Analysis Overview
SHA256
e766bc3bd8513eadc0d54e511049f1d35bc5c503aeef6cd38aa500d39d66da11
Threat Level: Known bad
The file Nursultan NextGen Crack.exe was found to be: Known bad.
Malicious Activity Summary
Xworm
Detect Xworm Payload
Command and Scripting Interpreter: PowerShell
Executes dropped EXE
Loads dropped DLL
Checks computer location settings
Adds Run key to start application
Drops desktop.ini file(s)
Drops file in Windows directory
Unsigned PE
Enumerates physical storage devices
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
Checks processor information in registry
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of FindShellTrayWindow
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Scheduled Task/Job: Scheduled Task
Suspicious behavior: AddClipboardFormatListener
Checks SCSI registry key(s)
Enumerates system info in registry
Suspicious use of AdjustPrivilegeToken
Modifies Internet Explorer settings
Modifies data under HKEY_USERS
Suspicious use of SendNotifyMessage
Uses Task Scheduler COM API
Modifies registry class
Uses Volume Shadow Copy service COM API
Suspicious behavior: EnumeratesProcesses
MITRE ATT&CK Matrix V13
Analysis: static1
Detonation Overview
Reported
2024-06-25 13:03
Signatures
Unsigned PE
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Analysis: behavioral1
Detonation Overview
Submitted
2024-06-25 13:03
Reported
2024-06-25 13:43
Platform
win7-20240508-ja
Max time kernel
2333s
Max time network
2276s
Command Line
Signatures
Detect Xworm Payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Xworm
Command and Scripting Interpreter: PowerShell
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
Executes dropped EXE
Adds Run key to start application
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\wininit = "C:\\Users\\Admin\\wininit" | C:\Users\Admin\AppData\Roaming\Nursultan NextGen Crack.exe | N/A |
Enumerates physical storage devices
Scheduled Task/Job: Scheduled Task
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\System32\schtasks.exe | N/A |
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Roaming\Nursultan NextGen Crack.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Roaming\Nursultan NextGen Crack.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Roaming\Nursultan NextGen Crack.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\wininit | N/A |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\wininit | N/A |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\wininit | N/A |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\wininit | N/A |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\wininit | N/A |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\wininit | N/A |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\wininit | N/A |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\wininit | N/A |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\wininit | N/A |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\wininit | N/A |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\wininit | N/A |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\wininit | N/A |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\wininit | N/A |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\wininit | N/A |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\wininit | N/A |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\wininit | N/A |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\wininit | N/A |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\wininit | N/A |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\wininit | N/A |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\wininit | N/A |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\wininit | N/A |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\wininit | N/A |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\wininit | N/A |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\wininit | N/A |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\wininit | N/A |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\wininit | N/A |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\wininit | N/A |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\wininit | N/A |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\wininit | N/A |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\wininit | N/A |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\wininit | N/A |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\wininit | N/A |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\wininit | N/A |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\wininit | N/A |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\wininit | N/A |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\wininit | N/A |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\wininit | N/A |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\wininit | N/A |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\wininit | N/A |
Suspicious use of SetWindowsHookEx
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Roaming\Nursultan NextGen Crack.exe | N/A |
Suspicious use of WriteProcessMemory
Uses Task Scheduler COM API
Processes
C:\Users\Admin\AppData\Local\Temp\Nursultan NextGen Crack.exe
"C:\Users\Admin\AppData\Local\Temp\Nursultan NextGen Crack.exe"
C:\Users\Admin\AppData\Roaming\Nursultan NextGen Crack.exe
"C:\Users\Admin\AppData\Roaming\Nursultan NextGen Crack.exe"
C:\Windows\system32\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Roaming\и.bat" "
C:\Windows\system32\chcp.com
chcp 65001
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Nursultan NextGen Crack.exe'
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Nursultan NextGen Crack.exe'
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\wininit'
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'wininit'
C:\Windows\System32\schtasks.exe
"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "wininit" /tr "C:\Users\Admin\wininit"
C:\Windows\system32\taskeng.exe
taskeng.exe {2BC84334-8B44-4FCD-9E49-2607A3EC2640} S-1-5-21-268080393-3149932598-1824759070-1000:UHRQKJCP\Admin:Interactive:[1]
C:\Users\Admin\wininit
C:\Users\Admin\wininit
C:\Users\Admin\wininit
C:\Users\Admin\wininit
C:\Users\Admin\wininit
C:\Users\Admin\wininit
C:\Users\Admin\wininit
C:\Users\Admin\wininit
C:\Users\Admin\wininit
C:\Users\Admin\wininit
C:\Users\Admin\wininit
C:\Users\Admin\wininit
C:\Users\Admin\wininit
C:\Users\Admin\wininit
C:\Users\Admin\wininit
C:\Users\Admin\wininit
C:\Users\Admin\wininit
C:\Users\Admin\wininit
C:\Users\Admin\wininit
C:\Users\Admin\wininit
C:\Users\Admin\wininit
C:\Users\Admin\wininit
C:\Users\Admin\wininit
C:\Users\Admin\wininit
C:\Users\Admin\wininit
C:\Users\Admin\wininit
C:\Users\Admin\wininit
C:\Users\Admin\wininit
C:\Users\Admin\wininit
C:\Users\Admin\wininit
C:\Users\Admin\wininit
C:\Users\Admin\wininit
C:\Users\Admin\wininit
C:\Users\Admin\wininit
C:\Users\Admin\wininit
C:\Users\Admin\wininit
C:\Users\Admin\wininit
C:\Users\Admin\wininit
C:\Users\Admin\wininit
C:\Users\Admin\wininit
C:\Users\Admin\wininit
C:\Users\Admin\wininit
C:\Users\Admin\wininit
C:\Users\Admin\wininit
C:\Users\Admin\wininit
C:\Users\Admin\wininit
C:\Users\Admin\wininit
C:\Users\Admin\wininit
C:\Users\Admin\wininit
C:\Users\Admin\wininit
C:\Users\Admin\wininit
C:\Users\Admin\wininit
C:\Users\Admin\wininit
C:\Users\Admin\wininit
C:\Users\Admin\wininit
C:\Users\Admin\wininit
C:\Users\Admin\wininit
C:\Users\Admin\wininit
C:\Users\Admin\wininit
C:\Users\Admin\wininit
C:\Users\Admin\wininit
C:\Users\Admin\wininit
C:\Users\Admin\wininit
C:\Users\Admin\wininit
C:\Users\Admin\wininit
C:\Users\Admin\wininit
C:\Users\Admin\wininit
C:\Users\Admin\wininit
C:\Users\Admin\wininit
C:\Users\Admin\wininit
C:\Users\Admin\wininit
C:\Users\Admin\wininit
C:\Users\Admin\wininit
C:\Users\Admin\wininit
C:\Users\Admin\wininit
C:\Users\Admin\wininit
C:\Users\Admin\wininit
C:\Users\Admin\wininit
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | seems-poet.gl.at.ply.gg | udp |
Files
memory/1724-0-0x000007FEF5203000-0x000007FEF5204000-memory.dmp
memory/1724-1-0x0000000000230000-0x000000000026A000-memory.dmp
C:\Users\Admin\AppData\Roaming\Nursultan NextGen Crack.exe
| MD5 | a9aee64b701db5f8cfc3c963872403b4 |
| SHA1 | 48079f6822d84ea354f301cdb97d2ecb59552e06 |
| SHA256 | f46d7ae8973b42a0cb892c6aa8d6a559b4cc1d0c67b1d5df3072c4f7f77b53fb |
| SHA512 | 696e745d488841c3b1a55a350d754b69a1d6b0d83fd9eac247229239951b12bfd98d8cbbcbfffd567966495a10950040edd77398702763071f6eeb50f13a3a1e |
C:\Users\Admin\AppData\Roaming\и.bat
| MD5 | 9885bc1f632421f329efe28818361344 |
| SHA1 | 9d0838fa885728361703a6e2b36e2aa3603b05ce |
