crimsonrat | hxxps://youareanidiot[.]cc/

Analysis

max time kernel
195s
max time network
303s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
25-05-2024 19:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://youareanidiot.cc/

Score

10^/10

crimsonrat darkcomet evasion persistence rat trojan

Malware Config

Extracted

Family

crimsonrat

185.136.161.124

Signatures

CrimsonRAT main payload 1 IoCs

Processes:

resource	yara_rule
C:\ProgramData\Hdlharas\dlrarhsiva.exe	family_crimsonrat

CrimsonRat
Crimson RAT is a malware linked to a Pakistani-linked threat actor.
rat crimsonrat
Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet

Modifies WinLogon for persistence 2 TTPs 23 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

Processes:

winupdate.exewinupdate.exewinupdate.exewinupdate.exewinupdate.exewinupdate.exewinupdate.exewinupdate.exewinupdate.exewinupdate.exewinupdate.exewinupdate.exewinupdate.exewinupdate.exewinupdate.exewinupdate.exewinupdate.exewinupdate.exeBlackkomet.exewinupdate.exewinupdate.exewinupdate.exewinupdate.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe"	winupdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe"	winupdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe"	winupdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe"	winupdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe"	winupdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe"	winupdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe"	winupdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe"	winupdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe"	winupdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe"	winupdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe"	winupdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe"	winupdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe"	winupdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe"	winupdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe"	winupdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe"	winupdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe"	winupdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe"	winupdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe"	Blackkomet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe"	winupdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe"	winupdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe"	winupdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe"	winupdate.exe

Downloads MZ/PE file
Modifies Windows Firewall 2 TTPs 1 IoCs
evasion

Windows Service
T1543.003

Disable or Modify System Firewall
T1562.004

Processes:

netsh.exe

pid process

3700 netsh.exe

pid	process
3700	netsh.exe

Sets file to hidden 1 TTPs 64 IoCs

Modifies file attributes to stop it showing in Explorer etc.

evasion

Hidden Files and Directories

T1564.001

Processes:

attrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exe

pid	process
7400	attrib.exe
8952	attrib.exe
8220	attrib.exe
10140	attrib.exe
13052	attrib.exe
12612	attrib.exe
4588	attrib.exe
2520	attrib.exe
7084	attrib.exe
10892	attrib.exe
13288	attrib.exe
10856	attrib.exe
1616	attrib.exe
11096	attrib.exe
11720	attrib.exe
3068	attrib.exe
12884	attrib.exe
6432	attrib.exe
1756	attrib.exe
4640	attrib.exe
10032	attrib.exe
6564	attrib.exe
7756	attrib.exe
6068	attrib.exe
8536	attrib.exe
10672	attrib.exe
10684	attrib.exe
6932	attrib.exe
12540	attrib.exe
14244	attrib.exe
6224	attrib.exe
7440	attrib.exe
8796	attrib.exe
7028	attrib.exe
11956	attrib.exe
12604	attrib.exe
5096	attrib.exe
14624	attrib.exe
7748	attrib.exe
10196	attrib.exe
13464	attrib.exe
8700	attrib.exe
9364	attrib.exe
12360	attrib.exe
8188	attrib.exe
1388	attrib.exe
5772	attrib.exe
12524	attrib.exe
13772	attrib.exe
5956	attrib.exe
11044	attrib.exe
7328	attrib.exe
4196	attrib.exe
804	attrib.exe
10916	attrib.exe
11056	attrib.exe
12616	attrib.exe
12948	attrib.exe
2212	attrib.exe
4176	attrib.exe
10180	attrib.exe
9332	attrib.exe
1756	attrib.exe
4448	attrib.exe

Checks computer location settings 2 TTPs 30 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

winupdate.exewinupdate.exewinupdate.exewinupdate.exeBlackkomet.exewinupdate.exewinupdate.exewinupdate.exewinupdate.exewinupdate.exewinupdate.exewinupdate.exewinupdate.exewinupdate.exewinupdate.exewinupdate.exewinupdate.exewinupdate.exewinupdate.exewinupdate.exeCrimsonRAT.exeCrimsonRAT.exeCrimsonRAT.exeCrimsonRAT.exewinupdate.exewinupdate.exeCrimsonRAT.exeCrimsonRAT.exeCrimsonRAT.exewinupdate.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation	winupdate.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation	winupdate.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation	winupdate.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation	winupdate.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation	Blackkomet.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation	winupdate.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation	winupdate.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation	winupdate.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation	winupdate.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation	winupdate.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation	winupdate.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation	winupdate.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation	winupdate.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation	winupdate.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation	winupdate.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation	winupdate.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation	winupdate.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation	winupdate.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation	winupdate.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation	winupdate.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation	CrimsonRAT.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation	CrimsonRAT.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation	CrimsonRAT.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation	CrimsonRAT.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation	winupdate.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation	winupdate.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation	CrimsonRAT.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation	CrimsonRAT.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation	CrimsonRAT.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation	winupdate.exe

Executes dropped EXE 38 IoCs

Processes:

CrimsonRAT.exedlrarhsiva.exeCrimsonRAT.exedlrarhsiva.exeCrimsonRAT.exeCrimsonRAT.exeCrimsonRAT.exeCrimsonRAT.exedlrarhsiva.exeCrimsonRAT.exedlrarhsiva.exedlrarhsiva.exedlrarhsiva.exedlrarhsiva.exeBlackkomet.exewinupdate.exewinupdate.exewinupdate.exewinupdate.exewinupdate.exewinupdate.exewinupdate.exewinupdate.exewinupdate.exewinupdate.exewinupdate.exewinupdate.exewinupdate.exewinupdate.exewinupdate.exewinupdate.exewinupdate.exewinupdate.exewinupdate.exewinupdate.exewinupdate.exewinupdate.exewinupdate.exe

pid	process
3612	CrimsonRAT.exe
4932	dlrarhsiva.exe
5356	CrimsonRAT.exe
1160	dlrarhsiva.exe
5964	CrimsonRAT.exe
1120	CrimsonRAT.exe
1680	CrimsonRAT.exe
4204	CrimsonRAT.exe
1116	dlrarhsiva.exe
2392	CrimsonRAT.exe
5548	dlrarhsiva.exe
5440	dlrarhsiva.exe
3980	dlrarhsiva.exe
6080	dlrarhsiva.exe
5532	Blackkomet.exe
2060	winupdate.exe
228	winupdate.exe
2148	winupdate.exe
5216	winupdate.exe
4512	winupdate.exe
4208	winupdate.exe
1976	winupdate.exe
4196	winupdate.exe
6116	winupdate.exe
3016	winupdate.exe
3644	winupdate.exe
5828	winupdate.exe
5304	winupdate.exe
3016	winupdate.exe
2884	winupdate.exe
5624	winupdate.exe
2724	winupdate.exe
1816	winupdate.exe
4904	winupdate.exe
6220	winupdate.exe
6480	winupdate.exe
6696	winupdate.exe
6904	winupdate.exe

Adds Run key to start application 2 TTPs 46 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

notepad.exewinupdate.exenotepad.exewinupdate.exenotepad.exewinupdate.exenotepad.exenotepad.exenotepad.exenotepad.exenotepad.exewinupdate.exewinupdate.exewinupdate.exenotepad.exewinupdate.exenotepad.exeBlackkomet.exenotepad.exenotepad.exewinupdate.exenotepad.exewinupdate.exewinupdate.exewinupdate.exenotepad.exenotepad.exenotepad.exewinupdate.exewinupdate.exewinupdate.exewinupdate.exenotepad.exewinupdate.exenotepad.exenotepad.exewinupdate.exenotepad.exenotepad.exewinupdate.exenotepad.exenotepad.exewinupdate.exewinupdate.exewinupdate.exewinupdate.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windows\\system32\\Windupdt\\winupdate.exe"	notepad.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windows\\system32\\Windupdt\\winupdate.exe"	winupdate.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windows\\system32\\Windupdt\\winupdate.exe"	notepad.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windows\\system32\\Windupdt\\winupdate.exe"	winupdate.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windows\\system32\\Windupdt\\winupdate.exe"	notepad.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windows\\system32\\Windupdt\\winupdate.exe"	winupdate.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windows\\system32\\Windupdt\\winupdate.exe"	notepad.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windows\\system32\\Windupdt\\winupdate.exe"	notepad.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windows\\system32\\Windupdt\\winupdate.exe"	notepad.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windows\\system32\\Windupdt\\winupdate.exe"	notepad.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windows\\system32\\Windupdt\\winupdate.exe"	notepad.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windows\\system32\\Windupdt\\winupdate.exe"	winupdate.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windows\\system32\\Windupdt\\winupdate.exe"	winupdate.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windows\\system32\\Windupdt\\winupdate.exe"	winupdate.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windows\\system32\\Windupdt\\winupdate.exe"	notepad.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windows\\system32\\Windupdt\\winupdate.exe"	winupdate.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windows\\system32\\Windupdt\\winupdate.exe"	notepad.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windows\\system32\\Windupdt\\winupdate.exe"	Blackkomet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windows\\system32\\Windupdt\\winupdate.exe"	notepad.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windows\\system32\\Windupdt\\winupdate.exe"	notepad.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windows\\system32\\Windupdt\\winupdate.exe"	winupdate.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windows\\system32\\Windupdt\\winupdate.exe"	notepad.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windows\\system32\\Windupdt\\winupdate.exe"	winupdate.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windows\\system32\\Windupdt\\winupdate.exe"	winupdate.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windows\\system32\\Windupdt\\winupdate.exe"	winupdate.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windows\\system32\\Windupdt\\winupdate.exe"	notepad.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windows\\system32\\Windupdt\\winupdate.exe"	notepad.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windows\\system32\\Windupdt\\winupdate.exe"	notepad.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windows\\system32\\Windupdt\\winupdate.exe"	winupdate.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windows\\system32\\Windupdt\\winupdate.exe"	winupdate.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windows\\system32\\Windupdt\\winupdate.exe"	winupdate.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windows\\system32\\Windupdt\\winupdate.exe"	winupdate.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windows\\system32\\Windupdt\\winupdate.exe"	notepad.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windows\\system32\\Windupdt\\winupdate.exe"	winupdate.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windows\\system32\\Windupdt\\winupdate.exe"	notepad.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windows\\system32\\Windupdt\\winupdate.exe"	notepad.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windows\\system32\\Windupdt\\winupdate.exe"	winupdate.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windows\\system32\\Windupdt\\winupdate.exe"	notepad.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windows\\system32\\Windupdt\\winupdate.exe"	notepad.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windows\\system32\\Windupdt\\winupdate.exe"	winupdate.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windows\\system32\\Windupdt\\winupdate.exe"	notepad.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windows\\system32\\Windupdt\\winupdate.exe"	notepad.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windows\\system32\\Windupdt\\winupdate.exe"	winupdate.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windows\\system32\\Windupdt\\winupdate.exe"	winupdate.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windows\\system32\\Windupdt\\winupdate.exe"	winupdate.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windows\\system32\\Windupdt\\winupdate.exe"	winupdate.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service
T1102

Processes:

flow ioc

264 raw.githubusercontent.com
265 raw.githubusercontent.com
266 raw.githubusercontent.com

flow	ioc
264	raw.githubusercontent.com
265	raw.githubusercontent.com
266	raw.githubusercontent.com

Drops file in System32 directory 64 IoCs

Processes:

notepad.exeattrib.exeattrib.exewinupdate.exewinupdate.exewinupdate.exeattrib.exeattrib.exeattrib.exeBlackkomet.exeattrib.exewinupdate.exenotepad.exewinupdate.exenotepad.exenotepad.exeattrib.exewinupdate.exeattrib.exeattrib.exeattrib.exewinupdate.exeattrib.exenotepad.exewinupdate.exenotepad.exewinupdate.exenotepad.exenotepad.exeattrib.exeattrib.exewinupdate.exenotepad.exeattrib.exewinupdate.exenotepad.exeattrib.exewinupdate.exenotepad.exewinupdate.exenotepad.exeattrib.exewinupdate.exewinupdate.exewinupdate.exeattrib.exeattrib.exewinupdate.exeattrib.exeattrib.exeattrib.exe

description	ioc	process
File created	C:\Windows\SysWOW64\Windupdt\winupdate.exe	notepad.exe
File opened for modification	C:\Windows\SysWOW64\Windupdt	attrib.exe
File opened for modification	C:\Windows\SysWOW64\Windupdt\winupdate.exe	attrib.exe
File created	C:\Windows\SysWOW64\Windupdt\winupdate.exe	winupdate.exe
File created	C:\Windows\SysWOW64\Windupdt\winupdate.exe	winupdate.exe
File opened for modification	C:\Windows\SysWOW64\Windupdt\	winupdate.exe
File opened for modification	C:\Windows\SysWOW64\Windupdt\	winupdate.exe
File opened for modification	C:\Windows\SysWOW64\Windupdt	attrib.exe
File opened for modification	C:\Windows\SysWOW64\Windupdt\winupdate.exe	attrib.exe
File opened for modification	C:\Windows\SysWOW64\Windupdt	attrib.exe
File created	C:\Windows\SysWOW64\Windupdt\winupdate.exe:SmartScreen:$DATA	Blackkomet.exe
File opened for modification	C:\Windows\SysWOW64\Windupdt\winupdate.exe	attrib.exe
File opened for modification	C:\Windows\SysWOW64\Windupdt\winupdate.exe	winupdate.exe
File created	C:\Windows\SysWOW64\Windupdt\winupdate.exe	notepad.exe
File created	C:\Windows\SysWOW64\Windupdt\winupdate.exe	winupdate.exe
File created	C:\Windows\SysWOW64\Windupdt\winupdate.exe	notepad.exe
File created	C:\Windows\SysWOW64\Windupdt\winupdate.exe	notepad.exe
File opened for modification	C:\Windows\SysWOW64\Windupdt\winupdate.exe	attrib.exe
File created	C:\Windows\SysWOW64\Windupdt\winupdate.exe	winupdate.exe
File opened for modification	C:\Windows\SysWOW64\Windupdt\winupdate.exe	attrib.exe
File opened for modification	C:\Windows\SysWOW64\Windupdt	attrib.exe
File opened for modification	C:\Windows\SysWOW64\Windupdt	attrib.exe
File opened for modification	C:\Windows\SysWOW64\Windupdt\	winupdate.exe
File opened for modification	C:\Windows\SysWOW64\Windupdt\winupdate.exe	attrib.exe
File created	C:\Windows\SysWOW64\Windupdt\winupdate.exe	notepad.exe
File created	C:\Windows\SysWOW64\Windupdt\winupdate.exe	winupdate.exe
File opened for modification	C:\Windows\SysWOW64\Windupdt\winupdate.exe	winupdate.exe
File created	C:\Windows\SysWOW64\Windupdt\winupdate.exe	notepad.exe
File opened for modification	C:\Windows\SysWOW64\Windupdt\winupdate.exe	winupdate.exe
File opened for modification	C:\Windows\SysWOW64\Windupdt\	winupdate.exe
File created	C:\Windows\SysWOW64\Windupdt\winupdate.exe	notepad.exe
File created	C:\Windows\SysWOW64\Windupdt\winupdate.exe	notepad.exe
File opened for modification	C:\Windows\SysWOW64\Windupdt\winupdate.exe	attrib.exe
File opened for modification	C:\Windows\SysWOW64\Windupdt\winupdate.exe	winupdate.exe
File opened for modification	C:\Windows\SysWOW64\Windupdt	attrib.exe
File created	C:\Windows\SysWOW64\Windupdt\winupdate.exe	winupdate.exe
File opened for modification	C:\Windows\SysWOW64\Windupdt\winupdate.exe	winupdate.exe
File created	C:\Windows\SysWOW64\Windupdt\winupdate.exe	notepad.exe
File opened for modification	C:\Windows\SysWOW64\Windupdt\winupdate.exe	attrib.exe
File created	C:\Windows\SysWOW64\Windupdt\winupdate.exe	winupdate.exe
File created	C:\Windows\SysWOW64\Windupdt\winupdate.exe	winupdate.exe
File created	C:\Windows\SysWOW64\Windupdt\winupdate.exe	notepad.exe
File opened for modification	C:\Windows\SysWOW64\Windupdt\	winupdate.exe
File opened for modification	C:\Windows\SysWOW64\Windupdt\	Blackkomet.exe
File opened for modification	C:\Windows\SysWOW64\Windupdt\winupdate.exe	attrib.exe
File created	C:\Windows\SysWOW64\Windupdt\winupdate.exe	winupdate.exe
File created	C:\Windows\SysWOW64\Windupdt\winupdate.exe	notepad.exe
File created	C:\Windows\SysWOW64\Windupdt\winupdate.exe	winupdate.exe
File created	C:\Windows\SysWOW64\Windupdt\winupdate.exe	notepad.exe
File opened for modification	C:\Windows\SysWOW64\Windupdt	attrib.exe
File opened for modification	C:\Windows\SysWOW64\Windupdt\winupdate.exe	winupdate.exe
File created	C:\Windows\SysWOW64\Windupdt\winupdate.exe	winupdate.exe
File opened for modification	C:\Windows\SysWOW64\Windupdt\	winupdate.exe
File created	C:\Windows\SysWOW64\Windupdt\winupdate.exe	Blackkomet.exe
File opened for modification	C:\Windows\SysWOW64\Windupdt\winupdate.exe	winupdate.exe
File opened for modification	C:\Windows\SysWOW64\Windupdt	attrib.exe
File opened for modification	C:\Windows\SysWOW64\Windupdt	attrib.exe
File opened for modification	C:\Windows\SysWOW64\Windupdt\winupdate.exe	winupdate.exe
File created	C:\Windows\SysWOW64\Windupdt\winupdate.exe	winupdate.exe
File opened for modification	C:\Windows\SysWOW64\Windupdt	attrib.exe
File opened for modification	C:\Windows\SysWOW64\Windupdt\winupdate.exe	attrib.exe
File opened for modification	C:\Windows\SysWOW64\Windupdt\winupdate.exe	winupdate.exe
File opened for modification	C:\Windows\SysWOW64\Windupdt	attrib.exe
File opened for modification	C:\Windows\SysWOW64\Windupdt\	winupdate.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 11 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exe

pid	pid_target	process	target process
5964	5732	WerFault.exe	notepad.exe
7152	6856	WerFault.exe	notepad.exe
7404	6432	WerFault.exe	notepad.exe
2476	4600	WerFault.exe	notepad.exe
11484	7796	WerFault.exe	notepad.exe
13144	12972	WerFault.exe	notepad.exe
14184	14028	WerFault.exe	notepad.exe
10080	14280	WerFault.exe	notepad.exe
4040	13588	WerFault.exe	notepad.exe
14464	10520	WerFault.exe	notepad.exe
14660	10324		notepad.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exemsedge.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies registry class 25 IoCs

Processes:

winupdate.exewinupdate.exewinupdate.exewinupdate.exewinupdate.exewinupdate.exewinupdate.exewinupdate.exewinupdate.exewinupdate.exeBlackkomet.exewinupdate.exewinupdate.exemsedge.exemsedge.exewinupdate.exewinupdate.exewinupdate.exewinupdate.exewinupdate.exewinupdate.exewinupdate.exewinupdate.exewinupdate.exewinupdate.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	winupdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	winupdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	winupdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	winupdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	winupdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	winupdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	winupdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	winupdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	winupdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	winupdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	Blackkomet.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	winupdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	winupdate.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2804150937-2146708401-419095071-1000\{562404A0-02E5-4947-892D-2476D7714FA3}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2804150937-2146708401-419095071-1000\{244DC81B-5227-4558-A715-DDE8D8F57826}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	winupdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	winupdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	winupdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	winupdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	winupdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	winupdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	winupdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	winupdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	winupdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	winupdate.exe

NTFS ADS 3 IoCs

Processes:

msedge.exe

description	ioc	process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 179472.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 996703.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 502862.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 26 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exemsedge.exemsedge.exeidentity_helper.exemsedge.exemsedge.exemsedge.exemsedge.exemsedge.exe

pid	process
4428	msedge.exe
4428	msedge.exe
4976	msedge.exe
4976	msedge.exe
2948	identity_helper.exe
2948	identity_helper.exe
5400	msedge.exe
5400	msedge.exe
912	msedge.exe
912	msedge.exe
1556	msedge.exe
1556	msedge.exe
1484	identity_helper.exe
1484	identity_helper.exe
3840	msedge.exe
3840	msedge.exe
5568	msedge.exe
5568	msedge.exe
2700	msedge.exe
2700	msedge.exe
2800	msedge.exe
2800	msedge.exe
5208	msedge.exe
5208	msedge.exe
5208	msedge.exe
5208	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 37 IoCs

