_0.9.1.396_10439382.exe C:\Users\Admin\AppData\Local\Temp\is-RGH6A.tmp\Calabiyau_Installer_Release_0.9.1.396_10439382.tmp
PID 368 wrote to memory of 1980 N/A C:\Users\Admin\AppData\Local\Temp\Calabiyau_Installer_Release_0.9.1.396_10439382.exe C:\Users\Admin\AppData\Local\Temp\is-RGH6A.tmp\Calabiyau_Installer_Release_0.9.1.396_10439382.tmp
PID 368 wrote to memory of 1980 N/A C:\Users\Admin\AppData\Local\Temp\Calabiyau_Installer_Release_0.9.1.396_10439382.exe C:\Users\Admin\AppData\Local\Temp\is-RGH6A.tmp\Calabiyau_Installer_Release_0.9.1.396_10439382.tmp
PID 1980 wrote to memory of 880 N/A C:\Users\Admin\AppData\Local\Temp\is-RGH6A.tmp\Calabiyau_Installer_Release_0.9.1.396_10439382.tmp C:\Program Files\CalabiYau\CalabiYau.exe
PID 1980 wrote to memory of 880 N/A C:\Users\Admin\AppData\Local\Temp\is-RGH6A.tmp\Calabiyau_Installer_Release_0.9.1.396_10439382.tmp C:\Program Files\CalabiYau\CalabiYau.exe
PID 880 wrote to memory of 2916 N/A C:\Program Files\CalabiYau\CalabiYau.exe C:\Program Files\CalabiYau\tqm64\TQMCenter_64.exe
PID 880 wrote to memory of 2916 N/A C:\Program Files\CalabiYau\CalabiYau.exe C:\Program Files\CalabiYau\tqm64\TQMCenter_64.exe
PID 2916 wrote to memory of 1832 N/A C:\Program Files\CalabiYau\tqm64\TQMCenter_64.exe C:\Windows\System32\cmd.exe
PID 2916 wrote to memory of 1832 N/A C:\Program Files\CalabiYau\tqm64\TQMCenter_64.exe C:\Windows\System32\cmd.exe
PID 880 wrote to memory of 4912 N/A C:\Program Files\CalabiYau\CalabiYau.exe C:\Program Files\CalabiYau\dxwebsetup.exe
PID 880 wrote to memory of 4912 N/A C:\Program Files\CalabiYau\CalabiYau.exe C:\Program Files\CalabiYau\dxwebsetup.exe
PID 880 wrote to memory of 4912 N/A C:\Program Files\CalabiYau\CalabiYau.exe C:\Program Files\CalabiYau\dxwebsetup.exe
PID 880 wrote to memory of 3608 N/A C:\Program Files\CalabiYau\CalabiYau.exe C:\Program Files\CalabiYau\MicrosoftEdgeWebview2Setup.exe
PID 880 wrote to memory of 3608 N/A C:\Program Files\CalabiYau\CalabiYau.exe C:\Program Files\CalabiYau\MicrosoftEdgeWebview2Setup.exe
PID 880 wrote to memory of 3608 N/A C:\Program Files\CalabiYau\CalabiYau.exe C:\Program Files\CalabiYau\MicrosoftEdgeWebview2Setup.exe
PID 880 wrote to memory of 1440 N/A C:\Program Files\CalabiYau\CalabiYau.exe C:\Program Files\CalabiYau\TenProtect\TASLogin64.exe
PID 880 wrote to memory of 1440 N/A C:\Program Files\CalabiYau\CalabiYau.exe C:\Program Files\CalabiYau\TenProtect\TASLogin64.exe
PID 4912 wrote to memory of 4352 N/A C:\Program Files\CalabiYau\dxwebsetup.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
PID 4912 wrote to memory of 4352 N/A C:\Program Files\CalabiYau\dxwebsetup.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
PID 4912 wrote to memory of 4352 N/A C:\Program Files\CalabiYau\dxwebsetup.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
PID 880 wrote to memory of 1084 N/A C:\Program Files\CalabiYau\CalabiYau.exe C:\Program Files\CalabiYau\QtWebEngineProcess.exe
PID 880 wrote to memory of 1084 N/A C:\Program Files\CalabiYau\CalabiYau.exe C:\Program Files\CalabiYau\QtWebEngineProcess.exe
PID 880 wrote to memory of 1084 N/A C:\Program Files\CalabiYau\CalabiYau.exe C:\Program Files\CalabiYau\QtWebEngineProcess.exe
PID 880 wrote to memory of 1084 N/A C:\Program Files\CalabiYau\CalabiYau.exe C:\Program Files\CalabiYau\QtWebEngineProcess.exe
PID 880 wrote to memory of 1084 N/A C:\Program Files\CalabiYau\CalabiYau.exe C:\Program Files\CalabiYau\QtWebEngineProcess.exe
PID 880 wrote to memory of 1084 N/A C:\Program Files\CalabiYau\CalabiYau.exe C:\Program Files\CalabiYau\QtWebEngineProcess.exe
PID 880 wrote to memory of 1084 N/A C:\Program Files\CalabiYau\CalabiYau.exe C:\Program Files\CalabiYau\QtWebEngineProcess.exe
PID 880 wrote to memory of 1084 N/A C:\Program Files\CalabiYau\CalabiYau.exe C:\Program Files\CalabiYau\QtWebEngineProcess.exe
PID 880 wrote to memory of 1084 N/A C:\Program Files\CalabiYau\CalabiYau.exe C:\Program Files\CalabiYau\QtWebEngineProcess.exe
PID 880 wrote to memory of 1084 N/A C:\Program Files\CalabiYau\CalabiYau.exe C:\Program Files\CalabiYau\QtWebEngineProcess.exe
PID 880 wrote to memory of 1084 N/A C:\Program Files\CalabiYau\CalabiYau.exe C:\Program Files\CalabiYau\QtWebEngineProcess.exe
PID 880 wrote to memory of 1084 N/A C:\Program Files\CalabiYau\CalabiYau.exe C:\Program Files\CalabiYau\QtWebEngineProcess.exe
PID 880 wrote to memory of 1084 N/A C:\Program Files\CalabiYau\CalabiYau.exe C:\Program Files\CalabiYau\QtWebEngineProcess.exe
PID 880 wrote to memory of 1084 N/A C:\Program Files\CalabiYau\CalabiYau.exe C:\Program Files\CalabiYau\QtWebEngineProcess.exe
PID 880 wrote to memory of 1084 N/A C:\Program Files\CalabiYau\CalabiYau.exe C:\Program Files\CalabiYau\QtWebEngineProcess.exe
PID 880 wrote to memory of 1084 N/A C:\Program Files\CalabiYau\CalabiYau.exe C:\Program Files\CalabiYau\QtWebEngineProcess.exe
PID 880 wrote to memory of 1084 N/A C:\Program Files\CalabiYau\CalabiYau.exe C:\Program Files\CalabiYau\QtWebEngineProcess.exe
PID 880 wrote to memory of 1084 N/A C:\Program Files\CalabiYau\CalabiYau.exe C:\Program Files\CalabiYau\QtWebEngineProcess.exe
PID 880 wrote to memory of 1084 N/A C:\Program Files\CalabiYau\CalabiYau.exe C:\Program Files\CalabiYau\QtWebEngineProcess.exe
PID 880 wrote to memory of 1084 N/A C:\Program Files\CalabiYau\CalabiYau.exe C:\Program Files\CalabiYau\QtWebEngineProcess.exe
PID 880 wrote to memory of 1084 N/A C:\Program Files\CalabiYau\CalabiYau.exe C:\Program Files\CalabiYau\QtWebEngineProcess.exe
PID 880 wrote to memory of 1084 N/A C:\Program Files\CalabiYau\CalabiYau.exe C:\Program Files\CalabiYau\QtWebEngineProcess.exe
PID 880 wrote to memory of 1084 N/A C:\Program Files\CalabiYau\CalabiYau.exe C:\Program Files\CalabiYau\QtWebEngineProcess.exe
PID 880 wrote to memory of 1084 N/A C:\Program Files\CalabiYau\CalabiYau.exe C:\Program Files\CalabiYau\QtWebEngineProcess.exe
PID 880 wrote to memory of 1084 N/A C:\Program Files\CalabiYau\CalabiYau.exe C:\Program Files\CalabiYau\QtWebEngineProcess.exe
PID 880 wrote to memory of 1084 N/A C:\Program Files\CalabiYau\CalabiYau.exe C:\Program Files\CalabiYau\QtWebEngineProcess.exe
PID 880 wrote to memory of 1084 N/A C:\Program Files\CalabiYau\CalabiYau.exe C:\Program Files\CalabiYau\QtWebEngineProcess.exe
PID 880 wrote to memory of 1084 N/A C:\Program Files\CalabiYau\CalabiYau.exe C:\Program Files\CalabiYau\QtWebEngineProcess.exe
PID 880 wrote to memory of 1084 N/A C:\Program Files\CalabiYau\CalabiYau.exe C:\Program Files\CalabiYau\QtWebEngineProcess.exe
PID 880 wrote to memory of 1084 N/A C:\Program Files\CalabiYau\CalabiYau.exe C:\Program Files\CalabiYau\QtWebEngineProcess.exe
PID 880 wrote to memory of 1084 N/A C:\Program Files\CalabiYau\CalabiYau.exe C:\Program Files\CalabiYau\QtWebEngineProcess.exe
PID 880 wrote to memory of 1084 N/A C:\Program Files\CalabiYau\CalabiYau.exe C:\Program Files\CalabiYau\QtWebEngineProcess.exe
PID 880 wrote to memory of 1084 N/A C:\Program Files\CalabiYau\CalabiYau.exe C:\Program Files\CalabiYau\QtWebEngineProcess.exe
PID 880 wrote to memory of 1084 N/A C:\Program Files\CalabiYau\CalabiYau.exe C:\Program Files\CalabiYau\QtWebEngineProcess.exe
PID 880 wrote to memory of 1084 N/A C:\Program Files\CalabiYau\CalabiYau.exe C:\Program Files\CalabiYau\QtWebEngineProcess.exe
PID 880 wrote to memory of 1084 N/A C:\Program Files\CalabiYau\CalabiYau.exe C:\Program Files\CalabiYau\QtWebEngineProcess.exe
PID 880 wrote to memory of 1084 N/A C:\Program Files\CalabiYau\CalabiYau.exe C:\Program Files\CalabiYau\QtWebEngineProcess.exe
PID 880 wrote to memory of 1084 N/A C:\Program Files\CalabiYau\CalabiYau.exe C:\Program Files\CalabiYau\QtWebEngineProcess.exe
PID 880 wrote to memory of 1084 N/A C:\Program Files\CalabiYau\CalabiYau.exe C:\Program Files\CalabiYau\QtWebEngineProcess.exe
PID 880 wrote to memory of 1084 N/A C:\Program Files\CalabiYau\CalabiYau.exe C:\Program Files\CalabiYau\QtWebEngineProcess.exe
PID 880 wrote to memory of 1084 N/A C:\Program Files\CalabiYau\CalabiYau.exe C:\Program Files\CalabiYau\QtWebEngineProcess.exe
PID 880 wrote to memory of 1084 N/A C:\Program Files\CalabiYau\CalabiYau.exe C:\Program Files\CalabiYau\QtWebEngineProcess.exe
PID 880 wrote to memory of 4292 N/A C:\Program Files\CalabiYau\CalabiYau.exe C:\Program Files\CalabiYau\QtWebEngineProcess.exe
PID 880 wrote to memory of 4292 N/A C:\Program Files\CalabiYau\CalabiYau.exe C:\Program Files\CalabiYau\QtWebEngineProcess.exe