| SHA256 | 6a218880f23edb2a809ee20919f355f80ef4a0b545c3d79ffa8c848441eced7a |
| SHA512 | ddb5252457e9e02a91073f58662cd2eb72d670827f5173e8705c9e41d55a4ba4efdab80f24371ff61573d250f7b8463ce05f9cec7c48085dcacd38cd21e65203 |
memory/2944-15-0x00000000000E0000-0x0000000000106000-memory.dmp
memory/2944-17-0x000007FEF5200000-0x000007FEF5BEC000-memory.dmp
memory/2120-22-0x000000001B210000-0x000000001B4F2000-memory.dmp
memory/2120-23-0x0000000001F20000-0x0000000001F28000-memory.dmp
memory/2120-24-0x0000000001F50000-0x0000000001F60000-memory.dmp
memory/2120-25-0x000000001B550000-0x000000001B5A0000-memory.dmp
memory/2120-26-0x00000000023A0000-0x00000000023AA000-memory.dmp
memory/2120-27-0x00000000023B0000-0x00000000023B8000-memory.dmp
memory/2120-28-0x000000001B9F0000-0x000000001BA48000-memory.dmp
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
| MD5 | 686cb6753954c3613d18ea3cb7143850 |
| SHA1 | 711538c8ba1620bf30d4a850ed1c9e9e59f0c871 |
| SHA256 | 775c4c5d814383eee35b06b264635b3991d671f2789d1edaf3fd9135f8b0abe2 |
| SHA512 | b8aa57de53833bf30bc1f01b2102b90718a365b08078adf92b3955aa67ece7ebd4594ca8ffd9d18aa0a5ce5dd6c08d5e1702cb3dc404cb3ef22e033cd82afaf5 |
memory/2772-34-0x000000001B200000-0x000000001B4E2000-memory.dmp
memory/2772-35-0x00000000024A0000-0x00000000024A8000-memory.dmp
memory/2772-36-0x00000000025F0000-0x0000000002600000-memory.dmp
memory/2772-37-0x000000001B4F0000-0x000000001B540000-memory.dmp
memory/2772-38-0x0000000002690000-0x000000000269A000-memory.dmp
memory/2772-39-0x00000000027C0000-0x00000000027C8000-memory.dmp
memory/2772-40-0x000000001B9E0000-0x000000001BA38000-memory.dmp
\??\PIPE\srvsvc
| MD5 | d41d8cd98f00b204e9800998ecf8427e |
| SHA1 | da39a3ee5e6b4b0d3255bfef95601890afd80709 |
| SHA256 | e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
| SHA512 | cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e |
memory/2944-53-0x000007FEF5200000-0x000007FEF5BEC000-memory.dmp
memory/2944-54-0x000007FEF5200000-0x000007FEF5BEC000-memory.dmp
memory/2944-55-0x000007FEF5200000-0x000007FEF5BEC000-memory.dmp
memory/2732-59-0x0000000000AE0000-0x0000000000B06000-memory.dmp
memory/1784-61-0x0000000001260000-0x0000000001286000-memory.dmp
memory/1852-66-0x0000000000260000-0x0000000000286000-memory.dmp
memory/1068-68-0x0000000000AA0000-0x0000000000AC6000-memory.dmp
memory/604-70-0x0000000000E80000-0x0000000000EA6000-memory.dmp
memory/2720-75-0x00000000001E0000-0x0000000000206000-memory.dmp
memory/2396-77-0x00000000010A0000-0x00000000010C6000-memory.dmp
memory/1960-81-0x0000000001210000-0x0000000001236000-memory.dmp
memory/1612-85-0x00000000002C0000-0x00000000002E6000-memory.dmp
memory/2728-87-0x0000000000160000-0x0000000000186000-memory.dmp
memory/2300-89-0x0000000000850000-0x0000000000876000-memory.dmp
memory/2036-91-0x00000000011B0000-0x00000000011D6000-memory.dmp
memory/1964-94-0x00000000003C0000-0x00000000003E6000-memory.dmp
memory/2772-96-0x0000000001040000-0x0000000001066000-memory.dmp
memory/1568-100-0x00000000010E0000-0x0000000001106000-memory.dmp
memory/2424-102-0x00000000011C0000-0x00000000011E6000-memory.dmp
memory/2888-104-0x00000000013E0000-0x0000000001406000-memory.dmp
memory/832-108-0x0000000000280000-0x00000000002A6000-memory.dmp
memory/2088-110-0x00000000008A0000-0x00000000008C6000-memory.dmp
memory/1716-112-0x0000000000C60000-0x0000000000C86000-memory.dmp
memory/2228-114-0x0000000000DC0000-0x0000000000DE6000-memory.dmp
memory/2576-118-0x0000000000FC0000-0x0000000000FE6000-memory.dmp
Analysis: behavioral2
Detonation Overview
Submitted
2024-06-25 13:03
Reported
2024-06-25 13:19
Platform
win10v2004-20240611-ja
Max time kernel
926s
Max time network
929s
Command Line
Signatures
Detect Xworm Payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Xworm
Command and Scripting Interpreter: PowerShell
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
Checks computer location settings
| Description | Indicator | Process | Target |
| Key value queried | \REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\Nursultan NextGen Crack.exe | N/A |
| Key value queried | \REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Roaming\Nursultan NextGen Crack.exe | N/A |
| Key value queried | \REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000\Control Panel\International\Geo\Nation | C:\Windows\SYSTEM32\CMD.EXE | N/A |
| Key value queried | \REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000\Control Panel\International\Geo\Nation | C:\Windows\SYSTEM32\CMD.EXE | N/A |
| Key value queried | \REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\ytoaly.exe | N/A |
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Roaming\Nursultan NextGen Crack.exe | N/A |
| N/A | N/A | C:\Users\Admin\wininit | N/A |
| N/A | N/A | C:\Users\Admin\wininit | N/A |
| N/A | N/A | C:\Users\Admin\wininit | N/A |
| N/A | N/A | C:\Users\Admin\wininit | N/A |
| N/A | N/A | C:\Users\Admin\wininit | N/A |
| N/A | N/A | C:\Users\Admin\wininit | N/A |
| N/A | N/A | C:\Users\Admin\wininit | N/A |
| N/A | N/A | C:\Users\Admin\wininit | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\ytoaly.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Roaming\Nursultan NextGen Crack.exe | N/A |
| N/A | N/A | C:\Users\Admin\wininit | N/A |
| N/A | N/A | C:\Users\Admin\wininit | N/A |
| N/A | N/A | C:\Users\Admin\wininit | N/A |
| N/A | N/A | C:\Users\Admin\wininit | N/A |
| N/A | N/A | C:\Users\Admin\wininit | N/A |
| N/A | N/A | C:\Users\Admin\wininit | N/A |
| N/A | N/A | C:\Users\Admin\wininit | N/A |
Loads dropped DLL
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\system32\wuauclt.exe | N/A |
| N/A | N/A | C:\Windows\system32\wuauclt.exe | N/A |
Adds Run key to start application
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wininit = "C:\\Users\\Admin\\wininit" | C:\Users\Admin\AppData\Roaming\Nursultan NextGen Crack.exe | N/A |
Drops desktop.ini file(s)
| Description | Indicator | Process | Target |
| File opened for modification | C:\Users\Admin\Videos\Captures\desktop.ini | C:\Windows\system32\svchost.exe | N/A |
Drops file in Windows directory
| Description | Indicator | Process | Target |
| File opened for modification | C:\Windows\Logs\MoSetup\UpdateAgent.log | C:\Windows\system32\wuauclt.exe | N/A |
| File created | C:\Windows\SoftwareDistribution\Download\6552516fd4c3b69631580dfc880ed1cb\Metadata\UpdateAgent.dll | C:\Windows\system32\wuauclt.exe | N/A |
| File opened for modification | C:\Windows\SoftwareDistribution\Download\6552516fd4c3b69631580dfc880ed1cb\Metadata\UAOneSettings.dll | C:\Windows\system32\wuauclt.exe | N/A |
| File opened for modification | C:\Windows\SoftwareDistribution\Download\6552516fd4c3b69631580dfc880ed1cb\Metadata\WinREAgent.dll | C:\Windows\system32\wuauclt.exe | N/A |
| File opened for modification | C:\Windows\SoftwareDistribution\Download\6552516fd4c3b69631580dfc880ed1cb\windlp.state-old.xml | C:\Windows\system32\wuauclt.exe | N/A |
| File opened for modification | C:\Windows\SoftwareDistribution\Download\6552516fd4c3b69631580dfc880ed1cb\Metadata\dpx.dll | C:\Windows\system32\wuauclt.exe | N/A |
| File opened for modification | C:\Windows\SoftwareDistribution\Download\6552516fd4c3b69631580dfc880ed1cb\Metadata\Mitigation.dll | C:\Windows\system32\wuauclt.exe | N/A |
| File opened for modification | C:\Windows\SoftwareDistribution\Download\6552516fd4c3b69631580dfc880ed1cb\Metadata\78902938-e1a7-4f20-9988-af1f7b7b0cb4.AggregatedMetadata.cab | C:\Windows\system32\wuauclt.exe | N/A |
| File opened for modification | C:\Windows\SoftwareDistribution\Download\6552516fd4c3b69631580dfc880ed1cb\windlp.state.xml | C:\Windows\system32\wuauclt.exe | N/A |
| File opened for modification | C:\Windows\SoftwareDistribution\Download\6552516fd4c3b69631580dfc880ed1cb\Metadata\wcp.dll | C:\Windows\system32\wuauclt.exe | N/A |
| File opened for modification | C:\Windows\SoftwareDistribution\Download\6552516fd4c3b69631580dfc880ed1cb\Metadata\TurboStack.dll | C:\Windows\system32\wuauclt.exe | N/A |
| File opened for modification | C:\Windows\SoftwareDistribution\Download\6552516fd4c3b69631580dfc880ed1cb\Metadata\ReserveManager.dll | C:\Windows\system32\wuauclt.exe | N/A |
| File opened for modification | C:\Windows\SoftwareDistribution\Download\6552516fd4c3b69631580dfc880ed1cb\Metadata\DesktopTargetServicedCompDB_Neutral.xml.cab | C:\Windows\system32\wuauclt.exe | N/A |
Enumerates physical storage devices
Checks SCSI registry key(s)
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters | C:\Windows\system32\vssvc.exe | N/A |
| Key queried | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters | C:\Windows\system32\vssvc.exe | N/A |
| Key created | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr | C:\Windows\system32\vssvc.exe | N/A |