Processes:

msedge.exemsedge.exe

pid	process
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

Blackkomet.exewinupdate.exewinupdate.exe

description	pid	process
Token: SeIncreaseQuotaPrivilege	5532	Blackkomet.exe
Token: SeSecurityPrivilege	5532	Blackkomet.exe
Token: SeTakeOwnershipPrivilege	5532	Blackkomet.exe
Token: SeLoadDriverPrivilege	5532	Blackkomet.exe
Token: SeSystemProfilePrivilege	5532	Blackkomet.exe
Token: SeSystemtimePrivilege	5532	Blackkomet.exe
Token: SeProfSingleProcessPrivilege	5532	Blackkomet.exe
Token: SeIncBasePriorityPrivilege	5532	Blackkomet.exe
Token: SeCreatePagefilePrivilege	5532	Blackkomet.exe
Token: SeBackupPrivilege	5532	Blackkomet.exe
Token: SeRestorePrivilege	5532	Blackkomet.exe
Token: SeShutdownPrivilege	5532	Blackkomet.exe
Token: SeDebugPrivilege	5532	Blackkomet.exe
Token: SeSystemEnvironmentPrivilege	5532	Blackkomet.exe
Token: SeChangeNotifyPrivilege	5532	Blackkomet.exe
Token: SeRemoteShutdownPrivilege	5532	Blackkomet.exe
Token: SeUndockPrivilege	5532	Blackkomet.exe
Token: SeManageVolumePrivilege	5532	Blackkomet.exe
Token: SeImpersonatePrivilege	5532	Blackkomet.exe
Token: SeCreateGlobalPrivilege	5532	Blackkomet.exe
Token: 33	5532	Blackkomet.exe
Token: 34	5532	Blackkomet.exe
Token: 35	5532	Blackkomet.exe
Token: 36	5532	Blackkomet.exe
Token: SeIncreaseQuotaPrivilege	2060	winupdate.exe
Token: SeSecurityPrivilege	2060	winupdate.exe
Token: SeTakeOwnershipPrivilege	2060	winupdate.exe
Token: SeLoadDriverPrivilege	2060	winupdate.exe
Token: SeSystemProfilePrivilege	2060	winupdate.exe
Token: SeSystemtimePrivilege	2060	winupdate.exe
Token: SeProfSingleProcessPrivilege	2060	winupdate.exe
Token: SeIncBasePriorityPrivilege	2060	winupdate.exe
Token: SeCreatePagefilePrivilege	2060	winupdate.exe
Token: SeBackupPrivilege	2060	winupdate.exe
Token: SeRestorePrivilege	2060	winupdate.exe
Token: SeShutdownPrivilege	2060	winupdate.exe
Token: SeDebugPrivilege	2060	winupdate.exe
Token: SeSystemEnvironmentPrivilege	2060	winupdate.exe
Token: SeChangeNotifyPrivilege	2060	winupdate.exe
Token: SeRemoteShutdownPrivilege	2060	winupdate.exe
Token: SeUndockPrivilege	2060	winupdate.exe
Token: SeManageVolumePrivilege	2060	winupdate.exe
Token: SeImpersonatePrivilege	2060	winupdate.exe
Token: SeCreateGlobalPrivilege	2060	winupdate.exe
Token: 33	2060	winupdate.exe
Token: 34	2060	winupdate.exe
Token: 35	2060	winupdate.exe
Token: 36	2060	winupdate.exe
Token: SeIncreaseQuotaPrivilege	228	winupdate.exe
Token: SeSecurityPrivilege	228	winupdate.exe
Token: SeTakeOwnershipPrivilege	228	winupdate.exe
Token: SeLoadDriverPrivilege	228	winupdate.exe
Token: SeSystemProfilePrivilege	228	winupdate.exe
Token: SeSystemtimePrivilege	228	winupdate.exe
Token: SeProfSingleProcessPrivilege	228	winupdate.exe
Token: SeIncBasePriorityPrivilege	228	winupdate.exe
Token: SeCreatePagefilePrivilege	228	winupdate.exe
Token: SeBackupPrivilege	228	winupdate.exe
Token: SeRestorePrivilege	228	winupdate.exe
Token: SeShutdownPrivilege	228	winupdate.exe
Token: SeDebugPrivilege	228	winupdate.exe
Token: SeSystemEnvironmentPrivilege	228	winupdate.exe
Token: SeChangeNotifyPrivilege	228	winupdate.exe
Token: SeRemoteShutdownPrivilege	228	winupdate.exe

Suspicious use of FindShellTrayWindow 64 IoCs

Processes:

msedge.exemsedge.exe

pid	process
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe

Suspicious use of SendNotifyMessage 40 IoCs

Processes:

msedge.exemsedge.exe

pid	process
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
1556	msedge.exe
1556	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

msedge.exe

pid process

1556 msedge.exe

pid	process
1556	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 4976 wrote to memory of 684	4976	msedge.exe	msedge.exe
PID 4976 wrote to memory of 684	4976	msedge.exe	msedge.exe
PID 4976 wrote to memory of 1036	4976	msedge.exe	msedge.exe
PID 4976 wrote to memory of 1036	4976	msedge.exe	msedge.exe
PID 4976 wrote to memory of 1036	4976	msedge.exe	msedge.exe
PID 4976 wrote to memory of 1036	4976	msedge.exe	msedge.exe
PID 4976 wrote to memory of 1036	4976	msedge.exe	msedge.exe
PID 4976 wrote to memory of 1036	4976	msedge.exe	msedge.exe
PID 4976 wrote to memory of 1036	4976	msedge.exe	msedge.exe
PID 4976 wrote to memory of 1036	4976	msedge.exe	msedge.exe
PID 4976 wrote to memory of 1036	4976	msedge.exe	msedge.exe
PID 4976 wrote to memory of 1036	4976	msedge.exe	msedge.exe
PID 4976 wrote to memory of 1036	4976	msedge.exe	msedge.exe
PID 4976 wrote to memory of 1036	4976	msedge.exe	msedge.exe
PID 4976 wrote to memory of 1036	4976	msedge.exe	msedge.exe
PID 4976 wrote to memory of 1036	4976	msedge.exe	msedge.exe
PID 4976 wrote to memory of 1036	4976	msedge.exe	msedge.exe
PID 4976 wrote to memory of 1036	4976	msedge.exe	msedge.exe
PID 4976 wrote to memory of 1036	4976	msedge.exe	msedge.exe
PID 4976 wrote to memory of 1036	4976	msedge.exe	msedge.exe
PID 4976 wrote to memory of 1036	4976	msedge.exe	msedge.exe
PID 4976 wrote to memory of 1036	4976	msedge.exe	msedge.exe
PID 4976 wrote to memory of 1036	4976	msedge.exe	msedge.exe
PID 4976 wrote to memory of 1036	4976	msedge.exe	msedge.exe
PID 4976 wrote to memory of 1036	4976	msedge.exe	msedge.exe
PID 4976 wrote to memory of 1036	4976	msedge.exe	msedge.exe
PID 4976 wrote to memory of 1036	4976	msedge.exe	msedge.exe
PID 4976 wrote to memory of 1036	4976	msedge.exe	msedge.exe
PID 4976 wrote to memory of 1036	4976	msedge.exe	msedge.exe
PID 4976 wrote to memory of 1036	4976	msedge.exe	msedge.exe
PID 4976 wrote to memory of 1036	4976	msedge.exe	msedge.exe
PID 4976 wrote to memory of 1036	4976	msedge.exe	msedge.exe
PID 4976 wrote to memory of 1036	4976	msedge.exe	msedge.exe
PID 4976 wrote to memory of 1036	4976	msedge.exe	msedge.exe
PID 4976 wrote to memory of 1036	4976	msedge.exe	msedge.exe
PID 4976 wrote to memory of 1036	4976	msedge.exe	msedge.exe
PID 4976 wrote to memory of 1036	4976	msedge.exe	msedge.exe
PID 4976 wrote to memory of 1036	4976	msedge.exe	msedge.exe
PID 4976 wrote to memory of 1036	4976	msedge.exe	msedge.exe
PID 4976 wrote to memory of 1036	4976	msedge.exe	msedge.exe
PID 4976 wrote to memory of 1036	4976	msedge.exe	msedge.exe
PID 4976 wrote to memory of 1036	4976	msedge.exe	msedge.exe
PID 4976 wrote to memory of 4428	4976	msedge.exe	msedge.exe
PID 4976 wrote to memory of 4428	4976	msedge.exe	msedge.exe
PID 4976 wrote to memory of 804	4976	msedge.exe	msedge.exe
PID 4976 wrote to memory of 804	4976	msedge.exe	msedge.exe
PID 4976 wrote to memory of 804	4976	msedge.exe	msedge.exe
PID 4976 wrote to memory of 804	4976	msedge.exe	msedge.exe
PID 4976 wrote to memory of 804	4976	msedge.exe	msedge.exe
PID 4976 wrote to memory of 804	4976	msedge.exe	msedge.exe
PID 4976 wrote to memory of 804	4976	msedge.exe	msedge.exe
PID 4976 wrote to memory of 804	4976	msedge.exe	msedge.exe
PID 4976 wrote to memory of 804	4976	msedge.exe	msedge.exe
PID 4976 wrote to memory of 804	4976	msedge.exe	msedge.exe
PID 4976 wrote to memory of 804	4976	msedge.exe	msedge.exe
PID 4976 wrote to memory of 804	4976	msedge.exe	msedge.exe
PID 4976 wrote to memory of 804	4976	msedge.exe	msedge.exe
PID 4976 wrote to memory of 804	4976	msedge.exe	msedge.exe
PID 4976 wrote to memory of 804	4976	msedge.exe	msedge.exe
PID 4976 wrote to memory of 804	4976	msedge.exe	msedge.exe
PID 4976 wrote to memory of 804	4976	msedge.exe	msedge.exe
PID 4976 wrote to memory of 804	4976	msedge.exe	msedge.exe
PID 4976 wrote to memory of 804	4976	msedge.exe	msedge.exe
PID 4976 wrote to memory of 804	4976	msedge.exe	msedge.exe

Views/modifies file attributes 1 TTPs 64 IoCs

evasion

Hidden Files and Directories

T1564.001

Processes:

pid	process
4000	attrib.exe
13324	attrib.exe
6320	attrib.exe
3276	attrib.exe
10168	attrib.exe
10032	attrib.exe
12524	attrib.exe
13472	attrib.exe
4844	attrib.exe
7716	attrib.exe
9072	attrib.exe
7272	attrib.exe
7660	attrib.exe
8960	attrib.exe
10140	attrib.exe
12228	attrib.exe
2724	attrib.exe
5512	attrib.exe
6984	attrib.exe
7720	attrib.exe
10080	attrib.exe
9572	attrib.exe
3496	attrib.exe
12816	attrib.exe
13672	attrib.exe
3196	attrib.exe
3716	attrib.exe
6484	attrib.exe
3280	attrib.exe
5488	attrib.exe
4740	attrib.exe
12908	attrib.exe
13664	attrib.exe
5476	attrib.exe
1388	attrib.exe
6520	attrib.exe
13772	attrib.exe
10672	attrib.exe
14244	attrib.exe
6972	attrib.exe
7860	attrib.exe
9340	attrib.exe
4176	attrib.exe
3068	attrib.exe
12408	attrib.exe
8616	attrib.exe
9332	attrib.exe
10644	attrib.exe
6932	attrib.exe
13044	attrib.exe
7448	attrib.exe
4456	attrib.exe
4716	attrib.exe
6516	attrib.exe
8	attrib.exe
8796	attrib.exe
10856	attrib.exe
13564	attrib.exe
8180	attrib.exe
3212	attrib.exe
5096	attrib.exe
6896	attrib.exe
13088	attrib.exe
12900	attrib.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://youareanidiot.cc/
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc761446f8,0x7ffc76144708,0x7ffc76144718
  2⤵
  PID:684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,6064654234964581129,1631358165431734118,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2080 /prefetch:2
  2⤵
  PID:1036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2064,6064654234964581129,1631358165431734118,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2164 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2064,6064654234964581129,1631358165431734118,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2848 /prefetch:8
  2⤵
  PID:804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,6064654234964581129,1631358165431734118,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:3016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,6064654234964581129,1631358165431734118,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3424 /prefetch:1
  2⤵
  PID:2452
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2064,6064654234964581129,1631358165431734118,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5128 /prefetch:8
  2⤵
  PID:544
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2064,6064654234964581129,1631358165431734118,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5128 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,6064654234964581129,1631358165431734118,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5348 /prefetch:1
  2⤵
  PID:1592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,6064654234964581129,1631358165431734118,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5220 /prefetch:1
  2⤵
  PID:3112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,6064654234964581129,1631358165431734118,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4640 /prefetch:1
  2⤵
  PID:656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,6064654234964581129,1631358165431734118,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3508 /prefetch:1
  2⤵
  PID:4304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,6064654234964581129,1631358165431734118,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3488 /prefetch:1
  2⤵
  PID:4264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,6064654234964581129,1631358165431734118,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3456 /prefetch:1
  2⤵
  PID:3500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,6064654234964581129,1631358165431734118,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5864 /prefetch:1
  2⤵
  PID:4076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,6064654234964581129,1631358165431734118,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5764 /prefetch:1
  2⤵
  PID:4248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,6064654234964581129,1631358165431734118,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3404 /prefetch:1
  2⤵
  PID:680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2064,6064654234964581129,1631358165431734118,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5680 /prefetch:8
  2⤵
  PID:5392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2064,6064654234964581129,1631358165431734118,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5636 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:5400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,6064654234964581129,1631358165431734118,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3364 /prefetch:1
  2⤵
  PID:5568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,6064654234964581129,1631358165431734118,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6084 /prefetch:1
  2⤵
  PID:5684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,6064654234964581129,1631358165431734118,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5580 /prefetch:1
  2⤵
  PID:5696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,6064654234964581129,1631358165431734118,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5724 /prefetch:1
  2⤵
  PID:2700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,6064654234964581129,1631358165431734118,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1292 /prefetch:1
  2⤵
  PID:5488

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2948

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2980

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:1556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffc761446f8,0x7ffc76144708,0x7ffc76144718
  2⤵
  PID:5504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,4546383001505481410,2451785860940713047,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1972 /prefetch:2
  2⤵
  PID:2880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2072,4546383001505481410,2451785860940713047,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2152 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2072,4546383001505481410,2451785860940713047,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2792 /prefetch:8
  2⤵
  PID:4388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,4546383001505481410,2451785860940713047,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3608 /prefetch:1
  2⤵
  PID:4600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,4546383001505481410,2451785860940713047,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3620 /prefetch:1
  2⤵
  PID:6008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,4546383001505481410,2451785860940713047,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3208 /prefetch:1
  2⤵
  PID:5720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,4546383001505481410,2451785860940713047,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2676 /prefetch:1
  2⤵
  PID:6040
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2072,4546383001505481410,2451785860940713047,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5336 /prefetch:8
  2⤵
  PID:2964
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2072,4546383001505481410,2451785860940713047,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5336 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,4546383001505481410,2451785860940713047,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5584 /prefetch:1
  2⤵
  PID:4508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2072,4546383001505481410,2451785860940713047,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=3684 /prefetch:8
  2⤵
  PID:5268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2072,4546383001505481410,2451785860940713047,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=3740 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:3840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,4546383001505481410,2451785860940713047,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5108 /prefetch:1
  2⤵
  PID:1616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,4546383001505481410,2451785860940713047,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5692 /prefetch:1
  2⤵
  PID:2060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,4546383001505481410,2451785860940713047,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2260 /prefetch:1
  2⤵
  PID:5276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,4546383001505481410,2451785860940713047,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1768 /prefetch:1
  2⤵
  PID:1472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,4546383001505481410,2451785860940713047,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5468 /prefetch:1
  2⤵
  PID:3668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,4546383001505481410,2451785860940713047,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4972 /prefetch:1
  2⤵
  PID:2884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,4546383001505481410,2451785860940713047,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4744 /prefetch:1
  2⤵
  PID:3544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,4546383001505481410,2451785860940713047,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1876 /prefetch:1
  2⤵
  PID:5908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,4546383001505481410,2451785860940713047,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5572 /prefetch:1
  2⤵
  PID:5008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,4546383001505481410,2451785860940713047,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5876 /prefetch:1
  2⤵
  PID:1252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,4546383001505481410,2451785860940713047,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6832 /prefetch:1
  2⤵
  PID:1028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,4546383001505481410,2451785860940713047,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5208 /prefetch:1
  2⤵
  PID:348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,4546383001505481410,2451785860940713047,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6020 /prefetch:1
  2⤵
  PID:2384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2072,4546383001505481410,2451785860940713047,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5736 /prefetch:8
  2⤵
  PID:5224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,4546383001505481410,2451785860940713047,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7028 /prefetch:1
  2⤵
  PID:4044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2072,4546383001505481410,2451785860940713047,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=3476 /prefetch:8
  2⤵
  PID:2212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2072,4546383001505481410,2451785860940713047,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6744 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5568
- C:\Users\Admin\Downloads\CrimsonRAT.exe
  "C:\Users\Admin\Downloads\CrimsonRAT.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  PID:3612
- - C:\ProgramData\Hdlharas\dlrarhsiva.exe
    "C:\ProgramData\Hdlharas\dlrarhsiva.exe"
    3⤵
    - Executes dropped EXE
    PID:4932
- C:\Users\Admin\Downloads\CrimsonRAT.exe
  "C:\Users\Admin\Downloads\CrimsonRAT.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  PID:5356
- - C:\ProgramData\Hdlharas\dlrarhsiva.exe
    "C:\ProgramData\Hdlharas\dlrarhsiva.exe"
    3⤵
    - Executes dropped EXE
    PID:1160
- C:\Users\Admin\Downloads\CrimsonRAT.exe
  "C:\Users\Admin\Downloads\CrimsonRAT.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  PID:5964
- - C:\ProgramData\Hdlharas\dlrarhsiva.exe
    "C:\ProgramData\Hdlharas\dlrarhsiva.exe"
    3⤵
    - Executes dropped EXE
    PID:1116
- C:\Users\Admin\Downloads\CrimsonRAT.exe
  "C:\Users\Admin\Downloads\CrimsonRAT.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  PID:1120
- - C:\ProgramData\Hdlharas\dlrarhsiva.exe
    "C:\ProgramData\Hdlharas\dlrarhsiva.exe"
    3⤵
    - Executes dropped EXE
    PID:5548
- C:\Users\Admin\Downloads\CrimsonRAT.exe
  "C:\Users\Admin\Downloads\CrimsonRAT.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  PID:1680
- - C:\ProgramData\Hdlharas\dlrarhsiva.exe
    "C:\ProgramData\Hdlharas\dlrarhsiva.exe"
    3⤵
    - Executes dropped EXE
    PID:5440
- C:\Users\Admin\Downloads\CrimsonRAT.exe
  "C:\Users\Admin\Downloads\CrimsonRAT.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  PID:4204
- - C:\ProgramData\Hdlharas\dlrarhsiva.exe
    "C:\ProgramData\Hdlharas\dlrarhsiva.exe"
    3⤵
    - Executes dropped EXE
    PID:3980
- C:\Users\Admin\Downloads\CrimsonRAT.exe
  "C:\Users\Admin\Downloads\CrimsonRAT.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  PID:2392
- - C:\ProgramData\Hdlharas\dlrarhsiva.exe
    "C:\ProgramData\Hdlharas\dlrarhsiva.exe"
    3⤵
    - Executes dropped EXE
    PID:6080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,4546383001505481410,2451785860940713047,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5148 /prefetch:1
  2⤵
  PID:2232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2072,4546383001505481410,2451785860940713047,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=2196 /prefetch:8
  2⤵
  PID:5724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,4546383001505481410,2451785860940713047,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6416 /prefetch:1
  2⤵
  PID:1956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2072,4546383001505481410,2451785860940713047,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=1768 /prefetch:8
  2⤵
  PID:4912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2072,4546383001505481410,2451785860940713047,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3172 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2700
- C:\Users\Admin\Downloads\Blackkomet.exe
  "C:\Users\Admin\Downloads\Blackkomet.exe"
  2⤵
  - Modifies WinLogon for persistence
  - Checks computer location settings
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in System32 directory
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  PID:5532
- - C:\Windows\SysWOW64\notepad.exe
    notepad
    3⤵
    - Adds Run key to start application
    - Drops file in System32 directory
    PID:1028
- - C:\Windows\SysWOW64\attrib.exe
    attrib "C:\Users\Admin\Downloads\Blackkomet.exe" +s +h
    3⤵
    PID:1300
- - C:\Windows\SysWOW64\attrib.exe
    attrib "C:\Users\Admin\Downloads" +s +h
    3⤵
    - Sets file to hidden
    PID:6068
- - C:\Windows\SysWOW64\Windupdt\winupdate.exe
    "C:\Windows\system32\Windupdt\winupdate.exe"
    3⤵
    - Modifies WinLogon for persistence
    - Checks computer location settings
    - Executes dropped EXE
    - Adds Run key to start application
    - Drops file in System32 directory
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    PID:2060
  - - C:\Windows\SysWOW64\notepad.exe
      notepad
      4⤵
      Adds Run key to start application
      PID:5736
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
      4⤵
      PID:448
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\Windows\SysWOW64\Windupdt" +s +h
      4⤵
      Drops file in System32 directory
      PID:784
  - - C:\Windows\SysWOW64\Windupdt\winupdate.exe
      "C:\Windows\system32\Windupdt\winupdate.exe"
      4⤵
      Modifies WinLogon for persistence
      Checks computer location settings
      Executes dropped EXE
      Adds Run key to start application
      Drops file in System32 directory
      Modifies registry class
      Suspicious use of AdjustPrivilegeToken
      PID:228
    - - C:\Windows\SysWOW64\notepad.exe
        
        notepad
        5⤵
        Adds Run key to start application
        Drops file in System32 directory
        
