Analysis
-
max time kernel
114s -
max time network
205s -
platform
windows11-21h2_x64 -
resource
win11-20240412-en -
resource tags
-
submitted
22-04-2024 13:42
Errors
General
-
Target
Fluorocarbomorpholide.exe
-
Size
249KB
-
MD5
5a3a24e9f5cb29cc1c5dbfea45ee6286
-
SHA1
7631d6d2e0464b7555b35aae09c4f77a73306722
-
SHA256
23289377de8b747b51dff08fd6321714fd834d2bd3d2b8845eee228e073b1e60
-
SHA512
c9fc63bc585511c1fe33c67471394a6ba540567e3881e55d20bab73d255e2de2173c3bcb5a181552b9875a9b419ced86b6822205182f3f06d8fe30331c47836d
-
SSDEEP
3072:B5bKZ+EdP/kDsCnO79mznWSppD1bzjg/rP+PVJ2qPkYFJ12ChYSN8R/2ONglXxf8:Bw4EdwTbDDKGtlrl5FBf1wGD4XdJIM
Malware Config
Signatures
-
Disables Task Manager via registry modification
-
Manipulates Digital Signatures 1 TTPs 3 IoCs
Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to obtain their binary as valid.
-
Possible privilege escalation attempt 2 IoCs
-
Modifies file permissions 1 TTPs 2 IoCs
-
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
-
Checks SCSI registry key(s) 3 TTPs 36 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 2 IoCs
-
Gathers network information 2 TTPs 2 IoCs
Uses commandline utility to view network configuration.
-
Gathers system information 1 TTPs 1 IoCs
Runs systeminfo.exe.
-
Kills process with taskkill 1 IoCs
-
Modifies registry class 23 IoCs
-
Runs net.exe
-
Runs ping.exe 1 TTPs 1 IoCs
-
Runs regedit.exe 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 9 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
-
Views/modifies file attributes 1 TTPs 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Fluorocarbomorpholide.exe"C:\Users\Admin\AppData\Local\Temp\Fluorocarbomorpholide.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c REG ADD HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t reg_dword /d 1 /f2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t reg_dword /d 1 /f3⤵
-
C:\Windows\SysWOW64\agentactivationruntimestarter.exe"C:\Windows\System32\agentactivationruntimestarter.exe"2⤵
-
C:\Windows\SysWOW64\appidtel.exe"C:\Windows\System32\appidtel.exe"2⤵
-
C:\Windows\SysWOW64\ARP.EXE"C:\Windows\System32\ARP.EXE"2⤵
-
C:\Windows\SysWOW64\at.exe"C:\Windows\System32\at.exe"2⤵
-
C:\Windows\SysWOW64\AtBroker.exe"C:\Windows\System32\AtBroker.exe"2⤵
-
C:\Windows\SysWOW64\attrib.exe"C:\Windows\System32\attrib.exe"2⤵
- Views/modifies file attributes
-
C:\Windows\SysWOW64\auditpol.exe"C:\Windows\System32\auditpol.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\autochk.exe"C:\Windows\System32\autochk.exe"2⤵
-
C:\Windows\SysWOW64\backgroundTaskHost.exe"C:\Windows\System32\backgroundTaskHost.exe"2⤵
-
C:\Windows\SysWOW64\BackgroundTransferHost.exe"C:\Windows\System32\BackgroundTransferHost.exe"2⤵
-
C:\Windows\SysWOW64\bitsadmin.exe"C:\Windows\System32\bitsadmin.exe"2⤵
-
C:\Windows\SysWOW64\bthudtask.exe"C:\Windows\System32\bthudtask.exe"2⤵
-
C:\Windows\SysWOW64\ByteCodeGenerator.exe"C:\Windows\System32\ByteCodeGenerator.exe"2⤵
-
C:\Windows\SysWOW64\cacls.exe"C:\Windows\System32\cacls.exe"2⤵
-
C:\Windows\SysWOW64\calc.exe"C:\Windows\System32\calc.exe"2⤵
- Modifies registry class
-
C:\Windows\SysWOW64\CameraSettingsUIHost.exe"C:\Windows\System32\CameraSettingsUIHost.exe"2⤵
-
C:\Windows\SysWOW64\CertEnrollCtrl.exe"C:\Windows\System32\CertEnrollCtrl.exe"2⤵
-
C:\Windows\SysWOW64\certreq.exe"C:\Windows\System32\certreq.exe"2⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\certutil.exe"C:\Windows\System32\certutil.exe"2⤵
- Manipulates Digital Signatures
-
C:\Windows\SysWOW64\charmap.exe"C:\Windows\System32\charmap.exe"2⤵
-
C:\Windows\SysWOW64\CheckNetIsolation.exe"C:\Windows\System32\CheckNetIsolation.exe"2⤵
-
C:\Windows\SysWOW64\chkdsk.exe"C:\Windows\System32\chkdsk.exe"2⤵
- Enumerates system info in registry
-
C:\Windows\SysWOW64\chkntfs.exe"C:\Windows\System32\chkntfs.exe"2⤵
- Enumerates system info in registry
-
C:\Windows\SysWOW64\choice.exe"C:\Windows\System32\choice.exe"2⤵
-
C:\Windows\SysWOW64\cipher.exe"C:\Windows\System32\cipher.exe"2⤵
-
C:\Windows\SysWOW64\cleanmgr.exe"C:\Windows\System32\cleanmgr.exe"2⤵
- Enumerates connected drives
-
C:\Windows\SysWOW64\cliconfg.exe"C:\Windows\System32\cliconfg.exe"2⤵
-
C:\Windows\SysWOW64\clip.exe"C:\Windows\System32\clip.exe"2⤵
-
C:\Windows\SysWOW64\CloudNotifications.exe"C:\Windows\System32\CloudNotifications.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe"2⤵
-
C:\Windows\SysWOW64\cmdkey.exe"C:\Windows\System32\cmdkey.exe"2⤵
-
C:\Windows\SysWOW64\cmdl32.exe"C:\Windows\System32\cmdl32.exe"2⤵
-
C:\Windows\SysWOW64\cmmon32.exe"C:\Windows\System32\cmmon32.exe"2⤵
-
C:\Windows\SysWOW64\cmstp.exe"C:\Windows\System32\cmstp.exe"2⤵
-
C:\Windows\SysWOW64\colorcpl.exe"C:\Windows\System32\colorcpl.exe"2⤵
-
C:\Windows\SysWOW64\comp.exe"C:\Windows\System32\comp.exe"2⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
C:\Windows\SysWOW64\compact.exe"C:\Windows\System32\compact.exe"2⤵
-
C:\Windows\SysWOW64\ComputerDefaults.exe"C:\Windows\System32\ComputerDefaults.exe"2⤵
-
C:\Windows\SysWOW64\control.exe"C:\Windows\System32\control.exe"2⤵
-
C:\Windows\SysWOW64\convert.exe"C:\Windows\System32\convert.exe"2⤵
-
C:\Windows\SysWOW64\CredentialUIBroker.exe"C:\Windows\System32\CredentialUIBroker.exe"2⤵
-
C:\Windows\SysWOW64\credwiz.exe"C:\Windows\System32\credwiz.exe"2⤵
-
C:\Windows\SysWOW64\cscript.exe"C:\Windows\System32\cscript.exe"2⤵
-
C:\Windows\SysWOW64\ctfmon.exe"C:\Windows\System32\ctfmon.exe"2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5324 -s 7363⤵
- Program crash
-
C:\Windows\SysWOW64\cttune.exe"C:\Windows\System32\cttune.exe"2⤵
-
C:\Windows\SysWOW64\cttunesvr.exe"C:\Windows\System32\cttunesvr.exe"2⤵
-
C:\Windows\SysWOW64\curl.exe"C:\Windows\System32\curl.exe"2⤵
-
C:\Windows\SysWOW64\dccw.exe"C:\Windows\System32\dccw.exe"2⤵
-
C:\Windows\SysWOW64\dcomcnfg.exe"C:\Windows\System32\dcomcnfg.exe"2⤵
-
C:\Windows\system32\mmc.exeC:\Windows\system32\mmc.exe C:\Windows\system32\comexp.msc3⤵
-
C:\Windows\SysWOW64\ddodiag.exe"C:\Windows\System32\ddodiag.exe"2⤵
-
C:\Windows\SysWOW64\DevicePairingWizard.exe"C:\Windows\System32\DevicePairingWizard.exe"2⤵
-
C:\Windows\SysWOW64\dfrgui.exe"C:\Windows\System32\dfrgui.exe"2⤵
-
C:\Windows\SysWOW64\dialer.exe"C:\Windows\System32\dialer.exe"2⤵
-
C:\Windows\SysWOW64\diskpart.exe"C:\Windows\System32\diskpart.exe"2⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\System32\diskperf.exe"2⤵
-
C:\Windows\SysWOW64\diskusage.exe"C:\Windows\System32\diskusage.exe"2⤵
-
C:\Windows\SysWOW64\Dism.exe"C:\Windows\System32\Dism.exe"2⤵
-
C:\Windows\SysWOW64\dllhost.exe"C:\Windows\System32\dllhost.exe"2⤵
-
C:\Windows\SysWOW64\dllhst3g.exe"C:\Windows\System32\dllhst3g.exe"2⤵
-
C:\Windows\SysWOW64\doskey.exe"C:\Windows\System32\doskey.exe"2⤵
-
C:\Windows\SysWOW64\dpapimig.exe"C:\Windows\System32\dpapimig.exe"2⤵
-
C:\Windows\SysWOW64\DpiScaling.exe"C:\Windows\System32\DpiScaling.exe"2⤵
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe" ms-settings:display3⤵
-
C:\Windows\SysWOW64\driverquery.exe"C:\Windows\System32\driverquery.exe"2⤵
-
C:\Windows\SysWOW64\dtdump.exe"C:\Windows\System32\dtdump.exe"2⤵
-
C:\Windows\SysWOW64\dvdplay.exe"C:\Windows\System32\dvdplay.exe"2⤵
-
C:\Program Files (x86)\Windows Media Player\wmplayer.exe/device:dvd3⤵
-
C:\Program Files (x86)\Windows Media Player\setup_wm.exe"C:\Program Files (x86)\Windows Media Player\setup_wm.exe" /RunOnce: /device:dvd4⤵
-
C:\Windows\SysWOW64\unregmp2.exe"C:\Windows\System32\unregmp2.exe" /AsyncFirstLogon4⤵
-
C:\Windows\system32\unregmp2.exe"C:\Windows\SysNative\unregmp2.exe" /AsyncFirstLogon /REENTRANT5⤵
-
C:\Windows\SysWOW64\DWWIN.EXE"C:\Windows\System32\DWWIN.EXE"2⤵
-
C:\Windows\SysWOW64\dxdiag.exe"C:\Windows\System32\dxdiag.exe"2⤵
-
C:\Windows\SysWOW64\EaseOfAccessDialog.exe"C:\Windows\System32\EaseOfAccessDialog.exe"2⤵
-
C:\Windows\SysWOW64\edpnotify.exe"C:\Windows\System32\edpnotify.exe"2⤵
-
C:\Windows\SysWOW64\efsui.exe"C:\Windows\System32\efsui.exe"2⤵
-
C:\Windows\SysWOW64\EhStorAuthn.exe"C:\Windows\System32\EhStorAuthn.exe"2⤵
-
C:\Windows\SysWOW64\esentutl.exe"C:\Windows\System32\esentutl.exe"2⤵
-
C:\Windows\SysWOW64\eudcedit.exe"C:\Windows\System32\eudcedit.exe"2⤵
-
C:\Windows\SysWOW64\eventcreate.exe"C:\Windows\System32\eventcreate.exe"2⤵
-
C:\Windows\SysWOW64\eventvwr.exe"C:\Windows\System32\eventvwr.exe"2⤵
-
C:\Windows\SysWOW64\mmc.exe"C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"3⤵
-