| Set value (data) | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 00000000040000002b58b4804f1d39ed0000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff0000000027010100000800002b58b4800000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff0000000007000100006809002b58b480000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d2b58b480000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000002b58b48000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 | C:\Windows\system32\vssvc.exe | N/A |
| Set value (data) | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 | C:\Windows\system32\vssvc.exe | N/A |
Checks processor information in registry
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 | C:\Windows\system32\svchost.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString | C:\Windows\system32\svchost.exe | N/A |
Enumerates system info in registry
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| Key opened | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| Key opened | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
Modifies Internet Explorer settings
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000\Software\Microsoft\Internet Explorer\Main | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
| Set value (data) | \REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000000000001000000fffffffffffffffffffffffffffffffff8ffffff550000007e040000bd020000 | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31115009" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2" | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000\Software\Microsoft\Internet Explorer\VersionManager | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "729882641" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\"" | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000\SOFTWARE\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000\Software\Microsoft\Internet Explorer\Main | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{570A821F-32F4-11EF-90FB-EE2A85AAE362} = "0" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31115009" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "729882641" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000\Software\Microsoft\Internet Explorer\GPU | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000\Software\Microsoft\Internet Explorer\IESettingSync | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000\Software\Microsoft\Internet Explorer\MINIE | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (data) | \REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d0713d2c01c7da01 | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (data) | \REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d0003b2c01c7da01 | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (data) | \REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000aa9cad4c9673b74c9a378d3b281cdc3700000000020000000000106600000001000020000000e3b16f13e7ee8d3e4e3a6d4db31a733fc5c54a539ac256ef91f658223982560a000000000e8000000002000020000000af5ad29e7209957c34425ac84e1ec89808ce2b039f3871f5dc234956a1b69af6200000003ce778e11a9310b3788c307be16e4ffc5b49acda7f0a78454a88cf8d41aa6c1140000000b1930d385fe36e24abdac4c2fa27bcc92cf525a0c7fa91ed7a445e55f2ad1e2ea05d219e050ab06fccbc36fefe5bd923a201bda22e195413c24caa95dd90101d | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (data) | \REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000aa9cad4c9673b74c9a378d3b281cdc37000000000200000000001066000000010000200000009b4d475dbd498d1c652d338b4853c6a5019e5b36db49ca43a0f3aedd0f58f7f9000000000e800000000200002000000024a600c5c57bf81653df0c8002bd9b677b894f8ef22c32e1c638bfc28bb5ddaa200000000812c83b46a57761c6ce97144b75250cd06f53ec6ac9c5d20fab4bbc34c00a48400000000058ddd963bc3abd8ef9c997e90c404c748b9e636e2c225cc44e7e3c4959c2fcf308f7815a04afeff32d0aac4e5cb6c0509f2bee5c55e8f35649cf9ca4b02f71 | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (data) | \REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
Modifies data under HKEY_USERS
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates | C:\Windows\system32\wuauclt.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs | C:\Windows\system32\wuauclt.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA | C:\Windows\system32\wuauclt.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs | C:\Windows\system32\wuauclt.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs | C:\Windows\system32\wuauclt.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs | C:\Windows\system32\wuauclt.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates | C:\Windows\system32\wuauclt.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates | C:\Windows\system32\wuauclt.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople | C:\Windows\system32\wuauclt.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs | C:\Windows\system32\wuauclt.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs | C:\Windows\system32\wuauclt.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot | C:\Windows\system32\wuauclt.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates | C:\Windows\system32\wuauclt.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs | C:\Windows\system32\wuauclt.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust | C:\Windows\system32\wuauclt.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates | C:\Windows\system32\wuauclt.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs | C:\Windows\system32\wuauclt.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133637946656608249" | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA | C:\Windows\system32\wuauclt.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs | C:\Windows\system32\wuauclt.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs | C:\Windows\system32\wuauclt.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs | C:\Windows\system32\wuauclt.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing | C:\Windows\system32\wuauclt.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs | C:\Windows\system32\wuauclt.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates | C:\Windows\system32\wuauclt.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root | C:\Windows\system32\wuauclt.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople | C:\Windows\system32\wuauclt.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates | C:\Windows\system32\wuauclt.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs | C:\Windows\system32\wuauclt.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates | C:\Windows\system32\wuauclt.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs | C:\Windows\system32\wuauclt.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs | C:\Windows\system32\wuauclt.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs | C:\Windows\system32\wuauclt.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed | C:\Windows\system32\wuauclt.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs | C:\Windows\system32\wuauclt.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates | C:\Windows\system32\wuauclt.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs | C:\Windows\system32\wuauclt.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust | C:\Windows\system32\wuauclt.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed | C:\Windows\system32\wuauclt.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs | C:\Windows\system32\wuauclt.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs | C:\Windows\system32\wuauclt.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates | C:\Windows\system32\wuauclt.exe | N/A |
Modifies registry class
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3665033694-1447845302-680750983-1000\{97906816-EA7A-4433-AEF1-7B28072932C2} | C:\Windows\system32\svchost.exe | N/A |
| Key created | \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3665033694-1447845302-680750983-1000\{D663289B-ADC8-439D-BF68-923E9566488F} | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| Key created | \REGISTRY\MACHINE\Software\Classes\CLSID | C:\Windows\system32\wuauclt.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{92680698-75CD-4800-A550-FEE6E05F70C2} | C:\Windows\system32\wuauclt.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{92680698-75CD-4800-A550-FEE6E05F70C2}\AppID = "{7FB72955-BD6B-4CE2-9EBA-5CEEB67C24EE}" | C:\Windows\system32\wuauclt.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000_Classes\Local Settings | C:\Windows\SYSTEM32\CMD.EXE | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000_Classes\Local Settings | C:\Windows\SYSTEM32\CMD.EXE | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000_Classes\Local Settings | C:\Windows\system32\svchost.exe | N/A |