        PID:1596
    - - C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        5⤵
        Drops file in System32 directory
        
        PID:5680
    - - C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        5⤵
        Drops file in System32 directory
        
        PID:4420
    - - C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        5⤵
        Modifies WinLogon for persistence
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        Modifies registry class
        
        PID:2148
      - C:\Windows\SysWOW64\notepad.exe
        
        notepad
        6⤵
        Adds Run key to start application
        Drops file in System32 directory
        
        PID:3832
      - C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        6⤵
        Sets file to hidden
        
        PID:5956
      - C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        6⤵
        Sets file to hidden
        
        PID:1756
      - C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        6⤵
        Modifies WinLogon for persistence
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        Modifies registry class
        
        PID:5216
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        7⤵
        Adds Run key to start application
        
        PID:5112
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        7⤵
        Sets file to hidden
        Drops file in System32 directory
        
        PID:1616
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        7⤵
        Sets file to hidden
        Drops file in System32 directory
        
        PID:2212
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        7⤵
        Modifies WinLogon for persistence
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        Modifies registry class
        
        PID:4512
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        8⤵
        Adds Run key to start application
        Drops file in System32 directory
        
        PID:3892
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        8⤵
        Drops file in System32 directory
        
        PID:3596
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        8⤵
        Drops file in System32 directory
        Views/modifies file attributes
        
        PID:5476
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        8⤵
        Modifies WinLogon for persistence
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        Modifies registry class
        
        PID:4208
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        9⤵
        Adds Run key to start application
        
        PID:4268
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        9⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:1388
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        9⤵
        Drops file in System32 directory
        
        PID:6068
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        9⤵
        Modifies WinLogon for persistence
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        Modifies registry class
        
        PID:1976
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        10⤵
        Adds Run key to start application
        
        PID:5012
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        10⤵
        Drops file in System32 directory
        
        PID:5856
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        10⤵
        
        PID:3460
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        10⤵
        Modifies WinLogon for persistence
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        Modifies registry class
        
        PID:4196
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        11⤵
        Adds Run key to start application
        
        PID:4132
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        11⤵
        Sets file to hidden
        
        PID:2520
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        11⤵
        
        PID:3904
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        11⤵
        Modifies WinLogon for persistence
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        Modifies registry class
        
        PID:6116
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        12⤵
        Adds Run key to start application
        
        PID:4348
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        12⤵
        Drops file in System32 directory
        
        PID:4180
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        12⤵
        
        PID:1816
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        12⤵
        Modifies WinLogon for persistence
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        Modifies registry class
        
        PID:3016
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        13⤵
        Adds Run key to start application
        Drops file in System32 directory
        
        PID:560
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        13⤵
        Drops file in System32 directory
        
        PID:180
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        13⤵
        Views/modifies file attributes
        
        PID:2724
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        13⤵
        Modifies WinLogon for persistence
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        Modifies registry class
        
        PID:3644
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        14⤵
        Adds Run key to start application
        
        PID:1968
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        14⤵
        Drops file in System32 directory
        
        PID:2964
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        14⤵
        Drops file in System32 directory
        
        PID:1756
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        14⤵
        Modifies WinLogon for persistence
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        Modifies registry class
        
        PID:5828
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        15⤵
        Adds Run key to start application
        
        PID:3036
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        15⤵
        Drops file in System32 directory
        Views/modifies file attributes
        
        PID:3196
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        15⤵
        Drops file in System32 directory
        
        PID:4804
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        15⤵
        Modifies WinLogon for persistence
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        Modifies registry class
        
        PID:5304
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        16⤵
        Adds Run key to start application
        Drops file in System32 directory
        
        PID:5712
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        16⤵
        
        PID:784
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        16⤵
        
        PID:5192
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        16⤵
        Modifies WinLogon for persistence
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        Modifies registry class
        
        PID:3016
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        17⤵
        Adds Run key to start application
        
        PID:2452
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        17⤵
        
        PID:4016
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        17⤵
        
        PID:3328
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        17⤵
        Modifies WinLogon for persistence
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        Modifies registry class
        
        PID:2884
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        18⤵
        Adds Run key to start application
        Drops file in System32 directory
        
        PID:2680
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        18⤵
        Views/modifies file attributes
        
        PID:3716
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        18⤵
        Drops file in System32 directory
        
        PID:5828
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        18⤵
        Modifies WinLogon for persistence
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        Modifies registry class
        
        PID:5624
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        19⤵
        Adds Run key to start application
        Drops file in System32 directory
        
        PID:4512
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        19⤵
        Sets file to hidden
        
        PID:4196
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        19⤵
        
        PID:6008
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        19⤵
        Modifies WinLogon for persistence
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        Modifies registry class
        
        PID:2724
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        20⤵
        Adds Run key to start application
        
        PID:1384
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        20⤵
        
        PID:6072
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        20⤵
        
        PID:6116
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        20⤵
        Modifies WinLogon for persistence
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        Modifies registry class
        
        PID:1816
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        21⤵
        Adds Run key to start application
        Drops file in System32 directory
        
        PID:1680
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        21⤵
        Sets file to hidden
        Drops file in System32 directory
        
        PID:4588
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        22⤵
        
        PID:6008
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        21⤵
        
        PID:5732
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        21⤵
        Modifies WinLogon for persistence
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        Modifies registry class
        
        PID:4904
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        22⤵
        Adds Run key to start application
        Drops file in System32 directory
        
        PID:3644
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        22⤵
        Views/modifies file attributes
        
        PID:5512
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        23⤵
        
        PID:5192
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        22⤵
        
        PID:2724
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        23⤵
        
        PID:1816
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        22⤵
        Modifies WinLogon for persistence
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        Modifies registry class
        
        PID:6220
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        23⤵
        Adds Run key to start application
        Drops file in System32 directory
        
        PID:6268
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        23⤵
        
        PID:6288
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        23⤵
        Drops file in System32 directory
        
        PID:6296
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        23⤵
        Modifies WinLogon for persistence
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        Modifies registry class
        
        PID:6480
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        24⤵
        Adds Run key to start application
        Drops file in System32 directory
        
        PID:6540
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        24⤵
        
        PID:6556
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        24⤵
        Sets file to hidden
        Drops file in System32 directory
        
        PID:6564
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        24⤵
        Modifies WinLogon for persistence
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        Modifies registry class
        
        PID:6696
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        25⤵
        Adds Run key to start application
        
        PID:6748
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        25⤵
        Drops file in System32 directory
        
        PID:6764
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        25⤵
        Drops file in System32 directory
        
        PID:6772
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        25⤵
        Executes dropped EXE
        
        PID:6904
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        26⤵
        
        PID:6956
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        26⤵
        Views/modifies file attributes
        
        PID:6972
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        26⤵
        
        PID:6980
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        26⤵
        
        PID:7112
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        27⤵
        
        PID:7164
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        27⤵
        Views/modifies file attributes
        
        PID:4844
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        27⤵
        
        PID:6212
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        27⤵
        
        PID:6292
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        28⤵
        
        PID:6296
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        28⤵
        Views/modifies file attributes
        
        PID:6320
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        28⤵
        Sets file to hidden
        
        PID:6432
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        28⤵
        
        PID:6564
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        29⤵
        
        PID:6604
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        29⤵
        Views/modifies file attributes
        
        PID:6520
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        29⤵
        Views/modifies file attributes
        
        PID:6484
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        29⤵
        
        PID:6852
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        30⤵
        
        PID:6972
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        30⤵
        Views/modifies file attributes
        
        PID:6984
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        30⤵
        Sets file to hidden
        
        PID:7084
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        30⤵
        
        PID:6152
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        31⤵
        
        PID:7144
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        31⤵
        Sets file to hidden
        
        PID:6224
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        31⤵
        
        PID:6436
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        31⤵
        
        PID:6636
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        32⤵
        
        PID:6812
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        32⤵
        Views/modifies file attributes
        
        PID:6516
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        32⤵
        
        PID:6628
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        32⤵
        
        PID:6984
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        33⤵
        
        PID:6212
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        33⤵
        
        PID:2964
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        33⤵
        
        PID:6568
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        33⤵
        
        PID:6220
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        34⤵
        
        PID:7040
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        34⤵
        
        PID:7060
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        34⤵
        
        PID:4844
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        35⤵
        
        PID:6564
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        34⤵
        
        PID:6504
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        35⤵
        
        PID:7136
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        35⤵
        
        PID:6848
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        35⤵
        
        PID:6428
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        35⤵
        
        PID:6252
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        36⤵
        
        PID:7064
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        36⤵
        
        PID:5512
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        36⤵
        
        PID:6316
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        36⤵
        
        PID:6316
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        37⤵
        
        PID:7068
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        37⤵
        Views/modifies file attributes
        
        PID:3276
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        37⤵
        
        PID:2856
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        37⤵
        
        PID:7196
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        38⤵
        
        PID:7248
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        38⤵
        
        PID:7264
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        38⤵
        Views/modifies file attributes
        
        PID:7272
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        38⤵
        
        PID:7420
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        39⤵
        
        PID:7468
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        39⤵
        
        PID:7488
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        39⤵
        
        PID:7496
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        39⤵
        
        PID:7684
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        40⤵
        
        PID:7732
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        40⤵
        Sets file to hidden
        
        PID:7748
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        40⤵
        
        PID:7756
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        40⤵
        
        PID:7892
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        41⤵
        
        PID:7952
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        41⤵
        
        PID:7968
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        41⤵
        
        PID:7976
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        41⤵
        
        PID:8104
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        42⤵
        
        PID:8164
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        42⤵
        Views/modifies file attributes
        
        PID:8180
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        42⤵
        Sets file to hidden
        
        PID:8188
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        42⤵
        
        PID:7236
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        43⤵
        
        PID:7364
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        43⤵
        
        PID:7276
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        43⤵
        Sets file to hidden
        
        PID:7400
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        43⤵
        
        PID:7660
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        44⤵
        
        PID:7488
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        44⤵
        
        PID:944
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        44⤵
        Views/modifies file attributes
        
        PID:8
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        44⤵
        
        PID:7424
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        45⤵
        
        PID:7888
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        45⤵
        
        PID:7748
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        45⤵
        Views/modifies file attributes
        
        PID:7860
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        45⤵
        
        PID:8044
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        46⤵
        
        PID:7924
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        46⤵
        
        PID:8016
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        46⤵
        
        PID:7916
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        46⤵
        
        PID:8148
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        47⤵
        
        PID:368
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        47⤵
        
        PID:7360
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        47⤵
        
        PID:7556
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        47⤵
        
        PID:5948
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        48⤵
        
        PID:944
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        48⤵
        Views/modifies file attributes
        
        PID:3280
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        48⤵
        
        PID:7676
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        48⤵
        
        PID:7860
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        49⤵
        
        PID:7996
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        49⤵
        
        PID:7784
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        49⤵
        
        PID:7320
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        49⤵
        
        PID:7180
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        50⤵
        
        PID:7220
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        50⤵
        
        PID:2444
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        50⤵
        Sets file to hidden
        
        PID:7440
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        50⤵
        
        PID:7824
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        51⤵
        
        PID:7708
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        51⤵
        
        PID:7828
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        51⤵
        Views/modifies file attributes
        
        PID:7660
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        51⤵
        
        PID:6792
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        52⤵
        
        PID:7860
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        52⤵
        
        PID:7356
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        52⤵
        
        PID:7360
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        52⤵
        
        PID:7684
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        53⤵
        
        PID:7916
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        53⤵
        
        PID:7828
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        53⤵
        
        PID:8012
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        53⤵
        
        PID:7288
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        54⤵
        
        PID:7292
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        54⤵
        
        PID:7404
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        54⤵
        
        PID:6792
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        54⤵
        
        PID:8016
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        55⤵
        
        PID:1000
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        55⤵
        Views/modifies file attributes
        
        PID:7716
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        55⤵
        
        PID:2012
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        55⤵
        
        PID:8260
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        56⤵
        
        PID:8308
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        56⤵
        
        PID:8324
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        56⤵
        
        PID:8332
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        56⤵
        
        PID:8468
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        57⤵
        
        PID:8520
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        57⤵
        Sets file to hidden
        
        PID:8536
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        57⤵
        
        PID:8544
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        57⤵
        
        PID:8676
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        58⤵
        
        PID:8728
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        58⤵
        
        PID:8744
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        58⤵
        
        PID:8752
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        58⤵
        
        PID:8884
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        59⤵
        
        PID:8936
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        59⤵
        Sets file to hidden
        
        PID:8952
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        59⤵
        Views/modifies file attributes
        
        PID:8960
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        59⤵
        
        PID:9204
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        60⤵
        
        PID:8044
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        60⤵
        
        PID:8208
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        60⤵
        Sets file to hidden
        
        PID:8220
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        60⤵
        
        PID:8432
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        61⤵
        
        PID:8288
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        61⤵
        
        PID:8412
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        61⤵
        
        PID:8416
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        61⤵
        
        PID:8824
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        62⤵
        
        PID:8820
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        62⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:8796
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        62⤵
        
        PID:8792
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        62⤵
        
        PID:9092
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        63⤵
        
        PID:8928
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        63⤵
        
        PID:9044
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        63⤵
        Sets file to hidden
        
        PID:7028
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        63⤵
        
        PID:6252
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        64⤵
        
        PID:8284
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        64⤵
        
        PID:8616
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        64⤵
        
        PID:8416
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        64⤵
        
        PID:9012
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        65⤵
        
        PID:8908
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        65⤵
        Sets file to hidden
        
        PID:4448
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        65⤵
        
        PID:8980
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        65⤵
        
        PID:8196
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        66⤵
        
        PID:8920
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        66⤵
        
        PID:7404
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        66⤵
        
        PID:8456
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        66⤵
        
        PID:9204
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        67⤵
        
        PID:9036
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        67⤵
        
        PID:9048
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        67⤵
        Sets file to hidden
        
        PID:8700
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        67⤵
        
        PID:8792
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        68⤵
        
        PID:8396
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        68⤵
        Views/modifies file attributes
        
        PID:3496
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        68⤵
        Sets file to hidden
        
        PID:804
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        68⤵
        
        PID:8980
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        69⤵
        
        PID:8756
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        69⤵
        Views/modifies file attributes
        
        PID:5488
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        69⤵
        Views/modifies file attributes
        
        PID:9072
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        69⤵
        
        PID:5560
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        70⤵
        
        PID:8240
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        70⤵
        Views/modifies file attributes
        
        PID:8616
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        70⤵
        
        PID:9048
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        70⤵
        
        PID:9420
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        71⤵
        
        PID:9472
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        71⤵
        
        PID:9488
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        71⤵
        
        PID:9496
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        71⤵
        
        PID:9632
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        72⤵
        
        PID:9684
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        72⤵
        
        PID:9700
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        72⤵
        
        PID:9708
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        72⤵
        
        PID:9840
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        73⤵
        
        PID:9888
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        73⤵
        
        PID:9904
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        73⤵
        
        PID:9912
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        73⤵
        
        PID:10100
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        74⤵
        
        PID:10156
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        74⤵
        
        PID:10172
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        74⤵
        
        PID:10180
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        74⤵
        
        PID:9388
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        75⤵
        
        PID:9336
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        75⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:9332
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        75⤵
        
        PID:9380
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        75⤵
        
        PID:9596
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        76⤵
        
        PID:9344
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        76⤵
        
        PID:9528
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        76⤵
        
        PID:9652
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        76⤵
        
        PID:9864
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        77⤵
        
        PID:10008
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        77⤵
        
        PID:10040
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        77⤵
        
        PID:9960
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        77⤵
        
        PID:8680
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        78⤵
        
        PID:10220
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        78⤵
        
        PID:10212
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        78⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:10140
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        78⤵
        
        PID:9728
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        79⤵
        
        PID:9784
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        79⤵
        
        PID:9780
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        79⤵
        
        PID:9760
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        79⤵
        
        PID:4484
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        80⤵
        
        PID:3248
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        80⤵
        Views/modifies file attributes
        
        PID:10168
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        80⤵
        
        PID:9952
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        80⤵
        
        PID:3728
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        81⤵
        
        PID:9620
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        81⤵
        
        PID:9600
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        81⤵
        Views/modifies file attributes
        
        PID:9340
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        81⤵
        
        PID:1040
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        82⤵
        
        PID:9416
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        82⤵
        
        PID:5908
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        82⤵
        
        PID:9452
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        82⤵
        
        PID:9536
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        83⤵
        
        PID:10124
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        83⤵
        
        PID:4740
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        83⤵
        
        PID:9840
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        83⤵
        
        PID:10184
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        84⤵
        
        PID:9632
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        84⤵
        
        PID:460
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        84⤵
        Sets file to hidden
        
        PID:5772
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        84⤵
        
        PID:2912
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        85⤵
        
        PID:10064
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        85⤵
        Sets file to hidden
        
        PID:10196
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        85⤵
        
        PID:2476
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        85⤵
        
        PID:1852
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        86⤵
        
        PID:1620
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        86⤵
        
        PID:1192
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        86⤵
        
        PID:4232
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        86⤵
        
        PID:9252
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        87⤵
        
        PID:9140
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        87⤵
        
        PID:6440
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        87⤵
        
        PID:9364
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        87⤵
        
        PID:9820
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        88⤵
        
        PID:6472
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        88⤵
        
        PID:5096
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        88⤵
        
        PID:5992
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        88⤵
        
        PID:5908
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        89⤵
        
        PID:540
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        89⤵
        Views/modifies file attributes
        
        PID:4740
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        89⤵
        
        PID:2204
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        89⤵
        
        PID:5608
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        90⤵
        
        PID:4812
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        90⤵
        Sets file to hidden
        
        PID:9364
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        90⤵
        
        PID:5264
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        90⤵
        
        PID:10392
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        91⤵
        
        PID:10440
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        91⤵
        
        PID:10456
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        91⤵
        
        PID:10464
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        91⤵
        
        PID:10604
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        92⤵
        
        PID:10656
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        92⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:10672
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        92⤵
        
        PID:10680
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        92⤵
        
        PID:10820
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        93⤵
        
        PID:10868
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        93⤵
        
        PID:10884
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        93⤵
        Sets file to hidden
        
        PID:10892
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        93⤵
        
        PID:11120
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        94⤵
        
        PID:11172
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        94⤵
        
        PID:11188
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        94⤵
        
        PID:11196
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        94⤵
        
        PID:9528
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        95⤵
        
        PID:10624
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        95⤵
        Views/modifies file attributes
        
        PID:10644
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        95⤵
        
        PID:10528
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        95⤵
        
        PID:10772
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        96⤵
        
        PID:10636
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        96⤵
        
        PID:10696
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        96⤵
        
        PID:10628
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        96⤵
        
        PID:11108
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        97⤵
        
        PID:11016
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        97⤵
        
        PID:11012
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        97⤵
        Sets file to hidden
        
        PID:10916
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        97⤵
        
        PID:10468
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        98⤵
        
        PID:10304
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        98⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:10032
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        98⤵
        
        PID:11228
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        98⤵
        
        PID:10944
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        99⤵
        
        PID:8444
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        99⤵
        Sets file to hidden
        
        PID:11096
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        99⤵
        
        PID:8540
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        99⤵
        
        PID:4436
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        100⤵
        
        PID:6336
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        100⤵
        
        PID:10696
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        100⤵
        
        PID:10300
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        100⤵
        
        PID:8460
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        101⤵
        
        PID:8540
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        101⤵
        Sets file to hidden
        
        PID:10684
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        101⤵
        
        PID:11104
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        101⤵
        
        PID:3416
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        102⤵
        
        PID:8512
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        102⤵
        
        PID:8404
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        102⤵
        
        PID:10776
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        102⤵
        
        PID:10436
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        103⤵
        
        PID:10788
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        103⤵
        
        PID:10032
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        103⤵
        
        PID:10696
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        103⤵
        
        PID:8764
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        104⤵
        
        PID:8428
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        104⤵
        Views/modifies file attributes
        
        PID:3212
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        104⤵
        
        PID:8460
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        104⤵
        
        PID:6976
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        105⤵
        
        PID:10436
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        105⤵
        
        PID:1284
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        105⤵
        
        PID:10468
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        105⤵
        
        PID:1980
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        106⤵
        
        PID:9200
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        106⤵
        
        PID:10572
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        106⤵
        
        PID:4544
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        106⤵
        
        PID:11276
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        107⤵
        
        PID:11336
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        107⤵
        
        PID:11352
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        107⤵
        
        PID:11360
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        107⤵
        
        PID:11736
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        108⤵
        
        PID:11788
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        108⤵
        
        PID:11804
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        108⤵
        
        PID:11812
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        108⤵
        
        PID:12104
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        109⤵
        
        PID:12156
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        109⤵
        
        PID:12172
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        109⤵
        
        PID:12180
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        109⤵
        
        PID:1284
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        110⤵
        
        PID:2772
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        110⤵
        
        PID:5884
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        110⤵
        
        PID:3800
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        110⤵
        
        PID:11556
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        111⤵
        
        PID:11636
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        111⤵
        
        PID:11652
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        111⤵
        
        PID:11660
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        111⤵
        
        PID:5660
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        112⤵
        
        PID:11876
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        112⤵
        
        PID:11956
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        112⤵
        
        PID:11836
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        112⤵
        
        PID:12052
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        113⤵
        
        PID:11784
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        113⤵
        
        PID:11904
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        113⤵
        
        PID:12084
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        113⤵
        
        PID:11908
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        114⤵
        
        PID:4600
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        114⤵
        
        PID:4584
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        114⤵
        Views/modifies file attributes
        