C:\Windows\system32\mmc.exe"C:\Windows\system32\eventvwr.msc" "C:\Windows\system32\eventvwr.msc"4⤵
-
C:\Windows\SysWOW64\expand.exe"C:\Windows\System32\expand.exe"2⤵
-
C:\Windows\SysWOW64\explorer.exe"C:\Windows\System32\explorer.exe"2⤵
-
C:\Windows\SysWOW64\extrac32.exe"C:\Windows\System32\extrac32.exe"2⤵
-
C:\Windows\SysWOW64\fc.exe"C:\Windows\System32\fc.exe"2⤵
-
C:\Windows\SysWOW64\find.exe"C:\Windows\System32\find.exe"2⤵
-
C:\Windows\SysWOW64\findstr.exe"C:\Windows\System32\findstr.exe"2⤵
-
C:\Windows\SysWOW64\finger.exe"C:\Windows\System32\finger.exe"2⤵
-
C:\Windows\SysWOW64\fixmapi.exe"C:\Windows\System32\fixmapi.exe"2⤵
-
C:\Windows\SysWOW64\fltMC.exe"C:\Windows\System32\fltMC.exe"2⤵
-
C:\Windows\SysWOW64\Fondue.exe"C:\Windows\System32\Fondue.exe"2⤵
-
C:\Windows\SysWOW64\fontview.exe"C:\Windows\System32\fontview.exe"2⤵
-
C:\Windows\SysWOW64\forfiles.exe"C:\Windows\System32\forfiles.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exe/c echo ".ses"3⤵
-
C:\Windows\SysWOW64\cmd.exe/c echo "2485799853"3⤵
-
C:\Windows\SysWOW64\cmd.exe/c echo "acrocef_low"3⤵
-
C:\Windows\SysWOW64\cmd.exe/c echo "AdobeSFX.log"3⤵
-
C:\Windows\SysWOW64\cmd.exe/c echo "aria-debug-1056.log"3⤵
-
C:\Windows\SysWOW64\cmd.exe/c echo "BroadcastMsg_1712930812.txt"3⤵
-
C:\Windows\SysWOW64\cmd.exe/c echo "chrome_installer.log"3⤵
-
C:\Windows\SysWOW64\cmd.exe/c echo "ddodiag.xml"3⤵
-
C:\Windows\SysWOW64\cmd.exe/c echo "dd_NDP472-KB4054530-x86-x64-AllOS-ENU_decompression_log.txt"3⤵
-
C:\Windows\SysWOW64\cmd.exe/c echo "dd_vcredistMSI3F38.txt"3⤵
-
C:\Windows\SysWOW64\cmd.exe/c echo "dd_vcredistMSI3F52.txt"3⤵
-
C:\Windows\SysWOW64\cmd.exe/c echo "dd_vcredistUI3F38.txt"3⤵
-
C:\Windows\SysWOW64\cmd.exe/c echo "dd_vcredistUI3F52.txt"3⤵
-
C:\Windows\SysWOW64\cmd.exe/c echo "Fluorocarbomorpholide.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exe/c echo "Fluorocarbomorpholide.harmless.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exe/c echo "hsperfdata_Admin"3⤵
-
C:\Windows\SysWOW64\cmd.exe/c echo "JavaDeployReg.log"3⤵
-
C:\Windows\SysWOW64\cmd.exe/c echo "jawshtml.html"3⤵
-
C:\Windows\SysWOW64\cmd.exe/c echo "jusched.log"3⤵
-
C:\Windows\SysWOW64\cmd.exe/c echo "Low"3⤵
-
C:\Windows\SysWOW64\cmd.exe/c echo "Microsoft .NET Framework 4.7.2 Setup_20240412_140259204.html"3⤵
-
C:\Windows\SysWOW64\cmd.exe/c echo "Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219"3⤵
-
C:\Windows\SysWOW64\cmd.exe/c echo "Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219"3⤵
-
C:\Windows\SysWOW64\cmd.exe/c echo "Microsoft_Windows_Desktop_Runtime_-_6.0.27_(x64)_20240412140333.log"3⤵
-
C:\Windows\SysWOW64\cmd.exe/c echo "Microsoft_Windows_Desktop_Runtime_-_6.0.27_(x64)_20240412140333_000_dotnet_runtime_6.0.27_win_x64.msi.log"3⤵
-
C:\Windows\SysWOW64\cmd.exe/c echo "Microsoft_Windows_Desktop_Runtime_-_6.0.27_(x64)_20240412140333_001_dotnet_hostfxr_6.0.27_win_x64.msi.log"3⤵
-
C:\Windows\SysWOW64\cmd.exe/c echo "Microsoft_Windows_Desktop_Runtime_-_6.0.27_(x64)_20240412140333_002_dotnet_host_6.0.27_win_x64.msi.log"3⤵
-
C:\Windows\SysWOW64\cmd.exe/c echo "Microsoft_Windows_Desktop_Runtime_-_6.0.27_(x64)_20240412140333_003_windowsdesktop_runtime_6.0.27_win_x64.msi.log"3⤵
-
C:\Windows\SysWOW64\cmd.exe/c echo "Microsoft_Windows_Desktop_Runtime_-_7.0.16_(x64)_20240412140409.log"3⤵
-
C:\Windows\SysWOW64\cmd.exe/c echo "Microsoft_Windows_Desktop_Runtime_-_7.0.16_(x64)_20240412140409_000_dotnet_runtime_7.0.16_win_x64.msi.log"3⤵
-
C:\Windows\SysWOW64\cmd.exe/c echo "Microsoft_Windows_Desktop_Runtime_-_7.0.16_(x64)_20240412140409_001_dotnet_hostfxr_7.0.16_win_x64.msi.log"3⤵
-
C:\Windows\SysWOW64\cmd.exe/c echo "Microsoft_Windows_Desktop_Runtime_-_7.0.16_(x64)_20240412140409_002_dotnet_host_7.0.16_win_x64.msi.log"3⤵
-
C:\Windows\SysWOW64\cmd.exe/c echo "Microsoft_Windows_Desktop_Runtime_-_7.0.16_(x64)_20240412140409_003_windowsdesktop_runtime_7.0.16_win_x64.msi.log"3⤵
-
C:\Windows\SysWOW64\cmd.exe/c echo "Microsoft_Windows_Desktop_Runtime_-_8.0.2_(x64)_20240412140426.log"3⤵
-
C:\Windows\SysWOW64\cmd.exe/c echo "Microsoft_Windows_Desktop_Runtime_-_8.0.2_(x64)_20240412140426_000_dotnet_runtime_8.0.2_win_x64.msi.log"3⤵
-
C:\Windows\SysWOW64\cmd.exe/c echo "Microsoft_Windows_Desktop_Runtime_-_8.0.2_(x64)_20240412140426_001_dotnet_hostfxr_8.0.2_win_x64.msi.log"3⤵
-
C:\Windows\SysWOW64\cmd.exe/c echo "Microsoft_Windows_Desktop_Runtime_-_8.0.2_(x64)_20240412140426_002_dotnet_host_8.0.2_win_x64.msi.log"3⤵
-
C:\Windows\SysWOW64\cmd.exe/c echo "Microsoft_Windows_Desktop_Runtime_-_8.0.2_(x64)_20240412140426_003_windowsdesktop_runtime_8.0.2_win_x64.msi.log"3⤵
-
C:\Windows\SysWOW64\cmd.exe/c echo "mozilla-temp-files"3⤵
-
C:\Windows\SysWOW64\cmd.exe/c echo "msedge_installer.log"3⤵
-
C:\Windows\SysWOW64\cmd.exe/c echo "OneNote"3⤵
-
C:\Windows\SysWOW64\cmd.exe/c echo "RDUOHHNY-20240412-1407.log"3⤵
-
C:\Windows\SysWOW64\cmd.exe/c echo "RDUOHHNY-20240412-1407a.log"3⤵
-
C:\Windows\SysWOW64\cmd.exe/c echo "README.txt"3⤵
-
C:\Windows\SysWOW64\cmd.exe/c echo "tmp32875.WMC"3⤵
-
C:\Windows\SysWOW64\cmd.exe/c echo "wct5479.tmp"3⤵
-
C:\Windows\SysWOW64\cmd.exe/c echo "wct61B.tmp"3⤵
-
C:\Windows\SysWOW64\cmd.exe/c echo "wct6801.tmp"3⤵
-
C:\Windows\SysWOW64\cmd.exe/c echo "wct6C28.tmp"3⤵
-
C:\Windows\SysWOW64\cmd.exe/c echo "wct9039.tmp"3⤵
-
C:\Windows\SysWOW64\cmd.exe/c echo "wctD2B1.tmp"3⤵
-
C:\Windows\SysWOW64\cmd.exe/c echo "wmsetup.log"3⤵
-
C:\Windows\SysWOW64\cmd.exe/c echo "{4183BE3C-04B6-4246-A7E9-2F573420FE13} - OProcSessId.dat"3⤵
-
C:\Windows\SysWOW64\cmd.exe/c echo "{4912284E-FD29-4B00-87C8-9C629F50E5A1}"3⤵
-
C:\Windows\SysWOW64\fsquirt.exe"C:\Windows\System32\fsquirt.exe"2⤵
-
C:\Windows\SysWOW64\fsutil.exe"C:\Windows\System32\fsutil.exe"2⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument ftp://ftp.exe/2⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffa2e423cb8,0x7ffa2e423cc8,0x7ffa2e423cd83⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2024,4095569010460046740,5623820016130952681,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=2060 /prefetch:23⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2024,4095569010460046740,5623820016130952681,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2108 /prefetch:33⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2024,4095569010460046740,5623820016130952681,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2528 /prefetch:83⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,4095569010460046740,5623820016130952681,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3128 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,4095569010460046740,5623820016130952681,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3136 /prefetch:13⤵
-
C:\Windows\SysWOW64\GameBarPresenceWriter.exe"C:\Windows\System32\GameBarPresenceWriter.exe"2⤵
-
C:\Windows\SysWOW64\GamePanel.exe"C:\Windows\System32\GamePanel.exe"2⤵
-
C:\Windows\SysWOW64\getmac.exe"C:\Windows\System32\getmac.exe"2⤵
-
C:\Windows\SysWOW64\gpresult.exe"C:\Windows\System32\gpresult.exe"2⤵
-
C:\Windows\SysWOW64\gpscript.exe"C:\Windows\System32\gpscript.exe"2⤵
-
C:\Windows\SysWOW64\gpupdate.exe"C:\Windows\System32\gpupdate.exe"2⤵
-
C:\Windows\SysWOW64\grpconv.exe"C:\Windows\System32\grpconv.exe"2⤵
-
C:\Windows\SysWOW64\hdwwiz.exe"C:\Windows\System32\hdwwiz.exe"2⤵
-
C:\Windows\SysWOW64\help.exe"C:\Windows\System32\help.exe"2⤵
-
C:\Windows\SysWOW64\hh.exe"C:\Windows\System32\hh.exe"2⤵
-
C:\Windows\SysWOW64\HOSTNAME.EXE"C:\Windows\System32\HOSTNAME.EXE"2⤵
-
C:\Windows\SysWOW64\icacls.exe"C:\Windows\System32\icacls.exe"2⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
C:\Windows\SysWOW64\icsunattend.exe"C:\Windows\System32\icsunattend.exe"2⤵
-
C:\Windows\SysWOW64\ieUnatt.exe"C:\Windows\System32\ieUnatt.exe"2⤵
-
C:\Windows\SysWOW64\iexpress.exe"C:\Windows\System32\iexpress.exe"2⤵
-
C:\Windows\SysWOW64\InfDefaultInstall.exe"C:\Windows\System32\InfDefaultInstall.exe"2⤵
-
C:\Windows\SysWOW64\InputSwitchToastHandler.exe"C:\Windows\System32\InputSwitchToastHandler.exe"2⤵
-
C:\Windows\SysWOW64\instnm.exe"C:\Windows\System32\instnm.exe"2⤵
-
C:\Windows\SysWOW64\ipconfig.exe"C:\Windows\System32\ipconfig.exe"2⤵
- Gathers network information
-
C:\Windows\SysWOW64\iscsicli.exe"C:\Windows\System32\iscsicli.exe"2⤵
-
C:\Windows\SysWOW64\iscsicpl.exe"C:\Windows\System32\iscsicpl.exe"2⤵
-
C:\Windows\system32\RunDll32.exeC:\Windows\system32\RunDll32.exe Shell32.dll,Control_RunDLL iscsicpl.dll,,03⤵
-
C:\Windows\SysWOW64\isoburn.exe"C:\Windows\System32\isoburn.exe"2⤵