Processes

C:\Users\Admin\AppData\Local\Temp\Calabiyau_Installer_Release_0.9.1.396_10439382.exe

"C:\Users\Admin\AppData\Local\Temp\Calabiyau_Installer_Release_0.9.1.396_10439382.exe"

C:\Users\Admin\AppData\Local\Temp\is-RGH6A.tmp\Calabiyau_Installer_Release_0.9.1.396_10439382.tmp

"C:\Users\Admin\AppData\Local\Temp\is-RGH6A.tmp\Calabiyau_Installer_Release_0.9.1.396_10439382.tmp" /SL5="$D005E,170395914,906752,C:\Users\Admin\AppData\Local\Temp\Calabiyau_Installer_Release_0.9.1.396_10439382.exe"

C:\Program Files\CalabiYau\CalabiYau.exe

"C:\Program Files\CalabiYau\CalabiYau.exe" -sleep=2000

C:\Program Files\CalabiYau\tqm64\TQMCenter_64.exe

"C:\Program Files\CalabiYau\tqm64\TQMCenter_64.exe"

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /c rmdir /s /q "C:\Program Files\CalabiYau\tqm64\stm\"

C:\Program Files\CalabiYau\dxwebsetup.exe

"C:\Program Files\CalabiYau\dxwebsetup.exe"

C:\Program Files\CalabiYau\MicrosoftEdgeWebview2Setup.exe

"C:\Program Files\CalabiYau\MicrosoftEdgeWebview2Setup.exe"

C:\Program Files\CalabiYau\TenProtect\TASLogin64.exe

C:\Program Files\CalabiYau\TenProtect\TASLogin64.exe -p 880

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe

C:\Program Files\CalabiYau\QtWebEngineProcess.exe

"C:\Program Files\CalabiYau\QtWebEngineProcess.exe" --type=renderer --disable-speech-api --enable-threaded-compositing --enable-features=AllowContentInitiatedDataUrlNavigations,TracingServiceInProcess --disable-features=BackgroundFetch,ConsolidatedMovementXY,DnsOverHttpsUpgrade,FormControlsRefresh,MojoVideoCapture,PictureInPicture,SmsReceiver,UseSkiaRenderer,WebPayments,WebUSB --lang=en-US --webengine-schemes=qrc:sLV --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=3 --mojo-platform-channel-handle=3016 /prefetch:1

C:\Program Files\CalabiYau\QtWebEngineProcess.exe

"C:\Program Files\CalabiYau\QtWebEngineProcess.exe" --type=utility --enable-features=AllowContentInitiatedDataUrlNavigations,TracingServiceInProcess --disable-features=BackgroundFetch,ConsolidatedMovementXY,DnsOverHttpsUpgrade,FormControlsRefresh,MojoVideoCapture,PictureInPicture,SmsReceiver,UseSkiaRenderer,WebPayments,WebUSB --lang=en-US --service-sandbox-type=network --use-gl=angle --application-name=CalabiYau --webengine-schemes=qrc:sLV --mojo-platform-channel-handle=3044 /prefetch:8

C:\Program Files (x86)\Microsoft\Temp\EUCFC3.tmp\MicrosoftEdgeUpdate.exe

"C:\Program Files (x86)\Microsoft\Temp\EUCFC3.tmp\MicrosoftEdgeUpdate.exe" /installsource taggedmi /install "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers"

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe

"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regsvc

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe

"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regserver

C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe

"C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe"

C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe

"C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe"

C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe

"C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe"

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe

"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNzEuMzkiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzEuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7NTdGRTY2NjItM0Q5RS00MEExLUE3MjktNzc4NzRFN0QzNTY2fSIgdXNlcmlkPSJ7NTY3M0VBMEMtM0U4My00MTI0LUI4RDgtRTk1NzdDMjU4RUYwfSIgaW5zdGFsbHNvdXJjZT0idGFnZ2VkbWkiIHJlcXVlc3RpZD0iezUzNTFDOTA3LUE1NTMtNDA1Qy05MjdDLUIyRDVENTFBMEYxRH0iIGRlZHVwPSJjciIgZG9tYWluam9pbmVkPSIwIj48aHcgbG9naWNhbF9jcHVzPSI4IiBwaHlzbWVtb3J5PSI4IiBkaXNrX3R5cGU9IjIiIHNzZT0iMSIgc3NlMj0iMSIgc3NlMz0iMSIgc3NzZTM9IjEiIHNzZTQxPSIxIiBzc2U0Mj0iMSIgYXZ4PSIxIi8-PG9zIHBsYXRmb3JtPSJ3aW4iIHZlcnNpb249IjEwLjAuMTkwNDEuMTI4OCIgc3A9IiIgYXJjaD0ieDY0IiBwcm9kdWN0X3R5cGU9IjQ4IiBpc193aXA9IjAiLz48b2VtIHByb2R1Y3RfbWFudWZhY3R1cmVyPSJEQURZIiBwcm9kdWN0X25hbWU9IlN0YW5kYXJkIFBDIChRMzUgKyBJQ0g5LCAyMDA5KSIvPjxleHAgZXRhZz0iJnF1b3Q7cjQ1MnQxK2syVGdxL0hYemp2Rk5CUmhvcEJXUjlzYmpYeHFlVURIOXVYMD0mcXVvdDsiLz48YXBwIGFwcGlkPSJ7RjNDNEZFMDAtRUZENS00MDNCLTk1NjktMzk4QTIwRjFCQTRBfSIgdmVyc2lvbj0iMS4zLjE4NS4xNyIgbmV4dHZlcnNpb249IjEuMy4xNzEuMzkiIGxhbmc9IiIgYnJhbmQ9IiIgY2xpZW50PSIiPjxldmVudCBldmVudHR5cGU9IjIiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjQ5NDQ3ODQxODYiIGluc3RhbGxfdGltZV9tcz0iMTQ5NyIvPjwvYXBwPjwvcmVxdWVzdD4

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe

"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /handoff "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers" /installsource taggedmi /sessionid "{57FE6662-3D9E-40A1-A729-77874E7D3566}"