        PID:4000
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        114⤵
        
        PID:5636
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        115⤵
        
        PID:11276
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        115⤵
        
        PID:11756
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        115⤵
        Sets file to hidden
        
        PID:11720
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        115⤵
        
        PID:11836
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        116⤵
        
        PID:6076
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        116⤵
        
        PID:1636
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        116⤵
        Sets file to hidden
        
        PID:11956
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        116⤵
        
        PID:1480
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        117⤵
        
        PID:11908
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        117⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:4176
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        117⤵
        
        PID:4732
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        117⤵
        
        PID:11716
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        118⤵
        
        PID:6116
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        118⤵
        Views/modifies file attributes
        
        PID:12228
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        118⤵
        
        PID:6248
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        118⤵
        
        PID:11872
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        119⤵
        
        PID:6784
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        119⤵
        
        PID:4532
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        119⤵
        
        PID:10356
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        119⤵
        
        PID:5456
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        120⤵
        
        PID:6176
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        120⤵
        
        PID:3504
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        120⤵
        
        PID:6140
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        120⤵
        
        PID:1756
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        121⤵
        
        PID:7132
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        121⤵
        
        PID:6940
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        121⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:6932
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        121⤵
        
        PID:5348
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        122⤵
        
        PID:3504
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        122⤵
        
        PID:11604
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        122⤵
        
        PID:11716
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        122⤵
        
        PID:3068
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        123⤵
        
        PID:11528
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        123⤵
        Sets file to hidden
        
        PID:1756
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        123⤵
        
        PID:11672
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        123⤵
        
        PID:6220
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        124⤵
        
        PID:11076
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        124⤵
        Sets file to hidden
        
        PID:11044
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        124⤵
        
        PID:11052
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        124⤵
        
        PID:6192
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        125⤵
        
        PID:2060
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        125⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:3068
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        125⤵
        Sets file to hidden
        
        PID:11056
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        125⤵
        
        PID:11064
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        126⤵
        
        PID:7504
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        126⤵
        
        PID:7232
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        126⤵
        
        PID:11040
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        126⤵
        
        PID:11432
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        127⤵
        
        PID:11652
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        127⤵
        Views/modifies file attributes
        
        PID:6896
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        127⤵
        
        PID:8004
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        127⤵
        
        PID:6940
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        128⤵
        
        PID:6896
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        128⤵
        
        PID:12104
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        128⤵
        
        PID:5512
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        128⤵
        
        PID:11072
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        129⤵
        
        PID:7796
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7796 -s 132
        130⤵
        Program crash
        
        PID:11484
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        129⤵
        
        PID:11052
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        129⤵
        Views/modifies file attributes
        
        PID:7720
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        129⤵
        
        PID:12332
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        130⤵
        
        PID:12380
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        130⤵
        
        PID:12396
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        130⤵
        Views/modifies file attributes
        
        PID:12408
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        130⤵
        
        PID:12540
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        131⤵
        
        PID:12588
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        131⤵
        Sets file to hidden
        
        PID:12604
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        131⤵
        
        PID:12612
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        131⤵
        
        PID:12756
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        132⤵
        
        PID:12804
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        132⤵
        
        PID:12820
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        132⤵
        
        PID:12828
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        132⤵
        
        PID:12964
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        133⤵
        
        PID:13028
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        133⤵
        Views/modifies file attributes
        
        PID:13044
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        133⤵
        Sets file to hidden
        
        PID:13052
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        133⤵
        
        PID:13216
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        134⤵
        
        PID:13268
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        134⤵
        
        PID:13284
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        134⤵
        
        PID:13292
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        134⤵
        
        PID:11072
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        135⤵
        
        PID:12428
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        135⤵
        
        PID:6940
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        135⤵
        
        PID:6248
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        135⤵
        
        PID:12472
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        136⤵
        
        PID:12672
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        136⤵
        Sets file to hidden
        
        PID:12612
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        136⤵
        
        PID:12716
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        136⤵
        
        PID:12624
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        137⤵
        
        PID:12664
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        137⤵
        Sets file to hidden
        
        PID:12540
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        137⤵
        Views/modifies file attributes
        
        PID:12816
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        137⤵
        
        PID:12940
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        138⤵
        
        PID:13084
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        138⤵
        Sets file to hidden
        
        PID:7756
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        138⤵
        
        PID:13236
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        138⤵
        
        PID:13096
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        139⤵
        
        PID:12352
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        139⤵
        Sets file to hidden
        
        PID:13288
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        139⤵
        
        PID:12304
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        139⤵
        
        PID:6940
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        140⤵
        
        PID:1404
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        140⤵
        Sets file to hidden
        
        PID:12360
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        140⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:12524
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        140⤵
        
        PID:12708
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        141⤵
        
        PID:12640
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        141⤵
        Sets file to hidden
        
        PID:12616
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        141⤵
        
        PID:11412
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        141⤵
        
        PID:12896
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        142⤵
        
        PID:7500
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        142⤵
        
        PID:12992
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        142⤵
        
        PID:5412
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        142⤵
        
        PID:13012
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        143⤵
        
        PID:7776
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        143⤵
        
        PID:8568
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        143⤵
        
        PID:12536
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        143⤵
        
        PID:1900
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        144⤵
        
        PID:12400
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        144⤵
        
        PID:12776
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        144⤵
        
        PID:8496
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        144⤵
        
        PID:11588
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        145⤵
        
        PID:7836
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        145⤵
        Views/modifies file attributes
        
        PID:13088
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        145⤵
        
        PID:13240
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        145⤵
        
        PID:7328
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        146⤵
        
        PID:13120
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        146⤵
        
        PID:8008
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        146⤵
        
        PID:9020
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        146⤵
        
        PID:9236
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        147⤵
        
        PID:12876
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        147⤵
        Sets file to hidden
        
        PID:12948
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        147⤵
        
        PID:12648
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        147⤵
        
        PID:11448
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        148⤵
        
        PID:12940
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        148⤵
        Views/modifies file attributes
        
        PID:12900
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        148⤵
        
        PID:13044
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        148⤵
        
        PID:11984
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        149⤵
        
        PID:12784
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        149⤵
        Views/modifies file attributes
        
        PID:7448
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        149⤵
        
        PID:12644
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        149⤵
        
        PID:8100
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        150⤵
        
        PID:8664
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        150⤵
        Views/modifies file attributes
        
        PID:12908
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        150⤵
        Sets file to hidden
        
        PID:12884
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        150⤵
        
        PID:11448
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        151⤵
        
        PID:8988
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        151⤵
        
        PID:7880
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        151⤵
        
        PID:13088
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        151⤵
        
        PID:11492
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        152⤵
        
        PID:12880
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        152⤵
        
        PID:9440
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        152⤵
        
        PID:12988
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        152⤵
        
        PID:10136
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        153⤵
        
        PID:9880
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        153⤵
        
        PID:8368
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        153⤵
        
        PID:12476
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        153⤵
        
        PID:8100
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        154⤵
        
        PID:12620
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        154⤵
        
        PID:6736
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        154⤵
        Sets file to hidden
        
        PID:4640
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        154⤵
        
        PID:9704
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        155⤵
        
        PID:12476
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        155⤵
        
        PID:7448
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        155⤵
        Views/modifies file attributes
        
        PID:10080
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        155⤵
        
        PID:10132
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        156⤵
        
        PID:12736
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        156⤵
        
        PID:9484
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        156⤵
        Views/modifies file attributes
        
        PID:4456
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        156⤵
        
        PID:12908
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        157⤵
        
        PID:3068
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        157⤵
        Views/modifies file attributes
        
        PID:9572
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        157⤵
        
        PID:8668
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        157⤵
        
        PID:13388
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        158⤵
        
        PID:13440
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        158⤵
        
        PID:13456
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        158⤵
        Sets file to hidden
        
        PID:13464
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        158⤵
        
        PID:13596
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        159⤵
        
        PID:13648
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        159⤵
        Views/modifies file attributes
        
        PID:13664
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        159⤵
        Views/modifies file attributes
        
        PID:13672
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        159⤵
        
        PID:13808
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        160⤵
        
        PID:13856
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        160⤵
        
        PID:13872
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        160⤵
        
        PID:13880
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        160⤵
        
        PID:14020
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        161⤵
        
        PID:14088
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        161⤵
        
        PID:14104
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        161⤵
        
        PID:14112
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        161⤵
        
        PID:14272
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        162⤵
        
        PID:9120
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        162⤵
        Views/modifies file attributes
        
        PID:13324
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        162⤵
        
        PID:13408
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        162⤵
        
        PID:13528
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        163⤵
        
        PID:13532
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        163⤵
        Views/modifies file attributes
        
        PID:13472
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        163⤵
        
        PID:13436
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        163⤵
        
        PID:13788
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        164⤵
        
        PID:13696
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        164⤵
        
        PID:13756
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        164⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:13772
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        164⤵
        
        PID:14068
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        165⤵
        
        PID:13912
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        165⤵
        
        PID:13968
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        165⤵
        
        PID:14004
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        165⤵
        
        PID:14180
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        166⤵
        
        PID:14268
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        166⤵
        Views/modifies file attributes
        
        PID:14244
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        166⤵
        
        PID:14224
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        166⤵
        
        PID:13332
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        167⤵
        
        PID:8668
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        167⤵
        
        PID:9048
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        167⤵
        
        PID:13568
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        167⤵
        
        PID:13792
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        168⤵
        
        PID:13628
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        168⤵
        
        PID:3220
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        168⤵
        Views/modifies file attributes
        
        PID:4716
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        168⤵
        
        PID:13844
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        169⤵
        
        PID:14056
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        169⤵
        
        PID:2912
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        169⤵
        
        PID:14208
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        169⤵
        
        PID:14044
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        170⤵
        
        PID:9572
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        170⤵
        Sets file to hidden
        
        PID:7328
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        170⤵
        Sets file to hidden
        
        PID:14244
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        170⤵
        
        PID:9840
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        171⤵
        
        PID:10640
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        171⤵
        
        PID:4008
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        171⤵
        
        PID:13676
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        171⤵
        
        PID:14188
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        172⤵
        
        PID:13844
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        172⤵
        Sets file to hidden
        
        PID:10180
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        172⤵
        
        PID:13380
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        172⤵
        
        PID:13544
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        173⤵
        
        PID:13528
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        173⤵
        
        PID:13564
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        173⤵
        
        PID:9048
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        173⤵
        
        PID:14256
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        174⤵
        
        PID:13664
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        174⤵
        
        PID:13888
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        174⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:5096
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        174⤵
        
        PID:13380
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        175⤵
        
        PID:4040
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        175⤵
        
        PID:892
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        175⤵
        
        PID:6476
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        175⤵
        
        PID:10744
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        176⤵
        
        PID:10080
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        176⤵
        Views/modifies file attributes
        
        PID:13564
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        176⤵
        
        PID:10972
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        176⤵
        
        PID:14340
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        177⤵
        
        PID:14388
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        177⤵
        
        PID:14404
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        177⤵
        
        PID:14412
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        177⤵
        
        PID:14556
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        178⤵
        
        PID:14600
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        178⤵
        
        PID:14616
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        178⤵
        Sets file to hidden
        
        PID:14624
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        178⤵
        
        PID:14776
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        179⤵
        
        PID:14828
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        179⤵
        
        PID:14844
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        179⤵
        
        PID:14852
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        179⤵
        
        PID:14984
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        180⤵
        
        PID:15032
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        180⤵
        
        PID:15052
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        180⤵
        
        PID:15060
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        180⤵
        
        PID:15192
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        181⤵
        
        PID:15244
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        181⤵
        
        PID:15260
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        181⤵
        
        PID:15268
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        181⤵
        
        PID:14360
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        182⤵
        
        PID:13564
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        182⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:10856
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        182⤵
        
        PID:9048
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        182⤵
        
        PID:14672
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        182⤵
        
        PID:10324
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        181⤵
        
        PID:10520
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 10520 -s 416
        182⤵
        Program crash
        
        PID:14464
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        180⤵
        
        PID:15200
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        179⤵
        
        PID:14992
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        178⤵
        
        PID:14784
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        177⤵
        
        PID:14564
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        176⤵
        
        PID:14348
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        175⤵
        
        PID:14132
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        174⤵
        
        PID:10392
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        173⤵
        
        PID:2436
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        172⤵
        
        PID:13756
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        171⤵
        
        PID:14084
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        170⤵
        
        PID:13588
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 13588 -s 416
        171⤵
        Program crash
        
        PID:4040
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        169⤵
        
        PID:13412
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        168⤵
        
        PID:10144
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        167⤵
        
        PID:13660
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        166⤵
        
        PID:13496
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        165⤵
        
        PID:14292
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        164⤵
        
        PID:14012
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        163⤵
        
        PID:13776
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        162⤵
        
        PID:13520
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        161⤵
        
        PID:14280
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 14280 -s 148
        162⤵
        Program crash
        
        PID:10080
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        160⤵
        
        PID:14028
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 14028 -s 416
        161⤵
        Program crash
        
        PID:14184
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        159⤵
        
        PID:13816
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        158⤵
        
        PID:13604
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        157⤵
        
        PID:13396
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        156⤵
        
        PID:12356
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        155⤵
        
        PID:6736
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        154⤵
        
        PID:9776
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        153⤵
        
        PID:13296
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        152⤵
        
        PID:10192
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        151⤵
        
        PID:8636
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        150⤵
        
        PID:9736
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        149⤵
        
        PID:8864
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        148⤵
        
        PID:8744
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        147⤵
        
        PID:13144
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        146⤵
        
        PID:12360
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        145⤵
        
        PID:7876
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        144⤵
        
        PID:5040
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        143⤵
        
        PID:1140
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        142⤵
        
        PID:12820
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        141⤵
        
        PID:8060
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        140⤵
        
        PID:12668
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        139⤵
        
        PID:4664
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        138⤵
        
        PID:13172
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        137⤵
        
        PID:12916
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        136⤵
        
        PID:7964
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        135⤵
        
        PID:12408
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        134⤵
        
        PID:4880
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        133⤵
        
        PID:13224
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        132⤵
        
        PID:12972
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 12972 -s 420
        133⤵
        Program crash
        
        PID:13144
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        131⤵
        
        PID:12764
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        130⤵
        
        PID:12548
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        129⤵
        
        PID:12340
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        128⤵
        
        PID:7336
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        127⤵
        
        PID:2000
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        126⤵
        
        PID:2504
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        125⤵
        
        PID:11632
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        124⤵
        
        PID:7056
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        123⤵
        
        PID:11924
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        122⤵
        
        PID:7016
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        121⤵
        
        PID:1636
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        120⤵
        
        PID:11920
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        119⤵
        
        PID:12068
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        118⤵
        
        PID:12028
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        117⤵
        
        PID:10388
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        116⤵
        
        PID:12252
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        115⤵
        
        PID:11868
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        114⤵
        
        PID:5068
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        113⤵
        
        PID:11996
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        112⤵
        
        PID:12064
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        111⤵
        
        PID:11800
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        110⤵
        
        PID:11564
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        109⤵
        
        PID:11316
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        108⤵
        
        PID:12112
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        107⤵
        
        PID:11744
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        106⤵
        
        PID:11284
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        105⤵
        
        PID:9156
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        104⤵
        
        PID:10780
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        103⤵
        
        PID:10908
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        102⤵
        
        PID:10864
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        101⤵
        
        PID:9136
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        100⤵
        
        PID:10860
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        99⤵
        
        PID:11228
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        98⤵
        
        PID:10260
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        97⤵
        
        PID:11256
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        96⤵
        
        PID:10896
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        95⤵
        
        PID:10764
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        94⤵
        
        PID:740
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        93⤵
        
        PID:11128
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        92⤵
        
        PID:10828
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        91⤵
        
        PID:10612
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        90⤵
        
        PID:10400
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        89⤵
        
        PID:2016
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        88⤵
        
        PID:9940
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        87⤵
        
        PID:1852
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        86⤵
        
        PID:9748
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        85⤵
        
        PID:4600
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4600 -s 156
        86⤵
        Program crash
        
        PID:2476
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        84⤵
        
        PID:1200
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        83⤵
        
        PID:5500
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        82⤵
        
        PID:9564
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        81⤵
        
        PID:3032
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        80⤵
        
        PID:4816
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        79⤵
        
        PID:1752
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        78⤵
        
        PID:9740
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        77⤵
        
        PID:940
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        76⤵
        
        PID:9944
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        75⤵
        
        PID:9516
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        74⤵
        
        PID:9372
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        73⤵
        
        PID:10108
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        72⤵
        
        PID:9848
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        71⤵
        
        PID:9640
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        70⤵
        
        PID:9428
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        69⤵
        
        PID:8700
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        68⤵
        
        PID:8972
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        67⤵
        
        PID:7404
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        66⤵
        
        PID:8236
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        65⤵
        
        PID:8252
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        64⤵
        
        PID:9084
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        63⤵
        
        PID:9208
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        62⤵
        
        PID:8992
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        61⤵
        
        PID:8868
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        60⤵
        
        PID:8376
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        59⤵
        
        PID:9212
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        58⤵
        
        PID:8892
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        57⤵
        
        PID:8684
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        56⤵
        
        PID:8476
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        55⤵
        
        PID:8268
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        54⤵
        
        PID:6432
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6432 -s 192
        55⤵
        Program crash
        
        PID:7404
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        53⤵
        
        PID:7520
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        52⤵
        
        PID:7820
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        51⤵
        
        PID:8144
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        50⤵
        
        PID:7968
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        49⤵
        
        PID:7988
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        48⤵
        
        PID:8028
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        47⤵
        
        PID:8
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        46⤵
        
        PID:7184
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        45⤵
        
        PID:8052
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        44⤵
        
        PID:7620
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        43⤵
        
        PID:7548
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        42⤵
        
        PID:6316
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        41⤵
        
        PID:8112
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        40⤵
        
        PID:7900
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        39⤵
        
        PID:7692
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        38⤵
        
        PID:7428
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        37⤵
        
        PID:7204
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        36⤵
        
        PID:6436
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        35⤵
        
        PID:6372
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        34⤵
        
        PID:6576
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        33⤵
        
        PID:6844
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        32⤵
        
        PID:6284
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        31⤵
        
        PID:6836
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        30⤵
        
        PID:6196
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        29⤵
        
        PID:6856
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6856 -s 188
        30⤵
        Program crash
        
        PID:7152
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        28⤵
        
        PID:6560
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        27⤵
        
        PID:6424
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        26⤵
        
        PID:7120
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        25⤵
        
        PID:6912
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        24⤵
        
        PID:6704
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        23⤵
        
        PID:6488
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        22⤵
        
        PID:6228
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        21⤵
        
        PID:5308
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        20⤵
        
        PID:3608
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        19⤵
        
        PID:5728
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        18⤵
        
        PID:5284
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        17⤵
        
        PID:6088
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        16⤵
        
        PID:5812
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        15⤵
        
        PID:5480
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        14⤵
        
        PID:1196
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        13⤵
        
        PID:4204
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        12⤵
        
        PID:5596
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        11⤵
        
        PID:5016
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        10⤵
        
        PID:5976
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        9⤵
        
        PID:2384
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        8⤵
        
        PID:5732
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5732 -s 188
        9⤵
        Program crash
        
        PID:5964
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        7⤵
        
        PID:1696
      - C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        6⤵
        
        PID:5924
    - - C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        5⤵
        
        PID:4264
  - - C:\Windows\SysWOW64\notepad.exe
      C:\Windows\SysWOW64\notepad.exe
      4⤵
      PID:5252
- - C:\Windows\SysWOW64\notepad.exe
    C:\Windows\SysWOW64\notepad.exe
    3⤵
    PID:5804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2072,4546383001505481410,2451785860940713047,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7068 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,4546383001505481410,2451785860940713047,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5036 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,4546383001505481410,2451785860940713047,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3172 /prefetch:1
  2⤵
  PID:9132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,4546383001505481410,2451785860940713047,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7232 /prefetch:1
  2⤵
  PID:7852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2072,4546383001505481410,2451785860940713047,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6956 /prefetch:8
  2⤵
  PID:9292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2072,4546383001505481410,2451785860940713047,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6388 /prefetch:8
  2⤵
  PID:9344
- C:\Users\Admin\Downloads\NJRat.exe
  "C:\Users\Admin\Downloads\NJRat.exe"
  2⤵
  PID:10056
- - C:\Windows\SysWOW64\netsh.exe
    netsh firewall add allowedprogram "C:\Users\Admin\Downloads\NJRat.exe" "NJRat.exe" ENABLE
    3⤵
    - Modifies Windows Firewall
    PID:3700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,4546383001505481410,2451785860940713047,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6916 /prefetch:1
  2⤵
  PID:10312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,4546383001505481410,2451785860940713047,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7400 /prefetch:1
  2⤵
  PID:10984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,4546383001505481410,2451785860940713047,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7364 /prefetch:1
  2⤵
  PID:10992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,4546383001505481410,2451785860940713047,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7260 /prefetch:1
  2⤵
  PID:4740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,4546383001505481410,2451785860940713047,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5676 /prefetch:1
  2⤵
  PID:11488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,4546383001505481410,2451785860940713047,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6316 /prefetch:1
  2⤵
  PID:11500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,4546383001505481410,2451785860940713047,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1756 /prefetch:1
  2⤵
  PID:8388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,4546383001505481410,2451785860940713047,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7484 /prefetch:1
  2⤵
  PID:4544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,4546383001505481410,2451785860940713047,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7136 /prefetch:1
  2⤵
  PID:2000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,4546383001505481410,2451785860940713047,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=55 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5660 /prefetch:1
  2⤵
  PID:11520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,4546383001505481410,2451785860940713047,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=56 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7928 /prefetch:1
  2⤵
  PID:10348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,4546383001505481410,2451785860940713047,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=57 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1772 /prefetch:1
  2⤵
  PID:12056