-
C:\Windows\SysWOW64\ktmutil.exe"C:\Windows\System32\ktmutil.exe"2⤵
-
C:\Windows\SysWOW64\label.exe"C:\Windows\System32\label.exe"2⤵
-
C:\Windows\SysWOW64\LaunchTM.exe"C:\Windows\System32\LaunchTM.exe"2⤵
-
C:\Windows\SysWOW64\Taskmgr.exe"C:\Windows\System32\Taskmgr.exe"3⤵
-
C:\Windows\SysWOW64\LaunchWinApp.exe"C:\Windows\System32\LaunchWinApp.exe"2⤵
-
C:\Windows\SysWOW64\lodctr.exe"C:\Windows\System32\lodctr.exe"2⤵
-
C:\Windows\SysWOW64\logagent.exe"C:\Windows\System32\logagent.exe"2⤵
-
C:\Windows\SysWOW64\logman.exe"C:\Windows\System32\logman.exe"2⤵
-
C:\Windows\SysWOW64\Magnify.exe"C:\Windows\System32\Magnify.exe"2⤵
-
C:\Windows\SysWOW64\makecab.exe"C:\Windows\System32\makecab.exe"2⤵
-
C:\Windows\SysWOW64\mavinject.exe"C:\Windows\System32\mavinject.exe"2⤵
-
C:\Windows\SysWOW64\mcbuilder.exe"C:\Windows\System32\mcbuilder.exe"2⤵
-
C:\Windows\SysWOW64\mfpmp.exe"C:\Windows\System32\mfpmp.exe"2⤵
-
C:\Windows\SysWOW64\mmc.exe"C:\Windows\System32\mmc.exe"2⤵
-
C:\Windows\system32\mmc.exe"C:\Windows\system32\mmc.exe"3⤵
-
C:\Windows\SysWOW64\mmgaserver.exe"C:\Windows\System32\mmgaserver.exe"2⤵
-
C:\Windows\SysWOW64\mobsync.exe"C:\Windows\System32\mobsync.exe"2⤵
-
C:\Windows\SysWOW64\mountvol.exe"C:\Windows\System32\mountvol.exe"2⤵
-
C:\Windows\SysWOW64\MRINFO.EXE"C:\Windows\System32\MRINFO.EXE"2⤵
-
C:\Windows\SysWOW64\msdt.exe"C:\Windows\System32\msdt.exe"2⤵
-
C:\Windows\SysWOW64\msfeedssync.exe"C:\Windows\System32\msfeedssync.exe"2⤵
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe"2⤵
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\System32\msiexec.exe"2⤵
-
C:\Windows\SysWOW64\msinfo32.exe"C:\Windows\System32\msinfo32.exe"2⤵
-
C:\Windows\SysWOW64\msra.exe"C:\Windows\System32\msra.exe"2⤵
-
C:\Windows\system32\msra.exe"C:\Windows\system32\msra.exe"3⤵
-
C:\Windows\SysWOW64\mstsc.exe"C:\Windows\System32\mstsc.exe"2⤵
-
C:\Windows\system32\mstsc.exe"C:\Windows\System32\mstsc.exe"3⤵
-
C:\Windows\SysWOW64\mtstocom.exe"C:\Windows\System32\mtstocom.exe"2⤵
-
C:\Windows\SysWOW64\MuiUnattend.exe"C:\Windows\System32\MuiUnattend.exe"2⤵
-
C:\Windows\SysWOW64\ndadmin.exe"C:\Windows\System32\ndadmin.exe"2⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe"2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net13⤵
-
C:\Windows\SysWOW64\net1.exe"C:\Windows\System32\net1.exe"2⤵
-
C:\Windows\SysWOW64\netbtugc.exe"C:\Windows\System32\netbtugc.exe"2⤵
-
C:\Windows\SysWOW64\NetCfgNotifyObjectHost.exe"C:\Windows\System32\NetCfgNotifyObjectHost.exe"2⤵
-
C:\Windows\SysWOW64\netiougc.exe"C:\Windows\System32\netiougc.exe"2⤵
-
C:\Windows\SysWOW64\Netplwiz.exe"C:\Windows\System32\Netplwiz.exe"2⤵
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\System32\netsh.exe"2⤵
-
C:\Windows\SysWOW64\NETSTAT.EXE"C:\Windows\System32\NETSTAT.EXE"2⤵
- Gathers network information
-
C:\Windows\SysWOW64\newdev.exe"C:\Windows\System32\newdev.exe"2⤵
-
C:\Windows\SysWOW64\notepad.exe"C:\Windows\System32\notepad.exe"2⤵
-
C:\Windows\SysWOW64\nslookup.exe"C:\Windows\System32\nslookup.exe"2⤵
-
C:\Windows\SysWOW64\ntprint.exe"C:\Windows\System32\ntprint.exe"2⤵
-
C:\Windows\SysWOW64\odbcad32.exe"C:\Windows\System32\odbcad32.exe"2⤵
-
C:\Windows\SysWOW64\odbcconf.exe"C:\Windows\System32\odbcconf.exe"2⤵
-
C:\Windows\SysWOW64\OneDriveSetup.exe"C:\Windows\System32\OneDriveSetup.exe"2⤵
-
C:\Windows\SysWOW64\OneDriveSetup.exe"C:\Windows\SysWOW64\OneDriveSetup.exe" C:\Windows\SysWOW64\OneDriveSetup.exe /permachine /childprocess /silent /renameReplaceOneDriveExe /renameReplaceODSUExe /cusid:S-1-5-21-2718508534-2116753757-2794822388-10003⤵
-
C:\Windows\SysWOW64\OneDriveSetup.exeC:\Windows\SysWOW64\OneDriveSetup.exe /peruser /childprocess /renameReplaceOneDriveExe /renameReplaceODSUExe3⤵
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.050.0310.0001\FileSyncConfig.exe"C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.050.0310.0001\FileSyncConfig.exe"4⤵
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDrive.exe/updateInstalled /background4⤵
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exe"C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exe" /update /restart /updateSource:ODU5⤵
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exeC:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exe /update /restart /updateSource:ODU /peruser /childprocess /extractFilesWithLessThreadCount /renameReplaceOneDriveExe /renameReplaceODSUExe /removeNonCurrentVersions /enableODSUReportingMode6⤵
-
C:\Windows\SysWOW64\openfiles.exe"C:\Windows\System32\openfiles.exe"2⤵
-
C:\Windows\SysWOW64\OpenWith.exe"C:\Windows\System32\OpenWith.exe"2⤵
-
C:\Windows\SysWOW64\OposHost.exe"C:\Windows\System32\OposHost.exe"2⤵
-
C:\Windows\SysWOW64\PackagedCWALauncher.exe"C:\Windows\System32\PackagedCWALauncher.exe"2⤵
-
C:\Windows\SysWOW64\PasswordOnWakeSettingFlyout.exe"C:\Windows\System32\PasswordOnWakeSettingFlyout.exe"2⤵
-
C:\Windows\SysWOW64\PATHPING.EXE"C:\Windows\System32\PATHPING.EXE"2⤵
-
C:\Windows\SysWOW64\pcaui.exe"C:\Windows\System32\pcaui.exe"2⤵
-
C:\Windows\SysWOW64\perfhost.exe"C:\Windows\System32\perfhost.exe"2⤵
-
C:\Windows\SysWOW64\perfmon.exe"C:\Windows\System32\perfmon.exe"2⤵
-
C:\Windows\SysWOW64\mmc.exe"C:\Windows\system32\mmc.exe" "C:\Windows\system32\perfmon.msc" /323⤵
-
C:\Windows\SysWOW64\PickerHost.exe"C:\Windows\System32\PickerHost.exe"2⤵
-
C:\Windows\SysWOW64\PING.EXE"C:\Windows\System32\PING.EXE"2⤵
- Runs ping.exe
-
C:\Windows\SysWOW64\PkgMgr.exe"C:\Windows\System32\PkgMgr.exe"2⤵
-
C:\Windows\SysWOW64\poqexec.exe"C:\Windows\System32\poqexec.exe"2⤵
-
C:\Windows\SysWOW64\powercfg.exe"C:\Windows\System32\powercfg.exe"2⤵
-
C:\Windows\SysWOW64\PresentationHost.exe"C:\Windows\System32\PresentationHost.exe"2⤵
-
C:\Windows\SysWOW64\prevhost.exe"C:\Windows\System32\prevhost.exe"2⤵
-
C:\Windows\SysWOW64\print.exe"C:\Windows\System32\print.exe"2⤵
-
C:\Windows\SysWOW64\printui.exe"C:\Windows\System32\printui.exe"2⤵
-
C:\Windows\SysWOW64\proquota.exe"C:\Windows\System32\proquota.exe"2⤵
-
C:\Windows\SysWOW64\provlaunch.exe"C:\Windows\System32\provlaunch.exe"2⤵
-
C:\Windows\SysWOW64\psr.exe"C:\Windows\System32\psr.exe"2⤵
-
C:\Windows\system32\psr.exe"C:\Windows\system32\psr.exe"3⤵
-
C:\Windows\SysWOW64\quickassist.exe"C:\Windows\System32\quickassist.exe"2⤵
-
C:\Windows\SysWOW64\rasautou.exe"C:\Windows\System32\rasautou.exe"2⤵
-
C:\Windows\SysWOW64\rasdial.exe"C:\Windows\System32\rasdial.exe"2⤵
-
C:\Windows\SysWOW64\raserver.exe"C:\Windows\System32\raserver.exe"2⤵
-
C:\Windows\SysWOW64\rasphone.exe"C:\Windows\System32\rasphone.exe"2⤵
-
C:\Windows\SysWOW64\RdpSa.exe"C:\Windows\System32\RdpSa.exe"2⤵
-
C:\Windows\SysWOW64\RdpSaProxy.exe"C:\Windows\System32\RdpSaProxy.exe"2⤵
-
C:\Windows\SysWOW64\RdpSa.exe"C:\Windows\system32\RdpSa.exe"3⤵
-
C:\Windows\SysWOW64\RdpSaUacHelper.exe"C:\Windows\System32\RdpSaUacHelper.exe"2⤵
-
C:\Windows\SysWOW64\rdrleakdiag.exe"C:\Windows\System32\rdrleakdiag.exe"2⤵
-
C:\Windows\SysWOW64\ReAgentc.exe"C:\Windows\System32\ReAgentc.exe"2⤵
-
C:\Windows\SysWOW64\recover.exe"C:\Windows\System32\recover.exe"2⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe"2⤵
-
C:\Windows\SysWOW64\regedit.exe"C:\Windows\System32\regedit.exe"2⤵
- Runs regedit.exe
-
C:\Windows\SysWOW64\regedt32.exe"C:\Windows\System32\regedt32.exe"2⤵
-
C:\Windows\SysWOW64\regedit.exe"C:\Windows\regedit.exe"3⤵
- Runs regedit.exe
-
C:\Windows\SysWOW64\regini.exe"C:\Windows\System32\regini.exe"2⤵
-
C:\Windows\SysWOW64\Register-CimProvider.exe"C:\Windows\System32\Register-CimProvider.exe"2⤵
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe"2⤵
-
C:\Windows\SysWOW64\rekeywiz.exe"C:\Windows\System32\rekeywiz.exe"2⤵
-
C:\Windows\SysWOW64\relog.exe"C:\Windows\System32\relog.exe"2⤵
-
C:\Windows\SysWOW64\replace.exe"C:\Windows\System32\replace.exe"2⤵
-
C:\Windows\SysWOW64\resmon.exe"C:\Windows\System32\resmon.exe"2⤵
-
C:\Windows\SysWOW64\perfmon.exe"C:\Windows\System32\perfmon.exe" /res3⤵
-
C:\Windows\system32\perfmon.exe"C:\Windows\Sysnative\perfmon.exe" /res4⤵
-
C:\Windows\SysWOW64\RMActivate.exe"C:\Windows\System32\RMActivate.exe"2⤵
-
C:\Windows\SysWOW64\RMActivate_isv.exe"C:\Windows\System32\RMActivate_isv.exe"2⤵
-
C:\Windows\SysWOW64\RMActivate_ssp.exe"C:\Windows\System32\RMActivate_ssp.exe"2⤵
-
C:\Windows\SysWOW64\RMActivate_ssp_isv.exe"C:\Windows\System32\RMActivate_ssp_isv.exe"2⤵
-
C:\Windows\SysWOW64\RmClient.exe"C:\Windows\System32\RmClient.exe"2⤵
-