| Key created | \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3665033694-1447845302-680750983-1000\{AF6070F6-9172-4791-80E8-B6501718C487} | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
Scheduled Task/Job: Scheduled Task
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\System32\schtasks.exe | N/A |
Suspicious behavior: AddClipboardFormatListener
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files\VideoLAN\VLC\vlc.exe | N/A |
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files\VideoLAN\VLC\vlc.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Roaming\Nursultan NextGen Crack.exe | N/A |
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
| N/A | N/A | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
| N/A | N/A | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
| N/A | N/A | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Uses Task Scheduler COM API
Uses Volume Shadow Copy service COM API
Processes
C:\Users\Admin\AppData\Local\Temp\Nursultan NextGen Crack.exe
"C:\Users\Admin\AppData\Local\Temp\Nursultan NextGen Crack.exe"
C:\Users\Admin\AppData\Roaming\Nursultan NextGen Crack.exe
"C:\Users\Admin\AppData\Roaming\Nursultan NextGen Crack.exe"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\и.bat" "
C:\Windows\system32\chcp.com
chcp 65001
C:\Windows\system32\choice.exe
choice /c 12 /n /m "Enter your choice:"
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Nursultan NextGen Crack.exe'
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Nursultan NextGen Crack.exe'
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\wininit'
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'wininit'
C:\Windows\System32\schtasks.exe
"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "wininit" /tr "C:\Users\Admin\wininit"
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=ja --service-sandbox-type=asset_store_service --field-trial-handle=4236,i,10582458631009492839,12932125510981375204,262144 --variations-seed-version --mojo-platform-channel-handle=4296 /prefetch:8
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --default-search-provider=? --out-pipe-name=MSEdgeDefault54146dbfh7a84h44d0hb134hcf3437a52441
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService
C:\Users\Admin\wininit
C:\Users\Admin\wininit
C:\Users\Admin\wininit
C:\Users\Admin\wininit
C:\Windows\SYSTEM32\CMD.EXE
"CMD.EXE"
C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Windows\system32\slmgr.vbs" /ipk
C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Windows\system32\slmgr.vbs" /skms kms.xspace.in
C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Windows\system32\slmgr.vbs" /ato
C:\Users\Admin\wininit
C:\Users\Admin\wininit
C:\Users\Admin\wininit
C:\Users\Admin\wininit
C:\Users\Admin\wininit
C:\Users\Admin\wininit
C:\Windows\SYSTEM32\CMD.EXE
"CMD.EXE"
C:\Users\Admin\wininit
C:\Users\Admin\wininit
C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Windows\system32\slmgr.vbs" /ipk W269N-WFGWX-YVC9B-4J6C9-T83GX
C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Windows\system32\slmgr.vbs" /skms kms8.msguides.com
C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Windows\system32\slmgr.vbs" /ato
C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Desktop\RestartCopy.xhtml
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:5488 CREDAT:17410 /prefetch:2
C:\Users\Admin\wininit
C:\Users\Admin\wininit
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffef00eab58,0x7ffef00eab68,0x7ffef00eab78
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1728 --field-trial-handle=1932,i,10446914038044724536,8734067833825884862,131072 /prefetch:2
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2156 --field-trial-handle=1932,i,10446914038044724536,8734067833825884862,131072 /prefetch:8
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2232 --field-trial-handle=1932,i,10446914038044724536,8734067833825884862,131072 /prefetch:8
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3124 --field-trial-handle=1932,i,10446914038044724536,8734067833825884862,131072 /prefetch:1
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3148 --field-trial-handle=1932,i,10446914038044724536,8734067833825884862,131072 /prefetch:1
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4256 --field-trial-handle=1932,i,10446914038044724536,8734067833825884862,131072 /prefetch:1
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4524 --field-trial-handle=1932,i,10446914038044724536,8734067833825884862,131072 /prefetch:8
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4664 --field-trial-handle=1932,i,10446914038044724536,8734067833825884862,131072 /prefetch:8
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4180 --field-trial-handle=1932,i,10446914038044724536,8734067833825884862,131072 /prefetch:8
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4784 --field-trial-handle=1932,i,10446914038044724536,8734067833825884862,131072 /prefetch:8
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4984 --field-trial-handle=1932,i,10446914038044724536,8734067833825884862,131072 /prefetch:8
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=4064 --field-trial-handle=1932,i,10446914038044724536,8734067833825884862,131072 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=ja --service-sandbox-type=asset_store_service --field-trial-handle=4152,i,10582458631009492839,12932125510981375204,262144 --variations-seed-version --mojo-platform-channel-handle=2420 /prefetch:8
C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Music\CompleteRestore.mpeg2"
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=1604 --field-trial-handle=1932,i,10446914038044724536,8734067833825884862,131072 /prefetch:8
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5084 --field-trial-handle=1932,i,10446914038044724536,8734067833825884862,131072 /prefetch:8
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DevicesFlow -s DevicesFlowUserSvc
C:\Users\Admin\wininit
C:\Users\Admin\wininit
C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {24AC8F2B-4D4A-4C17-9607-6A4B14068F97} -Embedding
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DevicesFlow -s DevicePickerUserSvc
C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://rt.pornhub.com/
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --lang=ja --js-flags=--ms-user-locale=ja_JP --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=12 --field-trial-handle=4372,i,10582458631009492839,12932125510981375204,262144 --variations-seed-version --mojo-platform-channel-handle=3920 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --lang=ja --js-flags=--ms-user-locale=ja_JP --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=11 --field-trial-handle=2232,i,10582458631009492839,12932125510981375204,262144 --variations-seed-version --mojo-platform-channel-handle=5192 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=ja --service-sandbox-type=asset_store_service --field-trial-handle=5328,i,10582458631009492839,12932125510981375204,262144 --variations-seed-version --mojo-platform-channel-handle=5404 /prefetch:8
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=ja --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --field-trial-handle=5360,i,10582458631009492839,12932125510981375204,262144 --variations-seed-version --mojo-platform-channel-handle=5468 /prefetch:8
C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {2F93C02D-77F9-46B4-95FB-8CBB81EEB62C} -Embedding
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --lang=ja --js-flags=--ms-user-locale=ja_JP --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=15 --field-trial-handle=5368,i,10582458631009492839,12932125510981375204,262144 --variations-seed-version --mojo-platform-channel-handle=5724 /prefetch:1
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DevicesFlow -s DevicesFlowUserSvc
C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DevicesFlow -s DevicesFlowUserSvc
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --lang=ja --js-flags=--ms-user-locale=ja_JP --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=16 --field-trial-handle=6044,i,10582458631009492839,12932125510981375204,262144 --variations-seed-version --mojo-platform-channel-handle=6060 /prefetch:1
C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --lang=ja --js-flags=--ms-user-locale=ja_JP --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=17 --field-trial-handle=5400,i,10582458631009492839,12932125510981375204,262144 --variations-seed-version --mojo-platform-channel-handle=5236 /prefetch:1