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3016

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4316

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 5732 -ip 5732
1⤵
PID:5284

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 6856 -ip 6856
1⤵
PID:7100

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 6432 -ip 6432
1⤵
PID:7852

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 4600 -ip 4600
1⤵
PID:9412

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 7796 -ip 7796
1⤵
PID:11484

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 12972 -ip 12972
1⤵
PID:13008

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 14028 -ip 14028
1⤵
PID:14064

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 14280 -ip 14280
1⤵
PID:14316

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 13588 -ip 13588
1⤵
PID:13796

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 10520 -ip 10520
1⤵
PID:13380

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Hdlharas\dlrarhsiva.exe

Filesize
9.1MB

MD5
64261d5f3b07671f15b7f10f2f78da3f

SHA1
d4f978177394024bb4d0e5b6b972a5f72f830181

SHA256
87f51b4632c5fbc351a59a234dfefef506d807f2c173aac23162b85d0d73c2ad

SHA512
3a9ff39e6bc7585b0b03f7327652e4c3b766563e8b183c25b6497e30956945add5684f1579862117e44c6bac2802601fc7c4d2a0daa1824f16c4da1fd6c9c91a

Download Submit
C:\ProgramData\Hdlharas\mdkhm.zip

Filesize
56KB

MD5
b635f6f767e485c7e17833411d567712

SHA1
5a9cbdca7794aae308c44edfa7a1ff5b155e4aa8

SHA256
6838286fb88e9e4e68882601a13fa770f1b510a0a86389b6a29070a129bf2e5e

SHA512
551ba05bd44e66685f359802b35a8c9775792a12844906b4b53e1a000d56624c6db323754331c9f399072790991c1b256d9114a50fb78111652a1c973d2880af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4b4f91fa1b362ba5341ecb2836438dea

SHA1
9561f5aabed742404d455da735259a2c6781fa07

SHA256
d824b742eace197ddc8b6ed5d918f390fde4b0fbf0e371b8e1f2ed40a3b6455c

SHA512
fef22217dcdd8000bc193e25129699d4b8f7a103ca4fe1613baf73ccf67090d9fbae27eb93e4bb8747455853a0a4326f2d0c38df41c8d42351cdcd4132418dac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
0d9726f43ae2e96b5f2ec236f79e3d14

SHA1
4bd600841acf5e523b59f74950e1702e153d2d3e

SHA256
6066a6b3cd93d129282a2620f454c7fd9ff37c232bdce244d324d6b68d958703

SHA512
12ecbce2d2bdbe81337b486777691183af15903ddf3463aeb82aeddbf0a2956817a48a2d492545ba2718e1f41ddd0d175e9cbffcc6171c5e5630c5edcfbed9b3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d9be3138e381dfabd5056b651ea1df6c

SHA1
2013741f2924f54fcd5286a9a6077c1bbcdd81eb

SHA256
98e3128e217ec35906799f0b5af65384fecc381057f0cb33772b56bc7c7c2728

SHA512
7cbf7de5585c01dcb220ac22946410e19ef2c757f02358a0045209184d3c264fa80044e8768157e0cadf3324175374ebc25fa8c8dbee74d38cf270ef0769fc7b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
eaa3db555ab5bc0cb364826204aad3f0

SHA1
a4cdfaac8de49e6e6e88b335cfeaa7c9e3c563ca

SHA256
ef7baeb1b2ab05ff3c5fbb76c2759db49294654548706c7c8e87f0cde855b86b

SHA512
e13981da51b52c15261ecabb98af32f9b920651b46b10ce0cc823c5878b22eb1420258c80deef204070d1e0bdd3a64d875ac2522e3713a3cf11657aa55aeccd4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\data_0

Filesize
44KB

MD5
9dcace26e94a8c83831bc275b0bab650

SHA1
67bbb8b456129171a670036a9e41ef869494daf9

SHA256
e9383a70947c65fd9d5432c0dcb7623701d09db3de892379ca3e129219ed83a8

SHA512
881f3ccfeed1eafa9716436b308819a4b4c7f943ab634b05459658c27b7bb78754932b90ede730255893ee9570d1dd8432ed4e6ad18650b4a70e67b8cd2fce5d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\data_1

Filesize
264KB

MD5
46730207d930c7f921cdbd36e2bdcd7a

SHA1
f8d2e544201153a03ea3ee510defbb30b74a99f5

SHA256
efb67ba7d13f72e52c595b308ff3e67c4078f8b59c2a7e5a54efce80ac098905

SHA512
887261fa3e44acae0db517cd6d4f2b057a48ea8747fadadce26f86cbd39f4fa346a5be79558d7045d5f7d212c7df211be3206e2d828d188af09e24e595c99cf1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\data_2

Filesize
1.0MB

MD5
f9d8dcd01662fd7f61bd0988dfcddec7

SHA1
b02fcb1e01ce141e2a4817dc741b84686863f0d4

SHA256
8ed6efe95de5c510f1458bb9d6d6e3f02f46888bb389b49b39135cd57f3ef018

SHA512
c16392e5c29c9bb094875517666906a98b395e2f47bc0d88ee93e3a2f42d923c968be28f45e2da725c513ac732fbffcbdb1f9e3b06007e980dc069416ff6e8fb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\data_3

Filesize
4.0MB

MD5
77eb646632ff7ec609c65a31f9780f5f

SHA1
9b084d4073e610c32c06ccf2ced9cabf121f23ce

SHA256
1bed26bcdad9158c24e02d65de2a00a57400b79cc8b598f59ecc73d33935c6a5

SHA512
a6fadd550ab801ffc99b7d5746e1c0e1718b95cda95e095dd243158b41390aecee3919d2a1abf4aec1bfb5f2057a379ff3a5203cddab7cee8e693fb15afb07a8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000e

Filesize
31KB

MD5
8c7293a7e43bd94f36fb87b600836e03

SHA1
09ef7d9ee4a100317ff34b329c5ac7babc5c7b74

SHA256
0d50ec899dc641a1acfb9a00fb734bfa302d106285127a5af195d97b944d7515

SHA512
dee75c0e4755d2b4a678f5e0ce1c6ab5ff8dd674e9b06574c58fecc56368c38fe465512f9bdeffabfe4423611d836b235bc219e3cc3cffbaa41b66c42344dfc3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000064

Filesize
174KB

MD5
85931056513284ac966270ded78ee2fe

SHA1
cdf316a91501a1a66f869623685e02668a9596ca

SHA256
0985711e35cb4994a0d51b9daa6151579f0a9fab9bff031ef0b9f30b850761d6

SHA512
4471537a741e4c4bc819d7fc4522751203dce7577712658c6a3dd306379eac0745caa3882ae6df8434a0944b8ab72f17d17d52b025d14af7f68639e0c221d9a9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000066

Filesize
177KB

MD5
40c87b49b58a52fc6b2c11fcdfd1c375

SHA1
213b3defbac1822fc816d7a0130850fff6b95654

SHA256
11c364d10c4c3c950c829c49c4808a7fe18c1c4a7787facc406d0dec0207dbd2

SHA512
6749e76f90325d8ecc3057481bc7c509535bb7f54e005ccba4284c687a0703e3ed9ece16105dbb778c0ef4bd24b825c3b5aefcf802883bac8fefa8ac38cce173

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000068

Filesize
209KB

MD5
b14406147f5a4293482238be9369a304

SHA1
93413f8cc3f22c58b068d086d1c56f3c07b8c2d4

SHA256
080204e95d213c2f365442fd528d9f5aea7974ac1f1a98eaf8d45d14d70476f7

SHA512
4652422d63ba09a19dcf726bba1f91179cc659db043d8a76fe81564cf2920b5899083280233bc35e4271fc16e918e3f058d47d2c7544a8313d417a671801dddc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000069

Filesize
213KB

MD5
78989d2bca27dae626cf188019c64a69

SHA1
e38fd73231dcd68aa298967ba7fabda9e53f053c

SHA256
24fe457f908a22ddaf7383cafcc4dd07dc5354982762b4fdf2dcc44f29a5eb8d

SHA512
962b32fefde8d78f67c565dee2c3e86f449bcce53bf23884df9631d3aec9c131682607b24934da2f606375203d1dd6b49d527c175dade1e68bd81bddb6a0c835

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00006a

Filesize
171KB

MD5
97fce0e28d2544aa6168c67b41a2667f

SHA1
129bc53e8004da98b6fddaf33ef5d37159599b16

SHA256
03d0216f30391fa1993e07a886b010fc822622f28eb10a34ffddcca631078791

SHA512
99167f43deb9054ed92e102a62b19fb3854558390f084300b8280c9848b6474d103f1cfbad1c5c87f971551ecc6f7147e02ae795fc178d910dd5a67ab1097bbd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00006b

Filesize
197KB

MD5
3e6565cc9681eba259b73b13f834d8aa

SHA1
384f0a72d2027ff990dd36cdeed69df1334743ba

SHA256
5a5f3b613da4bffecbb79afb80415399d4953e066d6090810d6c09bf03aa321e

SHA512
0ed99d13de45f66477357f0cd84ea2e3b889ef57b8b1a3a9180b5babcf5fe77961f054976bced47f5576ebd8560c6a7277ce4a870a4f56fc3cdb99d6d8fc9599

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00006c

Filesize
136KB

MD5
8dc9ae6b595ffd64f2cc9309ac17cc62

SHA1
4b05f429d0b63c35291f7e1692d44608681063cd

SHA256
06e727404f5c77852a339b18b5c8b2abf803ba7d7c04322969f4e3cfa583559f

SHA512
a5eaea1f296f987a9d7ccfba09aa8e130413f97a906c10aa71940943a1546da044e452fa7234bcdf3b5215f7b7e2d2329d98534ff2d63b33cca05e06cef56af1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_0000a3

Filesize
206KB

MD5
f998b8f6765b4c57936ada0bb2eb4a5a

SHA1
13fb29dc0968838653b8414a125c124023c001df

SHA256
374db366966d7b48782f352c78a0b3670ffec33ed046d931415034d6f93dcfef

SHA512
d340ae61467332f99e4606ef022ff71c9495b9d138a40cc7c58b3206be0d080b25f4e877a811a55f4320db9a7f52e39f88f1aa426ba79fc5e78fc73dacf8c716

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\02b1a637dfc4493e_0

Filesize
4KB

MD5
7cf9c7b79ec31a3af05f7ccdb9265f12

SHA1
91895548d4c6d71b1e83f981e147aca4533a4dfd

SHA256
963c6bab37c9369e9854d28c63db9eaca2e6f6e0bfa8905d85e7268eaae21c34

SHA512
2000f8277cff2d905308a6ed58acc0a4a2a38fcb846186dea81ed9080da1721e872e0cb1a7f1a0c60b879a6665a4f38b8726c0d76012120088a92b4cd2da1430

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\0482af33d4cf954b_0

Filesize
289KB

MD5
52e4dc120dddb03920bc9ceb988488ef

SHA1
bd795b1e272cb2564641ffaf8f4fd0551d681e50

SHA256
4435cf84d7d1e897be1c316fa557920cc560a2aee04dcbc90adcc97fe529cae9

SHA512
3615afad05af9a56afd9cd827a8e78dcd83edd361d8b2414540f3a25a816e7744d26b07d63f1d123a162ed147c19d3ea341a93154a5d419896b7f601ea761349

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\0503effc8bf0d7f8_0

Filesize
2KB

MD5
8eb810800d766c949b52e18fe8fba387

SHA1
829d79098d7291eadac578849b68582b7a852201

SHA256
f7bd0b9a2a2cc6781dd987bec4691e706a2efe3def629cfc6be5349f0473722c

SHA512
dc0d58889a6140d1a1c3f62e72b2c5ddaa1774b54d0462a6c361882636ef3724da191060dedab62be1a54caac9d4f804872af7ac6a76a86c25d6e21c4842937b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\0580a8e1646d7bcd_0

Filesize
14KB

MD5
1a189e5d97f0e92a1bd7791ecc985425

SHA1
f234f7efa43def20f3e652edd6304539b6496898

SHA256
b1d5dd09c10f42933a39ffa34bbce6995ee5831a8462068f2ee7c86920e3d9f6

SHA512
1cef25b173de9375f88a251ea8abf56bbf970eb1e77fb54191a1ef4b675f69f454be929b8c5b8d33832e1a11a9ea0e1bbd45e21bc07f11cb246538917bf1b54a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\06450eb6a7b09545_0

Filesize
2KB

MD5
fe6352817847cf21496d98846cc1bffa

SHA1
0ca6d7a608e9cd8059429dfe728d730fa3279c3f

SHA256
ded6bd5010c7d8a4abeab2528eb5c2ce35a5d6167044ec5b56df511cd5c54b10

SHA512
b45dbd68afb29e7b21efd4c68a69599134433189659dc3821ede37ca36f1bf0d21e885c95d0873d633a1f0315a6bfa11f4709b85b46f57172f7b9972b26c7192

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\16236234ae263013_0

Filesize
4.8MB

MD5
f4021e2345d95ec6b2fc07634c81929e

SHA1
54fd16068cc0276f7f780bc1fb9c85f37511b6ac

SHA256
d686bc6e1d73c87b84c3f4d9bf2cb5dfffa68a407139f8245d7cfb62567f7746

SHA512
9cd4030f6329672d20bf00042cc7b050bb386f06d68a042347ede12cbdf4d205fce9145a43a12fcfec5fb52218e3d8ff931c01442486a86446fe5b669276c262

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\1927a26afb9a8b4a_0

Filesize
1KB

MD5
72e49cdcb6da801376a5270bd1b07b94

SHA1
19a9487e9f9c6ce7ec62a5025ed8da374581e0bc

SHA256
80c818e1aa4edb705d76d35a5f9b2bf9368acb245f984c5ddf0b9483adaf0691

SHA512
a47e0674ef5b10243fb0d1895dfedfb3e0a61774ee72422ce70dd8a27f846712936244576cf821da142163caa6f6a020dd939da0232a2ce4532619f7bb64d819

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\1ba208775fb5fe09_0

Filesize
3KB

MD5
ddb879dadc6807d69b3c74c1fb33aeb9

SHA1
6606fc52282438de27fac55c3c7012ce0656bf91

SHA256
5362f541cdc5228b3fe31557e88a4307bd40f5085ea98ebed1e6fe7f709c610c

SHA512
9d9d1ddf824227209e299396b2ce056c843766169704c8d5b23c2156c338ee6470d4e8e40da31e4cbb974dd3a0cb4e73d14db9a18e439452abbc2f4ef39d5572

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\25c90b4fb1c6ef85_0

Filesize
1KB

MD5
1c21b33ca6e35774b7db0aa0fb775c0b

SHA1
9141821934cc93c3504fba93cbe2c400012edb81

SHA256
dead07bf9e4d25f3b07ec0cf7f41d0b742b4dd0f6b7ddc903e9431f98d1fb16a

SHA512
c13a50bbb98960f322aea7dd960db2da8867ae45e8f4aa4333135823481edb5135be0a7baf926c9f264b7068f062fee16175379e996659cf713438277e83b086

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\295f5e2112efe00a_0

Filesize
5KB

MD5
d15c3928a8697ebf5155b790d0093b0b

SHA1
31ec305ae09536ae8a5f34819e3cc19894ebfbdc

SHA256
057a2021189e396132f7619564e3f480d62b553823e8c3f15dcddbc0279cc5c2

SHA512
247110bd26f3404123ef51a9da88b3485b8cce2c1a6a9fdd17d06475f391e20dd9c54c521825650f5fd5b3425a1bea089064fc6e25d8466724cde77eab8158f0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\3f908eb48725b239_0

Filesize
6KB

MD5
54fb71df795713358e0307b1087b5f61

SHA1
ca9fd2e7b20836fe3a149c8d98f0ef9cce5e7681

SHA256
a50fa3d2be140e9204afff689bfa23a63118f37f9f201a37cd69e0a4c23f790e

SHA512
c4c2625cdda405caef9614dad8be35e024239e7133f0f19783a02858af759ba74156e067ac8e775f24cbe4309f83c8a58db2dc625d8147d29e9bc5bd6414c324

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\45a16ff6d0d9ab5f_0

Filesize
1KB

MD5
9e8cf5201c9f64c424ba6dafd7a6918a

SHA1
3cab36aeaff4558be6ded0d4a2b19862ce4eb321

SHA256
6199c15eb9b5a55d567dd5c10367153f9d80a8b6c55cd13a677c19dbdab79ca8

SHA512
dd8e876fdb17d31f5b9554c405e645e31e87ceec0cc18a8b5b8c97fe88c8fc1a0237d151ac5304120ea5ab43f0c98560f6b1ca2d6b1f3df193f43f8dfd45d827

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\47d4e623e47f5bdd_0

Filesize
262B

MD5
6babe8c7e063926c80dc0dd9dc401faf

SHA1
09488108aa7091c67c3d63a13cd6cf9f9edd8683

SHA256
098006ca04ce6230272d2224adc9ea496999f9ce237719ef54a9d43906687bd4

SHA512
04d2e36d86f130d0e2c7a4b2539aac42d4e06f9a5097705f94df884f4f40faf4c4917acf6d92ae4a27dfad1be185ae437411ea173bb559e3cdae66c09c51aa9f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\53ac5abc87e80789_0

Filesize
2KB

MD5
e4b5a06fd28414410075760bbb8301dd

SHA1
7e18cf89974ac133cbd29d733effac7c2aaa52a5

SHA256
560e9479a8710a89747e20a1efbdd7be2d3a2d9eb6452dd664110d266837af8d

SHA512
e2ff9474840b50ec626de6bd771fc083cdbcd581061de13e80563ad5001cec02f3033e46f4d83da9649f9e3ed0ab52188294baa44e1e13aa8653187ba481c83e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\5b2f11f3f15a5775_0

Filesize
3KB

MD5
10cdca9638d298c4feae95ee6918c82d

SHA1
a94beccac765798442ae97e8a7eac46beb42e6b0

SHA256
fa9d4df974ee254f6fb0698f1fe8b60e78748492793813390b384105b7a8c03b

SHA512
0ed779a2a18a6f7e6cf28fa600ceae57e557309399de45645d123135b7652dfea6cab1c4979f6f40c80566f4ec2242538da44f20efa598927e41113bba9a251b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\695c42f61090a800_0

Filesize
5KB

MD5
b7aa3c6d2ecb54939d10e6dd196fc146

SHA1
04b3f7d8fb3a1ab7b4652cca4561d977728735cd

SHA256
5018b2af7f84c440ff813356b9135c4ddcf84b8e3464a2d2dea3a05d3de39c26

SHA512
f32337e81a4e98bdecd8cbb8863c6282167589ffbfb24e4e99f31d9c7ea5560b96931e13f65cb4c4bfd1880e5572b12706fb6c0c889b5b4d99b891ce980ee39c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\6d3b0ad57bdf7db9_0

Filesize
1KB

MD5
32575a5e2581931e2f0a78e5b7f05918

SHA1
add84a0e9a5fd77c1ba987170faa87059b00d104

SHA256
6777802ddf45c90171c3e5f23c75aa580cb374121d3998a098068044bc1283a9

SHA512
f34f826cf3120e9799c6f2783ede1a185ca3b452d74a2c3d9f8ddeda27748150898175b6f1dad472cf25bc14596c07ea02d485c801333f34776bdbcf1973e02d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\74b88724f60b0383_0

Filesize
1KB

MD5
85760ad7e4cd296c02e8bcefb8f0934c

SHA1
4eca04c9dfb4353b952d909c75bdf260985ffd91

SHA256
38c2535f933995c2d88f0dc465909d870ae02a7f8ff0cba761e68e62316a4a75

SHA512
f0f2fa8f16ee5549d2dfd7b0b2a3c235f5ad9c5f952cb8c374dce8d7195c8c48b6d4544b0cbafef3c917adca7bac5adfa59f01b2e446c5b9d5d36e3f98eaad5c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\7a66a1246c4f29f4_0

Filesize
9KB

MD5
23e11aa7070eb517237b8ad7edd3d028

SHA1
593aa262f3631949221851c873eefb353f11f624

SHA256
2fcfeceee4afdd1c3010758185d20fb2af39fe8c73d77ee82f783d2abc5a2649

SHA512
50b4e120c62f8d221d15850705ca5d36cfc6f80168e7091ce423af2297455d88f64fb8205e0a464492e5acb5fa2ca49f96d8f028e4c5b2f2526e74165e5dcc0a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\7ca0d0f4c5b7b37c_0