C:\Windows\SysWOW64\Robocopy.exe"C:\Windows\System32\Robocopy.exe"2⤵
-
C:\Windows\SysWOW64\ROUTE.EXE"C:\Windows\System32\ROUTE.EXE"2⤵
-
C:\Windows\SysWOW64\RpcPing.exe"C:\Windows\System32\RpcPing.exe"2⤵
-
C:\Windows\SysWOW64\rrinstaller.exe"C:\Windows\System32\rrinstaller.exe"2⤵
-
C:\Windows\SysWOW64\runas.exe"C:\Windows\System32\runas.exe"2⤵
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe"2⤵
-
C:\Windows\SysWOW64\RunLegacyCPLElevated.exe"C:\Windows\System32\RunLegacyCPLElevated.exe"2⤵
-
C:\Windows\SysWOW64\runonce.exe"C:\Windows\System32\runonce.exe"2⤵
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe"2⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe"2⤵
-
C:\Windows\SysWOW64\sdbinst.exe"C:\Windows\System32\sdbinst.exe"2⤵
-
C:\Windows\SysWOW64\sdchange.exe"C:\Windows\System32\sdchange.exe"2⤵
-
C:\Windows\SysWOW64\sdiagnhost.exe"C:\Windows\System32\sdiagnhost.exe"2⤵
-
C:\Windows\SysWOW64\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe"2⤵
-
C:\Windows\SysWOW64\SearchIndexer.exe"C:\Windows\System32\SearchIndexer.exe"2⤵
-
C:\Windows\SysWOW64\SearchProtocolHost.exe"C:\Windows\System32\SearchProtocolHost.exe"2⤵
-
C:\Windows\SysWOW64\SecEdit.exe"C:\Windows\System32\SecEdit.exe"2⤵
-
C:\Windows\SysWOW64\secinit.exe"C:\Windows\System32\secinit.exe"2⤵
-
C:\Windows\SysWOW64\sethc.exe"C:\Windows\System32\sethc.exe"2⤵
-
C:\Windows\SysWOW64\setup16.exe"C:\Windows\System32\setup16.exe"2⤵
-
C:\Windows\SysWOW64\setupugc.exe"C:\Windows\System32\setupugc.exe"2⤵
-
C:\Windows\SysWOW64\setx.exe"C:\Windows\System32\setx.exe"2⤵
-
C:\Windows\SysWOW64\sfc.exe"C:\Windows\System32\sfc.exe"2⤵
-
C:\Windows\SysWOW64\shrpubw.exe"C:\Windows\System32\shrpubw.exe"2⤵
-
C:\Windows\SysWOW64\shutdown.exe"C:\Windows\System32\shutdown.exe"2⤵
-
C:\Windows\SysWOW64\SndVol.exe"C:\Windows\System32\SndVol.exe"2⤵
-
C:\Windows\SysWOW64\sort.exe"C:\Windows\System32\sort.exe"2⤵
-
C:\Windows\SysWOW64\SpatialAudioLicenseSrv.exe"C:\Windows\System32\SpatialAudioLicenseSrv.exe"2⤵
-
C:\Windows\SysWOW64\srdelayed.exe"C:\Windows\System32\srdelayed.exe"2⤵
-
C:\Windows\SysWOW64\stordiag.exe"C:\Windows\System32\stordiag.exe"2⤵
-
C:\Windows\SysWOW64\fltmc.exe"fltmc.exe" volumes3⤵
-
C:\Windows\SysWOW64\fltmc.exe"fltmc.exe" instances3⤵
-
C:\Windows\SysWOW64\fltmc.exe"fltmc.exe" filters3⤵
-
C:\Windows\SysWOW64\subst.exe"C:\Windows\System32\subst.exe"2⤵
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\System32\svchost.exe"2⤵
-
C:\Windows\SysWOW64\sxstrace.exe"C:\Windows\System32\sxstrace.exe"2⤵
-
C:\Windows\SysWOW64\SyncHost.exe"C:\Windows\System32\SyncHost.exe"2⤵
-
C:\Windows\SysWOW64\systeminfo.exe"C:\Windows\System32\systeminfo.exe"2⤵
- Gathers system information
-
C:\Windows\SysWOW64\SystemPropertiesAdvanced.exe"C:\Windows\System32\SystemPropertiesAdvanced.exe"2⤵
-
C:\Windows\SysWOW64\SystemPropertiesComputerName.exe"C:\Windows\System32\SystemPropertiesComputerName.exe"2⤵
-
C:\Windows\SysWOW64\SystemPropertiesDataExecutionPrevention.exe"C:\Windows\System32\SystemPropertiesDataExecutionPrevention.exe"2⤵
-
C:\Windows\SysWOW64\SystemPropertiesHardware.exe"C:\Windows\System32\SystemPropertiesHardware.exe"2⤵
-
C:\Windows\SysWOW64\SystemPropertiesPerformance.exe"C:\Windows\System32\SystemPropertiesPerformance.exe"2⤵
-
C:\Windows\SysWOW64\SystemPropertiesProtection.exe"C:\Windows\System32\SystemPropertiesProtection.exe"2⤵
-
C:\Windows\SysWOW64\SystemPropertiesRemote.exe"C:\Windows\System32\SystemPropertiesRemote.exe"2⤵
-
C:\Windows\SysWOW64\SystemUWPLauncher.exe"C:\Windows\System32\SystemUWPLauncher.exe"2⤵
-
C:\Windows\SysWOW64\systray.exe"C:\Windows\System32\systray.exe"2⤵
-
C:\Windows\SysWOW64\takeown.exe"C:\Windows\System32\takeown.exe"2⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
C:\Windows\SysWOW64\TapiUnattend.exe"C:\Windows\System32\TapiUnattend.exe"2⤵
-
C:\Windows\SysWOW64\tar.exe"C:\Windows\System32\tar.exe"2⤵
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\System32\taskkill.exe"2⤵
- Kills process with taskkill
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x00000000000004DC 0x00000000000004E41⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k AarSvcGroup -p -s AarSvc1⤵
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{5BD95610-9434-43C2-886C-57852CC8A120} -Embedding1⤵
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 5324 -ip 53241⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService1⤵
-
C:\Windows\system32\dashost.exedashost.exe {39a9afa9-407e-4f54-9e345061bc37c7a5}2⤵
-
C:\Windows\system32\dashost.exedashost.exe {edf89460-172c-418d-826fe65f3da35a1d}2⤵
-
C:\Windows\system32\dashost.exedashost.exe {91dd5562-baf1-4aac-88061d80ef2a5c42}2⤵
-
C:\Windows\system32\dllhost.exeC:\Windows\system32\dllhost.exe /Processid:{02D4B3F1-FD88-11D1-960D-00805FC79235}1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵
-
C:\Windows\System32\vdsldr.exeC:\Windows\System32\vdsldr.exe -Embedding1⤵
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
-
C:\Windows\System32\msdtc.exeC:\Windows\System32\msdtc.exe1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k McpManagementServiceGroup1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DisplayEnhancementService1⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}1⤵
Network
MITRE ATT&CK Enterprise v15
Defense Evasion
File and Directory Permissions Modification
1Hide Artifacts
1Hidden Files and Directories
1Subvert Trust Controls
1SIP and Trust Provider Hijacking
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD53e5a2dac1f49835cf442fde4b7f74b88
SHA17b2cf4e2820f304adf533d43e6d75b3008941f72
SHA25630bd1e1bafb4502c91c1fb568372c0fb046d32a4b732e6b88ce59ea23663e4ce
SHA512933ac835894ce6cb8aac0261153823c96b6abec955173653dd56e534d644efd03aec71acb4f8cb0b9af871962296ec06cd03e570a0ac53098b8cd55657543786
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD56e15af8f29dec1e606c7774ef749eaf2
SHA115fbec608e4aa6ddd0e7fd8ea64c2e8197345e97
SHA256de9124e3fddde204df6a6df22b8b87a51823ba227d3e304a6a6aced9da00c74c
SHA5121c9c9acd158273749e666271a5cdb2a6aebf6e2b43b835ebcc49d5b48490cbbf4deddef08c232417cee33d4809dec9ddac2478765c1f3d7ed8ea7441f5fd1d15
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
6KB
MD5d5187a0c3df950416369e758184a2a17
SHA16b360d27e793995dc0bac684daefb7e74242bf04
SHA256560d2a06ca6f41845874d926c7c25019f4f783dcdb83385b348055e957a9a3ac
SHA5124d20134f713d50c044045ddbeb254bdca59c9a3135623c885e79ec8d681924cbf754e6edfa90955a58108f6c347bb2cb507f34933311233eeb598fe423512e98
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
6KB
MD57f833b357a89b71283503aaea75c0c59
SHA1cb4623b475fb7fd81a4e272497ef7d5e311bd395
SHA256d20babee9a812d71a1137b96a33e01dc2fa10b24a712ab171b2b7ce41bcbae59
SHA512f65d8b9fbecc05006662c84b296ef50b4f1c31eff070dc675e91eb18834a4805699b9f70439b8d2abc80e1239e5e9229a3c80a1ceb93f6778685ceacb5f9b246
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
11KB
MD5be33c6b83c46c89bdfe766ea5878d3b8
SHA1f92ba1f17cd512cbf3769c1a05b54a698e2cab7e
SHA2567159fa9d3d02995d10a22a71fd0301a27bc33050027a4d4168c7323989d649e5
SHA51223bb14669f82fa363b90b133bc08336fa6ccfc802b9dbf04a627f762a3eb278659a46d90d7d6fe9bae59c8e91afb1f1edcd1ba8ea04ded656b347bbbb637a0a0
-
C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdbFilesize
512KB
MD5d9403fb40cfea4dd4a74f2ad5f03cfac
SHA16f23b5f34c5ee194060a471546384f0ac0296f39
SHA256d748266f0900159c1c1f8ceb74b9442965b86a19a17eee88961eb5d443c6f97d
SHA5121f9dbc47f9172ecfb1547c0db4ad3b3d3fae892482da027e244bf53d0d5f95ba3f0594618d53f056ca82b0ee7235ccca01bfad97a7d9fe20ef2ece2a08045a53
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.050.0310.0001\FileSyncClient.dllFilesize
4.6MB
MD5efce4ad20b267b830fe481f651a01cad
SHA10d16b8b951e34dd6c8f082428200e1eae364229d
SHA256c9e1671633ed2e8a0cbfe02f982ae0e2ae41e979d13138408c5329a1282b01a4
SHA5122efdf98e4a131efe721ef186d4f314b9c696b145a71cbdc9464f33264b73a26225515a413876afdb00439c117e1aaf0f4c36dd0f59172ba5e5d71d8c6b00e203
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.050.0310.0001\FileSyncConfig.exeFilesize
433KB
MD5744825e09c334ade152ce758b899f0ef
SHA1880304dc61f1bb323c1db6ea46b804bd868fbbe9
SHA256d6ef50b5d22c3bd1c9624f975b2a39bd3180e89a59f094becc7590efa2a6c79e
SHA51295e64bbb4f58e0572abb76bb31e0205bdc98dca829bfb69028d9cff72052ffd317191baa28a7b52a6baec99ff17512f85cfe1cfae73aee2c84a2e1221802b37b
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.050.0310.0001\FileSyncSessions.dllFilesize
3.1MB
MD5fa5be2452f0c1abac5f547375ed0b642