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DevicesFlow -s DevicesFlowUserSvc
C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DevicesFlow -s DevicesFlowUserSvc
C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService
C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ja --service-sandbox-type=service --field-trial-handle=6632,i,10582458631009492839,12932125510981375204,262144 --variations-seed-version --mojo-platform-channel-handle=6644 /prefetch:8
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=125.0.6422.142 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=125.0.2535.92 --initial-client-data=0x23c,0x240,0x244,0x238,0x258,0x7ffeea324ef8,0x7ffeea324f04,0x7ffeea324f10
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=2304,i,1974551879081169229,7103994053611096628,262144 --variations-seed-version --mojo-platform-channel-handle=2300 /prefetch:2
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=ja --service-sandbox-type=none --field-trial-handle=1964,i,1974551879081169229,7103994053611096628,262144 --variations-seed-version --mojo-platform-channel-handle=2300 /prefetch:3
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=ja --service-sandbox-type=service --field-trial-handle=2324,i,1974551879081169229,7103994053611096628,262144 --variations-seed-version --mojo-platform-channel-handle=3368 /prefetch:8
C:\Program Files (x86)\Microsoft\Edge\Application\125.0.2535.92\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\125.0.2535.92\elevation_service.exe"
C:\Program Files (x86)\Microsoft\Edge\Application\125.0.2535.92\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\125.0.2535.92\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=ja --service-sandbox-type=none --field-trial-handle=4484,i,1974551879081169229,7103994053611096628,262144 --variations-seed-version --mojo-platform-channel-handle=4464 /prefetch:8
C:\Program Files (x86)\Microsoft\Edge\Application\125.0.2535.92\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\125.0.2535.92\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=ja --service-sandbox-type=none --field-trial-handle=4484,i,1974551879081169229,7103994053611096628,262144 --variations-seed-version --mojo-platform-channel-handle=4464 /prefetch:8
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ja --service-sandbox-type=service --field-trial-handle=4592,i,1974551879081169229,7103994053611096628,262144 --variations-seed-version --mojo-platform-channel-handle=4604 /prefetch:8
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=ja --service-sandbox-type=service --field-trial-handle=4616,i,1974551879081169229,7103994053611096628,262144 --variations-seed-version --mojo-platform-channel-handle=4708 /prefetch:8
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ja --service-sandbox-type=service --field-trial-handle=4612,i,1974551879081169229,7103994053611096628,262144 --variations-seed-version --mojo-platform-channel-handle=4608 /prefetch:8
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=ja --service-sandbox-type=service --field-trial-handle=4628,i,1974551879081169229,7103994053611096628,262144 --variations-seed-version --mojo-platform-channel-handle=4720 /prefetch:8
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ja --service-sandbox-type=service --field-trial-handle=4684,i,1974551879081169229,7103994053611096628,262144 --variations-seed-version --mojo-platform-channel-handle=4748 /prefetch:8
C:\Users\Admin\AppData\Local\Temp\ytoaly.exe
"C:\Users\Admin\AppData\Local\Temp\ytoaly.exe"
C:\Users\Admin\AppData\Roaming\Nursultan NextGen Crack.exe
"C:\Users\Admin\AppData\Roaming\Nursultan NextGen Crack.exe"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\и.bat" "
C:\Windows\system32\chcp.com
chcp 65001
C:\Windows\system32\choice.exe
choice /c 12 /n /m "Enter your choice:"
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=ja --service-sandbox-type=none --field-trial-handle=4480,i,1974551879081169229,7103994053611096628,262144 --variations-seed-version --mojo-platform-channel-handle=4180 /prefetch:8
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=ja --service-sandbox-type=none --field-trial-handle=120,i,1974551879081169229,7103994053611096628,262144 --variations-seed-version --mojo-platform-channel-handle=4172 /prefetch:8
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ja --service-sandbox-type=service --field-trial-handle=4952,i,1974551879081169229,7103994053611096628,262144 --variations-seed-version --mojo-platform-channel-handle=4176 /prefetch:8
C:\Users\Admin\wininit
C:\Users\Admin\wininit
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4868 --field-trial-handle=1932,i,10446914038044724536,8734067833825884862,131072 /prefetch:2
C:\Users\Admin\wininit
C:\Users\Admin\wininit
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://underical.suppport/
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --lang=ja --js-flags=--ms-user-locale=ja_JP --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --field-trial-handle=5100,i,1974551879081169229,7103994053611096628,262144 --variations-seed-version --mojo-platform-channel-handle=5148 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --lang=ja --js-flags=--ms-user-locale=ja_JP --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --field-trial-handle=5084,i,1974551879081169229,7103994053611096628,262144 --variations-seed-version --mojo-platform-channel-handle=5368 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=ja --service-sandbox-type=asset_store_service --field-trial-handle=5668,i,1974551879081169229,7103994053611096628,262144 --variations-seed-version --mojo-platform-channel-handle=5676 /prefetch:8
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=ja --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --field-trial-handle=5696,i,1974551879081169229,7103994053611096628,262144 --variations-seed-version --mojo-platform-channel-handle=5796 /prefetch:8
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --lang=ja --js-flags=--ms-user-locale=ja_JP --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --field-trial-handle=5728,i,1974551879081169229,7103994053611096628,262144 --variations-seed-version --mojo-platform-channel-handle=6080 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --lang=ja --js-flags=--ms-user-locale=ja_JP --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --field-trial-handle=5732,i,1974551879081169229,7103994053611096628,262144 --variations-seed-version --mojo-platform-channel-handle=5468 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --lang=ja --js-flags=--ms-user-locale=ja_JP --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --field-trial-handle=6120,i,1974551879081169229,7103994053611096628,262144 --variations-seed-version --mojo-platform-channel-handle=5944 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=5088,i,1974551879081169229,7103994053611096628,262144 --variations-seed-version --mojo-platform-channel-handle=6112 /prefetch:8
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --lang=ja --js-flags=--ms-user-locale=ja_JP --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --field-trial-handle=4224,i,1974551879081169229,7103994053611096628,262144 --variations-seed-version --mojo-platform-channel-handle=4448 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=ja --service-sandbox-type=search_indexer --message-loop-type-ui --field-trial-handle=6528,i,1974551879081169229,7103994053611096628,262144 --variations-seed-version --mojo-platform-channel-handle=6676 /prefetch:8
C:\Users\Admin\wininit
C:\Users\Admin\wininit
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DevicesFlow -s DevicesFlowUserSvc
C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
C:\Users\Admin\wininit
C:\Users\Admin\wininit
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -s LxpSvc
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --default-search-provider=? --out-pipe-name=MSEdgeDefaultbbd9f53ah4ffeh4cc8hb9cche50beb7c71bd
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --lang=ja --js-flags=--ms-user-locale=ja_JP --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --field-trial-handle=4112,i,1974551879081169229,7103994053611096628,262144 --variations-seed-version --mojo-platform-channel-handle=5692 /prefetch:1
C:\Windows\System32\FodHelper.exe
C:\Windows\System32\FodHelper.exe -Embedding
C:\Users\Admin\wininit
C:\Users\Admin\wininit
C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
C:\Users\Admin\wininit
C:\Users\Admin\wininit
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=125.0.6422.142 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=125.0.2535.92 --initial-client-data=0x23c,0x240,0x244,0x238,0x2f4,0x7ffeea324ef8,0x7ffeea324f04,0x7ffeea324f10