Filesize
262B

MD5
cfceedf3071e16044802fdb36a327467

SHA1
ca203cdb838b3cbf8c748722261409466416a4ab

SHA256
968fe686bbb553558afd222158ddab72358cfa56aa0d78c61d17d89ef40741f7

SHA512
b3feb3d2a7d5b5753d223642fb054582d655292f9c7e60d9639f3479e09705e1b8140115f9c9ae22842415c90d5f88cef0dbf1f249526725d405c23c709a420a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\7d7621a425aef257_0

Filesize
6KB

MD5
de8a2f9849b325a6e23aaa0ae4f8094c

SHA1
fa317032056cc2bf3f9dae759a722b2ca4d10384

SHA256
201906101ff26f4c23ec8cd9067dba471e8e757fd1b687f699293b72e5f2890f

SHA512
3771aebf20fd03007f8765c50bb776e744e42490ebef7bad6f45381bb82eae473632f89e3c7f9b9aa9fa6682c2f9c33765784d580e6f0d2ba69ab991f889785e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\7dee6525feecea98_0

Filesize
307KB

MD5
dd5b6ab1af677d6debe5db1e15248ff1

SHA1
fd963bfc92d7f28094aef3a72c4cf4b4cbbe82e4

SHA256
385f5bd0f69f801d27a43a0e0281d36306f6e0013237bb0875482d8166ecb855

SHA512
d3246d668351bdf088be3f30c2adc1a8365f5c3f9072ede5fd32264b461858520099074d0d8026debd1b6ceb7a8648e588f2dcc457bc2b18882623bcdb2499c9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\7f05d59e6df9a390_0

Filesize
26KB

MD5
465c69baec21ae0616f410afff6a8291

SHA1
9fad54318d3d6887e0b8792495e165f725d2bfae

SHA256
a3fa278b7f7895e7723249c33a6735fb3f6d7821f67f91a72284ca3e852c9186

SHA512
881c4aa6017910de72e6fad0185187b84bcc6fc5967013af96aeb4be60d469d5b2d149b58f64751e622ab354d2f1cfa4bca8b0e82138b16570c461810c043ab1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\80baba1206113f67_0

Filesize
8KB

MD5
30c734d75a4d84cc4a5d23ffb89e0d6f

SHA1
2ada98fbc0e435fbb97172391666d292c657034a

SHA256
0920fa7f5de9c1e00afd4f1a762e4ddfa46398413cf8be08360c0e8ed13b9590

SHA512
dbde8c9ce45c8551e9d64d5a73db92f56ada79e5761c15b0241c1acecacfe80ffb5560001f7f89562137e69385c90330a9c64b2072fd82825366c932518b337b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\9412c8b664751f90_0

Filesize
1KB

MD5
0c72a9be37d723dbbe5609dd04595ace

SHA1
fec7496dc6277ccaad4e19f587ef3fcbd571e07b

SHA256
d40f2e4fa8c69e6bfab3f0cf606bcee3bda2c9f63440827a8039b16864c567e6

SHA512
0c82bd3a7f831f08c97fa1042abc7a92847ab03ff004bbef198d04263c8b5ade1aa8d2d79b13b7dfa9ef90233e74ab0bd7de51230ec26a13d8913b5959c5fb60

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\94ebe1630900d094_0

Filesize
7KB

MD5
28b863af3437dd63c4ae660a200f4c88

SHA1
33e55a430d44952151d182d5103dcae9908bd504

SHA256
b368fc2255140dd3667856255e57ac065cc87d6873c3f3e859d75a4deeeaeb2a

SHA512
543e553ce3c4096216df7839c1af14de0c9af8b3cad7a10fe34fccff5810073aabc308938f0d7b8a29b1daf10b0a4ce8032294abb0b25d5b6de73291d000e3e9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\9aee5cd509922cea_0

Filesize
1KB

MD5
76bc755b1c9ad7557429f19aebb99c17

SHA1
c3f9ca782529ec7f61a3e9bac85df58274b641dc

SHA256
7afa618d843f014be7742d33f7f19f3995073248f1b5d6060dd16b465d26a713

SHA512
dea34428e695852fe6a88ee04f55958fdb26fa4b3dabe0d9e4a709b3de978ac35bd7283c5df6e7d9944b1c739f618b707cc71f629af800cde828d78aa7651a00

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\9eb49b832d016644_0

Filesize
262B

MD5
1fbd25995d083e0b5672c29d29becaa4

SHA1
b520955ab4b543fde96ed207dcb672d4e939a50e

SHA256
f943c0e359118f28d7182ccb1009443dc6a446a1c9e802029881d34393ebf845

SHA512
5d1958059ff77f5eed9a040b783782f060842f89ee43e734b61b5ced75d7b27dc854afc7390992536de08fd881092c75a6f068ffd0a9759a3875368ef72389c5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\a09f6271ad0c4092_0

Filesize
47KB

MD5
7d39cdb95d01cce4b181a80e18e1927e

SHA1
1b466c3853fdb469b2bab1d082bc31065885807f

SHA256
47f17d22a16af117ded4b56b76ad2a6942187c0eff7e30485f6043ba85f1adbb

SHA512
ac24dd53d74150b2955588a80633d21b62cc5c0b0da6539f8901d7d34b0e2c6cec1ce39afc45a3aca3bf1c81612b867b9e06de448e3fd54fcffaeb5591fb1e9b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\a267b7c21d8b8c9c_0

Filesize
9KB

MD5
c8b4c902276478964e15ccfe70372140

SHA1
7a408e852807e8d300f9e28c1854ee4996ec3f38

SHA256
857cac0ec76f1321dfd83a2962ea336e41ae3bc9b78e52dc183b08cf11e701bb

SHA512
e687f2fe19b2ddac3efdf5abbea86af27da381df23d1ea2224d9a88fdbde69281ece44ef5c74b8353aeb56fb74d3b41275495ed69a5a4f360e092fcb031999bd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\aa20c296787a3f88_0

Filesize
2KB

MD5
585c3372a416cce284b057930676904b

SHA1
b8b51c301b2dc878ffc80f5320ce9141cba06da9

SHA256
de044802e7b4aed89ad02b30c80bb0535c7fb7f1485d36bfa09a87597498be97

SHA512
7b5fd4c470710628976ac1589667d5d9cf85fea1472afb1f324b8c0ef7371e2fe839c07da4667dfa29030da66f13d99e5aebfdc793c29eace04b175864fc0df5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\ac9b40a0411376f7_0

Filesize
1KB

MD5
cdefb5fe534ba4eeee8b39d5e9200fe9

SHA1
a208cc3c852a08f0dc92b7a236a2c853ae91d875

SHA256
75e5390c3f238b38c8da21df5143182a7bc5a3609a415be45492940d1d99a1bc

SHA512
835b401f3705574fef7c970186bc18602a8c42462bc341e3cf57810349b3f97fdb6a1e30c679d33ca6c031c772d4dfaf08c1f1d3259f488a3fdcc2c557486afd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\af2cfcaf6d9b18bc_0

Filesize
2KB

MD5
1bc69755ded540225322202c1e6774d1

SHA1
abb6d5ff40dc5c94ae9dc1ccd7dc682fdd5c6308

SHA256
672eaaf27151a0a5e1e2873cb6a0410151533c4598c78265589feed99eecd52c

SHA512
03b3938b487e3b5023b79351970895379058becbe3b9ec76bc559c1bc1eea6bd8b3d775f2ee245e87a91b220106518db332d3ac87a45968c9780124f10cdde13

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\af48edbd3578ee3b_0

Filesize
2KB

MD5
9b2b4b21016160ea0d6df68983802488

SHA1
0364d770f1a563a2f8b23e686cbbf3e77ffe5eaa

SHA256
b2b65b2dc304179d0e4ec715938c5d23cab8a1578bbd883743ed25d7767c1e88

SHA512
c6384642971d78f9abb87b808d3614fa3660c2fb3162f1a20ab254d4533149dc2f589e8a7d9014c3e338fc19f54f9a58c8b0898f862275a529e8b40a89f9ceaf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\b1d7d09e2437e8ee_0

Filesize
5KB

MD5
a538d72f72b7a0b5ca180ff3bcc21351

SHA1
9699ef60dc77c1aa3b597adec578b738dce82b7a

SHA256
b7aede49adf0715e9ef3a8471f98cdcdaeb1434189e1ddb304219f68445f2ea5

SHA512
da93b5ef9cbddc5c0ac1cffe497459041d29ea7024b4ba085e0e2f0d49c0d137b70451756555d70c5adc4020c92a7f15456622b23b26885c1d52a461b5af3f50

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\bf0c3222b48cb44a_0

Filesize
1KB

MD5
044d9b5359825f38b5b4ffb7e0427b2d

SHA1
c90915e4ca4d98430f778283224668166da19167

SHA256
b0ecde3b6059e4e402f4cbb64b694909795002a72511f03e8dac778870c4a965

SHA512
1f0be7013b2587546d66cb772e433d83db3012440607c987b8b571a8ada6b5ed11f0bbd5e82c4572b3f50ee351bf87a18376c59ce53a4502d94407a8e4d2d993

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\c035c55e661cf4e0_0

Filesize
3KB

MD5
1f434351a38d2e9d85625674a69d39cc

SHA1
4d5f0507a26799cf284fbf7216916256725a4ab0

SHA256
8a8ce6b58864137e79dd545fbd1a78eb63b522d0a62084a8e11bdb4b9929ca92

SHA512
c0d112311907bf4c5eb6b496e643c89302a7639a296ef8bc67cfc8f3921b5fd8b6df1137d21ef63ee1bb9d7e3eace40a340fa9570992232db621902c4524dc25

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\c4d2cdfff5f83430_0

Filesize
27KB

MD5
73cdf94da21bdbc0e109d74253da095e

SHA1
b8bab2d78903dab937505d4a5e477733b782c0c5

SHA256
21b692c9eb91016032e8aaea48fc07b7bebfc9d7d8300a56018ad408f7f5e20b

SHA512
3cfd6809755e110e02087905800adb6f52f5a93ea84ed8df3d5b30d1cf1a2acb5333213e2c64d4d031269031d592a219f77246b66f1edd5afc913ec794b8cf3d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\d00019f29c31fea5_0

Filesize
2KB

MD5
69c2b2bed44599dc2323110918d7638f

SHA1
4ca50479c75236adaf35d8a7098f5177a81d2ba7

SHA256
d47790875682a32894bbf459156eaa086a623d820db853b5b1eadf8ae7e151d7

SHA512
e7d0ea0eca2a1797df1016737170e40f935373bc3cd463ff3c5627503c5104bdac2abb74c3732cfa21b700b20b270adddd2f63915d1cac06ae79e365c57f287a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\d3dbb3008455b523_0

Filesize
262B

MD5
6fdc1f84a030dcc4ea26a497d14330b3

SHA1
adb20a693cc14aec07f01614295b421ef5322a9d

SHA256
6fe95effd695956e6fd4be8344f875d81171511494d4ecccf2c1cd20fce2fb33

SHA512
ffe374ac17259e9f031b8da373d39b9679f5975db25a79d06df655c5b2f5f67158ca6315fe95de1fd8a9bac62e89220ec1c7b2c462e792dde2f8902a639fa9a3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\d7a29efad91a1117_0

Filesize
262B

MD5
d2d8eeb2115389a2f650d9cc7ab0e0ef

SHA1
b1e51869490e06c2cbe2147df914254283d2e9ac

SHA256
8bce8cfee4c6aae2cc3d3a9509a0490613716dabcac4df652669e8e67a2f6bb8

SHA512
fac3545476af37f8a93cc3722b1a07e6a00c89b8b2e32232337f1eb546623d06d4348163e4beafff000aa8afe2695ae2c45463c3661edfe24e8fac0fa06aa22d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\daea348421cbc209_0

Filesize
2KB

MD5
2ea82a08263f888063e5eaf72c8c846d

SHA1
d18c495b7ea6af8127bca9bed86f129ebd6b8862

SHA256
fc5640a9b3e10834fc0ef24ce51b3811ff63a7fcb622c10cb470c512fb8a409c

SHA512
15035428240c1e27ab422e2a5a5089dc57bb0f442623a634b1efc3d4e7a02e6ed9862e818d2d7109bcf5a8f72b8196b2ea37131aea005e75fb1d222bd6ef0578

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\dbbc94bf25c3545d_0

Filesize
175KB

MD5
827375f3acff836615c58e6a24308896

SHA1
3a080f6b255ec61349bf47c56239c66a450d505b

SHA256
77652dc674806431615a8dc282ce696ba39576221644839f6cf7f82fce6d631c

SHA512
c1ef41b0ef72c9a373e71bb043057ebb517054f24db2d2038986df2533d3e53651d11271a3d0646b6afafcfe42322fe7b8e83bf51ed725535b91023acc547344

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\dca689a8d8fda85f_0

Filesize
433KB

MD5
8739993f6a3f71b0f76f2b64f71606c7

SHA1
68a6b32f364166544e46081f14ddb74da321b767

SHA256
2909757aafc54503a37c40e95f47298cc3e94563c7599bc8538b2b84db17f182

SHA512
1c6ec80b01c9a291b1dfd995e7962ff14737ad42bb5b4b4a0186ff0be81888e48e20b67be770955a3d2ba8afd0460d95aeb2e1ab20bfb08f7f293162c8080d78

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\dfc2f3772193a974_0

Filesize
110KB

MD5
f83e1fee8d69dfb2942c4f6b0319432e

SHA1
97325d4136314ad11af29dbb85249d91bcdbf2bc

SHA256
dfac378a6eed8545bd19f32df29ee078c170ba8f17cf3e5711dda98b5fd72463

SHA512
5d36b5269be76d4abb2d7c4adf3d8b392ebc3c3c6861d626fab318efcd056e786e1357bb93562e73deaf9085f5a5bef35e1ed90dcf67c452be28125ee6ae1234

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\e52ae3fb759a78f0_0

Filesize
262B

MD5
1b8db1f961583440f5be59d64e51d6e7

SHA1
14dd43dddd7ed0d1214c09e159b40199be7704ce

SHA256
7c080492db81be13c15e6dfac99408c1b5f82736db8826b3b1d01abf6573f968

SHA512
c2e2bf7388d509a36ec5e866c9a2ec8d52dade287e4e1df4821dd20f284f2b4ca40ae348ce021cd2db103d2da7739d440c909337d84ce7b40a9098108f6f6fe4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\e55f0a6d1b533c66_0

Filesize
2KB

MD5
88f22437cfd05d53904798e883ccfb94

SHA1
b15276595300c809d16e2746181e2c62c8d8d9d3

SHA256
b2483cdd0d206da01fe1e6ad1e37c54206c9419fdfe8892a871185d522d6fdd6

SHA512
1bbdeb57ee53d98f1deff81c9ab5d134e777b8c48607fe1e5f0279a5fb95e05e3ac2be3ff221a6d5c88ed66caa5cc7371254727bedb51120b437e42f6ae2f7d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\eafdef011b18f148_0

Filesize
5KB

MD5
0549d1d475ff1cba9d42a2ceabf491f0

SHA1
d3cf2c1fdb9252514ebc8b14d5489431ff9c85a8

SHA256
4751647f153f67ece0de1d773e0998cae6882b637891658a44346d7beaabce26

SHA512
31c65f9b16959500872c9e4cff617f6b8fa45b5771786c020a8f9445cb16b301dc61ec2e78c68bc27186b3858371fed49f88c0083a4123bc022acb0624de6df7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\eb25b6a5aa4bb911_0

Filesize
29KB

MD5
a8daeafabcd6cb352ba023e9325ebdbd

SHA1
66900fdb1e3270f4b0a893c475804f7c9fb07c65

SHA256
ef7ef7225e91eeb795b8226a012ef46bc6b984fd596a48804c66f574a0c80f16

SHA512
b699b7ccb45a7fd516e3727754f06c034d26c9bf3667cbfbcd282e99d0ffbfd9ea4535ed6b074c448d41f371bc126bdd956167427d8301f345a4217e976321ad

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\edb3b6840a8ddc0a_0

Filesize
7KB

MD5
c72e439e065edd3753e95f85d58f91e5

SHA1
bd88612e80c45a15e42ecea91f474f984b1c5bf8

SHA256
7450a452d075a173b632e1831b6b36eeaa4f018584531589a33cd602fde8c7b6

SHA512
99ca0e361aa8245c005f4d2207540b9c6969d4db0f3c119862c550e01fc77915e8f606831452197f9a3ef4841a3da0503ab806373d167f7cf02316159be06b96

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\ee78db1f46fcf47c_0

Filesize
21KB

MD5
24f3300cc4be9d7b7234710f15952956

SHA1
a02a1980f5608fb76a256f84976d87fdf9cf3b7a

SHA256
b938a4f4abdbb61bc5165329b3b41fa03782d65d3808309092d6e198fb8b2a03

SHA512
003e9860877d8339c20078dc134ec2d9df31c6f9328e4d32e75a79eca2d55db3dee8c041d5518fa7f2ccf9faadb0ba7c639b116ee6c3568a7723e67f6358722c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\f078f5fb70fd150f_0

Filesize
2KB

MD5
6111c947c886d381fde97b2185705639

SHA1
f0b6e4f3a9a4dcd190d18074f21f170ecd9aa07a

SHA256
ff2ed258a82b7c30685a7d95bc08355626e3605e4f70b617beb8e8e5fea56b16

SHA512
251be7090869b22d2e0077a67b44bb920df75d2eb45969d52cf87088f84fc99c119d39fc48576dae7e1482728c7d196146170da31a6835da7e4d5070e049235d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\f2e4bbad99a372cc_0

Filesize
2KB

MD5
713ac22371a8ba9e2bace7e360fe600b

SHA1
6628a91b443e599e4ed388c6892df2979a4bac22

SHA256
11a76280121369ae1975867eafe3d476eae8ad16b39b9fd6943d4dfadfca2005

SHA512
a4bc679b471fd1b4a6ebda36d049503caa7b73c8e267a6d23ea47614cdb23b35db186975daabcdc819154f965e1d9c58ecb20a04563de0d6064fa29f5aef2f7a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\f89251fac2b69325_0

Filesize
3KB

MD5
f21bb44b872202843e2253d49ddc7d16

SHA1
624c2094c0391efe8af7c4c9b97d8c89ec1143e3

SHA256
2565af70451d81dbbba29559205beed499f4e7bea578674918739c45fa8bd415

SHA512
04b7538669440d0dc2b415155ad2afc8a1fa54f12bf21841190734d15cdee1c183ebc9f12436c94b06f91f46a74a6ea695070a802a1cdc9fc228d659167064d1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
ef6f270bb1e2a66a864e9485fe6f7032

SHA1
5770c0a44773c1cf0ffd190c514bdc717880cac5

SHA256
1526e88db34d7158efd684dad54981f11ca6be0dc37e1ad64457cffe057c9284

SHA512
c9c230b9cef1074944e4eae7b1cb88f0e8769e70a0f33e7790d68290b697564489b422c7f442b01b17badb484757442ecf3cb00209ca806c24796d410ee6d3e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
6KB

MD5
64f15e7ead7702ebef4ea7c956d3cfeb

SHA1
fc50cae9177c8a528bbd7b87762f24d137aca9ea

SHA256
9716613f0ab92e9ad05caa004c28c6cdad5c0547d511a3ff6a2694358cfeb0aa

SHA512
1b18b3fcd4fa0d3f61b66cc009d816557a100e931f88e4d2f90efbd358c924979192d00d34f2db6f144b0ff9b822057a132e6b9a77fae9e7f7c07d0694b39740

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
6KB

MD5
160fe648a3d76c4dfc086cc896420976

SHA1
57bad0744bab1b6696f6e2616e0d77dbcec3b643

SHA256
44010d0c18f578b4cf1ba6c5e9fabe3f625172dafbdc54aab888e3e94378b951

SHA512
bf67ec561bc6178b1fe3eab20b1907ae67f9530eb5b247143193ce2f796e4369a63a491a8b01baad19d2324d3c0f59960d9725b101c304607458ce848a43df39

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies

Filesize
28KB

MD5
71ae81902422fa2acae60ae9205df3b3

SHA1
d3bc36426794b0e445e321846a209d6132cf1131

SHA256
5a8025c70fcecea4c99648c22b5011c2ebb3fd12a1612cb23476d0b285620a4e

SHA512
8b252f5ad4af3f505f83ecd5e12db4b1c7e071039fe64b2d8c1fa1ff21094bf0df041d1595e323b80c44649aef3910e8dc0854d751443adafe8ab3eee2489b82

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG

Filesize
319B

MD5
6985734724b8912ec8aae6fb37453a01

SHA1
d5026e3261654da846380f5824adebca3419d40b

SHA256
d6b56f62ba5a066b6da8b2920458e19b029fea0182b4c4daf561b0dfcc48cdd0

SHA512
0c24d890223126968fabc8592a62ea93a1d857544c4575154ce96ecf623907cae969bbeedaabf5ab9bff3ab6f86ea313ddd0703ba9ba5299467cfde4f4cb627e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Favicons