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe

"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /svc

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe

"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNzEuMzkiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzEuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7NTdGRTY2NjItM0Q5RS00MEExLUE3MjktNzc4NzRFN0QzNTY2fSIgdXNlcmlkPSJ7NTY3M0VBMEMtM0U4My00MTI0LUI4RDgtRTk1NzdDMjU4RUYwfSIgaW5zdGFsbHNvdXJjZT0idGFnZ2VkbWkiIHJlcXVlc3RpZD0ie0FFOEZCNTBGLTA4QkItNDc0Ni1CMDc1LTc4Njk5MUIwOTBEMH0iIGRlZHVwPSJjciIgZG9tYWluam9pbmVkPSIwIj48aHcgbG9naWNhbF9jcHVzPSI4IiBwaHlzbWVtb3J5PSI4IiBkaXNrX3R5cGU9IjIiIHNzZT0iMSIgc3NlMj0iMSIgc3NlMz0iMSIgc3NzZTM9IjEiIHNzZTQxPSIxIiBzc2U0Mj0iMSIgYXZ4PSIxIi8-PG9zIHBsYXRmb3JtPSJ3aW4iIHZlcnNpb249IjEwLjAuMTkwNDEuMTI4OCIgc3A9IiIgYXJjaD0ieDY0IiBwcm9kdWN0X3R5cGU9IjQ4IiBpc193aXA9IjAiLz48b2VtIHByb2R1Y3RfbWFudWZhY3R1cmVyPSJEQURZIiBwcm9kdWN0X25hbWU9IlN0YW5kYXJkIFBDIChRMzUgKyBJQ0g5LCAyMDA5KSIvPjxleHAgZXRhZz0iJnF1b3Q7cjQ1MnQxK2syVGdxL0hYemp2Rk5CUmhvcEJXUjlzYmpYeHFlVURIOXVYMD0mcXVvdDsiLz48YXBwIGFwcGlkPSJ7OEE2OUQzNDUtRDU2NC00NjNjLUFGRjEtQTY5RDlFNTMwRjk2fSIgdmVyc2lvbj0iMTA2LjAuNTI0OS4xMTkiIG5leHR2ZXJzaW9uPSIxMDYuMC41MjQ5LjExOSIgbGFuZz0iZW4iIGJyYW5kPSJHR0xTIiBjbGllbnQ9IiI-PGV2ZW50IGV2ZW50dHlwZT0iMzEiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjUiIHN5c3RlbV91cHRpbWVfdGlja3M9IjQ5NTE0NTQxMzciLz48L2FwcD48L3JlcXVlc3Q-

C:\Windows\system32\AUDIODG.EXE

C:\Windows\system32\AUDIODG.EXE 0x2ec 0x2f4

C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{C37DB9B6-EBE4-4BD8-86D5-6CADB730C69C}\MicrosoftEdge_X64_123.0.2420.81.exe

"C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{C37DB9B6-EBE4-4BD8-86D5-6CADB730C69C}\MicrosoftEdge_X64_123.0.2420.81.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --system-level

C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{C37DB9B6-EBE4-4BD8-86D5-6CADB730C69C}\EDGEMITMP_E9719.tmp\setup.exe

"C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{C37DB9B6-EBE4-4BD8-86D5-6CADB730C69C}\EDGEMITMP_E9719.tmp\setup.exe" --install-archive="C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{C37DB9B6-EBE4-4BD8-86D5-6CADB730C69C}\MicrosoftEdge_X64_123.0.2420.81.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --system-level

C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{C37DB9B6-EBE4-4BD8-86D5-6CADB730C69C}\EDGEMITMP_E9719.tmp\setup.exe

"C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{C37DB9B6-EBE4-4BD8-86D5-6CADB730C69C}\EDGEMITMP_E9719.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\MsEdgeCrashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=123.0.6312.106 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{C37DB9B6-EBE4-4BD8-86D5-6CADB730C69C}\EDGEMITMP_E9719.tmp\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=123.0.2420.81 --initial-client-data=0x22c,0x230,0x234,0x208,0x238,0x7ff69c0cbaf8,0x7ff69c0cbb04,0x7ff69c0cbb10

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe

"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNzEuMzkiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzEuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7NTdGRTY2NjItM0Q5RS00MEExLUE3MjktNzc4NzRFN0QzNTY2fSIgdXNlcmlkPSJ7NTY3M0VBMEMtM0U4My00MTI0LUI4RDgtRTk1NzdDMjU4RUYwfSIgaW5zdGFsbHNvdXJjZT0idGFnZ2VkbWkiIHJlcXVlc3RpZD0ie0Q5NTc4NDY0LUZFQzgtNDc5Ny1CMzI4LTY1Nzg2QzhCRjRGMn0iIGRlZHVwPSJjciIgZG9tYWluam9pbmVkPSIwIj48aHcgbG9naWNhbF9jcHVzPSI4IiBwaHlzbWVtb3J5PSI4IiBkaXNrX3R5cGU9IjIiIHNzZT0iMSIgc3NlMj0iMSIgc3NlMz0iMSIgc3NzZTM9IjEiIHNzZTQxPSIxIiBzc2U0Mj0iMSIgYXZ4PSIxIi8-PG9zIHBsYXRmb3JtPSJ3aW4iIHZlcnNpb249IjEwLjAuMTkwNDEuMTI4OCIgc3A9IiIgYXJjaD0ieDY0IiBwcm9kdWN0X3R5cGU9IjQ4IiBpc193aXA9IjAiLz48b2VtIHByb2R1Y3RfbWFudWZhY3R1cmVyPSJEQURZIiBwcm9kdWN0X25hbWU9IlN0YW5kYXJkIFBDIChRMzUgKyBJQ0g5LCAyMDA5KSIvPjxleHAgZXRhZz0iJnF1b3Q7VlBRb1AxRitmcTE1d1J6aDFrUEw0UE1wV2g4T1JNQjVpenZyT0MvY2hqUT0mcXVvdDsiLz48YXBwIGFwcGlkPSJ7RjMwMTcyMjYtRkUyQS00Mjk1LThCREYtMDBDM0E5QTdFNEM1fSIgdmVyc2lvbj0iIiBuZXh0dmVyc2lvbj0iMTIzLjAuMjQyMC44MSIgbGFuZz0iIiBicmFuZD0iIiBjbGllbnQ9IiIgZXhwZXJpbWVudHM9ImNvbnNlbnQ9ZmFsc2UiPjx1cGRhdGVjaGVjay8-PGV2ZW50IGV2ZW50dHlwZT0iOSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iNDk2NDg5NDE5MSIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjUiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjQ5NjUzMDQwNjgiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSIxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI1MjA4OTgzNjQ1IiBzb3VyY2VfdXJsX2luZGV4PSIwIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIiBkb3dubG9hZGVyPSJiaXRzIiB1cmw9Imh0dHA6Ly9tc2VkZ2UuZi50bHUuZGwuZGVsaXZlcnkubXAubWljcm9zb2Z0LmNvbS9maWxlc3RyZWFtaW5nc2VydmljZS9maWxlcy83YTBhMGJkNi1iOWM5LTRjNTYtOTY0OS1lOWU5YzIyZmJlNDM_UDE9MTcxMzE0MzYwMiZhbXA7UDI9NDA0JmFtcDtQMz0yJmFtcDtQND1oeVpQcVVldmVLRHNvblRvJTJiR3dYNkdXMXdhMndhWjZJOHVoYWtFODdpNWV3bnlZZklUdGFoNzhwN2NKQk1oZ0dyb0I0TmEzMXFRMzhjTVBCcFNleSUyYkElM2QlM2QiIHNlcnZlcl9pcF9oaW50PSIiIGNkbl9jaWQ9Ii0xIiBjZG5fY2NjPSIiIGNkbl9tc2VkZ2VfcmVmPSIiIGNkbl9henVyZV9yZWZfb3JpZ2luX3NoaWVsZD0iIiBjZG5fY2FjaGU9IiIgY2RuX3AzcD0iIiBkb3dubG9hZGVkPSIxNzIwODY3NDQiIHRvdGFsPSIxNzIwODY3NDQiIGRvd25sb2FkX3RpbWVfbXM9IjE2NDA1Ii8-PGV2ZW50IGV2ZW50dHlwZT0iMSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iNTIwOTA1Mzk5OSIgc291cmNlX3VybF9pbmRleD0iMCIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjYiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjUyMjQyNDU2NTAiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSIyIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIxOTY3NTciIHN5c3RlbV91cHRpbWVfdGlja3M9IjU2NzU0MTU3MDkiIHNvdXJjZV91cmxfaW5kZXg9IjAiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiIHVwZGF0ZV9jaGVja190aW1lX21zPSI5NzAiIGRvd25sb2FkX3RpbWVfbXM9IjI0MzU5IiBkb3dubG9hZGVkPSIxNzIwODY3NDQiIHRvdGFsPSIxNzIwODY3NDQiIHBhY2thZ2VfY2FjaGVfcmVzdWx0PSIwIiBpbnN0YWxsX3RpbWVfbXM9IjQ1MTE0Ii8-PC9hcHA-PC9yZXF1ZXN0Pg