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=3272,i,6877360656168868205,11918701633379547433,262144 --variations-seed-version --mojo-platform-channel-handle=3268 /prefetch:2
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=ja --service-sandbox-type=none --field-trial-handle=1956,i,6877360656168868205,11918701633379547433,262144 --variations-seed-version --mojo-platform-channel-handle=3400 /prefetch:3
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=ja --service-sandbox-type=service --field-trial-handle=2212,i,6877360656168868205,11918701633379547433,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:8
C:\Program Files (x86)\Microsoft\Edge\Application\125.0.2535.92\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\125.0.2535.92\elevation_service.exe"
C:\Program Files (x86)\Microsoft\Edge\Application\125.0.2535.92\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\125.0.2535.92\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=ja --service-sandbox-type=none --field-trial-handle=4520,i,6877360656168868205,11918701633379547433,262144 --variations-seed-version --mojo-platform-channel-handle=4516 /prefetch:8
C:\Program Files (x86)\Microsoft\Edge\Application\125.0.2535.92\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\125.0.2535.92\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=ja --service-sandbox-type=none --field-trial-handle=4520,i,6877360656168868205,11918701633379547433,262144 --variations-seed-version --mojo-platform-channel-handle=4516 /prefetch:8
C:\Windows\system32\srtasks.exe
C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
C:\Windows\system32\wuauclt.exe
"C:\Windows\system32\wuauclt.exe" /UpdateDeploymentProvider UpdateDeploymentProvider.dll /ClassId f12dc78d-4f58-4a02-803e-92ac3b0ee753 /RunHandlerComServer
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=ja --service-sandbox-type=none --field-trial-handle=4292,i,6877360656168868205,11918701633379547433,262144 --variations-seed-version --mojo-platform-channel-handle=4224 /prefetch:8
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=ja --service-sandbox-type=none --field-trial-handle=4304,i,6877360656168868205,11918701633379547433,262144 --variations-seed-version --mojo-platform-channel-handle=564 /prefetch:8
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ja --service-sandbox-type=service --field-trial-handle=4700,i,6877360656168868205,11918701633379547433,262144 --variations-seed-version --mojo-platform-channel-handle=4736 /prefetch:8
C:\Users\Admin\wininit
C:\Users\Admin\wininit
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 232.168.11.51.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 249.197.17.2.in-addr.arpa | udp |
| US | 8.8.8.8:53 | g.bing.com | udp |
| US | 204.79.197.237:443 | g.bing.com | tcp |
| US | 8.8.8.8:53 | 69.31.126.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 88.156.103.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 104.219.191.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | seems-poet.gl.at.ply.gg | udp |
| US | 147.185.221.20:30996 | seems-poet.gl.at.ply.gg | tcp |
| US | 8.8.8.8:53 | 20.221.185.147.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 103.169.127.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 18.31.95.13.in-addr.arpa | udp |
| US | 8.8.8.8:53 | cxcs.microsoft.net | udp |
| BE | 104.68.66.114:443 | cxcs.microsoft.net | tcp |
| NL | 23.62.61.152:443 | www.bing.com | tcp |
| US | 8.8.8.8:53 | 172.214.232.199.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 152.61.62.23.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 114.66.68.104.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 14.227.111.52.in-addr.arpa | udp |
| US | 147.185.221.20:30996 | seems-poet.gl.at.ply.gg | tcp |
| US | 8.8.8.8:53 | kms.xspace.in | udp |
| US | 103.224.212.237:1688 | kms.xspace.in | tcp |
| US | 147.185.221.20:30996 | seems-poet.gl.at.ply.gg | tcp |
| US | 147.185.221.20:30996 | seems-poet.gl.at.ply.gg | tcp |
| US | 147.185.221.20:30996 | seems-poet.gl.at.ply.gg | tcp |
| US | 8.8.8.8:53 | 4.173.189.20.in-addr.arpa | udp |
| US | 147.185.221.20:30996 | seems-poet.gl.at.ply.gg | tcp |
| US | 8.8.8.8:53 | kms8.msguides.com | udp |
| US | 107.175.77.7:1688 | kms8.msguides.com | tcp |
| US | 147.185.221.20:30996 | seems-poet.gl.at.ply.gg | tcp |
| US | 8.8.8.8:53 | www.google.com | udp |
| GB | 142.250.187.196:443 | www.google.com | tcp |
| GB | 142.250.187.196:443 | www.google.com | udp |
| US | 8.8.8.8:53 | apis.google.com | udp |
| GB | 142.250.200.14:443 | apis.google.com | udp |
| US | 8.8.8.8:53 | 10.178.250.142.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 3.200.250.142.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 196.187.250.142.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 195.212.58.216.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 14.200.250.142.in-addr.arpa | udp |
| US | 8.8.8.8:53 | play.google.com | udp |
| GB | 172.217.169.46:443 | play.google.com | udp |
| US | 8.8.8.8:53 | 46.169.217.172.in-addr.arpa | udp |
| US | 8.8.8.8:53 | clients2.google.com | udp |
| GB | 142.250.187.206:443 | clients2.google.com | udp |
| N/A | 224.0.0.251:5353 | udp | |
| GB | 142.250.187.206:443 | clients2.google.com | tcp |
| US | 8.8.8.8:53 | 206.187.250.142.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 161.19.199.152.in-addr.arpa | udp |
| GB | 142.250.187.196:443 | www.google.com | udp |
| GB | 172.217.169.46:443 | play.google.com | udp |
| US | 8.8.8.8:53 | rt.pornhub.com | udp |
| US | 8.8.8.8:53 | rt.pornhub.com | udp |
| US | 66.254.114.41:443 | rt.pornhub.com | tcp |
| US | 8.8.8.8:53 | rt.pornhub.com | udp |
| US | 8.8.8.8:53 | rt.pornhub.com | udp |
| US | 8.8.8.8:53 | rt.pornhub.com | udp |
| US | 8.8.8.8:53 | 41.114.254.66.in-addr.arpa | udp |
| US | 66.254.114.41:443 | rt.pornhub.com | tcp |
| US | 8.8.8.8:53 | business.bing.com | udp |
| US | 8.8.8.8:53 | business.bing.com | udp |
| US | 8.8.8.8:53 | rt.pornhub.com | udp |
| US | 8.8.8.8:53 | rt.pornhub.com | udp |
| US | 8.8.8.8:53 | rt.pornhub.com | udp |
| US | 13.107.6.158:443 | business.bing.com | tcp |
| US | 13.107.6.158:443 | business.bing.com | tcp |
| US | 66.254.114.41:443 | rt.pornhub.com | tcp |
| US | 8.8.8.8:53 | bzib.nelreports.net | udp |
| US | 8.8.8.8:53 | bzib.nelreports.net | udp |
| US | 2.20.12.87:443 | bzib.nelreports.net | tcp |
| US | 8.8.8.8:53 | static.trafficjunky.com | udp |
| US | 8.8.8.8:53 | static.trafficjunky.com | udp |
| US | 8.8.8.8:53 | ei.phncdn.com | udp |
| US | 8.8.8.8:53 | ei.phncdn.com | udp |
| GB | 64.210.156.17:443 | ei.phncdn.com | tcp |
| GB | 64.210.156.17:443 | ei.phncdn.com | tcp |
| GB | 64.210.156.16:443 | ei.phncdn.com | tcp |
| GB | 64.210.156.16:443 | ei.phncdn.com | tcp |
| GB | 64.210.156.16:443 | ei.phncdn.com | tcp |
| GB | 64.210.156.16:443 | ei.phncdn.com | tcp |
| GB | 64.210.156.16:443 | ei.phncdn.com | tcp |
| GB | 64.210.156.16:443 | ei.phncdn.com | tcp |
| US | 8.8.8.8:53 | 87.12.20.2.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 158.6.107.13.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 16.156.210.64.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 17.156.210.64.in-addr.arpa | udp |
| US | 8.8.8.8:53 | media.trafficjunky.net | udp |
| US | 8.8.8.8:53 | media.trafficjunky.net | udp |
| US | 8.8.8.8:53 | 67.31.126.40.in-addr.arpa | udp |
| GB | 64.210.156.21:443 | media.trafficjunky.net | tcp |
| US | 8.8.8.8:53 | 21.156.210.64.in-addr.arpa | udp |
| US | 8.8.8.8:53 | prvc.io | udp |
| US | 8.8.8.8:53 | prvc.io | udp |
| US | 8.8.8.8:53 | cdn1-smallimg.phncdn.com | udp |
| US | 8.8.8.8:53 | cdn1-smallimg.phncdn.com | udp |
| US | 172.67.177.254:443 | prvc.io | udp |
| US | 172.67.177.254:443 | prvc.io | tcp |
| US | 66.254.114.156:443 | cdn1-smallimg.phncdn.com | tcp |
| US | 8.8.8.8:53 | 254.177.67.172.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 156.114.254.66.in-addr.arpa | udp |
| US | 8.8.8.8:53 | ei.phprcdn.com | udp |
| US | 8.8.8.8:53 | ei.phprcdn.com | udp |
| GB | 64.210.156.18:443 | ei.phprcdn.com | tcp |
| US | 8.8.8.8:53 | 18.156.210.64.in-addr.arpa | udp |
| GB | 64.210.156.16:443 | ei.phprcdn.com | tcp |
| US | 8.8.8.8:53 | r.trackwilltrk.com | udp |
| US | 8.8.8.8:53 | r.trackwilltrk.com | udp |
| US | 8.8.8.8:53 | r.trackwilltrk.com | udp |
| US | 8.8.8.8:53 | rt.pornhub.com | udp |
| NL | 45.131.147.145:443 | r.trackwilltrk.com | tcp |
| US | 8.8.8.8:53 | static.javhdhello.com | udp |
| US | 8.8.8.8:53 | static.javhdhello.com | udp |
| US | 8.8.8.8:53 | static.javhdhello.com | udp |