SHA15a94fa5c36b9ac1e7416297663cd9f4deaf41b82
SHA2568d6f3177af6201914dc5415b69e60058c33f424ef6ae0c4b8cce46588fc23334
SHA5120c26c314365ae3f6da310b24229a84825cde96200eba6c5156208c640c155c3e99825188b789d870352a8f01d2ff6fa406c17dd337d5547c52e0997bfb057b2d
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.050.0310.0001\FileSyncTelemetryExtensions.dllFilesize
27KB
MD59586b31345d24efb7aa9059726033436
SHA1c60f3d47a4acd631476bc85ed05105e359d502c0
SHA256b963d9193aa064a3ca6bf9b2a9ae498f33901a0ca261741a0fe9c0df4529aab8
SHA512333343ffbbe051398db32d746b7d537fe08e0dd9f522a64e52b22ef632e8db3b70bf3824a459e02b8eedb9b720304d59a39026037debd60d76b8e59618c63582
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.050.0310.0001\FileSyncViews.dllFilesize
2.1MB
MD5eaa949adecd84b64c75dbf9ed3730a1b
SHA18420d12eedc5001576ffa309e6bf7ce5ac7e0fe6
SHA25639713e62d5b7280ffd85414151fafe4711817872561be47d417e6b8fc6efaa11
SHA512d97398390819bc58873d0a491f26f43a89a2ced001a725523caca8e3996a1ca7020290813a599f7f2de183d21c480eefadf4ac2732bc07d6f6502a0d59fd017c
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.050.0310.0001\LogUploader.dllFilesize
626KB
MD5e76598a9081e6ef607753908ad65b1a4
SHA1807d5202ffc1b867dd28ebe447c36d40682a6aa5
SHA256efe42d4f15d60b65ef735de4cb46f3f65863311b5193a510167ed67169341e33
SHA512d9c91356751971f171ebbea33249872372b0dc5eacc44462482420b5f8bc9b41c3e1e5efb12a02b6fc0fdbc4a29c0d1422a9af5e17a853c557e760664f525946
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.050.0310.0001\LoggingPlatform.dllFilesize
310KB
MD555f9372e3c6951b5ee3a4e6cd248a35a
SHA1d663527b11349e4ac6e78bf350af0032db6cb03c
SHA2563c8f09d36d11aa745392e1d5f42afd9672b502869ab3d518ea715e1d31255d32
SHA512018b1bc0270d02ab762a5c1ae24ff042959a59fc84032684eb819080c446214ad600fbbf9b2d60027920df88e04c65f7002823ae1b11c3dd92a427d6ad4dc5b4
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.050.0310.0001\LogoImages\OneDriveMedTile.contrast-black_scale-100.pngFilesize
1KB
MD572747c27b2f2a08700ece584c576af89
SHA15301ca4813cd5ff2f8457635bc3c8944c1fb9f33
SHA2566f028542f6faeaaf1f564eab2605bedb20a2ee72cdd9930bde1a3539344d721b
SHA5123e7f84d3483a25a52a036bf7fd87aac74ac5af327bb8e4695e39dada60c4d6607d1c04e7769a808be260db2af6e91b789008d276ccc6b7e13c80eb97e2818aba
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.050.0310.0001\LogoImages\OneDriveMedTile.contrast-black_scale-125.pngFilesize
1KB
MD5b83ac69831fd735d5f3811cc214c7c43
SHA15b549067fdd64dcb425b88fabe1b1ca46a9a8124
SHA256cbdcf248f8a0fcd583b475562a7cdcb58f8d01236c7d06e4cdbfe28e08b2a185
SHA5124b2ee6b3987c048ab7cc827879b38fb3c216dab8e794239d189d1ba71122a74fdaa90336e2ea33abd06ba04f37ded967eb98fd742a02463b6eb68ab917155600
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.050.0310.0001\LogoImages\OneDriveMedTile.contrast-black_scale-150.pngFilesize
2KB
MD5771bc7583fe704745a763cd3f46d75d2
SHA1e38f9d7466eefc6d3d2aaa327f1bd42c5a5c7752
SHA25636a6aad9a9947ab3f6ac6af900192f5a55870d798bca70c46770ccf2108fd62d
SHA512959ea603abec708895b7f4ef0639c3f2d270cfdd38d77ac9bab8289918cbd4dbac3c36c11bb52c6f01b0adae597b647bb784bba513d77875979270f4962b7884
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.050.0310.0001\LogoImages\OneDriveMedTile.contrast-black_scale-200.pngFilesize
2KB
MD509773d7bb374aeec469367708fcfe442
SHA12bfb6905321c0c1fd35e1b1161d2a7663e5203d6
SHA25667d1bb54fcb19c174de1936d08b5dbdb31b98cfdd280bcc5122fb0693675e4f2
SHA512f500ea4a87a24437b60b0dc3ec69fcc5edbc39c2967743ddb41093b824d0845ffddd2df420a12e17e4594df39f63adad5abb69a29f8456fed03045a6b42388bc
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.050.0310.0001\LogoImages\OneDriveMedTile.contrast-black_scale-400.pngFilesize
6KB
MD5e01cdbbd97eebc41c63a280f65db28e9
SHA11c2657880dd1ea10caf86bd08312cd832a967be1
SHA2565cb8fd670585de8a7fc0ceede164847522d287ef17cd48806831ea18a0ceac1f
SHA512ffd928e289dc0e36fa406f0416fb07c2eb0f3725a9cdbb27225439d75b8582d68705ec508e3c4af1fc4982d06d70ef868cafbfc73a637724dee7f34828d14850
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.050.0310.0001\LogoImages\OneDriveMedTile.contrast-white_scale-100.pngFilesize
2KB
MD519876b66df75a2c358c37be528f76991
SHA1181cab3db89f416f343bae9699bf868920240c8b
SHA256a024fc5dbe0973fd9267229da4ebfd8fc41d73ca27a2055715aafe0efb4f3425
SHA51278610a040bbbb026a165a5a50dfbaf4208ebef7407660eea1a20e95c30d0d42ef1d13f647802a2f0638443ae2253c49945ebe018c3499ddbf00cfdb1db42ced1
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.050.0310.0001\LogoImages\OneDriveMedTile.contrast-white_scale-125.pngFilesize
3KB
MD58347d6f79f819fcf91e0c9d3791d6861
SHA15591cf408f0adaa3b86a5a30b0112863ec3d6d28
SHA256e8b30bfcee8041f1a70e61ca46764416fd1df2e6086ba4c280bfa2220c226750
SHA5129f658bc77131f4ac4f730ed56a44a406e09a3ceec215b7a0b2ed42d019d8b13d89ab117affb547a5107b5a84feb330329dc15e14644f2b52122acb063f2ba550
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.050.0310.0001\LogoImages\OneDriveMedTile.contrast-white_scale-150.pngFilesize
3KB
MD5de5ba8348a73164c66750f70f4b59663
SHA11d7a04b74bd36ecac2f5dae6921465fc27812fec
SHA256a0bbe33b798c3adac36396e877908874cffaadb240244095c68dff840dcbbf73
SHA51285197e0b13a1ae48f51660525557cceaeed7d893dd081939f62e6e8921bb036c6501d3bb41250649048a286ff6bac6c9c1a426d2f58f3e3b41521db26ef6a17c
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.050.0310.0001\LogoImages\OneDriveMedTile.contrast-white_scale-200.pngFilesize
4KB
MD5f1c75409c9a1b823e846cc746903e12c
SHA1f0e1f0cf35369544d88d8a2785570f55f6024779
SHA256fba9104432cbb8ebbd45c18ef1ba46a45dd374773e5aa37d411bb023ded8efd6
SHA512ed72eb547e0c03776f32e07191ce7022d08d4bcc66e7abca4772cdd8c22d8e7a423577805a4925c5e804ed6c15395f3df8aac7af62f1129e4982685d7e46bd85
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.050.0310.0001\LogoImages\OneDriveMedTile.contrast-white_scale-400.pngFilesize
8KB
MD5adbbeb01272c8d8b14977481108400d6
SHA11cc6868eec36764b249de193f0ce44787ba9dd45
SHA2569250ef25efc2a9765cf1126524256fdfc963c8687edfdc4a2ecde50d748ada85
SHA512c15951cf2dc076ed508665cd7dac2251c8966c1550b78549b926e98c01899ad825535001bd65eeb2f8680cd6753cd47e95606ecf453919f5827ed12bca062887
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.050.0310.0001\LogoImages\OneDriveMedTile.scale-100.pngFilesize
2KB
MD557a6876000151c4303f99e9a05ab4265
SHA11a63d3dd2b8bdc0061660d4add5a5b9af0ff0794
SHA2568acbdd41252595b7410ca2ed438d6d8ede10bd17fe3a18705eedc65f46e4c1c4
SHA512c6a2a9124bc6bcf70d2977aaca7e3060380a4d9428a624cc6e5624c75ebb6d6993c6186651d4e54edf32f3491d413714ef97a4cdc42bae94045cd804f0ad7cba
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.050.0310.0001\LogoImages\OneDriveMedTile.scale-125.pngFilesize
4KB
MD5d03b7edafe4cb7889418f28af439c9c1
SHA116822a2ab6a15dda520f28472f6eeddb27f81178
SHA256a5294e3c7cd855815f8d916849d87bd2357f5165eb4372f248fdf8b988601665
SHA51259d99f0b9a7813b28bae3ea1ae5bdbbf0d87d32ff621ff20cbe1b900c52bb480c722dd428578dea5d5351cc36f1fa56b2c1712f2724344f026fe534232812962
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.050.0310.0001\LogoImages\OneDriveMedTile.scale-150.pngFilesize
5KB
MD5a23c55ae34e1b8d81aa34514ea792540
SHA13b539dfb299d00b93525144fd2afd7dd9ba4ccbf
SHA2563df4590386671e0d6fee7108e457eb805370a189f5fdfeaf2f2c32d5adc76abd
SHA5121423a2534ae71174f34ee527fe3a0db38480a869cac50b08b60a2140b5587b3944967a95016f0b00e3ca9ced1f1452c613bb76c34d7ebd386290667084bce77d
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.050.0310.0001\LogoImages\OneDriveMedTile.scale-200.pngFilesize
6KB
MD513e6baac125114e87f50c21017b9e010
SHA1561c84f767537d71c901a23a061213cf03b27a58
SHA2563384357b6110f418b175e2f0910cffe588c847c8e55f2fe3572d82999a62c18e
SHA512673c3bec7c2cd99c07ebfca0f4ab14cd6341086c8702fe9e8b5028aed0174398d7c8a94583da40c32cd0934d784062ad6db71f49391f64122459f8bb00222e08
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.050.0310.0001\LogoImages\OneDriveMedTile.scale-400.pngFilesize
15KB
MD5e593676ee86a6183082112df974a4706
SHA1c4e91440312dea1f89777c2856cb11e45d95fe55
SHA256deb0ec0ee8f1c4f7ea4de2c28ff85087ee5ff8c7e3036c3b0a66d84bae32b6bb
SHA51211d7ed45f461f44fa566449bb50bcfce35f73fc775744c2d45ea80aeb364fe40a68a731a2152f10edc059dea16b8bab9c9a47da0c9ffe3d954f57da0ff714681
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.050.0310.0001\LogoImages\OneDriveSmallTile.contrast-black_scale-100.pngFilesize
783B
MD5f4e9f958ed6436aef6d16ee6868fa657
SHA1b14bc7aaca388f29570825010ebc17ca577b292f
SHA256292cac291af7b45f12404f968759afc7145b2189e778b14d681449132b14f06b