Network

Country Destination Domain Proto
US 8.8.8.8:53 21.114.53.23.in-addr.arpa udp
US 8.8.8.8:53 13.86.106.20.in-addr.arpa udp
US 8.8.8.8:53 0.204.248.87.in-addr.arpa udp
US 8.8.8.8:53 159.113.53.23.in-addr.arpa udp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 pc.crashsight.qq.com udp
CN 121.229.88.95:443 pc.crashsight.qq.com tcp
US 8.8.8.8:53 130.118.77.104.in-addr.arpa udp
US 8.8.8.8:53 tqos.anticheatexpert.com udp
HK 129.226.103.201:8081 tqos.anticheatexpert.com udp
US 8.8.8.8:53 201.103.226.129.in-addr.arpa udp
HK 129.226.103.201:8081 tqos.anticheatexpert.com udp
US 8.8.8.8:53 apps.game.qq.com udp
US 8.8.8.8:53 down.klbq.qq.com udp
CN 101.227.134.49:80 apps.game.qq.com tcp
CN 114.66.250.47:443 down.klbq.qq.com tcp
CN 114.66.250.47:443 down.klbq.qq.com tcp
US 8.8.8.8:53 whois.pconline.com.cn udp
US 8.8.8.8:53 down.qq.com udp
CN 14.29.101.169:80 whois.pconline.com.cn tcp
DE 43.152.137.29:443 down.qq.com tcp
DE 43.152.137.29:443 down.qq.com tcp
US 8.8.8.8:53 pc.perfsight.qq.com udp
CN 43.141.128.108:443 pc.perfsight.qq.com tcp
N/A 224.0.0.251:5353 udp
US 8.8.8.8:53 msedge.api.cdp.microsoft.com udp
US 23.102.129.60:443 msedge.api.cdp.microsoft.com tcp
US 8.8.8.8:53 29.137.152.43.in-addr.arpa udp
US 8.8.8.8:53 open.weixin.qq.com udp
DE 43.152.137.29:443 down.qq.com tcp
US 8.8.8.8:53 60.129.102.23.in-addr.arpa udp
HK 203.205.239.154:443 open.weixin.qq.com tcp
HK 203.205.239.154:443 open.weixin.qq.com tcp
US 8.8.8.8:53 intldlgs.qq.com udp
US 8.8.8.8:53 msfwifi.3g.qq.com udp
US 8.8.8.8:53 154.239.205.203.in-addr.arpa udp
HK 43.154.240.13:8080 msfwifi.3g.qq.com tcp
BE 23.14.90.96:443 intldlgs.qq.com tcp
N/A 255.255.255.255:67 udp
US 8.8.8.8:53 ocsp.digicert.cn udp
US 163.181.154.243:80 ocsp.digicert.cn tcp
US 8.8.8.8:53 96.90.14.23.in-addr.arpa udp
US 8.8.8.8:53 243.154.181.163.in-addr.arpa udp
US 8.8.8.8:53 13.240.154.43.in-addr.arpa udp
US 8.8.8.8:53 res.wx.qq.com udp
NL 43.152.42.232:443 res.wx.qq.com tcp
NL 43.152.42.232:443 res.wx.qq.com tcp
NL 43.152.42.232:443 res.wx.qq.com tcp
NL 43.152.42.232:443 res.wx.qq.com tcp
BE 23.14.90.96:443 intldlgs.qq.com tcp
US 8.8.8.8:53 232.42.152.43.in-addr.arpa udp
US 8.8.8.8:53 open.weixin.qq.com udp
HK 203.205.239.154:443 open.weixin.qq.com tcp
US 8.8.8.8:53 msedge.f.tlu.dl.delivery.mp.microsoft.com udp
GB 104.77.118.123:80 msedge.f.tlu.dl.delivery.mp.microsoft.com tcp
US 8.8.8.8:53 lp.open.weixin.qq.com udp
CN 109.244.216.15:443 lp.open.weixin.qq.com tcp
CN 109.244.216.15:443 lp.open.weixin.qq.com tcp
CN 121.229.88.95:443 pc.crashsight.qq.com tcp
CN 101.227.134.27:80 apps.game.qq.com tcp
CN 42.236.89.185:443 down.klbq.qq.com tcp
CN 42.236.89.185:443 down.klbq.qq.com tcp
CN 14.29.101.168:80 whois.pconline.com.cn tcp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
CN 109.244.217.35:443 lp.open.weixin.qq.com tcp
CN 109.244.217.35:443 lp.open.weixin.qq.com tcp
CN 101.227.134.49:80 apps.game.qq.com tcp
CN 119.167.147.70:443 down.klbq.qq.com tcp
CN 119.167.147.70:443 down.klbq.qq.com tcp
CN 14.29.101.160:80 whois.pconline.com.cn tcp
N/A 127.0.0.1:60667 tcp
N/A 127.0.0.1:60669 tcp
N/A 127.0.0.1:60737 tcp
N/A 127.0.0.1:60739 tcp
US 8.8.8.8:53 udp
US 8.8.8.8:53 download.microsoft.com udp
GB 23.37.1.191:80 download.microsoft.com tcp
US 8.8.8.8:53 30.243.111.52.in-addr.arpa udp
GB 23.37.1.191:443 download.microsoft.com tcp
US 8.8.8.8:53 191.1.37.23.in-addr.arpa udp
CN 101.227.134.27:80 apps.game.qq.com tcp
CN 115.56.90.107:443 down.klbq.qq.com tcp
CN 115.56.90.107:443 down.klbq.qq.com tcp
CN 14.29.101.169:80 whois.pconline.com.cn tcp
CN 109.244.216.15:443 lp.open.weixin.qq.com tcp
CN 109.244.216.15:443 lp.open.weixin.qq.com tcp
CN 114.66.246.100:443 down.klbq.qq.com tcp
CN 114.66.246.100:443 down.klbq.qq.com tcp
CN 14.29.101.168:80 whois.pconline.com.cn tcp
CN 121.229.88.95:443 pc.crashsight.qq.com tcp
CN 109.244.217.35:443 lp.open.weixin.qq.com tcp
CN 109.244.217.35:443 lp.open.weixin.qq.com tcp
CN 122.189.171.103:443 down.klbq.qq.com tcp
CN 122.189.171.103:443 down.klbq.qq.com tcp
CN 14.29.101.160:80 whois.pconline.com.cn tcp

Files

memory/368-0-0x0000000000400000-0x00000000004EB000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\is-RGH6A.tmp\Calabiyau_Installer_Release_0.9.1.396_10439382.tmp

MD5 dfed274da67e0b3a8b96f094a9560b6c
SHA1 f1962d545fa9c5bcdf72659ab26aee5b88cb1d05
SHA256 9332c50391190257db94f18322f2152068655a2cc3aa43ecf7a59a55287fb488
SHA512 28082f0640184641734a0042d8364fe6df103e1d814128b3f85b4e5335bdd8b150a31d0598f18b3b1d592f741741f70f482c0d039dfb3caade15972335160bf5

memory/1980-5-0x0000000000BE0000-0x0000000000BE1000-memory.dmp

memory/368-29-0x0000000000400000-0x00000000004EB000-memory.dmp

memory/1980-30-0x0000000000400000-0x0000000000729000-memory.dmp

C:\Program Files\CalabiYau\CalabiYau.exe

MD5 b9a7d4967f239fc5393fd5d8088a7aec
SHA1 582d14c1b6412e775c2fc5798178ed73170014aa
SHA256 a853267d347871ca8003b482d4c746c274987588b19d85e6436da1e7bad3e5bd
SHA512 cbf885a4e111b28c73ab0c94c5798d348452228683c9e495a63fe60239e65f3124bf1adc84af577d45bc55b5dfa764a907035b0eb5d772f46203555883fe2de7

C:\Program Files\CalabiYau\UpdateGUI\is-UCU3E.tmp

MD5 bacb72fa56de18d5ac63e4a0a3fe768f
SHA1 7db19efe649d30337781afd62616c0549255046e
SHA256 25905676b543c4f05e9dae135f929c03a57686a6941ce59be2b3450521feb943
SHA512 78d82962c11e5928e77c5bd0377ecb6b00c2eca242d637f76e68fbf907bce7381f3a5294100d055c30f6e2aee164db0b95dcf0c0c77e39edcec4a046cfc63ed4

C:\Program Files\CalabiYau\UpdateGUI\is-VFPNG.tmp

MD5 01370c79ebabd534e7b58d35072d2866
SHA1 8cd0cd21ff838a2a314246def4bd858bab184a5d
SHA256 742bb9bf4c232f84ad8008af4af8eda7a1ec3eb76f05d9d7ebb95f6a5cabd2d8
SHA512 b07d9634ac804b476d61b6a0fc87894947e88744cc3eecf7d68ede3714acd938fae14452e43f9110919b8f8f9f5d4222e9de2ca97a915dd07b3231d674729761

C:\Program Files\CalabiYau\UpdateGUI\is-94DVA.tmp

MD5 85893a96a568ba9781f50f876ed303cd
SHA1 fb7473bc5b1e88e978b7e5664b45d69770c8f4fa
SHA256 08e34f12de24e89379a0533f21a23ce6fecbea05d4062796d4ffd4adc3012316
SHA512 864fa39423b8ca9c43fa177aca1484ec2ffae4868a434e7a8016efe88f396b67fb8ca3766f611de7218e9983653a8b7b88b07c2591b252dd93a0d9638980e7ff

C:\Program Files\CalabiYau\UpdateGUI\is-DV7C2.tmp

MD5 55b80c522731ecb92914bf9cded028c2
SHA1 424c61bc659caf04281959ede1b1f03b703934ed
SHA256 4c787ff8d40bb803e75fe6218fec36a672cfa6cfc7f6e80e68a7eb0b77a10e5a
SHA512 3779b530c7dba624369cb0f5d15154d89547adc3c4c7cc0571f1e8326588165098b9b5768d0052ecf1ea4f2dc84ae7dcf4712e3bc9ebdadb5fca4b0f4de43812

C:\Program Files\CalabiYau\UpdateGUI\is-H90I2.tmp

MD5 4614d03a94d46c0e9d1c5d96a3fe1d78
SHA1 cacb73ca3c7e31a4b8f749854060b7a422497050
SHA256 c7919be431ce2fa1906ff9eeb19e4cb19a30a4680107ef8737ce894654b21a5a
SHA512 4f30e8c5893662d7889a049c206b08559ad1a34eb7927be313086d6dae40dca3571de3852dba2ad9324e028fa86e8a391a58ec48ba5dbd5c4a88660ffe8b30df