| US | 8.8.8.8:53 | r.trackwilltrk.com | udp |
| GB | 195.181.164.18:443 | static.javhdhello.com | tcp |
| US | 8.8.8.8:53 | 104.201.58.216.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 145.147.131.45.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 18.164.181.195.in-addr.arpa | udp |
| US | 8.8.8.8:53 | nav-edge.smartscreen.microsoft.com | udp |
| US | 8.8.8.8:53 | nav-edge.smartscreen.microsoft.com | udp |
| GB | 51.140.244.186:443 | nav-edge.smartscreen.microsoft.com | tcp |
| GB | 51.140.244.186:443 | nav-edge.smartscreen.microsoft.com | tcp |
| NL | 45.131.147.145:443 | r.trackwilltrk.com | tcp |
| US | 8.8.8.8:53 | r.trackwilltrk.com | udp |
| US | 8.8.8.8:53 | rt.pornhub.com | udp |
| US | 8.8.8.8:53 | data-edge.smartscreen.microsoft.com | udp |
| US | 8.8.8.8:53 | data-edge.smartscreen.microsoft.com | udp |
| US | 8.8.8.8:53 | static.javhdhello.com | udp |
| US | 8.8.8.8:53 | r.trackwilltrk.com | udp |
| US | 8.8.8.8:53 | 186.244.140.51.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 14.213.58.216.in-addr.arpa | udp |
| US | 8.8.8.8:53 | ss.phncdn.com | udp |
| US | 8.8.8.8:53 | ss.phncdn.com | udp |
| US | 8.8.8.8:53 | region1.google-analytics.com | udp |
| US | 8.8.8.8:53 | region1.google-analytics.com | udp |
| US | 216.239.34.36:443 | region1.google-analytics.com | tcp |
| US | 8.8.8.8:53 | storage.googleapis.com | udp |
| US | 8.8.8.8:53 | storage.googleapis.com | udp |
| GB | 142.250.200.27:443 | storage.googleapis.com | tcp |
| US | 8.8.8.8:53 | 164.189.21.2.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 36.34.239.216.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 27.200.250.142.in-addr.arpa | udp |
| NL | 23.62.61.155:443 | www.bing.com | tcp |
| US | 8.8.8.8:53 | rt.pornhub.com | udp |
| US | 8.8.8.8:53 | rt.pornhub.com | udp |
| US | 8.8.8.8:53 | 155.61.62.23.in-addr.arpa | udp |
| US | 216.239.34.36:443 | region1.google-analytics.com | udp |
| NL | 23.62.61.155:443 | www.bing.com | udp |
| US | 8.8.8.8:53 | clients2.google.com | udp |
| US | 8.8.8.8:53 | clients2.google.com | udp |
| US | 8.8.8.8:53 | edge-mobile-static.azureedge.net | udp |
| US | 8.8.8.8:53 | edge-mobile-static.azureedge.net | udp |
| NL | 23.62.61.194:443 | www.bing.com | tcp |
| GB | 142.250.187.206:443 | clients2.google.com | tcp |
| US | 13.107.253.64:443 | edge-mobile-static.azureedge.net | tcp |
| US | 8.8.8.8:53 | clients2.googleusercontent.com | udp |
| US | 8.8.8.8:53 | clients2.googleusercontent.com | udp |
| GB | 172.217.16.225:443 | clients2.googleusercontent.com | tcp |
| US | 8.8.8.8:53 | 64.253.107.13.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 194.61.62.23.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 225.16.217.172.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 10.180.250.142.in-addr.arpa | udp |
| US | 8.8.8.8:53 | edge-consumer-static.azureedge.net | udp |
| US | 8.8.8.8:53 | edge-consumer-static.azureedge.net | udp |
| US | 13.107.253.64:443 | edge-consumer-static.azureedge.net | tcp |
| US | 8.8.8.8:53 | beacons.gcp.gvt2.com | udp |
| GB | 172.217.169.67:443 | beacons.gcp.gvt2.com | tcp |
| US | 8.8.8.8:53 | 67.169.217.172.in-addr.arpa | udp |
| US | 147.185.221.20:30996 | seems-poet.gl.at.ply.gg | tcp |
| US | 8.8.8.8:53 | api.edgeoffer.microsoft.com | udp |
| US | 8.8.8.8:53 | api.edgeoffer.microsoft.com | udp |
| US | 8.8.8.8:53 | underical.suppport | udp |
| US | 8.8.8.8:53 | underical.suppport | udp |
| IE | 94.245.104.56:443 | api.edgeoffer.microsoft.com | tcp |
| US | 8.8.8.8:53 | underical.suppport | udp |
| US | 8.8.8.8:53 | underical.suppport | udp |
| US | 8.8.8.8:53 | underical.suppport | udp |
| US | 8.8.8.8:53 | underical.suppport | udp |
| US | 8.8.8.8:53 | business.bing.com | udp |
| US | 8.8.8.8:53 | business.bing.com | udp |
| US | 13.107.6.158:443 | business.bing.com | tcp |
| US | 8.8.8.8:53 | nav-edge.smartscreen.microsoft.com | udp |
| US | 8.8.8.8:53 | nav-edge.smartscreen.microsoft.com | udp |
| GB | 172.165.61.93:443 | nav-edge.smartscreen.microsoft.com | tcp |
| US | 8.8.8.8:53 | bzib.nelreports.net | udp |
| US | 8.8.8.8:53 | bzib.nelreports.net | udp |
| US | 2.20.12.87:443 | bzib.nelreports.net | tcp |
| US | 8.8.8.8:53 | 56.104.245.94.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 93.61.165.172.in-addr.arpa | udp |
| US | 8.8.8.8:53 | google.com | udp |
| US | 8.8.8.8:53 | google.com | udp |
| US | 8.8.8.8:53 | underical.suppport | udp |
| US | 8.8.8.8:53 | underical.suppport | udp |
| US | 8.8.8.8:53 | underical.suppport | udp |
| US | 8.8.8.8:53 | underical.suppport | udp |
| US | 8.8.8.8:53 | underical.suppport | udp |
| US | 8.8.8.8:53 | underical.suppport | udp |
| US | 8.8.8.8:53 | underical.suppport | udp |
| NL | 23.62.61.72:443 | www.bing.com | udp |
| US | 8.8.8.8:53 | 72.61.62.23.in-addr.arpa | udp |
| US | 8.8.8.8:53 | underical.suppport | udp |
| US | 8.8.8.8:53 | underical.suppport | udp |
| US | 8.8.8.8:53 | underical.suppport | udp |
| US | 8.8.8.8:53 | underical.suppport | udp |
| US | 8.8.8.8:53 | bzib.nelreports.net | udp |
| US | 8.8.8.8:53 | bzib.nelreports.net | udp |
| NL | 23.62.61.72:443 | www.bing.com | udp |
| BE | 104.68.66.114:443 | cxcs.microsoft.net | tcp |
| NL | 23.62.61.152:443 | www.bing.com | tcp |
| US | 8.8.8.8:53 | 50.23.12.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 0.181.190.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 171.39.242.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 28.118.140.52.in-addr.arpa | udp |
| NL | 23.62.61.129:443 | www.bing.com | udp |
| US | 8.8.8.8:53 | 129.61.62.23.in-addr.arpa | udp |
| US | 8.8.8.8:53 | underical.suppport | udp |
| US | 8.8.8.8:53 | underical.suppport | udp |
| US | 8.8.8.8:53 | underical.suppport | udp |
| US | 8.8.8.8:53 | underical.suppport | udp |
| US | 8.8.8.8:53 | beacons.gcp.gvt2.com | udp |
| GB | 172.217.169.67:443 | beacons.gcp.gvt2.com | udp |
| US | 8.8.8.8:53 | beacons3.gvt2.com | udp |
| GB | 216.58.213.3:443 | beacons3.gvt2.com | tcp |
| GB | 216.58.213.3:443 | beacons3.gvt2.com | udp |
| US | 8.8.8.8:53 | 3.213.58.216.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 240.197.17.2.in-addr.arpa | udp |
| NL | 23.62.61.155:443 | www.bing.com | udp |
| US | 8.8.8.8:53 | 209.205.72.20.in-addr.arpa | udp |
| NL | 23.62.61.97:443 | www.bing.com | tcp |
| US | 8.8.8.8:53 | 97.61.62.23.in-addr.arpa | udp |
| US | 8.8.8.8:53 | edge-consumer-static.azureedge.net | udp |
| US | 8.8.8.8:53 | edge-consumer-static.azureedge.net | udp |
| US | 13.107.253.64:443 | edge-consumer-static.azureedge.net | tcp |
| BE | 104.68.66.114:443 | cxcs.microsoft.net | tcp |
Files
memory/2756-1-0x00007FFEF41F3000-0x00007FFEF41F5000-memory.dmp
memory/2756-0-0x0000000000220000-0x000000000025A000-memory.dmp
C:\Users\Admin\AppData\Roaming\Nursultan NextGen Crack.exe
| MD5 | a9aee64b701db5f8cfc3c963872403b4 |
| SHA1 | 48079f6822d84ea354f301cdb97d2ecb59552e06 |
| SHA256 | f46d7ae8973b42a0cb892c6aa8d6a559b4cc1d0c67b1d5df3072c4f7f77b53fb |
| SHA512 | 696e745d488841c3b1a55a350d754b69a1d6b0d83fd9eac247229239951b12bfd98d8cbbcbfffd567966495a10950040edd77398702763071f6eeb50f13a3a1e |
memory/1372-17-0x00000000001D0000-0x00000000001F6000-memory.dmp
memory/1372-18-0x00007FFEF41F0000-0x00007FFEF4CB1000-memory.dmp
C:\Users\Admin\AppData\Roaming\и.bat
| MD5 | 9885bc1f632421f329efe28818361344 |
| SHA1 | 9d0838fa885728361703a6e2b36e2aa3603b05ce |
| SHA256 | 6a218880f23edb2a809ee20919f355f80ef4a0b545c3d79ffa8c848441eced7a |
| SHA512 | ddb5252457e9e02a91073f58662cd2eb72d670827f5173e8705c9e41d55a4ba4efdab80f24371ff61573d250f7b8463ce05f9cec7c48085dcacd38cd21e65203 |
memory/1544-20-0x00000267E7EB0000-0x00000267E7F42000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_yn4rh3pv.a3o.ps1
| MD5 | d17fe0a3f47be24a6453e9ef58c94641 |
| SHA1 | 6ab83620379fc69f80c0242105ddffd7d98d5d9d |
| SHA256 | 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7 |
| SHA512 | 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82 |
memory/1544-31-0x00000267E7E10000-0x00000267E7E32000-memory.dmp
memory/1544-30-0x00000267E7DA0000-0x00000267E7DB0000-memory.dmp
memory/1544-32-0x00000267E8160000-0x00000267E826E000-memory.dmp
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
| MD5 | d85ba6ff808d9e5444a4b369f5bc2730 |
| SHA1 | 31aa9d96590fff6981b315e0b391b575e4c0804a |
| SHA256 | 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f |
| SHA512 | 8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249 |
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
| MD5 | d28a889fd956d5cb3accfbaf1143eb6f |
| SHA1 | 157ba54b365341f8ff06707d996b3635da8446f7 |
| SHA256 | 21e5d7ccf80a293e6ba30ed728846ca19c929c52b96e2c8d34e27cd2234f1d45 |