SHA512cd5d78317e82127e9a62366fd33d5420a6f25d0a6e55552335e64dc39932238abd707fe75d4f62472bc28a388d32b70ff08b6aa366c092a7ace3367896a2bd98
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.050.0310.0001\LogoImages\OneDriveSmallTile.contrast-black_scale-125.pngFilesize
1018B
MD52c7a9e323a69409f4b13b1c3244074c4
SHA13c77c1b013691fa3bdff5677c3a31b355d3e2205
SHA2568efeacefb92d64dfb1c4df2568165df6436777f176accfd24f4f7970605d16c2
SHA512087c12e225c1d791d7ad0bf7d3544b4bed8c4fb0daaa02aee0e379badae8954fe6120d61fdf1a11007cbcdb238b5a02c54f429b6cc692a145aa8fbd220c0cb2d
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.050.0310.0001\LogoImages\OneDriveSmallTile.contrast-black_scale-150.pngFilesize
1KB
MD5552b0304f2e25a1283709ad56c4b1a85
SHA192a9d0d795852ec45beae1d08f8327d02de8994e
SHA256262b9a30bb8db4fc59b5bc348aa3813c75e113066a087135d0946ad916f72535
SHA5129559895b66ef533486f43274f7346ad3059c15f735c9ce5351adf1403c95c2b787372153d4827b03b6eb530f75efcf9ae89db1e9c69189e86d6383138ab9c839
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.050.0310.0001\LogoImages\OneDriveSmallTile.contrast-black_scale-200.pngFilesize
1KB
MD522e17842b11cd1cb17b24aa743a74e67
SHA1f230cb9e5a6cb027e6561fabf11a909aa3ba0207
SHA2569833b80def72b73fca150af17d4b98c8cd484401f0e2d44320ecd75b5bb57c42
SHA5128332fc72cd411f9d9fd65950d58bf6440563dc4bd5ce3622775306575802e20c967f0ee6bab2092769a11e2a4ea228dab91a02534beeb8afde8239dd2b90f23a
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.050.0310.0001\LogoImages\OneDriveSmallTile.contrast-black_scale-400.pngFilesize
3KB
MD53c29933ab3beda6803c4b704fba48c53
SHA1056fe7770a2ba171a54bd60b3c29c4fbb6d42f0c
SHA2563a7ef7c0bda402fdaff19a479d6c18577c436a5f4e188da4c058a42ef09a7633
SHA51209408a000a6fa8046649c61ccef36afa1046869506f019f739f67f5c1c05d2e313b95a60bd43d9be882688df1610ad7979dd9d1f16a2170959b526ebd89b8ef7
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.050.0310.0001\LogoImages\OneDriveSmallTile.scale-100.pngFilesize
1KB
MD51f156044d43913efd88cad6aa6474d73
SHA11f6bd3e15a4bdb052746cf9840bdc13e7e8eda26
SHA2564e11167708801727891e8dd9257152b7391fc483d46688d61f44b96360f76816
SHA512df791d7c1e7a580e589613b5a56ba529005162d3564fffd4c8514e6afaa5eccea9cea9e1ac43bd9d74ee3971b2e94d985b103176db592e3c775d5feec7aac6d1
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.050.0310.0001\LogoImages\OneDriveSmallTile.scale-125.pngFilesize
2KB
MD509f3f8485e79f57f0a34abd5a67898ca
SHA1e68ae5685d5442c1b7acc567dc0b1939cad5f41a
SHA25669e432d1eec44bed4aad35f72a912e1f0036a4b501a50aec401c9fa260a523e3
SHA5120eafeaf735cedc322719049db6325ccbf5e92de229cace927b78a08317e842261b7adbda03ec192f71ee36e35eb9bf9624589de01beaec2c5597a605fc224130
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.050.0310.0001\LogoImages\OneDriveSmallTile.scale-150.pngFilesize
3KB
MD5ed306d8b1c42995188866a80d6b761de
SHA1eadc119bec9fad65019909e8229584cd6b7e0a2b
SHA2567e3f35d5eb05435be8d104a2eacf5bace8301853104a4ea4768601c607ddf301
SHA512972a42f7677d57fcb8c8cb0720b21a6ffe9303ea58dde276cfe2f26ee68fe4cc8ae6d29f3a21a400253de7c0a212edf29981e9e2bca49750b79dd439461c8335
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.050.0310.0001\LogoImages\OneDriveSmallTile.scale-200.pngFilesize
4KB
MD5d9d00ecb4bb933cdbb0cd1b5d511dcf5
SHA14e41b1eda56c4ebe5534eb49e826289ebff99dd9
SHA25685823f7a5a4ebf8274f790a88b981e92ede57bde0ba804f00b03416ee4feda89
SHA5128b53dec59bba8b4033e5c6b2ff77f9ba6b929c412000184928978f13b475cd691a854fee7d55026e48eab8ac84cf34fc7cb38e3766bbf743cf07c4d59afb98f4
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.050.0310.0001\LogoImages\OneDriveSmallTile.scale-400.pngFilesize
11KB
MD5096d0e769212718b8de5237b3427aacc
SHA14b912a0f2192f44824057832d9bb08c1a2c76e72
SHA2569a0b901e97abe02036c782eb6a2471e18160b89fd5141a5a9909f0baab67b1ef
SHA51299eb3d67e1a05ffa440e70b7e053b7d32e84326671b0b9d2fcfcea2633b8566155477b2a226521bf860b471c5926f8e1f8e3a52676cacb41b40e2b97cb3c1173
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.050.0310.0001\MSVCP140.dllFilesize
431KB
MD5bd329995813712d94d83f8d61228cd3c
SHA1a4b4346a1cd6fec54fe41d6aaabcc9dd120d29a5
SHA256a33550c04e81f849fed5077e8a02e72277974d41644480e0e2f6d17aad19beca
SHA5126b1878263895064eb3c11c50fee754552f67cb6cee6fb6fb2c9dc96e96afacd2c3db53f8f0115447e0d3b87b7e7cda6ca79328889010c9fdcb8daaad8e2c0e5b
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.050.0310.0001\OneDrive.VisualElementsManifest.xmlFilesize
344B
MD55ae2d05d894d1a55d9a1e4f593c68969
SHA1a983584f58d68552e639601538af960a34fa1da7
SHA256d21077ad0c29a4c939b8c25f1186e2b542d054bb787b1d3210e9cab48ec3080c
SHA512152949f5b661980f33608a0804dd8c43d70e056ae0336e409006e764664496fef6e60daa09fecb8d74523d3e7928c0dbd5d8272d8be1cf276852d88370954adc
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.050.0310.0001\OneDrive.exeFilesize
1.9MB
MD54592abdea88598149b6edf0acdf725b5
SHA10429e6697b13435dfc8c2c631d17d3140493d1f3
SHA25628611d106d449e08374d674a3876cfac799f3b57e19e2dc283612e03623aaf67
SHA512f3acb79214f9113b6d137c819e3180d79c54fea2f64b698d4cdd5c7101b1e5102a116f8b5b13d94d3d05d1b39ba203240ef7b59143a47fce1396b65d664087c5
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.050.0310.0001\OneDriveStandaloneUpdater.exeFilesize
2.8MB
MD50e5fd9e26ed643ca4bd7f16f725f9449
SHA1baf005f55fa4f455b2dfee0901e14dac9bbbe4f4
SHA256243b6499571730a5af85d90df9ebd089a1f82c7ff97a0cb19325d213b51b7c31
SHA5123e4ccff546fd0afc7aeffa1a520d31b22a757cbb84bc1eace529d58b765f3de03b84d5ce659527bfee0ef94579eaf2fd96058128291eb56d4915a8d8f7a631f5
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.050.0310.0001\OneDriveTelemetryStable.dllFilesize
1.4MB
MD5955d9c7c659c95df3170beb55e0f220c
SHA1ba2bb2a7951a9675dc56b33954ddc74f4b9ab53e
SHA256fd187e6c9b58fb52515b4b396e407dd36c0a38a87179074be483748a88f6f528
SHA512e8cc3804f05e12d51c78f84a03d26c2495489244e15256d2f0a0917039edf7ddf3ff6844d0693ab62b6def3f8f2fbb087ec904f7ea023f90caf53b478542530b
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.050.0310.0001\Qt5Core.dllFilesize
5.0MB
MD5e7d523380f4f3a4cd162dbc9cf5f1c8b
SHA16b38a6fdb66833c767cdf43a5dc8637aed510a84
SHA2563ac3eadee2d73655ad5dd103048c70f83e214f96c2816d7392369db04f185e60
SHA512e9fa242195ad4389eccac08f5ae336357ed3f65afcaa363c16ff23154c3d17dfb5cc96cdd8359c3e24866ec62fff050b8b4357342f89eec1fdafe3a212d6a05a
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.050.0310.0001\Qt5Gui.dllFilesize
5.3MB
MD5c9f6e3c3064dbc245f261952a61ffb9d
SHA104c36d07229129a6d16abe76477eb12a1c836394
SHA256d4aa2eef060af4852a1f735a837c40eda95ed57b8aa492de92821b30aec43ce4
SHA512c0d819d30373b3f2112d7a4d755ce80a3d664da8bba78e75c809d0341fc9c67fd063604196531630fda055ec100318327f7bc0de0cb8ceea1bae6ee3b7a8de06
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.050.0310.0001\Qt5Qml.dllFilesize
2.7MB
MD5ebe2ef5ae79118dee07f2a10b08eb860
SHA1193ce9e5a7b8bfaa737c532f7993f9c34ea82b47
SHA256f1f95ae0fa95a958359c26243f0f8384fc3687a71deba000e5c606542eb939ae
SHA5126c92b63c2a8dc55e838a1dd33634fa0c1cde1f3bd75e85b4f270aa18e2b37c5aeffca40c495c6227be310406c9ca7d42511cd10310a4adb74ade5bb9aec781c3
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.050.0310.0001\Qt5Quick.dllFilesize
3.3MB
MD5447dd09680c82009644e6865200ed48e
SHA1162fb525d1fd103c1b2f05b0f4dc5f153b716d20
SHA25605eecf716032307ae42666178b31e221b9dd10456dfe7e517d938ae9ad8384f9
SHA5122822a7b7872483c74c42b0f85c193bd0ac2610110d397b66121c9aa49d24f5f4ec70c834be21da32290ff1a8a86cfcc330a0135afeebcd4213f6be940b47c692
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.050.0310.0001\Resources.priFilesize
4KB
MD57473be9c7899f2a2da99d09c596b2d6d
SHA10f76063651fe45bbc0b5c0532ad87d7dc7dc53ac
SHA256e1252527bc066da6838344d49660e4c6ff2d1ddfda036c5ec19b07fdfb90c8c3
SHA512a4a5c97856e314eedbad38411f250d139a668c2256d917788697c8a009d5408d559772e0836713853704e6a3755601ae7ee433e07a34bd0e7f130a3e28729c45
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.050.0310.0001\SyncEngine.DLLFilesize
7.9MB
MD559cecb8d0f5b2c3bf58f2358ff75a32f
SHA1248efefe1c5105ca8a9298ea706ce098fadd6c57
SHA256bea27e72482eeb9cfddc4881bd15c50abce02df72660c92d50b553edeeab5bd4
SHA512b38436559dc39e294ea300cbafe700c962f9c55fdf5c2d68e841c5d8491885cc5e1df9adcac219a3f1157afa3fe91db0d1e6e3c2e210cb1c6e331ba4cc71fa1c
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.050.0310.0001\Telemetry.dllFilesize
229KB
MD5d8483a39b24a75f34212c7ae71cec197
SHA1cbe708750a41d91d08e764a0ec524bd74e463e7a
SHA256dd0f93390a524918ef4717278c8fd77f9793505a314675f74da54baf98bdb8b9