C:\Program Files\CalabiYau\UpdateGUI\is-TR9F9.tmp

MD5 7a2799f4bc45505e7104e06dc8e254f8
SHA1 323bc35e0101b351a4abde1fce698520832518a8
SHA256 92f72f495a6897f7d7cf2c2064b2b65f6b4fbd4f30911a534a5cd0de73395ebe
SHA512 2627da183779f17fcc9709a6da2e2916a296f61124adb9bf563c80d723ada9b769806cab8fbc4ed916f54fd4cde18f25e7ad53ed6c75e7e61fdef37c2f1ec9b2

C:\Program Files\CalabiYau\UpdateGUI\is-74KTI.tmp

MD5 c4fe3f03efd3188252caa101f954ffeb
SHA1 98b613aee45c71aed9d2be0d61d7ace323929e9c
SHA256 95bb425be3d515a6a58f7399d44dd9e032baea11667dfdba29517c460171880a
SHA512 80018e0bddf079367d3568433a5f89f0144aa0a75286b0105fe32aeeb5d80876c9b2e1ecaafb70fb041271e27a234a2cb88a2d3d160a4aa3768ccfcfc574704a

C:\Program Files\CalabiYau\UpdateGUI\is-5OK8M.tmp

MD5 4f096d96285e06cd51aef7d2d3de04da
SHA1 c90ef0eb5b1a0b1b85ad6792291747fb6307dcdb
SHA256 5bb420fbe28315f2117376052bb8488ce84a3398dda65005b8ae1f792017e9a8
SHA512 80f558c50a71ad9c4930b3838b481e4fb453c38d57c91f7f70c1f86e4043b9a4fbcec27d7c025285504cbf3bde7c50b4770f18121d7818ac58e2ee9c2071f97c

C:\Program Files\CalabiYau\UpdateGUI\is-1PEIM.tmp

MD5 cd0c37f1875b704f8eb08e397381ac16
SHA1 249d33c43e105a1c36ec6a24e5ef8dbc5f56b31b
SHA256 d86ac158123a245b927592c80cc020fea29c8c4addc144466c4625a00ca9c77a
SHA512 d60c56716399b417e1d9d7d739af13674c8572974f220a44e5e4e9ab0b0a23b8937bd0929eee9f03f20b7f74db008f70f9559a7eb66948b3afab5b96bdd1a6d5

C:\Program Files\CalabiYau\UpdateGUI\is-7639U.tmp

MD5 8ad9c7cffbb2413f4d5ff9f3aaa1a69b
SHA1 2b5116e49ac5913ef8a512a7299e9a459dab4778
SHA256 18aef42187072c35b537be80e3b2da7ce4919b2c9574add19409d98e3026d916
SHA512 d489b82ce896a06cd37905bc5b2fe9620f4e7feb2a9b77fc93f94e0270b67e7a2f3879afba6b546ad44f2ee96f050e83bfc93830010a707126667857be79028a

C:\Program Files\CalabiYau\UpdateGUI\is-AT8OC.tmp

MD5 84269806dce633e56e492ef060fa8f88
SHA1 a1e71cb750d25e7a63e0c9d0b01063df421f1938
SHA256 5fca695ed2cefec010d546310699226eef4b305df38cbe3dea2fdf9494abc163
SHA512 b25d25a35e6e431bacaf4d5fea0e40f3fe49cca14895c64ddbd78c212a2ef0b09b56616154a3d26813e9faaf3db1f6bb24a300b5f39b8ce286a41a12f6920ef1

C:\Program Files\CalabiYau\UpdateGUI\is-5B13P.tmp

MD5 df3ca8d16bded6a54977b30e66864d33
SHA1 b7b9349b33230c5b80886f5c1f0a42848661c883
SHA256 1d1a1ae540ba132f998d60d3622f0297b6e86ae399332c3b47462d7c0f560a36
SHA512 951b2f67c2f2ef1cfcd4b43bd3ee0e486cdba7d04b4ea7259df0e4b3112e360aefb8dcd058becccacd99aca7f56d4f9bd211075bd16b28c2661d562e50b423f0

C:\Program Files\CalabiYau\UpdateGUI\is-4SKD3.tmp

MD5 36354d9b5b0a58a4b9a19103852c00a2
SHA1 0ea4b3cfb14e49cec0d42ff0f1fa989e69647a8f
SHA256 e5a863d3f4bfefed7d73a7b1499f81b7235bc9ae3c108065041bcb8e5446b1bb
SHA512 caaaff8e904f8dd24ce12dfd8fdf23ac54f4bf630a8535b1b575bf3890a51bce82bce145d001fb18b65f30bedb9fc863cf61dd69d446ddf5bffd64bc06ae1fb4

memory/1980-476-0x0000000000400000-0x0000000000729000-memory.dmp

C:\Program Files\CalabiYau\UpdateGUI\is-DF7UE.tmp

MD5 b1399c7bcc6ac3806a6b904212faf547
SHA1 bb75cb27c951f7e5d34cc514d598e34e372b18d1
SHA256 476a9bbb93f15181bf5c379be141e0518439dff7bb13b35a98698c85f2f092d9
SHA512 14918a56c6195562e6954395286a18ac4fa61f8768a9060a153a4e0eb698a1d2b2bd75c18303db511b5cb68b2c2677d2442466a5ca8a6484e5318948b8397a75

C:\Program Files\CalabiYau\UpdateGUI\is-BJI34.tmp

MD5 7ef7eab654df53e087ac4703c9ea0b16
SHA1 743dc76d168326b60f09347945fe1342a6effc4c
SHA256 13e568fdcde1b7b7f2d1c97a474bdb8858f5ab761157f0fea7201ccecf84b9b8
SHA512 0b860f10c03acb3866e82fd6044c29d63a2c6a1d5f6628f3d31f1cd1e44d7144e3660df3446b7a0b76b7811b261675e5aa39fb27efeec060d287fde3e630edd2

C:\Program Files\CalabiYau\UpdateGUI\is-009NA.tmp

MD5 11d9ac94e8cb17bd23dea89f8e757f18
SHA1 d4fb80a512486821ad320c4fd67abcae63005158
SHA256 e1d6f78a72836ea120bd27a33ae89cbdc3f3ca7d9d0231aaa3aac91996d2fa4e
SHA512 aa6afd6bea27f554e3646152d8c4f96f7bcaaa4933f8b7c04346e410f93f23cfa6d29362fd5d51ccbb8b6223e094cd89e351f072ad0517553703f5bf9de28778

C:\Program Files\CalabiYau\UpdateGUI\is-HPP3G.tmp

MD5 7667b0883de4667ec87c3b75bed84d84
SHA1 e6f6df83e813ed8252614a46a5892c4856df1f58
SHA256 04e7ccbdcad7cbaf0ed28692fb08eab832c38aad9071749037ee7a58f45e9d7d
SHA512 968cbaafe416a9e398c5bfd8c5825fa813462ae207d17072c035f916742517edc42349a72ab6795199d34ccece259d5f2f63587cfaeb0026c0667632b05c5c74

memory/1980-568-0x0000000000BE0000-0x0000000000BE1000-memory.dmp

C:\Program Files\CalabiYau\Qt5Positioning.dll

MD5 714764b987a174a4c03e29187ece86d6
SHA1 70b96b3951702972738bd618324a87257e6157cd
SHA256 8889372b8880e9ab78b86d863cfb1a7c4e22cfaa5360d3761bd03b9de10228bd
SHA512 698e807e4b8aa7aae05ea85f02f51a9f7edc5b74bd97e047d607bb95823b5d1d4e52e749513f2ce4c4bd89c643dee4504847da5f0061f4cd09d7f2ef3e310e7d

memory/880-617-0x00007FFAF4EA0000-0x00007FFAF5298000-memory.dmp

memory/880-616-0x00007FFAF6150000-0x00007FFAF6691000-memory.dmp

C:\Program Files\CalabiYau\Qt5Qml.dll

MD5 d055566b5168d7b1d4e307c41ce47c4b
SHA1 043c0056e9951da79ec94a66a784972532dc18ef
SHA256 30035484c81590976627f8face9507caa8581a7dc7630cccf6a8d6de65cab707
SHA512 4f12d17aa8a3008caa3ddd0e41d3ed713a24f9b5a465ee93b2e4beccf876d5bdf0259aa0d2dd77ad61bb59dc871f78937ffbe4d0f60638014e8ea8a27caf228d

C:\Program Files\CalabiYau\Qt5QmlModels.dll

MD5 2030c4177b499e6118be5b9e5761fce1
SHA1 050d0e67c4aa890c80f46cf615431004f2f4f8fc
SHA256 51e4e5a5e91f78774c44f69b599fae4735277ef2918f7061778615cb5c4f6e81
SHA512 488f7d5d9d8deee9bbb9d63dae346e46efeb62456279f388b323777999b597c2d5aea0ee379bdf94c9cbcfd3367d344fb6b5e90ac40be2ce95efa5bbdd363bcc