Filesize
32KB

MD5
43fdaffd66f379c03cf55dff2a251352

SHA1
2df64153fbb6ec836a5cad859c9a636816f4f93b

SHA256
17328342136fc608974740908b9c7e005524ef8497d2f9f9a51ba9f832f73be2

SHA512
bd7bbbfe90b1dcb75e6f64c93f028fe497092f52995bbdd85d5402739839ebc460018f4eb06dfed9d6ddb4f0305583c76254bea47e70d0377d9132807d4ac419

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\GPUCache\data_1

Filesize
264KB

MD5
f5f585d534fb16160f4cd0f28084e424

SHA1
f09128c4504ae4377e23afab84cc5080d9fee395

SHA256
147cf9253c460f9281cfc1b02cc69b08c01cc7857f54472cb5512aea8843a127

SHA512
d08a1d4e12c52cd0344e4c4a1e00be939102a0f23ff42a06dd82d0de50808d15fcfe8bc1556c65d1e2cd7b6939d1b70ebeb95a3e9729f3d9a8e6edf1c5c2c472

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History

Filesize
124KB

MD5
181dff7d5d2735c8dabae434e29cff47

SHA1
9e4c03f05af7e3d8be4e86722c611cc6a3136e30

SHA256
27a110e8b0471fb5483571e6f153f06586d1ff12b0b053cbc5b3efe51ba8d4ca

SHA512
91e4384ae3069f57f986fe13c532c63e71f4a68a54aecb677e92b92784f3b1648bb1debb1115a2e807c35c1d1eeb00fed3c735cc35e74b505e2479cbbf88ca23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History Provider Cache

Filesize
3KB

MD5
8db561a4dcbb861278bfd5e01a973650

SHA1
643987a6199a8a0839679e1fc1460558fd0e8ed4

SHA256
12d6ef842a429225c774c5df784c778e53b66139d1e451ed6c8c28a9b6a64649

SHA512
7d90df2099adb6dcdc598c3305d4ec330df369c72cb94f272b84d24eeeba8b942403b71d37fa798924b5e720e7b0c022b17e5bd5fd7fa91a94206e1b5a34ca14

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log

Filesize
131B

MD5
76f69e67b05141d8293007f1df44f5d2

SHA1
198864513332c3c9197a5ef84a0f5801e49e1183

SHA256
d581ef73f156ef0be70674b2a1fae0bcb49d2ae728a623e8ce2404e49b21595a

SHA512
da33493b5553469de1601b3e53fb8628ae0381e3c1911d57365d9ffc3c79251c18c58ed76a9f1d6cc989ad9e196cace16811c823b233c84908939630f0ae7852

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG

Filesize
331B

MD5
a656de577b16ac3f0dbc15bd8501f21d

SHA1
b0b169618e29bc2b7e643ee0f9c0b457c21a8f51

SHA256
f048367aaa344d7f15ae724c43c3fc0d795d96b17ae339d306b4a4ded1e82b34

SHA512
e9b62e1e28d12a316b6b02ed8c79ac416246a39930c217ccba16edf40766cd78927c7c7a8dd86e3861c411c621b3d38639cd5d7998ceb23b0e837adc03d7c2ba

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
7ceba948241db412b003e00b8c22e97f

SHA1
a26da3cac73c3165a5d6b25d2bf74e73226c1ca8

SHA256
908be7a731eb9b850a9f1edbae83594b23f782b994436f3ff824a026aa9ddc29

SHA512
33d5f00c55482003e408126cdce9c958ee0917f40e46fb1d425ebb9e3b2fbb59d390ea6fc34a8e203da0a4a89020c1a404076df4b2cd88b95b32f0d8a8c6cd19

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
a319e551eab3af10f59a0b598da12ba1

SHA1
831dc4ba1e88a732eb64340bba1b8d136400ce61

SHA256
050318dc900754b565b3902cc6b1d2b5bc769a1e9999ffb3858828527d2303e1

SHA512
35d0dc433f762895166258ab41eb37f0843badcbac1d45f261ab8c649a7253e0a6958c2f89d303a293977ce7b1f211c2c9b2dde0618fb957d6f7e365371d6820

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
5KB

MD5
d51bc496ae3b2d54c08f1536b0aae7a4

SHA1
0aa606fa6e3eb8c1da67025a23ebacf52671ff2f

SHA256
87efa0a3e53cec075bc902f94aa262d813b33d1af3066ab3c97e3161167959b3

SHA512
d015f13a6f2d843ca5531135301ffed7c163d3681d3b4c0c0df6893c032c0f29e2801bf98c6e550fe647df7846dfa05b1ddc6ce04b4f34b37769948f8085a91a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
a6784a74b30b5c3a51e02d36128f1498

SHA1
e002e12304ac621e72aa2b51548faeb48e4b5e2b

SHA256
b6ffe231d5185a06beb09035f6d80e0ba2380fa7d60523db079d53e714ec4c27

SHA512
316f30a803764ef481c876722b2f35d124260fca310f8553025132e5646d316e4c9a6b7e5227e0830881392cb276f79253b7d71512fbe242a7195bddb9f6eeef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
88e91526e6eb607b3bf0128361471f5c

SHA1
c73d76f1a0ff6b5a66d1d0d39ee1a3016fccf864

SHA256
0bd298d58c3dc95e4d563fd09b9a5288b2611da461d44f795caaa9dfea3c7d76

SHA512
17d98b55b01cd22506d6332d136585260f177a7658d8f0b37f26b528e24648a09295309664eb622e4f12543cf8a1cba13684fa098d0c12ff06dc0dec352aff6c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
95efd951cee9fdc68bdb3dd8459cbe88

SHA1
de4aecaf07b9bfa723d41dfdebb81f9bc95a6842

SHA256
1b90458fcb750897a02c013e34338a6b6fa0e9e0f3177bf245e5ceba220887ee

SHA512
d1893e2cfc6090ac3e293f4ea3f9cdd5868572b74089965777a6f90b95c78ad4065ce840befe4221be9fdd3c6e4c18cb1e98a9a07151808c6578bbb6e6728df1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
10KB

MD5
c553aadbd95c0164ad0db20260719548

SHA1
5915416b9608b3ffd8c867bd6c8c4d24daf551cc

SHA256
46698402416ecb6ca0f8060a3f345c9008d24ce43cc40947ed97ee8400ce45e5

SHA512
7c98b0220ed15affdb9220dc7207c3149dacaa8b8c6225c3bd90476f94ae8bb75a4e4beb817f08c44ec1d2744306419ce2cc262831118d5f7c44fd5ce8331d78

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
10KB

MD5
2c697f4dda831bad3b4ac9fb7c502b46

SHA1
658a73230f2f6dd6a716904be8b3cc9c58debe80

SHA256
5d3c8cff8d933d01c81315ba1eaddc1aadbfccdff01f051f5626ceadb12a52b3

SHA512
d11ae9f06a1be9a47c44c3636228c88ba69084d475f6c6c3a5cd4ac30162e655e07a389c8377c89b9c911a76cbc4e7b017ca5b52132f74095597eda81e3f2d21

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
11KB

MD5
5fca63c8c30778a3a608e9fb228882c5

SHA1
980fe959a34dac0cbc96f6e3aaf601226cc8ca12

SHA256
18d06f0d987b640e3d4742f9a2a755a2c6127ac25128b06a197c7e69235e7e38

SHA512
76b318704aa9c0e6619f4e5b290d30771b77227f1f70bf69fadce4ac295f028378d6f31d79e03657b9b2fcc1adb0f7000fcf1d0334946024d4712b22c278b422

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
4ceed48120f1185760a23cd3d986053f

SHA1
c2c2ee2af33fa9a0685a57d80c3e589426f65aa4

SHA256
d15cd0f99caf967e8da46bd1316080848139ee424518cf53fe3f57003d86cd9e

SHA512
e9af5bd432f5044de56608a0af3d41b08e3a2fe20f2393e0ea33e4e7061451be0bb5570fbcb1ad0c85023e5b961f578fd3ae893ceee7972961c68f99804d8e90

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
b5018e33ae872c753672cf6741705f8a

SHA1
a27dea8d727b6aa5d9e7ebb2a7d23b42a2b05a13

SHA256
1ac14b07484cb6f92d257c0d7a51d494eeb133435a52f92026ac77833175e8aa

SHA512
276ccac91c575c236dbf8e18f35853c1a746f26b6b1eff448c7a079a34388b6a65188593004c4d70788dee1dbf6058ca29810e6de5a56f00ded93f2c5a389732

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
ae8823321e7897018cdf364170078bde

SHA1
279815957b5d336b38eb3a16cfe2ca2cec549309

SHA256
dc9033334a0db5b3bdf8a65373439029432735a941ee97f803ea1a07ac3b06a6

SHA512
a3e2d2050fec3ac6794550d8023d6aed91783554c78ea8af1218346ba9771749524ea08ed6e02d708dc647bc87bef0d4ebf9c8364eaf44c8d35cf0c94b7d7485

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
10KB

MD5
ceb197b77d369437d88470d7eb5e4c8d

SHA1
bb9106ad14b78898afe2aa48e0a56a971a174878

SHA256
837a1a087d2a21946eb656f4bd779ab386d9526ec826628b2709124fc7db5813

SHA512
13651733e990befd5c42b2fd33551b7fc2576269f4994d67c2ded0ffa79637e8499e9bbc8dd29a5819049b6b7fe8fd8a78f45f326e1764682d24d43b6d844e0b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
c3df306935015aef6aef720ced31020d

SHA1
7a51d2f1b0e05feab8b5950dbfca368863528b19

SHA256
647ee9a735e284da5c613e86f3967430dfc73e9fdf4d266bab31692c1711ea21

SHA512
2df9d5609db4babe8f9e37179de2332bb20815a4595f79c571efea0c3629c0b9d132090c71b702a0d13996a500c9d77d43cf832ffb75588ca2ea8d57c028b687

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
4abf9b9ca890c5ab2b40fb2d97c0da45

SHA1
09b1ebb536a2012510b763290e1ab8b5577a7335

SHA256
ceba411d6ee1f8770c79b414b22380abf9d18a5ecf3ed0dfc8e58dc98cbc72b2

SHA512
6c33b86b80c16f9a4059dd39946f8e91a56cb65c55071cbb1a22d9385b2bcf9a5751820f41c508155e7327d1b080634c98b6d49c3c2ee9da546d396d3682ee5f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
2959ac70ebfaeb62a50238419066cfe1

SHA1
2119126eb8b3bd9bfd616b25ae8e8fd3b49d37c3

SHA256
cac1da6a80f72b08272693a0d06393bb19a8befff695c0f91d86fd3d77530aba

SHA512
4f690a453ea776b6d44f006ebb75b1186922c5c747a7cfa174e3eaa7f721c65a13baba6beee8fdb0f7e5349d919e412439e5bdcc7b8da61a30cd16a5a5f0342e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
10KB

MD5
caa188e60a95a7d4da317637c89ec9d2

SHA1
220864bb586e619471f47c4075b86283ac6d95d4

SHA256
52268f6314ad2ce6e5f9630c492924256b9b51321fb5e173184823390bd2762f

SHA512
323e9f5bf84d51c647fdcf461a573597685101b72e071c556b63d3c11db6bc097037afc8e89f343fb177592ac616f5829b60d94a42f4ae8106b64362ad365600

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\bfaeb59486396eed9d92017d1b603e59ce130a62\1733cee0-ee33-4eac-a9c3-dc3490ed39ed\index-dir\the-real-index

Filesize
72B

MD5
e8e21480bdb8fb2ce64ade8df397a718

SHA1
75461e87e1f2ecf5f4f995565c18d9382ca464e1

SHA256
ba3df991acee320fd52fe766b0800808d49e062378f476e72f45f66e5be0c77d

SHA512
3428ebe2d31406e93200911afca620affa15c61460b2c2d4a1a423be0ba9e2b40bf191e8daaf155b7c826f901497431d639947aa03bd89bc2582ec686893d1a7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\bfaeb59486396eed9d92017d1b603e59ce130a62\1733cee0-ee33-4eac-a9c3-dc3490ed39ed\index-dir\the-real-index~RFe595c4f.TMP

Filesize
48B

MD5
3c7b84888c993a20ea31956e25059e59

SHA1
42138305422d67174bb37f5c35a37b195e7ffef7

SHA256
d09aa89ba6ac3f527ced315afd18889002c16c2c9d734e32eba915e34278b1c7

SHA512
f6c5f84de26fbadb7502c11424415d07098a740736b4df8f5561f1343e5cc891d17261ca30b1b18db00b8279cf980df172dd790460d82e9722272387b2592ec1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\bfaeb59486396eed9d92017d1b603e59ce130a62\ee5d6acf-7be8-4d74-92e0-7c8439e86c3d\index-dir\the-real-index

Filesize
120B

MD5
92a8d04f5367f069fb68ff1ac9826160

SHA1
afe5c0793f318f1fcf20efd5e5ac55a97de947ba

SHA256
8f4591c353d0d9449fbbd04b830e3771def40da78b39161d7fcc848005768b3f

SHA512
2460c16738743debba2d64f5b2a2ee70aa76ab8c0f04b6a92415a48f62efc331bd4a268da65845b6509f12889b795a64ae5186ef618972ba1523103b5e4cf8a6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\bfaeb59486396eed9d92017d1b603e59ce130a62\ee5d6acf-7be8-4d74-92e0-7c8439e86c3d\index-dir\the-real-index~RFe595c5f.TMP

Filesize
48B

MD5
e98be549b377bbb33d4b4ef688ebaf4d

SHA1
3e499e78d2c3885c70569b200d00f1e4c2ba193c

SHA256
05f9cc61339194a00b1767b255744a4ed316a7c557d65024b1a1e3c0dd351b04

SHA512
13a008744447f95f885bf72d85221cc07130a6f4317f6c46a704a3024a65d2c6aab589c3898eb3aba97036f235be1b45dde2e429aad30aaf2b89ca46a79fa007

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\bfaeb59486396eed9d92017d1b603e59ce130a62\index.txt

Filesize
183B

MD5
b6b906d24b9774a5361bd42db6ad445b

SHA1
88bb36d498130006d8b06b6cfe33885db2cccc89

SHA256
30fa0cae5a2b90dff21b0049dfc57c6b5b3fcddf532f4cc7343f27e3d3d805e3

SHA512
e373d5323dd6ceec71a4cae97fde230d5b0ff53d18dbb2ff8b5b2c0bf116570a2ad5428a81b76f6dea55d9143c593bcdc20c26319c259a64719a6452ecd75a83

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\bfaeb59486396eed9d92017d1b603e59ce130a62\index.txt

Filesize
178B

MD5
a784519e67b6123e9ac78d4cae3efa91

SHA1
af29c2ab803a3dff43e78fec935853f3b7bded88

SHA256
9dceb6675a4d18e39daab6f3fbc429ac1ef953ee98c9cca0322cfb0412bb0478

SHA512
53e7364b6ef276acf1316087995638d0f437ae98e2a3b58de937938cc2955724101c1261df2f234688407be21fd2d24a06a9a33fb7359767e399b44bf86095f8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\bfaeb59486396eed9d92017d1b603e59ce130a62\index.txt~RFe590dd1.TMP

Filesize
92B

MD5
143de67b9c68c1aca09915eb861feab8

SHA1
d4db810f4729d0c5c54bcb07082f1fb8e3881473

SHA256
224d4f642cf23c890c335a9cde5b68774be60d88ae6ca378dcf93afbcaf8c72c

SHA512
edcdf4919f43069407a86296c026de02ae4de57fa4efd1a896fb270528c2aa660e2a2a7f1dd1999c455da8a8d18994e6dccd2539859d5a28ab5f2cbfacedc731

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
5b4ca7d3bac7c15a100196e0d895afa1

SHA1
a661bf914f070ea97a2f9cecd5defbf4b69871d8

SHA256
3ed159bf2d64a1472199d0f5c7a077f9cb5aaf7a05f9602b7a770c3898741a98

SHA512
bbaa3831511f5fb0d624058ae854105f9f9ad551fdb4b288a3dc3f49b4d2ab536f872a1637a8444f6af4d053385a00e65434f4ee3a6f34fc7d656e2c80e2beeb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe595ba3.TMP

Filesize
48B

MD5
bbfaf93eeb37d6bf32a68975af21dc79

SHA1
7008bb3ecfbd4c11220f84352fd323f525740e07

SHA256
44cf979c16d5bd9b2a984a427c1c2f900a503e457cdd8a0f4f80d1cbec82e5c1

SHA512
e861f4a019298fd0dbbb344bf864ce2c76dfc3f38d8c9520a61bab775bb7c907511a7f49baaeda52857fb92ea08328739ef91e8c30a82a15e04cbce56fec1c2f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\000003.log

Filesize
498B

MD5
83d04b159b495d77365c271a183212fa

SHA1
8dec45ca0e56ee60332bdbbfe365a2d7176f6b39

SHA256
5a2a2dc669645a790ec243d21f5aae177c4dcf7a8ccaac52c7647cf95815b065

SHA512
fdc6110a37ae3bb3d1dfd87b417ed764c359c81256440323f2da847c2e686002ab62233af6bbf5fd5108e6c0e26faa08476af4b65b2b6bb53a0f71bb37108b5c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG

Filesize
319B

MD5
ea8c68a84c34a71aea8ccd0b63197d26

SHA1
f2f14b6638ab0e261e08df55d904507303bc53d2

SHA256
bea6f38368187ad2a5fd14215e23ea3e8afdc458d881b7b327a549b0b0f5ce2e

SHA512
c7455492ccaeb729391b97dc70407e72bdd3bc149c6e1166abd3fe3e43c6d7047ae81156744e0d8bbf7b4499686208e4158bc1f5f1c57d3f122548805b645e63

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sessions\Tabs_13361140071471472

Filesize
12KB

MD5
256c3238c95204f5259fb8ff39f60b5e

SHA1
da5480382c48f5ff93afa815c276103960d1bdbe

SHA256
1f7de2e4087fda7f5c7544d66b04b012f643594e9a1841ca359a977a14fea396

SHA512
fb429467cf737219c53d632679a3c9649c34b5fee689f21d6f8e27bf5bbed517e8b19676d574e9f033c92d6daff5d0249f12225c37a491228dc572b5c1872c1c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\000003.log

Filesize
328B

MD5
378676c9aa15a1ee1c519d378341c6e1

SHA1
feb80ac63fec3a2ed747ce3a6b7636c28f4d5d1e

SHA256
897330331a3e1f37ee6809d7be065e1d1cee62a15727e751848697ea7760e1c1

SHA512
e4fac598e8ffdae582b41c5b26a0b89cca20b784ec40e97a63db566a4233c4f8baa091d9c09d9f58ed3720b7a646110a8cf1284bbb8cf7173ad3dd01b99f2a97

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG

Filesize
350B

MD5
c30a118fb2915b0d799be27147415f4b

SHA1
1889885ea95e22b0e87aa196f48a49cff9509c81

SHA256
dd57c7c8a0a5c04b4631d83d6611c7b7fac11c455a9aaa765ae483c6ee89128d

SHA512
1504a1922164e721c0071c0402cf3799c5508f414ad32732dd06a5009d71edce9fe0ff43f78f1c346ef41114371349725a717efa3d7efca9f46ab9844a320181

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG

Filesize
323B

MD5
0bcb2fb31a26895ca51f76ecaba50ece

SHA1
44e8b953412a7d47de970f56f04c1748188ab1d5

SHA256
c127c841b689fe3a0233c2a6320a878b53e3f42031a1e5e7f90b65b76d601a7c

SHA512
eb891adf3b7552b8214c1fb6382b67aef367825a060efba971ae62c55f314e9b2fd5b73633729cdf8b7ef8dfd7b69adfdb228963ec782c2246562b5992c3a004

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
538B

MD5
a985888c00257edd54815292acff398d

SHA1
0a94c813e9c4a8de31c4a85aad8f4316d7da8952

SHA256
a8e3c5e43f79a019111767a6530fdcdddc4ad94a74c56e3b75d0d285d462aeb8

SHA512
bac328958dcd4e1eff9caa9564e420ffa17d83a0653ecb51f9805d118affeb547977efdc55b2deab5d6c1c28412996dab2214071f5721773443f2a7c5d126f29

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
f0f967e87dabe01c2f91cc188d3af760

SHA1
2fca35cbb3d4a45e22bfa13ef326d246b5f5a5ea

SHA256
e3617f37cbd5bd486dfc609a0f493312ccf50e87e2e29b0ddce5bc5c81c3d0b3

SHA512
d20b65d94f0f43dc0c2b76423b5a6668b577b738e8838401fc566d494560a1d5a63025d92e308741244153c074ddd5536555218b5d60bb059f155d920dcd188f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
42aafdfee4741507c3e10c0ee39f17aa

SHA1
ba7b0ac5bb7460439f18724304391e8de2b21a85

SHA256
376db74ce9eebf2c472ae6037cf9ff9fedaf8e603093bb07899560e603e7adea

SHA512
e2d308bf76a8df36d2fff9e8bc117d69b9b7e32ef3fafc99b373d2b43c87524b124b1ae75474611cdf2a70831f549b0ee0c2fbb0e77ec03a3db6b897be4ae769