SHA512d8ecfa2891a1cc4dd927854c0fc3f49ad7fe3402047d5db46379f4923e7aefb89fc63d52e88ebc74842cf9ec096dda9d07c9d65f9350421332dcded3df717aec
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.050.0310.0001\UpdateRingSettings.dllFilesize
257KB
MD5a87c3012257c1be3a0ce588dbd57ebcb
SHA11c9000b3870d0164118b416ca46f0f6db1c0c6d2
SHA2562e778b9665472b80295361e649df2b10c3b08065bc013f954d9a8753f27c9b24
SHA512e650a89c17d3a6c301dcbbf373ae2e34ed2cbcb45b78b30ac16426e76914ebf8f500b6880e4c291b56e3d52687ee4113f3002e78b08d14dedfbb3a36bb42e3da
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.050.0310.0001\adal.dllFilesize
1.4MB
MD591cad78c36e2a519a21fa0a1bde4a8ce
SHA1a539ab64e940079a82368bfa62b577d52fc70e97
SHA256f4f6a395573ce52b9fd00a873bfa50ebcf67ea722d70ee68839690777acf0324
SHA5124187e438a68b3986d377a6ed1c757b0d7432c71c7f7f6d59c7f961a10bda6fc99ed553d481204d401f822f05226f1f17e4bf5a6c5b893631c0531358e61d8e72
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.050.0310.0001\ucrtbase.dllFilesize
1.1MB
MD5030ffb87a16778bf1c8c6996e03df43f
SHA133c85868f847377d1786d79b46d72113e8be9404
SHA25695dd07d8afab753b0dc19db8e81c9a1d1ce4bf9e598fb5cf3d9a403af540838d
SHA51255f75f50fc2bd01ef059d5008a2070475c3c774615f1cec4b6eef128c04d0dd77e31a9d92b33b92d5a238de7aeda63bebf666d8afc060d4a6a5608a7973a254f
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.050.0310.0001\vcruntime140.dllFilesize
73KB
MD5f135dfc5ac026c9b6a29854774d71d71
SHA165dd44ad62f23474d664567234abb619f19f2d39
SHA256c9ccfacf80630f47611d65e370bf3148caf3d3b5d6604bc5d277220f56d78ab8
SHA51219f0b4cfa76f13a91c4f6ccd8317b3b3c71e06cf8ffd1d3c2054ef7b8159f8ae65443de4a7d85efbb626e7db58de1d983054ad4cde56df4691a15361f08dc2f3
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exeFilesize
40.2MB
MD5fb4aa59c92c9b3263eb07e07b91568b5
SHA16071a3e3c4338b90d892a8416b6a92fbfe25bb67
SHA256e70e80dbbc9baba7ddcee70eda1bb8d0e6612dfb1d93827fe7b594a59f3b48b9
SHA51260aabbe2fd24c04c33e7892eab64f24f8c335a0dd9822eb01adc5459e850769fc200078c5ccee96c1f2013173bc41f5a2023def3f5fe36e380963db034924ace
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\settings\Personal\logUploaderSettings_temp.iniFilesize
108B
MD51cd0c2821a9cf116e4e0943c8dff4a03
SHA16c9104fb647e816336eb05841dfd00e38792ab41
SHA256514ac822a4705678bde6a84196b26741d5ac43d9fab6a3f4442399f4d475d9c9
SHA512bfa35a92170f5ab3ae9f3fba72ee76428c5fc24c36aec61e179180ba7d81d6282259827553d99fea66a14f55e0b54c40926ef2d8ddb9fc58645906e3e46d5113
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\settings\PreSignInSettingsConfig.jsonFilesize
63KB
MD5e516a60bc980095e8d156b1a99ab5eee
SHA1238e243ffc12d4e012fd020c9822703109b987f6
SHA256543796a1b343b4ebc0285d89cb8eb70667ac7b513da37495e38003704e9d88d7
SHA5129b51e99ba20e9da56d1acc24a1cf9f9c9dbdeb742bec034e0ff2bc179a60f4aff249f40344f9ddd43229dcdefa1041940f65afb336d46c175ffeff725c638d58
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\setup\logs\DeviceHealthSummaryConfiguration.iniFilesize
77B
MD5a8ec8da7a2b514ba12977dcc8f3291df
SHA1c46683cc06db3087d9170df0a5a04868c7ded9a7
SHA25624a2cebe4f588fe904832acae83972bd612f8e8d4a5c627270696e77d94d29b9
SHA512508f9a0c3a5462882f4abb317f84c879d678e3b3f6102ea3e23b1be1b524ea800399729db8e0e927ae6422faa81a6f8bfa997588192dd7019cc2cc43f55d79ff
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\setup\logs\userTelemetryCache.otc.sessionFilesize
20KB
MD5be523753866bf6debb0f7fe9d33f3e09
SHA1cd6171cb79513157520b456a858526e9039aa1e3
SHA256649a242a7cc640eb78be329ed81bfedd2941839ef8aedcd27b82f19e04029c66
SHA5126a4ceec21faac63e0ccec4e365dfb943313d4e00b81ea02d2f6b41e306bdb642a0b51a284574e1aa4c0c1181ff3a6bd307f7bb28c75ccdb7fdfc51c856d6bc75
-
C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XMLFilesize
9KB
MD57050d5ae8acfbe560fa11073fef8185d
SHA15bc38e77ff06785fe0aec5a345c4ccd15752560e
SHA256cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b
SHA512a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\P3J30ITL\update100[2].xmlFilesize
726B
MD553244e542ddf6d280a2b03e28f0646b7
SHA1d9925f810a95880c92974549deead18d56f19c37
SHA25636a6bd38a8a6f5a75b73caffae5ae66dfabcaefd83da65b493fa881ea8a64e7d
SHA5124aa71d92ea2c46df86565d97aac75395371d3e17877ab252a297b84dca2ab251d50aaffc62eab9961f0df48de6f12be04a1f4a2cbde75b9ae7bcce6eb5450c62
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_m2p54ale.eyn.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
C:\Users\Admin\AppData\Local\Temp\aria-debug-9588.logFilesize
470B
MD5937f8c795663ae70c3e19c9fa997783f
SHA1b7abdff9fd27c67816306c33d45e2f08ac13393d
SHA256f5046b952e03bc5fa8ea9b5d3b9b450f4076a4ed5d72be7f83538fc8c56d8020
SHA512b9f42d46f94dfa6312f4086a89944d26c4eb76c6757c92175b8f41fe3be64981f888d90ab8f3e6008a779c3fc1a7f3037c8649089aa0a16dc9c2cff99149439f
-
C:\Users\Admin\AppData\Local\Temp\tmp39AF.tmpFilesize
28.5MB
MD5229821a67d5eec1d4752d27be470ca0b
SHA1a2dc1262c72bc67c506787103099eea5d8fb15e4
SHA2568569c7c5b51ca75401e73071dde7f76d0abe6187840114d131072b73cfcf7f94
SHA512363610435a4a76c5f525f48d87b4dc49af9f6b1badab7bec55690551a4ea1f677339ee695fe960047bd561db629bc2486d621e3b460e89c33d7722c911b07d76
-
C:\Users\Admin\AppData\Local\Temp\tmpD334.tmpFilesize
33.1MB
MD5162e0458395e973b8ec1894a050bc4a0
SHA128ad9acf285eeb849542baa6b7407e4a243bb33d
SHA2563a6924971813e9cc3e1da01e150add8532de225ee25d618a080df847b64142b0
SHA5124ae46bf949c4c40ddaa339ec7cd4b14d5a9479ffd4bbd6fe0edf013861dbf3b96d5a44e6b47aa2d95c6bd87c62932c62c3cee9009d7dee5b4c09ebbcfbb06957
-
C:\Windows\Logs\DISM\dism.logFilesize
13KB
MD5ac0702ae99591769035266f19e735fc1
SHA1c2524d78bc82c6bad281367834f8611bd4f9d266
SHA256dbbab03aeed55210deb0b479ea69f550febcbb7c45dbb5f321531dc821d8af89
SHA5123fd7f3b505eca9c5cd9f870d9d621faf39b5dd7a334c83a850a62162155aa45abefc4758985972b98604fdc3765fe5d7aa3a2e2179824ec0cecca0ec534a5078
-
C:\Windows\Panther\UnattendGC\diagerr.xmlFilesize
19KB
MD534b6144e643f1b652f3cebe873fda61d
SHA18748a43a211112d9447e60f2ad75599a69efc986
SHA2563af9547fbe77dece79d51c8332847b9b7fdfb2300f1e65d8fc69089cfa581411
SHA512e31271a16c43238aa9532bffc4615c735e504ae6f06860dafa8537afd6817883b3b5b8cc9027269f9adb447a1369f3e82f6bd348aba2b3f4b8c8cf9da2b2d27e
-
C:\Windows\Panther\UnattendGC\diagerr.xmlFilesize
12KB
MD5df40bce78298bf7a99a0975fbb3be53e
SHA10d51887bad30d36fbd34e459184d122df7768ad0
SHA2562b47819964d2b54c3b036404d1ac56ea572b6da0e568f4c83586aa5ac2a9d364
SHA512b606cde694fd53dd6cbe41692bcf635f8c9b2294407ae85597a506f524ce5b927e20807a5b25f68d93ee6c34b8a314ccd44d294b896dbf655935f9f61fccfd08
-
C:\Windows\Panther\UnattendGC\diagerr.xmlFilesize
14KB
MD59fb67a7bf10e0908f6ff9cc5d5f41c78
SHA15fa02250787d093dfbbf959c1a7233e59848b51b
SHA256f26ccedb924a2037bd7805c64b6d463620cb934b9fc1b05108fcda840c56fe6e
SHA51212484546c7ae8b789f5d5fd96dfce6232b1abca5f9837e558cdc9b4063574f1ef94dcc2f591a2da690f7fd730a17b4c2a04b145aaef67724132f25a5911bfeda
-
C:\Windows\Panther\UnattendGC\diagerr.xmlFilesize
17KB
MD503f007bafa1e2136076d9e425026f8c0
SHA1342d57a285a342a60254478ffc3efa967d8913dc
SHA25647c55c505ad4987940ae353e7ef2fd9a9fe489fbc016960b15e04770cf03c9c2
SHA5124673126c034eb105d646be71d76d8606dd2da2a18b3a9e2a90656a4bcf34c537aa339451f62f35afbb2dd4f41df28572208cc2c0565befd0dfb90172be24eec7
-
C:\Windows\Panther\UnattendGC\diagwrn.xmlFilesize
17KB
MD5b6fe6a90fcc828a8704c95b4c3311fd4
SHA1cbdc23bc16414f75cd45bd9d74ed1a63c7d92d36
SHA2567475e2d6a57186b9cf5bee34ddb6aa72f341c29e2eddca8b5e60327cc853787e
SHA5128e8758fcabe20cbcb1db6c7bb901e44c57669700a0ffe046ccea8c4af2406e83cc6d0ecf0c2a6ab04a013a1b8af6db9f5ebeb65f6588b88cc669f6074f57c3f4
-
C:\Windows\Panther\UnattendGC\diagwrn.xmlFilesize
12KB
MD51c9ddd0bf160c2be921b54b832ee55ec
SHA1815afde9610a107c30e24f2fdb705a0bb89e3e21
SHA2567ed846e3fb3d08437a1e996f2c2d3ba7e7f95350e4de6d08710be19eba87e7b7
SHA51200c7a6828ce657f8f202fbf3a665e299894e5f8cb166a81959dc2e53987d3ee47fd4ffa9bcc1d52797b8c4a8426b70c1bf6e5aa4b75c23bd75d633af8487a621
-
C:\Windows\Panther\UnattendGC\diagwrn.xmlFilesize
14KB
MD58343d845c185bac62ed56c06313b14ca
SHA1637a0f06e795ffce87d9e12dc59609bcd2f22dd5
SHA25642064eface446fc9c5a795897e3aac6674ad7c544ae95bf5a7e118db0bdbb784
SHA512b3830bf7cd6509a2d5ec12a567188be318adf2dbdf299936f868dbaad2fa49482ba7be91522e29afcc6a51de397d5c3724d11c94ad92a89e72158ef556de65f4
-
C:\Windows\Panther\UnattendGC\diagwrn.xmlFilesize
16KB
MD593a000e3b8acc60e7c8a0f06a8344146
SHA1bbcb3d88dcc443357ce2f0a68f797bab47c8be20
SHA2560181bc22c2885e5e05cfdd58830329f2649b54bff67c648668fe88f7202bac54
SHA51275721b5c041d120d83314ebde186c1a2c6b3608225a88587b6cf42189aa663bbcd91bdb951203bbe5c1cfbd4bb99b2af13c1cb308c8b135be95acbea1e55fb40