C:\Program Files\CalabiYau\StackWalker.dll

MD5 e6b3a5c289b8cb66afcef7dea2c8edc6
SHA1 e94d442e9b70d6f7280eca0c25469062ca8c9f62
SHA256 84add93c3b5d3a427bb3853bfebe21df24a85ab43276d846c1b28f990dbd4be3
SHA512 b25d19c53607122bcad611d3bf45843c20cf0bf1586f7f5fc4e6b7a1e805bedde1b2bca60b45398be40eefc86ec44faa115df839cd5bffdc8923f762cadc3a72

C:\Program Files\CalabiYau\Qt5QuickWidgets.dll

MD5 98ef5971f86fb44ca9b1968189ce6d93
SHA1 3d90381671497ace9aed530e35bb68f4f747acfb
SHA256 d82e8df844ac7b1d0a71a897ce7c93ba8601bfee6413c8a1206b0b7cbf69d02f
SHA512 fbed6e3cb76e5f3919b799d53b955e2b77cdd00aa0e75b26715be4bc4be744a51ed8aa2fd22f21d9865cc8e1940cb7f0fd37da6b804e95a5456d7f0f1331f01d

C:\Program Files\CalabiYau\Qt5PrintSupport.dll

MD5 61ac08d0e73555352714ff9044130c52
SHA1 f5fee2811236640821a2c18c9e2eaadd509c6e62
SHA256 783d4f1feb8dc0bc00acb8c094d6c1ab39ac6b5858874e60dd3d45677af4307a
SHA512 6abdbfe5ffbd5c1c1204edbfcc47f6b1072aa6a5b229901fe9b22cd2e193e7c963c62b8ac3cabec6467d2440eaddd47214d8f98a06e885822314b98bbcfc2bde

C:\Program Files\CalabiYau\Qt5Quick.dll

MD5 65f59cfc0c1c060ce20d3b9ceffbaf46
SHA1 cfd56d77506cd8c0671ca559d659dab39e4ad3c2
SHA256 c81ad3c1111544064b1830c6f1aef3c1fd13b401546ab3b852d697c0f4d854b3
SHA512 d6f6dc19f1a0495026cba765b5a2414b6af0dbfc37b5aceed1cd0ae37b3b0f574b759a176d75b01edd74c6ce9a3642d3d29a3fd7f166b53a41c8978f562b4b50

C:\Program Files\CalabiYau\Qt5WebEngineCore.dll

MD5 024ab212db7943cb76a1bacc19dd90db
SHA1 8163d89bb975e6bfaae57381e2f83d5635ecf185
SHA256 a426794dc8c476b742f9b592a3d5e2e7f867c1ebb750b6168dba0ac7460dee16
SHA512 2d9cb2fcfed9fbfc8a6b7ccecb1159351dc1c2bea9f9d3aa8cde63e8769b1087dc5d0128de7e6fca9b8ba07b45a7c6d9a516866c26dcde8205349be051e434da

C:\Program Files\CalabiYau\Qt5Core.dll

MD5 817520432a42efa345b2d97f5c24510e
SHA1 fea7b9c61569d7e76af5effd726b7ff6147961e5
SHA256 8d2ff4ce9096ddccc4f4cd62c2e41fc854cfd1b0d6e8d296645a7f5fd4ae565a
SHA512 8673b26ec5421fce8e23adf720de5690673bb4ce6116cb44ebcc61bbbef12c0ad286dfd675edbed5d8d000efd7609c81aae4533180cf4ec9cd5316e7028f7441

C:\Program Files\CalabiYau\Qt5Sql.dll

MD5 ccfddf94281ffad70ee2d26bb77f8b1c
SHA1 6861a4b16ac5ab05ff594e50d8d63579dab1d969
SHA256 9ca14f8d46c25c7c5be2ffbd070231859906204a775e8b8b3f762630efd5f721
SHA512 4bd2d0ba6e3cef76de2a0e09d8ad1b27c8d00e55744ec25f37bef1e4e5e8723468054d1b8c719ab2318bdda342639447f138995a9be22fd8c5af71eece953bb2

C:\Program Files\CalabiYau\Qt5Network.dll

MD5 3569693d5bae82854de1d88f86c33184
SHA1 1a6084acfd2aa4d32cedfb7d9023f60eb14e1771
SHA256 4ef341ae9302e793878020f0740b09b0f31cb380408a697f75c69fdbd20fc7a1
SHA512 e5eff4a79e1bdae28a6ca0da116245a9919023560750fc4a087cdcd0ab969c2f0eeec63bbec2cd5222d6824a01dd27d2a8e6684a48202ea733f9bb2fab048b32

C:\Program Files\CalabiYau\Qt5WebChannel.dll

MD5 5a3423d138ae3b710f519c84cf8779f8
SHA1 e43a7054fe9f7fb520b55d7994cbec6597e4786c
SHA256 b4779c806f60183899c2027dd919c133062de83f7395aa40c1c32e6c6498de37
SHA512 0e7c42a5c5013899580d3829061d2a01df809456f52b9711ba69ca203fda113605588d45d3a07d34c254dcb415c889bc8563535cece4980a4ac81caed9eb6482

C:\Program Files\CalabiYau\Qt5WebSockets.dll

MD5 a016545f963548e0f37885e07ef945c7
SHA1 cbe499e53ab0bd2da21018f4e2092e33560c846f
SHA256 6b56f77da6f17880a42d2f9d2ec8b426248f7ab2196a0f55d37ade39e3878bc6
SHA512 47a3c965593b97392f8995c7b80394e5368d735d4c77f610afd61367ffe7658a0e83a0dbd19962c4fa864d94f245a9185a915010afa23467f999c833982654c2

C:\Program Files\CalabiYau\Qt5Gui.dll

MD5 47307a1e2e9987ab422f09771d590ff1
SHA1 0dfc3a947e56c749a75f921f4a850a3dcbf04248
SHA256 5e7d2d41b8b92a880e83b8cc0ca173f5da61218604186196787ee1600956be1e
SHA512 21b1c133334c7ca7bbbe4f00a689c580ff80005749da1aa453cceb293f1ad99f459ca954f54e93b249d406aea038ad3d44d667899b73014f884afdbd9c461c14

C:\Program Files\CalabiYau\Qt5Widgets.dll

MD5 4cd1f8fdcd617932db131c3688845ea8
SHA1 b090ed884b07d2d98747141aefd25590b8b254f9
SHA256 3788c669d4b645e5a576de9fc77fca776bf516d43c89143dc2ca28291ba14358
SHA512 7d47d2661bf8fac937f0d168036652b7cfe0d749b571d9773a5446c512c58ee6bb081fec817181a90f4543ebc2367c7f8881ff7f80908aa48a7f6bb261f1d199

C:\Program Files\CalabiYau\Qt5Multimedia.dll

MD5 01df79071f9da0b9b7bda3db7fdc8809
SHA1 6944acc06f8691a27aa0833d29f0389f0e036bf0
SHA256 1a59ae2a9ff768ad6bfb888fe3dd2544e238f0b28da83cf375ebd803ce713dc4
SHA512 486d3f93e56ab50e0c9937e3472762946afdbb28279818d42081f5784f3af2df6d55253d4cf4839601058dcefb5e543144b91b4572bed96ca9926a0a2afe5711

C:\Program Files\CalabiYau\Qt5WebEngineWidgets.dll

MD5 1b3351ae6202c0062badf6db9e1acd51
SHA1 be460f95a4b76909b7cbbe2d0ee352f584d8891c
SHA256 4da0eaa3e6d0ef0f691c6074d50599bc3f52c10d0b4cfa3ebf231a38bb2e7f16
SHA512 63ebd025cf5f2a5b874b392ebe6f2ae9b11f259443d53164f2a23e383aeed62a9ee7167980accd5820546d156410b92104f7def89749e25ccd5f92f3ef2e9e75

C:\Program Files\CalabiYau\Core.dll

MD5 2625199429e1d3d474ef76bc31004396
SHA1 fe7ab68fc5ff93e205bd69032dbba22d572048c8
SHA256 01f6616082ebbded98bce1a9d0e691d77fb5a278773a7ebe39dc79aba4a6bec9
SHA512 7f6bc2e20755d76e19f38d67b43fdf37e5d16133d11ab05bca094776ffa2f93613eaa6fcd24bdc1927a66baabea4e1b7ca74345ad294890e74e388919ec31cc1

memory/1980-621-0x0000000000400000-0x0000000000729000-memory.dmp

memory/368-622-0x0000000000400000-0x00000000004EB000-memory.dmp

C:\Program Files\CalabiYau\platforms\qwindows.dll

MD5 4931fcd0e86c4d4f83128dc74e01eaad
SHA1 ac1d0242d36896d4dda53b95812f11692e87d8df
SHA256 3333ba244c97264e3bd19db5953efa80a6e47aaced9d337ac3287ec718162b85
SHA512 0396bccda43856950afe4e7b16e0f95d4d48b87473dc90cf029e6ddfd0777e1192c307cfe424eae6fb61c1b479f0ba1ef1e4269a69c843311a37252cf817d84d

C:\Program Files\CalabiYau\libGLESv2.dll

MD5 2247ee4356666335df7d72129af8d600
SHA1 f0131c1a67fc17c0e8dcc4a4ca38c9f1780e7182
SHA256 50fad5605b3d57627848b3b84a744dfb6a045609b8236b04124f2234676758d8
SHA512 67f2a7bf169c7b9a516689cf1b16446ca50e57f099b9b742ccb1abb2dcde8867f8f6305ad8842cd96194687fc314715ae04c1942b0e0a4f51b592b028c5b16d3