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
538B

MD5
41b73a2c0603e768c886be2de42173ba

SHA1
65b979dfe7ea4282cd1a3cc9f658be862143dbfb

SHA256
34cd4881561b349b8822b9958a7d496f907668b2ce16e4dad49c9920f8058785

SHA512
f586f50c7353b64430f765efea17ea8bce66fdbe6f763b9d6df52b0b51555340813ff92f59799775fc9e7185895fbb5b2c5e0f3cf3bfd17e0970484314231e36

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
3ac0fe808b5cccd83be6a2d4b0c2d771

SHA1
9cbdb2499a6427ef957e280bf837c4d906e691ec

SHA256
e8f6cee80b89394ddcaf6d0edf5c8ed38b45d1f5f4df31442bb9f6803b4b2185

SHA512
90f15e77c737f31eb8af9d8968317063f7b570cb11c41ce7686e9c48b0019e6b57275c4db5a3c1e080c2465c3ba11eca54bb3a42a4e7dd1741d5e2db363071e4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
e574d7c2cc7b59704fa65ffb2f9bf1ec

SHA1
fb5d1cbf8ae4c586dc1dffc2d82ca120c78a0b22

SHA256
1879c9593dc3321fbd912c22b9f1213b93091e0f99823cf90acb37f0d6fa3eef

SHA512
86b4b19166ebe45d20198257558ada90001562dc026a91f9710097464ce61c30f8cb06f5a5a72e0fbea5124401ec920ef2a749496b3c67542ec916ff60c9af89

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
829d57605d7d596255114d179bbd72f7

SHA1
9fb6ab3fe28f88c75f490bfd837744c40d3c7313

SHA256
c84f89fa2c45e2cb31760365e66866dab465ac5c0c8f0648e3ec0dc3727ab101

SHA512
9c5f49a269b38d61fc92af662cd8e025d675a72af5c679cbe59a4823e7b2c4ad81ea97c1bbbfab07fef19880f3028888027da089beca1625618a9a8e3fb36d4a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
ea9977ff70ef014708c4ccfee396f035

SHA1
1d04a7b673a3877a77705696e3ea208cf4b7c3ec

SHA256
35988351d1e9caa6735c47f81849af0e5e2b62d26b57bb19f94ffd7837e912ff

SHA512
643e0ec62a4c0180f882c902e2110a87cae729459b7eeca9af320678831a097b1c3cb926dc2eec0bd4632538af315db550ecffe433d84b3c607ab52d75b8c52f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
474d57b729847197ebfa3b19383f5323

SHA1
13084335b1a6839f88abeca534eef44930d71edd

SHA256
5c061ced27efeb7303a50fb787273a3cfca1fcf84167adf11ef1ec9c2657cacd

SHA512
ba0847a6ed8603203335c8d868949c3dbd3c600c4ad940eae5a697d7c72f46c2edbd89ab9aa7391bc92689a5cb87cbd5f6e15ccebb6ba29172932e3086947621

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
be62491fcc2771907deaf7066c29b854

SHA1
5faa9e96bcb2970bceea79cd6f7b483d0c2d0ff7

SHA256
19b0df6b605482be0ef91009a4303ffc8a885208d19030f92765598def85fcaa

SHA512
3c831acae6f4817d8864a50c7fc28a311956cf72a65fa275e10076ebde31ad29fca11714c440e35ea74422d2f280db45cdc87d5c2a2037d79b9d4c824bf94eb6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
ff3ecff595f51e5c97440ff511a73101

SHA1
7beb859221f85d3e9676dc4e2e67de3e2c57e9b6

SHA256
c9a305861ee2979e84263da91eba459ee6b0a21cfcd89e969df0e30038c510c9

SHA512
43ec14cf3d791c83849cc615436703e9ba4bd22cd0bf94b6212b297450201db1f50afa4069e9c12945cd2833f5d5a3a84147e6ccb8deb0bea1b02b1ad9edf7d9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
a354b971fc864f1cb5cf2e9129481920

SHA1
1e8bb369d5c4bd79bbd52d11f03afaea8c16fe3b

SHA256
cd0c6129444e7de504d5f0d0bec4b7f17f6daf69fe9d1f6027e1826293fe8eb3

SHA512
999f52211506c59cde86f7963b35058039140c8be8130ed270a4deac268990c22cdbdf3b4164800e4d5ffa9595f7866ed4a92730b7e6c2b1cc4bd4d2427f0082

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Visited Links

Filesize
128KB

MD5
0c5607dd4c695ff434ecd627f8206702

SHA1
d83124e91c0df96d1ac71b440bc3411dfd119a57

SHA256
70c1c6a918dce8423aa2266cba65ef56fccdb66a6b8a903f6764d65c74b986fd

SHA512
764d7a7f4a147db2cca789e838349bce8a0d52e51b96ec98cc2a331351736858e480ec25a88c72f597cf1430cd69b805837ec4db56dc3192246bd73aa8040fc1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data

Filesize
116KB

MD5
a399e5d1fc226fe0c4e31dc84e10f1ed

SHA1
5140c87599fb87192439986b85cd18297da28f8d

SHA256
c9656a85a314fef082cc62378726feb50ab14c4a146b91ef2f3d4a5167bd8d6e

SHA512
1ff2d8835fa2d12c8dfcf8ed64f7f10e749dad6fee601e945292f7959dc03a863b565ea44615655ab3f47d6c4f17176c15bc9fcecca301e64ba0be83e5cd5ea0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db

Filesize
44KB

MD5
0340ac39ba337c01a66581fded8dc7c3

SHA1
8562018b74516d8832a1b2347ea1930afd01720f

SHA256
cb77eddedce623be33ce57a699a9e25687f6ddfe31ef7d854a8cfa20e683cc49

SHA512
f374777c1391872dc45d26c55cafcb6bb7d3d75e6fd927f14f6986d89039fbbf6ecb89709c6f6cad60545cef28abf31305f1f2eebedc84d7636f045c2eee921f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log

Filesize
187B

MD5
24aeffec4aff2925d91385ccbe2ed6f0

SHA1
e29634efd4c125cdb8efc424a927470d95b0ec1d

SHA256
83a699600123ed00d9f66bba846e191600e1cbbdce4dfb8866381b4388d1bbbb

SHA512
1ddcede6b01d0070516374930880cc6bf279aaf148df729737631f405776e2322deda73cbbc4752e65b9519bf790d7e65267442d164f9cde95d8c9de134b8a14

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG

Filesize
322B

MD5
bb32d4d579936217abb118be1e168a2a

SHA1
5330ea40a6361f37ff5c5b43ce0e1ce746752f96

SHA256
d1ac8509c8248aee299fdc02985cacf5d6545eeff50f9ddd13ef6a5729e46323

SHA512
b9db0cdb4856df07a2f4e01618f4a363a58db9909cd5a4d37099d375efa0eb177aab7ae16a1e6ab96c52c1aa9879ec10725f75a103d1e13f4964738f433f0d04

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log

Filesize
594B

MD5
e2ce5ff61eabe914b0f4db6dfdee6acb

SHA1
cdf18958ca03951e0286dd1f0d6ec1657b05a0bb

SHA256
e170e12235bfc58a9eb8fcb2d08bb1a7a98f20a202163e872c4d9c51f27322e6

SHA512
5d978a099586dab3fc25f09b6b9af4240025fb783427d51777879e1247fd0a9a823236f457a6b63e892b7fbce4adc44536f124b99916a41c59769bb3e2f28f09

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG

Filesize
340B

MD5
5cd3299a92a85bcace698d92810da94b

SHA1
358b4ce7f013f2eb288f9422944091604a8bce31

SHA256
edd3f76a81c6ee6f7243a1adcdbd47906be57bea3c234a147eba8173697494f8

SHA512
9044499e23997605f825f8c80173edc331991813b1349e465ede6f5c1ee04b9767cba16c944cd7c4f628508247a49b13b25b6e598f3f978a74b907d47d556a1a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\data_0

Filesize
44KB

MD5
53e0515554d56d9d678f68560e1ed385

SHA1
1016173f9211ab4b6f16a43804c7a96d9ee9f6e9

SHA256
f4a9a804e02cff14361afc7a7d1b8186738f1ba7161f2107ea53471db8986eac

SHA512
1fbd73260a8cc76423b49080d1cc8691174eb5ad84c4688e62ada6984b84af7523b740eb191b5036cc64745f3842301da05a3107423e8c2e3a8ae305df8efc9e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\data_1

Filesize
264KB

MD5
29f1983117f1e3740199d94324f07519

SHA1
50298484807b316ad3559f597eefa421ba2275c8

SHA256
9d5e16822f82a651839ec5ca72458b454354049ccb3c1c3237c195ebcdb29ca6

SHA512
e028f015887995bc2f3e45d4cf95707a59ac01f62101a87f1cf86e2d0ef726e04af76f5f121bc1496ef125cee69fb1d808c05ed7a4166e1634d5c7cdf8518001

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\data_3

Filesize
4.0MB

MD5
90fd6ba2c221ffb257209571aef132bc

SHA1
21b9c0529324c1bcd306449352e55d13e4904e7a

SHA256
ab6461ad302cdb0c98cc7e57277cf70507c14e56bde76c44a95b006ccc05c75a

SHA512
839654373015a2f1c740fc519dda6433bd60de3d7c30d7cedef630ce6bf5c4fa36207944183d9ec4b4eb85cf18a700cfe7895a0639c3d05790df6efd9197437b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\f_000001

Filesize
22KB

MD5
1ac9e744574f723e217fb139ef1e86a9

SHA1
4194dce485bd10f2a030d2499da5c796dd12630f

SHA256
4564be03e04002c5f6eaeaea0aff16c5d0bbdad45359aef64f4c199cda8b195e

SHA512
b8515fb4b9470a7ce678331bbd59f44da47b627f87ea5a30d92ec1c6d583f1607539cd9318a5bccf0a0c6c2bd2637992e0519bd37acdf876f7a11ed184fb5109

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\f_000002

Filesize
17KB

MD5
913728da90cf90d8e78af59c60b47c3d

SHA1
f42f2a545d4fcaf4f76d0f060f52e33a47df7f1e

SHA256
b0b478f9aa6aaf8d5811e296047ae1f8ee07f4c4998fe9d7b960755ea1fafb82

SHA512
3af86e053dd56aef03e6f967a49b1a0d492616a71e2e49090e0c8e5cbe58ff37ccc55e91f06bf34096059a49f3de84b0bca587f3f17c366f97c0f7a0fd17c974

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version

Filesize
11B

MD5
838a7b32aefb618130392bc7d006aa2e

SHA1
5159e0f18c9e68f0e75e2239875aa994847b8290

SHA256
ac3dd2221d90b09b795f1f72e72e4860342a4508fe336c4b822476eb25a55eaa

SHA512
9e350f0565cc726f66146838f9cebaaa38dd01892ffab9a45fe4f72e5be5459c0442e99107293a7c6f2412c71f668242c5e5a502124bc57cbf3b6ad8940cb3e9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
af89e80ce72b17848dd15ff22b2c04bd

SHA1
2007336ad0393150c0220d3baf3ee9ae3dec5b35

SHA256
962a96696ca7b4d1bd4af57d726dd453974fe66f35711f6011ce2372c7a09ce7

SHA512
542e67d8171f93fe8765ed3c006c08228184a1e09f43e3cdc44f306e8e591b1e00ef130c8b0422cadb42531562d82cf4e9e9e7669d69f94b37c021280586a1a0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
3c3e733db97cad70af97c25c3728f5d0

SHA1
c0b36ba08f4f98fa248e87f51e0ed487aadef0a3

SHA256
cd2aa830e7ef24a1d700b10cb0bac418ff5d4b6c437c12085c7d88ed033cc1b1

SHA512
c1def354b73f597f35d06c85ec3a9d138c279faf21f5992179e2d5f147ca4bafb1b7c58ccfd556b69091bb6e25dc2b20d9f688c221ea204c90f69977caf86665

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
c5c557cfb440cc435d3454737eed834c

SHA1
bfd99fbbf956c37d95156b6c2768fb882281345d

SHA256
ad11c0f0f82b333d92b0cab805f3ecbf506c474ea9605ee1f9a1f2a8d8226f4e

SHA512
4acd82e8254968f009483bdf1e7f826c67ef1a55eefec034076f1d82709aa0e5e6de09a347a731623bebc048713444d9f73f71ec67dfd5057a8cd45e24e081ab

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
32ac2311cb4f23e191213283113f6fc6

SHA1
7286c13fc9e61b6da1a9ba58cdf2ee5b23263d5a

SHA256
fb1cdcb26830679f52521d9e60a76cc125f683a29e0aa2654228e86c88421b9f

SHA512
5f2ab57b6ad83e49fd154f676eec2bc538f188af2690d8fd65dec54c0c0e4d9eb5c6b4e7d4fea0a59d78d3e95e4d433b1ddd4ac916342aa2121f9020045dc130

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
eb28d26cdfa4ed80be15016444aaeb78

SHA1
184a8605791882ef21de21d69c0c0c9d99a1e37e

SHA256
96cd7fae7b70c5f963958bb8d1019050547c65bab740c1bd7ef101127d103107

SHA512
2b67e6259d1d0fd464f86190e3206d954e28923553655cafb15fee9577d7f0bf4a2b0b902a145366581abe85c7f228186f3b24bb024bdfab3eff2b0c00f16ae7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\GPUCache\data_1

Filesize
264KB

MD5
bb08b33f571d577f8a2ddd2ada37cd12

SHA1
0d7ce5b5a27e569b7af29f83e1d7b0177bcdfb31

SHA256
5e1fcdf2fe49ee405873db9f7e7b35c85405919cdd0fcee6ef17211883280bf6

SHA512
723fd897c4835f3499148fd3680520af2fc5b1f18872339f285fa92d26287fed99db3cb26d5d10df9b94afe392dc9636931068cb49974a542cb287ee8efcc8ff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\9cd93bc6dcf544bae69531052e64647ec02f2bb4.tbres

Filesize
4KB

MD5
916a2bef5cdbf86c31c1f779af058231

SHA1
f83186a9d207232751dc538c3a1cc670d9302b9c

SHA256
d354f11a79a719fdc804a22e633c685db8ce6075af96f9fb6fbd9d9e131dc4b7

SHA512
e14636ca0511e1a4bbc8ec6936ae6f6206b948b58b325326ab4f2d4064d365bf55854dcd4d913308457284ceff642fdc588338cfcc6fcf4062c8d137f135aa93

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
13KB

MD5
4e8c62897e8ed36f921b4f1612fe2205

SHA1
365e4392e74cc859a8d5b9d81ca01ce9ae77f425

SHA256
02d4b9708ce5805e3fc9397e0c7989ba50e3eb211881fe8d6b2b80923bbcfce7

SHA512
f363b5bcf3952e82c3087d65ac5c8c20927c24d6a8ed9b3c02395d7a34bc75405edce9e3d98e71a7ee4f9da8912dfd085e6544f0d4ce5da74280f4d658b548ab

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
13KB

MD5
cb1f8ccfff34403e191c1bc8830072a3

SHA1
11a3cc9a329ec57465978870bb54bad32871895b

SHA256
3af5bae8d0325bc1ce5c85637b351309b6932da012fad9f64c6236bbd030e939

SHA512
e92ca1ce703abc90aec27333702c2be9385a9196d8d31f685a70f8ee386c515e146f0d68119042e7d47de194aed51d55961ce4b61c61c0cf73673f590a193f9b

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
13KB

MD5
090133ef22489632f1964d046efe9ffe

SHA1
eb27ea259776c972df8b076a6875a9f6bd9629f4

SHA256
de89fe7a66df0d177fbff48f38f7ad1c8ac3875afd0a50914f203f7bff75d858

SHA512
086243f4c5397106700c590c16ec6f509765613add5b3df128f011847dc092a453ac653731e2fcae22c75e95146d83ecc9f482eb05687932dbb7e00711a7d0f9

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 101959.crdownload

Filesize
31KB

MD5
29a37b6532a7acefa7580b826f23f6dd

SHA1
a0f4f3a1c5e159b6e2dadaa6615c5e4eb762479f

SHA256
7a84dd83f4f00cf0723b76a6a56587bdce6d57bd8024cc9c55565a442806cf69

SHA512
a54e2b097ffdaa51d49339bd7d15d6e8770b02603e3c864a13e5945322e28eb2eebc32680c6ddddbad1d9a3001aa02e944b6cef86d4a260db7e4b50f67ac9818

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 101959.crdownload:SmartScreen

Filesize
7B

MD5
4047530ecbc0170039e76fe1657bdb01

SHA1
32db7d5e662ebccdd1d71de285f907e3a1c68ac5

SHA256
82254025d1b98d60044d3aeb7c56eed7c61c07c3e30534d6e05dab9d6c326750

SHA512
8f002af3f4ed2b3dfb4ed8273318d160152da50ee4842c9f5d9915f50a3e643952494699c4258e6af993dc6e1695d0dc3db6d23f4d93c26b0bc6a20f4b4f336e

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 179472.crdownload

Filesize
84KB

MD5
b6e148ee1a2a3b460dd2a0adbf1dd39c

SHA1
ec0efbe8fd2fa5300164e9e4eded0d40da549c60

SHA256
dc31e710277eac1b125de6f4626765a2684d992147691a33964e368e5f269cba

SHA512
4b8c62ddfc7cd3e5ce1f8b5a1ba4a611ab1bfccf81d80cf2cfc831cffa1d7a4b6da0494616a53b419168bc3a324b57382d4a6186af083de6fc93d144c4503741

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 502862.crdownload

Filesize
5KB

MD5
fe537a3346590c04d81d357e3c4be6e8

SHA1
b1285f1d8618292e17e490857d1bdf0a79104837

SHA256
bbc572cced7c94d63a7208f4aba4ed20d1350bef153b099035a86c95c8d96d4a

SHA512
50a5c1ad99ee9f3a540cb30e87ebfdf7561f0a0ee35b3d06c394fa2bad06ca6088a04848ddcb25f449b3c98b89a91d1ba5859f1ed6737119b606968be250c8ce

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 996703.crdownload

Filesize
756KB

MD5
c7dcd585b7e8b046f209052bcd6dd84b

SHA1
604dcfae9eed4f65c80a4a39454db409291e08fa

SHA256
0e8336ed51fe4551ced7d9aa5ce2dde945df8a0cc4e7c60199c24dd1cf7ccd48

SHA512
c5ba102b12d2c685312d7dc8d58d98891b73243f56a8491ea7c41c2edaaad44ad90b8bc0748dbd8c84e92e9ae9bbd0b0157265ebe35fb9b63668c57d0e1ed5f2

Download Submit
\??\pipe\LOCAL\crashpad_4976_KTWJEXMLVHPYJYCT

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/228-1719-0x0000000013140000-0x000000001320F000-memory.dmp

Filesize
828KB

Download
memory/1028-1677-0x0000000000E70000-0x0000000000E71000-memory.dmp

Filesize
4KB

Download
memory/1816-1782-0x0000000013140000-0x000000001320F000-memory.dmp

Filesize
828KB

Download
memory/1976-1739-0x0000000013140000-0x000000001320F000-memory.dmp

Filesize
828KB

Download
memory/2060-1716-0x0000000013140000-0x000000001320F000-memory.dmp

Filesize
828KB

Download
memory/2148-1722-0x0000000013140000-0x000000001320F000-memory.dmp

Filesize
828KB

Download
memory/2724-1779-0x0000000013140000-0x000000001320F000-memory.dmp

Filesize
828KB

Download
memory/2884-1773-0x0000000013140000-0x000000001320F000-memory.dmp

Filesize
828KB

Download
memory/3016-1757-0x0000000013140000-0x000000001320F000-memory.dmp

Filesize
828KB

Download
memory/3016-1770-0x0000000013140000-0x000000001320F000-memory.dmp

Filesize
828KB

Download
memory/3612-1562-0x000001CE68180000-0x000001CE6819E000-memory.dmp

Filesize
120KB

Download
memory/3644-1760-0x0000000013140000-0x000000001320F000-memory.dmp

Filesize
828KB

Download
memory/4196-1751-0x0000000013140000-0x000000001320F000-memory.dmp

Filesize
828KB

Download
memory/4208-1736-0x0000000013140000-0x000000001320F000-memory.dmp

Filesize
828KB

Download
memory/4512-1728-0x0000000013140000-0x000000001320F000-memory.dmp

Filesize
828KB

Download
memory/4904-1785-0x0000000013140000-0x000000001320F000-memory.dmp

Filesize
828KB

Download
memory/4932-1592-0x0000017144690000-0x0000017144FA4000-memory.dmp

Filesize
9.1MB

Download
memory/5216-1725-0x0000000013140000-0x000000001320F000-memory.dmp

Filesize
828KB

Download
memory/5304-1766-0x0000000013140000-0x000000001320F000-memory.dmp

Filesize
828KB

Download
memory/5532-1710-0x0000000013140000-0x000000001320F000-memory.dmp

Filesize
828KB

Download
memory/5624-1776-0x0000000013140000-0x000000001320F000-memory.dmp

Filesize
828KB

Download
memory/5804-1709-0x0000000000760000-0x0000000000761000-memory.dmp

Filesize
4KB

Download
memory/5828-1763-0x0000000013140000-0x000000001320F000-memory.dmp

Filesize
828KB

Download
memory/6116-1754-0x0000000013140000-0x000000001320F000-memory.dmp

Filesize
828KB

Download