-
C:\Windows\Panther\UnattendGC\setupact.logFilesize
47KB
MD5d659a0dfdac7e0fc69e4da1138ddf834
SHA1c1610df3f8ebea3f22c3a0d13b7a5bd15db3c711
SHA256394bf54b7235ebe57090b9d9ab515ac554c780fd8e9e92023e436c6075530481
SHA512c3cce4a262fbc56a35781a5f64de8d392c01f2f060b89f4b3f639cb2129c042cfd9c60afa2abd4c255e1d292031180ba8b96c8615d682e85ee6b6be7f91af85f
-
C:\Windows\Panther\UnattendGC\setupact.logFilesize
46KB
MD5a9ca7b32415b8be194488cfd54a6dd29
SHA1fb85b3d80ccdbad54f556e582fef0777119d4ef0
SHA25649823424aaba6b2d5919fe330694e64a73df7edda66e7f7839ecd1df665d7045
SHA512f2cbec1a505d527dfba282a11f77adfc28a0a1876a7f65b9fb71d2f12db1d950c4e0e8ed3aa77e4eed7ae46ce80fc38fd7481161b5188ccf0ed1c2be56618b15
-
C:\Windows\Panther\UnattendGC\setupact.logFilesize
46KB
MD5ac4a2d363ac62daabf44e2a3b15f6bba
SHA1b1e9bae2ee612728b5be9209d8ee78bc5740a2cb
SHA256172528180a2ee00e6dcc67315ba3f9cefc25546b87120fb5246e6edaed361bc3
SHA5129dce698a5b53026e0c4c31c72d89fa5ce29b33fef8573d6557822d5db9cebefbdb685e252adacd57124d84b8cb6c847a989f54b2483f82f616b2bcf15258c69b
-
C:\Windows\Panther\UnattendGC\setupact.logFilesize
47KB
MD5c57805f6140be7a6a5269c2afa6ca81b
SHA117c4bf0e538578da2c89febe6f3e125177c8b875
SHA256473364f268a957d23e257b57ae23672fde64734f9a5c3633f8a17d9abb01da5b
SHA51202fb543609d52b7e5fe7a2eb03598304435598729a19906b92e6e9dca77532ea5b4f61aeaa09a6f3fe0979774a34f7d8658826e8f0526d142f7d2893a8ea9755
-
C:\Windows\Panther\UnattendGC\setuperr.logFilesize
547B
MD5062f6569e742f6175108e6c8b568308f
SHA129fb3fedc21a016792f90b2e3843f5deffa06fe5
SHA256af693054c59c1e2e90cf26f537050e252c946dd492ede2051122894720b161c6
SHA512fc5ef33b68e9d6508d01990f47a5b359dddb69ed9ac48a42ebbc36db00c06b47d11300c035498c3c16b35735eef32bdf0a4ef74e0429d79e9f3a2d0e76ec6719
-
C:\Windows\Panther\UnattendGC\setuperr.logFilesize
827B
MD5384eda7830e6dc22d36e10d16db0cce1
SHA1990d35ce13566277dbae8aa0188636e97b4de603
SHA2565d189c03b9939d1235859de342609e9d410bd45a78cbd51131ec07c7c1086c76
SHA512d2ad873ebd514dc57f5885764083c812dec8bada2238f5dd258029e91f4cbe533c762ff53141c90e55b1e1b46673415bfb2dd1df5662c7ee2bc1ed99218f46fc
-
C:\Windows\Panther\UnattendGC\setuperr.logFilesize
1KB
MD559fc64575c1e8bf05fb13f666288c7e3
SHA1455d1e0fbd36dc0960e66869af1a14acabe9656c
SHA2560f0ab993e5037c73ff2238d1134a7990793b78e87c753383a382c658c1a392c1
SHA512ae76c6c99d07b53f07ac375a1bd230cf0bf896f95348c9120fa3b1c0a9c4f59576c923bb4de293abdece9de8817fba17709e5ad31102db1d6170d46d9b8f0d95
-
\??\pipe\LOCAL\crashpad_7232_PWKBQQMUXGUIZGUIMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
memory/6032-164-0x0000000005000000-0x0000000005010000-memory.dmpFilesize
64KB
-
memory/6032-1-0x0000000005000000-0x0000000005010000-memory.dmpFilesize
64KB
-
memory/6032-159-0x0000000005000000-0x0000000005010000-memory.dmpFilesize
64KB
-
memory/6032-69-0x0000000005000000-0x0000000005010000-memory.dmpFilesize
64KB
-
memory/6032-68-0x0000000005000000-0x0000000005010000-memory.dmpFilesize
64KB
-
memory/6032-63-0x00007FFA38D00000-0x00007FFA397C2000-memory.dmpFilesize
10.8MB
-
memory/6032-165-0x0000000005000000-0x0000000005010000-memory.dmpFilesize
64KB
-
memory/6032-166-0x00007FF412E50000-0x00007FF412E60000-memory.dmpFilesize
64KB
-
memory/6032-4-0x0000000005000000-0x0000000005010000-memory.dmpFilesize
64KB
-
memory/6032-2-0x0000000005000000-0x0000000005010000-memory.dmpFilesize
64KB
-
memory/6032-0-0x00007FFA38D00000-0x00007FFA397C2000-memory.dmpFilesize
10.8MB
-
memory/6032-5-0x00007FF412E50000-0x00007FF412E60000-memory.dmpFilesize
64KB
-
memory/6032-3-0x0000000005000000-0x0000000005010000-memory.dmpFilesize
64KB
-
memory/6288-70-0x000000001C850000-0x000000001C860000-memory.dmpFilesize
64KB
-
memory/6288-67-0x000000001C850000-0x000000001C860000-memory.dmpFilesize
64KB
-
memory/6288-65-0x000000001C850000-0x000000001C860000-memory.dmpFilesize
64KB
-
memory/6288-66-0x00007FF4DDA60000-0x00007FF4DDA70000-memory.dmpFilesize
64KB
-
memory/6288-332-0x000000001C850000-0x000000001C860000-memory.dmpFilesize
64KB
-
memory/6288-252-0x000000001C850000-0x000000001C860000-memory.dmpFilesize
64KB
-
memory/6288-239-0x000000001C850000-0x000000001C860000-memory.dmpFilesize
64KB
-
memory/6288-241-0x00007FF4DDA60000-0x00007FF4DDA70000-memory.dmpFilesize
64KB
-
memory/6288-242-0x000000001C850000-0x000000001C860000-memory.dmpFilesize
64KB
-
memory/6288-240-0x000000001C850000-0x000000001C860000-memory.dmpFilesize
64KB
-
memory/6288-238-0x000000001C850000-0x000000001C860000-memory.dmpFilesize
64KB
-
memory/6288-233-0x000000001C850000-0x000000001C860000-memory.dmpFilesize
64KB
-
memory/6288-232-0x00007FFA38D00000-0x00007FFA397C2000-memory.dmpFilesize
10.8MB
-
memory/6288-64-0x000000001C850000-0x000000001C860000-memory.dmpFilesize
64KB
-
memory/6288-61-0x00007FFA38D00000-0x00007FFA397C2000-memory.dmpFilesize
10.8MB
-
memory/6288-62-0x000000001C850000-0x000000001C860000-memory.dmpFilesize
64KB
-
memory/6724-1223-0x0000000000890000-0x00000000008A0000-memory.dmpFilesize
64KB
-
memory/6724-1256-0x0000000000890000-0x00000000008A0000-memory.dmpFilesize
64KB
-
memory/6724-1228-0x0000000000890000-0x00000000008A0000-memory.dmpFilesize
64KB
-
memory/6724-1247-0x0000000000890000-0x00000000008A0000-memory.dmpFilesize
64KB
-
memory/6808-45-0x0000000000B40000-0x0000000000B50000-memory.dmpFilesize
64KB
-
memory/6996-78-0x0000000005180000-0x0000000005181000-memory.dmpFilesize
4KB
-
memory/6996-73-0x0000000005180000-0x0000000005181000-memory.dmpFilesize
4KB
-
memory/6996-83-0x0000000005180000-0x0000000005181000-memory.dmpFilesize
4KB
-
memory/6996-72-0x0000000005180000-0x0000000005181000-memory.dmpFilesize
4KB
-
memory/6996-71-0x0000000005180000-0x0000000005181000-memory.dmpFilesize
4KB
-
memory/6996-77-0x0000000005180000-0x0000000005181000-memory.dmpFilesize
4KB
-
memory/6996-79-0x0000000005180000-0x0000000005181000-memory.dmpFilesize
4KB
-
memory/6996-81-0x0000000005180000-0x0000000005181000-memory.dmpFilesize
4KB
-
memory/6996-82-0x0000000005180000-0x0000000005181000-memory.dmpFilesize
4KB
-
memory/6996-80-0x0000000005180000-0x0000000005181000-memory.dmpFilesize
4KB
-
memory/9796-1240-0x0000000001160000-0x0000000001170000-memory.dmpFilesize
64KB
-
memory/9796-1206-0x0000000001160000-0x0000000001170000-memory.dmpFilesize
64KB
-
memory/9796-1208-0x0000000001160000-0x0000000001170000-memory.dmpFilesize
64KB
-
memory/9796-1232-0x0000000001160000-0x0000000001170000-memory.dmpFilesize
64KB
-
memory/9796-1241-0x0000000001160000-0x0000000001170000-memory.dmpFilesize
64KB
-
memory/9796-1235-0x0000000001160000-0x0000000001170000-memory.dmpFilesize
64KB
-
memory/9796-1209-0x0000000001160000-0x0000000001170000-memory.dmpFilesize
64KB
-
memory/10412-1163-0x0000000003A00000-0x0000000003A10000-memory.dmpFilesize
64KB
-
memory/10892-1230-0x00000000013C0000-0x00000000013D0000-memory.dmpFilesize
64KB
-
memory/10892-1196-0x00000000013C0000-0x00000000013D0000-memory.dmpFilesize
64KB
-
memory/10892-1224-0x00000000013C0000-0x00000000013D0000-memory.dmpFilesize
64KB
-
memory/10892-1199-0x00000000013C0000-0x00000000013D0000-memory.dmpFilesize
64KB
-
memory/10892-1198-0x00000000013C0000-0x00000000013D0000-memory.dmpFilesize
64KB
-
memory/10892-1221-0x00000000013C0000-0x00000000013D0000-memory.dmpFilesize
64KB
-
memory/10892-1231-0x00000000013C0000-0x00000000013D0000-memory.dmpFilesize
64KB
-
memory/11116-1322-0x000002349A680000-0x000002349A690000-memory.dmpFilesize
64KB
-
memory/11116-1326-0x000002349A600000-0x000002349A624000-memory.dmpFilesize
144KB
-
memory/11116-1325-0x000002349A600000-0x000002349A62A000-memory.dmpFilesize
168KB
-
memory/11116-1323-0x000002349A5C0000-0x000002349A5CA000-memory.dmpFilesize
40KB
-
memory/11116-1324-0x000002349A680000-0x000002349A690000-memory.dmpFilesize
64KB
-
memory/11116-1311-0x0000023480000000-0x0000023480022000-memory.dmpFilesize
136KB
-
memory/11116-1312-0x00007FFA38D00000-0x00007FFA397C2000-memory.dmpFilesize
10.8MB
-
memory/11116-1321-0x0000023481DF0000-0x0000023481E12000-memory.dmpFilesize
136KB
-
memory/11168-1212-0x0000000000790000-0x00000000007A0000-memory.dmpFilesize
64KB
-
memory/11168-1252-0x0000000000790000-0x00000000007A0000-memory.dmpFilesize
64KB
-
memory/11168-1251-0x0000000000790000-0x00000000007A0000-memory.dmpFilesize
64KB
-
memory/11168-1244-0x0000000000790000-0x00000000007A0000-memory.dmpFilesize
64KB
-
memory/11168-1217-0x0000000000790000-0x00000000007A0000-memory.dmpFilesize
64KB
-
memory/11168-1215-0x0000000000790000-0x00000000007A0000-memory.dmpFilesize
64KB