C:\Program Files\CalabiYau\libEGL.dll

MD5 bb00ef1dd81296af10fdfa673b4d1397
SHA1 773ffcf4a231b963baac36cbef68079c09b62837
SHA256 32092de077fd57b6ef355705ec46c6d21f6d72fbe3d3a5dd628f2a29185a96fa
SHA512 c87c0868c04852b63a7399afe4e568cd9a65b7b7d5fd63030abea649aac5e9f2293ab5be2b2ce56a57f2b4b1992ae730150a293ada53637fc5cd7be0a727cbd4

memory/880-624-0x00000217DDD30000-0x00000217DDD40000-memory.dmp

C:\Program Files\CalabiYau\bearer\qgenericbearer.dll

MD5 14d67b1249a52090a8d3edca9fdcc262
SHA1 25854e05f742ec256d438537e32e3c4d4edeb020
SHA256 0534cef5f54eb6d10b2e90bd6089dc413c555771e12220be9a5cc48adddc803d
SHA512 7e147968b23396c9cee076e570e9339242c2e594d42d9cbbcb19d3d664635ae84a3e73ddf9ece59abdce5e02b6edd3521e9685d93eb987bacfdcd2b9c09a2c7a

C:\Program Files\CalabiYau\styles\qwindowsvistastyle.dll

MD5 53a85f51054b7d58d8ad7c36975acb96
SHA1 893a757ca01472a96fb913d436aa9f8cfb2a297f
SHA256 d9b21182952682fe7ba63af1df24e23ace592c35b3f31eceef9f0eabeb5881b9
SHA512 35957964213b41f1f21b860b03458404fbf11daf03d102fbea8c2b2f249050cefbb348edc3f22d8ecc3cb8abfdc44215c2dc9da029b4f93a7f40197bd0c16960

C:\Program Files\CalabiYau\Gbspy64.dll

MD5 8e4d03982f349a77525ff4b49bef4e4e
SHA1 43a18d560fce86d948016780f528f9798ee28839
SHA256 5c8f3da120e649874eba545722e81ffa43a6d8d67fa0619383f9a3f3c1a95d1c
SHA512 7cc38e728a0213d0fb971d9f1b3cd22c4ae0478805c9516bfd3380bc190a6cd7c19345399f768f51e9e6cd64d085276423d5aac07f3f167a805dc7a465189855

C:\Program Files\CalabiYau\GameBabyConfig64.dat

MD5 affbf5327dc01b05b4b403aed1a2c10a
SHA1 0a6f9b8a2fd4fc544cf31ac39fbadb798ebb94aa
SHA256 7b5730bd4f411bb2166669bcd7c769dad4e1a3e20875ee99b928e308aa7e351e
SHA512 ac4d409a1ab8c5ecda0dc789c1651aa7ebfcae8a9a73bf5051dd26d56d3150c8a5adf2f3b18edaa28b6a20ac333b1022bf790bf2e9237fd4aa9cf88868d3c8b6

C:\Program Files\CalabiYau\channelArgs

MD5 7b46ef262f13869b3b67196d5ada0492
SHA1 cff3615e1e1abbef923b7798d4efbcfbbc204bff
SHA256 6b33cdb20c42057d1723fc8d4c69c5f2a866681fa6756a475784839c3b546d03
SHA512 cf1693eb5c6aee9694b8d9326c40320ac935039bb99d9411927b8174d5df84f3d15f30694d75f8226c943f1cdbd1ee300f5cbbd7971fd133cdb58eaff3eab51f

C:\Program Files\CalabiYau\profile

MD5 3fd9a366b053e02859df5c5798cf94e6
SHA1 b42e2371e8645e9ba95aee15edff172168c08818
SHA256 557a33c5fb9cc71845ae191926c81492a51dd2e2e6c06f0daa48f2621d20ea32
SHA512 76d0658b9bdc0bf7dd67506e57f21895a8b8c9be8cb2071bfd17227acae8e070def8ee3a498521c8c5d586dfdb15a23fa5d34e892f243f8dd601fb87304454ca

C:\Program Files\CalabiYau\TQM64\TQMCenter_64.exe

MD5 0d47a77635ec9497b6bc6e29ab3ea00c
SHA1 3935fc2745310d14e153a48fb93f19a430876439
SHA256 f9a69d21321bed941667c619132d0e61b1348c43c06e18bd65721fbc3edce1d2
SHA512 44f505575c4c8ac856fb74752fec2d134f5d151a729db8e16fd140f86fa2deb9e38bb442efad25075067064130485cebe5ae360b36ee9c67795444d601ec0bcc

C:\Program Files\CalabiYau\log\launcher.log

MD5 db91a0b123f1c1cf54c7eaffa22cb759
SHA1 14cf664ec4a1476c45cef050d8a92b7a5ad1d8be
SHA256 f63f78dd22dda3bfc678eb2aea37bd28212a70d6d5ca422dfeca457d656080ba
SHA512 8d830f8faf7accb148fff925252a299a3176aa1d9eb392c3de3b19a9a8b89428e35ba9c952f39f515830bb1a1325550fda3dc5180ce1e779db980dee64bec8d0

memory/880-666-0x00007FFB15A90000-0x00007FFB15A91000-memory.dmp

C:\Windows\SysWOW64\directx\websetup\dsetup32.dll

MD5 a5412a144f63d639b47fcc1ba68cb029
SHA1 81bd5f1c99b22c0266f3f59959dfb4ea023be47e
SHA256 8a011da043a4b81e2b3d41a332e0ff23a65d546bd7636e8bc74885e8746927d6
SHA512 2679a4cb690e8d709cb5e57b59315d22f69f91efa6c4ee841943751c882b0c0457fd4a3376ac3832c757c6dfaffb7d844909c5665b86a95339af586097ee0405

C:\Windows\SysWOW64\directx\websetup\dsetup.dll

MD5 984cad22fa542a08c5d22941b888d8dc
SHA1 3e3522e7f3af329f2235b0f0850d664d5377b3cd
SHA256 57bc22850bb8e0bcc511a9b54cd3da18eec61f3088940c07d63b9b74e7fe2308
SHA512 8ef171218b331f0591a4b2a5e68dcbae98f5891518ce877f1d8d1769c59c0f4ddae43cc43da6606975078f889c832f0666484db9e047782e7a0ae4a2d41f5bef

memory/1440-701-0x0000000140000000-0x000000014030A000-memory.dmp

C:\Windows\Logs\DirectX.log

MD5 5457e671f423f25e348627a077c825f8
SHA1 f9da36378ca6b7d213a8dd33b288ccd44521d72e
SHA256 4d7fba8a6272bac3933ec5ea1381413bf8bb3d43140f0ff20df81417c7c8151f
SHA512 6b69949d6e05ab6d91f8a65279f99692ed8e62ff9e2bb216701f519fc199f00ce2cd5f27397da9dbed65f4133ada878e3e27f149e2199ce1f9817fd52f0eb53e

C:\Program Files\CalabiYau\log\launcher.log

MD5 b99303e482719cde2c5ea1c1e002e1b4
SHA1 755b029f1136a7329a30a919d881ef102ca7a00e
SHA256 a1e67ada40884a03fe2eb4d8b67b82300bb6b4a48b9f854fb6a56f577cd57b9b
SHA512 56bb87c1bb2d7f48c8adf1b68eab25276c74dee93dc628ac9eb3f29bb47ac7ea5ff10b3a4b0bbf29ec1583f43a7277e523453f61fd2557620111e8a189dd6dd7

memory/1440-747-0x00007FFAEE250000-0x00007FFAEFC81000-memory.dmp

memory/1440-752-0x0000000000770000-0x00000000007AD000-memory.dmp

memory/1440-789-0x0000000000B70000-0x0000000000B71000-memory.dmp

memory/4292-802-0x00007FFAF4EA0000-0x00007FFAF5298000-memory.dmp

memory/1084-808-0x00007FFB14D60000-0x00007FFB14D61000-memory.dmp

memory/1440-806-0x00007FFAD5AA0000-0x00007FFAD5AB0000-memory.dmp

memory/1084-801-0x00007FFB16060000-0x00007FFB16061000-memory.dmp

memory/1084-795-0x00007FFB15B60000-0x00007FFB15B61000-memory.dmp

memory/1440-812-0x00007FFAD5AA0000-0x00007FFAD5AB0000-memory.dmp

memory/1440-817-0x00007FFAD5AA0000-0x00007FFAD5AB0000-memory.dmp

memory/1084-820-0x00007FFAF4EA0000-0x00007FFAF5298000-memory.dmp

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe

MD5 4dc57ab56e37cd05e81f0d8aaafc5179
SHA1 494a90728d7680f979b0ad87f09b5b58f16d1cd5
SHA256 87c6f7d9b58f136aeb33c96dbfe3702083ec519aafca39be66778a9c27a68718
SHA512 320eeed88d7facf8c1f45786951ef81708c82cb89c63a3c820ee631c52ea913e64c4e21f0039c1b277cfb710c4d81cd2191878320d00fd006dd777c727d9dc2b

memory/1440-904-0x0000000140000000-0x000000014030A000-memory.dmp

memory/1440-906-0x00007FF4FDE80000-0x00007FF4FDE81000-memory.dmp

C:\Program Files\CalabiYau\config.ini.szTNoj

MD5 b13d2dd08b41927ba22fba4bbf25e37b
SHA1 219f8cd52d83be73c031f4267ff3269a59389683
SHA256 b9e784cd79f571098c003d0cbd7dc1f24e837937ed6ef767213ff80d12ec269f
SHA512 8b2fcc355d0960299bd81438d226598d83fb719debf4ad03f6190a98ac4a804c35b1cf227f1566d8d47f6b0fabd64d2634ca7d5a830937bcfe4943af3e5862cd

memory/1440-923-0x0000000002440000-0x000000000246F000-memory.dmp

memory/1440-925-0x0000000002430000-0x0000000002431000-memory.dmp

C:\ProgramData\Microsoft\EdgeUpdate\Log\MicrosoftEdgeUpdate.log

MD5 48e99f4dc4b70731e37e36dffc23d411
SHA1 f59b89cbe439527cf2a9dace26abe8954d133956
SHA256 bc300c2e4b775bfe10b104ceebc1f1ed791f85d115818e35779379617f113df8
SHA512 1908b2ab174cd7df10d28bbbdf37511eeb26d1d87f883030da1f205621a966bc8c81169e52fb4c7658904eb3f26a1deb1227cafd14f20c9304b70346f5d83c8f

memory/1440-978-0x00007FFAE8610000-0x00007FFAEA0C1000-memory.dmp

memory/880-1027-0x00000217DDD30000-0x00000217DDD40000-memory.dmp

memory/1440-1059-0x0000000140000000-0x000000014030A000-memory.dmp

memory/1440-1060-0x00007FFAF04B0000-0x00007FFAF074C000-memory.dmp

memory/1084-1061-0x000001AA99530000-0x000001AA99C6F000-memory.dmp

memory/1084-1062-0x000001AA99C70000-0x000001AA99CDB000-memory.dmp

memory/1084-1063-0x000001AA99CE0000-0x000001AA99DAD000-memory.dmp

memory/1440-1081-0x00007FFAEE250000-0x00007FFAEFC81000-memory.dmp

memory/1440-1085-0x0000000004340000-0x0000000004341000-memory.dmp

memory/1440-1084-0x0000000000770000-0x00000000007AD000-memory.dmp

memory/1440-1102-0x00007FFAF04B0000-0x00007FFAF074C000-memory.dmp

memory/1440-1106-0x0000000002440000-0x000000000246F000-memory.dmp

memory/1440-1123-0x0000000002430000-0x0000000002431000-memory.dmp

memory/1440-1127-0x00007FFAF04B0000-0x00007FFAF074C000-memory.dmp

memory/880-1143-0x00007FFB0F8A0000-0x00007FFB0F8A1000-memory.dmp

C:\Program Files (x86)\Microsoft\EdgeUpdate\Download\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\123.0.2420.81\MicrosoftEdge_X64_123.0.2420.81.exe

MD5 cf5144a59c3b26558c05a5226c4b53fe
SHA1 bcf541fbd1bf0168a2d63ead5b06d8918b89b296
SHA256 3a848782e612b4fd77d4910acb1a6f91b1eea3336065d4643486ff17e24970ea
SHA512 2d46fdc92c09257cfafc9bdd659413d7925f405d7b78a6d9a44e353984d9fd70b7c3e9b87475eeee80f984377fdbb884055f4a4f10b7972746811326bfeb9a34

C:\Program Files\MsEdgeCrashpad\settings.dat

MD5 0bcf5dc9388fc8ca0c8bcee560f3a261
SHA1 aa40b67b919ae75dc15387d0ec920a6e0d2bdcb1
SHA256 104dc311e3d8b6dff916d3e8cc7b98435754c2f2850761c34176f61a83616e2a
SHA512 9fe9d61267137dd2aeed065cf2944885a16c1fdab32dde720ee1f808206e5542250a16878beeddd159ed4dcd3857c2881edfe658a75626377abfe19bfbf25217

memory/1440-1167-0x00007FFAF04B0000-0x00007FFAF074C000-memory.dmp

memory/1440-1171-0x0000000004340000-0x0000000004341000-memory.dmp

C:\Program Files (x86)\Microsoft\EdgeCore\123.0.2420.81\Installer\setup.exe

MD5 149e6b831dee17cc2122c64124654b5a
SHA1 c4f67f0781345cfc6fdfc5670dcbecf3848afee2
SHA256 3095052d066346ec2b48726ef87623f3e5e93400c6dd8b1e45a628fc0d72cf40
SHA512 679966f6a48ccf9cac63c36a8f6823ed1476198b08d29368db94584b2be2ba4cb1278f4f6510a520933fd09bb83594ab544c94be4c0b05f1d8ee99443fc49085

memory/1440-1187-0x0000000000770000-0x00000000007AD000-memory.dmp

memory/1440-1188-0x00007FFAEE250000-0x00007FFAEFC81000-memory.dmp

C:\Windows\SysWOW64\directx\websetup\filelist.dat

MD5 d6f81567baaf05b557d9bc6c348cb5f1
SHA1 0c840165fcd34d996c85b6b44b00c7206bf772b6
SHA256 e60413bec64775bf1933ef4f9673c8bcfbe0ce71e950fd589bbd14c0f9a00359
SHA512 09b84cc9199592821d7de38cbe24332097b276bb25b6d09f7dcdc3a6b17369ee944a6f8120f13ea6a5c15eb759a90d7ce29cc845a5c0680ff2fa53e2623171e2

C:\Windows\SysWOW64\directx\websetup\dxupdate.cab

MD5 4afd7f5c0574a0efd163740ecb142011
SHA1 3ebca5343804fe94d50026da91647442da084302
SHA256 6e39b3fdb6722ea8aa0dc8f46ae0d8bd6496dd0f5f56bac618a0a7dd22d6cfb2
SHA512 6f974acec7d6c1b6a423b28810b0840e77a9f9c1f9632c5cba875bd895e076c7e03112285635cf633c2fa9a4d4e2f4a57437ae8df88a7882184ff6685ee15f3f

C:\Windows\Logs\DirectX.log

MD5 243ec6cd2f108aa4cfea272ea437ab6b
SHA1 3992181e7191c1a85659bcece7dc00d34ec96fec
SHA256 a1bffa19c05150afa817780f62d86fe5754c29a689aac6f4008fdb7f3906dc15
SHA512 5e1ac2911d9778924097ab0b3b591567870a8640ef84d4fc8b39f1d903028503d73aa38b7c7566dd4d948b27ada55921d510afa9830d5ad894cacb0eff34f672

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dxwsetup.cif

MD5 2c4d9e4773084f33092ced15678a2c46
SHA1 bad603d543470157effd4876a684b9cfd5075524
SHA256 ed710d035ccaab0914810becf2f5db2816dba3a351f3666a38a903c80c16997a
SHA512 d2e34cac195cfede8bc64bdc92721c574963ff522618eda4d7172f664aeb4c8675fd3d4f3658391ee5eaa398bcd2ce5d8f80deecf51af176f5c4bb2d2695e04e

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dxupdate.cif

MD5 b36d3f105d18e55534ad605cbf061a92
SHA1 788ef2de1dea6c8fe1d23a2e1007542f7321ed79
SHA256 c6c5e877e92d387e977c135765075b7610df2500e21c16e106a225216e6442ae
SHA512 35ae00da025fd578205337a018b35176095a876cd3c3cf67a3e8a8e69cd750a4ccc34ce240f11fae3418e5e93caf5082c987f0c63f9d953ed7cb8d9271e03b62

C:\Windows\SysWOW64\directx\websetup\filelist.dat

MD5 cec960807fa5bec11ad4a31c3512da4d
SHA1 a3ac60a3518747d3bbead5edfd17e155cf7ce9f7
SHA256 f960075a7b1c2590e18700f3230f7baea9aced3e6ba5dc93dac193027b5cec48
SHA512 2da2d935f9b96bd36536f3a7a494775c8ed9bfef6538ffe66307b73cd5c82210fc43bbe6706d74d99dd5b924fb78a0d1beceee8c0e22d91e17b1346dd85690ec

C:\Windows\Logs\DirectX.log

MD5 240faabfa067cbd91b23419d321c5ad6
SHA1 16798c7df437d2ba729269597ff7ecb35a167af3
SHA256 b0bbaa6beb07be62e129660633a4301bbb114d27392ce8487c57d45b062ed7b1
SHA512 baee25c5e67b2325bd782d5399324b91339933c5a6cef5333253dd110bbdfe02b7a7da11184a924b31417f95e6d0ecb767a509d7a7a1e5432095215c5b063db9

C:\Users\Admin\AppData\Local\CalabiYau\QtWebEngine\Default\f0c0c58d-4fe3-4e0d-91ee-15be37fc9392.tmp

MD5 bae0bcaf69d66b9637034bad8a87affb
SHA1 4dadbb9e6ef3c3107a49f7929fd22a04e8392400
SHA256 15317edacb7d49054b6b4f1aba58f21dfb39d00458b5fe967e8a2e832700aebf
SHA512 37fc8adae805bc4b1ffda89e4baac241398944a9bdf23001f03095d06dc5c8beaa43d64be54d1e4c5038503dde131d7f3a266dd98348d2f5e356404921577516

C:\Users\Admin\AppData\Local\CalabiYau\QtWebEngine\Default\Network Persistent State~RFe58fe31.TMP

MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b