| SHA512 | 0b6d88deb9be85722e6a78d5886d49f2caf407a59e128d2b4ed74c1356f9928c40048a62731959f2460e9ff9d9feee311043d2a37abe3bb92c2b76a44281478c |
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
| MD5 | da5c82b0e070047f7377042d08093ff4 |
| SHA1 | 89d05987cd60828cca516c5c40c18935c35e8bd3 |
| SHA256 | 77a94ef8c4258445d538a6006ffadb05afdf888f6f044e1e5466b981a07f16c5 |
| SHA512 | 7360311a3c97b73dd3f6d7179cd979e0e20d69f380d38292447e17e369087d9dd5acb66cd0cbdd95ac4bfb16e5a1b86825f835a8d45b14ea9812102cff59704b |
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
| MD5 | e5663972c1caaba7088048911c758bf3 |
| SHA1 | 3462dea0f9c2c16a9c3afdaef8bbb1f753c1c198 |
| SHA256 | 9f7f29a4696876cadca3f14d7e43f9ede0c97fd64be3f5d94bda49a91b6a419e |
| SHA512 | ff4e72c46cf083de62baa2ce2661555dd91b5f144294015f7b262fd4500cb67fe80e1871a82da63b607e3e9cef401f4b73c587bf1134637881ecad51aad1eddc |
memory/1372-70-0x00007FFEF41F0000-0x00007FFEF4CB1000-memory.dmp
memory/1372-73-0x00007FFEF41F0000-0x00007FFEF4CB1000-memory.dmp
C:\Users\Admin\Videos\Captures\desktop.ini
| MD5 | b0d27eaec71f1cd73b015f5ceeb15f9d |
| SHA1 | 62264f8b5c2f5034a1e4143df6e8c787165fbc2f |
| SHA256 | 86d9f822aeb989755fac82929e8db369b3f5f04117ef96fd76e3d5f920a501d2 |
| SHA512 | 7b5c9783a0a14b600b156825639d24cbbc000f5066c48ce9fecc195255603fc55129aaaca336d7ce6ad4e941d5492b756562f2c7a1d151fcfc2dabac76f3946c |
memory/1372-88-0x00007FFEF41F0000-0x00007FFEF4CB1000-memory.dmp
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\wininit.log
| MD5 | 2ff39f6c7249774be85fd60a8f9a245e |
| SHA1 | 684ff36b31aedc1e587c8496c02722c6698c1c4e |
| SHA256 | e1b91642d85d98124a6a31f710e137ab7fd90dec30e74a05ab7fcf3b7887dced |
| SHA512 | 1d7e8b92ef4afd463d62cfa7e8b9d1799db5bf2a263d3cd7840df2e0a1323d24eb595b5f8eb615c6cb15f9e3a7b4fc99f8dd6a3d34479222e966ec708998aed1 |
memory/1372-94-0x0000000002400000-0x000000000240A000-memory.dmp
memory/1372-95-0x000000001B1C0000-0x000000001B1CC000-memory.dmp
memory/1372-96-0x000000001B200000-0x000000001B212000-memory.dmp
memory/1372-97-0x000000001C100000-0x000000001C148000-memory.dmp
memory/1372-102-0x000000001B8F0000-0x000000001B904000-memory.dmp
\??\pipe\crashpad_2356_QVAAOSWGLSSFWSHE
| MD5 | d41d8cd98f00b204e9800998ecf8427e |
| SHA1 | da39a3ee5e6b4b0d3255bfef95601890afd80709 |
| SHA256 | e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
| SHA512 | cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
| MD5 | d751713988987e9331980363e24189ce |
| SHA1 | 97d170e1550eee4afc0af065b78cda302a97674c |
| SHA256 | 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945 |
| SHA512 | b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
| MD5 | 904172b9eb0b3dda2db63c2dfc083a9d |
| SHA1 | 56118d0e05010dcff505b9f1f1a36f6729ab9771 |
| SHA256 | 44080f018e4b3d9acc403520c5dd2d4179d8bb11271ff00b7377effeca47bdc1 |
| SHA512 | 05899f474ae6d169ec48c2fd41f1d93e2df414cba1acb2696ed3f381f38914e42b8470a2baf8eded2d2817fb71896634bd8df25b8805cbaebaf79a1ed918f99c |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
| MD5 | bb627dd41c5229e31c290e924c90094b |
| SHA1 | b1d82b092da6469aa5bc7fad996352936fbecc49 |
| SHA256 | fc634ed56dcd401cb3acf6a7a9b869da3812628a4f86fc0cbc311355baf66ebf |
| SHA512 | 17a940c5afd0af8a7ff1dffd8f3eb60cd97bcb75cf800640872e7a18f26a1c78c96abf0915e72fb68255b686bf2927473bbd36257217da0aad159bed047e51a0 |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
| MD5 | ec57088f805fac5adf5ea569ee675184 |
| SHA1 | 3f5a32431bbc1d3f3253c28317011aa2e714ecd5 |
| SHA256 | 448023f453e719cf4c071a86812bb4552a30c9495231fde58702bcdbe4be390d |
| SHA512 | efeed2f3ef63f69d01eef0ba09bd4e6be10d1621ff66e8808abcbfd654085c1593ba0ecc6e06ab603894e10f360f39a73b48fe584d6a9282feab2a0a348989be |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
| MD5 | 5b6c9859ac002b962a4f30d2045a44f6 |
| SHA1 | 08cd086d003bd96797fd1555ce223eb86dab61b8 |
| SHA256 | 4dd2234adc27c3fa2ea43761b5f61713daf25ae1bc703f4d80e402ce7ca27018 |
| SHA512 | 3fb76835e40b2fd9fc6260af6feea7ec4707153d661d5d4ca7efd082e392c470b4d9d640b7e0b752e17eede7972fafbcd32cec1bb057c88cde0496aa1c17a6a1 |
C:\Users\Admin\AppData\Local\Temp\~DFAD38426004830D84.TMP
| MD5 | 306d491be4a27e9b7cfabd5f06e09c57 |
| SHA1 | 4450c1f6322f0a952cb739027f6f2f6e6a753cae |
| SHA256 | a2ddd711764d91cd2c1524a4334f1b5034f3481e2c7111914213d2682e1a1f53 |
| SHA512 | 5abeb70c21ed2b86c9f4cb32a303b102691bd4e252f6631b96d704542611ac7043caf173ace0e21dd9bfae23e643b081b265478b86a4242723bcf595aa1d94c5 |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
| MD5 | 4245449e690349596d5d21fb288e3bc3 |
| SHA1 | 0ab40197339553c8dc9d04cbaef2c7ccb6fbcadb |
| SHA256 | cd44ea4d4a813bfa4a2f58ecf3501f732acf645e77f73e62f42bd829f428259d |
| SHA512 | 0a9d5156dc51415f445838ba90dc08bbd7a0cff51eddf5da5f139f903ad4ee922d9fc344aebe3eadb3d55e744945dc4c477ba5e8d99e52d1cfea54283dbbdbc7 |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
| MD5 | cf82fd99fffdac85c7b1d68a0aef0073 |
| SHA1 | 4985a76b6e56ff0712886d8492b93cd5a7424909 |
| SHA256 | fbd6a29ba1edb58f81a697f333a2ba90c35d2f86fa71c81eb53ff3664941192d |
| SHA512 | ccb2d5e442175b08ce300bc89664597691041293b1c7f86996bd2a7256e68710db47901a02531cb4545a6c31c24601e0a56c0cefc8e056658dd09e49784c1532 |
memory/2636-244-0x00007FFEF66E0000-0x00007FFEF6714000-memory.dmp
memory/2636-243-0x00007FF744F50000-0x00007FF745048000-memory.dmp
memory/2636-252-0x00007FFEF1280000-0x00007FFEF1291000-memory.dmp
memory/2636-250-0x00007FFEF54D0000-0x00007FFEF54E1000-memory.dmp
memory/2636-253-0x00007FFEEAB20000-0x00007FFEEAD2B000-memory.dmp
memory/2636-249-0x00007FFEF54F0000-0x00007FFEF5507000-memory.dmp
memory/2636-248-0x00007FFEF66C0000-0x00007FFEF66D1000-memory.dmp
memory/2636-246-0x00007FFEF68F0000-0x00007FFEF6908000-memory.dmp
memory/2636-245-0x00007FFEE9140000-0x00007FFEE93F6000-memory.dmp
memory/2636-251-0x00007FFEF12A0000-0x00007FFEF12BD000-memory.dmp
memory/2636-261-0x00007FFEE7D60000-0x00007FFEE7E6E000-memory.dmp
memory/2636-260-0x00007FFEEFDA0000-0x00007FFEEFDB1000-memory.dmp
memory/2636-259-0x00007FFEEFDC0000-0x00007FFEEFDD1000-memory.dmp
memory/2636-254-0x00007FFEE3FA0000-0x00007FFEE5050000-memory.dmp
memory/2636-258-0x00007FFEF0610000-0x00007FFEF0621000-memory.dmp
memory/2636-256-0x00007FFEF0AE0000-0x00007FFEF0B01000-memory.dmp
memory/2636-257-0x00007FFEF0630000-0x00007FFEF0648000-memory.dmp
memory/2636-255-0x00007FFEF0D40000-0x00007FFEF0D81000-memory.dmp
memory/2636-247-0x00007FFEF6750000-0x00007FFEF6767000-memory.dmp
memory/2636-323-0x00007FFEE3FA0000-0x00007FFEE5050000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\Log.tmp
| MD5 | a60b1e4aea06efbc4a992faf6b2103ed |
| SHA1 | 4e88b75b5a689b5236a920e087538b16352dfe5c |
| SHA256 | 3524ab61a42f0be7509dd5b3b50ae69a2bbf1d50c96e970228ad455b1e934039 |
| SHA512 | da59bedf276b98d3fa7ab55b663d9799448d3c622a28042c9dbe2dfa1522c20483440e2743e458a5ec388ee46e0e17b49e85175b0e66ce60d5525455b6c91a88 |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
| MD5 | 6551b09fde2bbca312eb53e274f8d400 |
| SHA1 | a10c326ed8020733409b680c37f3b8b9d2e8ebe1 |
| SHA256 | 821b6babb5350c927a0f1fef98c542de9e829f61c64143e9f414e6237d05355d |
| SHA512 | 1025d839e29a03c95da74b50d681de52e5660f8a62786abe5705ed626c4d8defc463a786042e520b2e88c437c66618d5bdb5d60aef1cd5327f6c45243719cb5a |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
| MD5 | ae9ab065b10c6a1502c2402870bb0315 |
| SHA1 | 21c9af93227491499f8947b2d56c5cf3f715970f |
| SHA256 | 1a69e68050224160e73315f4a62e4abb18df0a5d5fe573813b1cf072d7333a2e |
| SHA512 | 3d85eb8f3e80828a1b8ddf414538afcfb92ae8ded1ca60e219398019b73d9b175e40612176fd86790048e6e3f4cace4fd95c850d4f08edee969184fe65f39f0e |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
| MD5 | e8316a17f9ddfe162636dba93373621a |
| SHA1 | 8d66a815e1ad8cf3737dfaa038e2fcb39e96a149 |
| SHA256 | 8e3113e59794c927cf73157399ede177a8c048a1c1e43954341fcb6ed36276b4 |
| SHA512 | 9c57a88e899035af11bd0ed9a112361133d2c4f1d758635c8c3019ba6892004d4002af64b6314a9f08cc742d46d35275cf3c1d1d45e30621a3bc34e40fe707fe |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
| MD5 | 6f2140379346c8da0a9b59829c9d6546 |
| SHA1 | fd634e583f58e332349d503007a37ffeb4a36234 |
| SHA256 | 666971f1f784a1e44b039f2c893034b7017abd8eaf2e3ad788fef8c00ef1afd4 |
| SHA512 | 0f98c30a8a80994980f0afc861ec5b43cff070faea6aa1829b5d88e64aa941f114479aa4d2748611ffd859fc39ee5dd39cfeb496a9b6b20720d00e35ae2562b7 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
| MD5 | 30949c611a6873332a8fb30989717961 |
| SHA1 | 42001b35edfb1abf29ffab8509f82378444e14e4 |
| SHA256 | 2df6bd1d07757fa3d8d596ba74225504c86457930e8277e1ae90789a17452c57 |
| SHA512 | 5bf98fde495831b8c874bd2ec42142de2cd7532531065fa1355dda5b8df490bfc9209406e1d10991f6de9baf688eb0ed05b24df213d1b1ce6c52327eebf17dca |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\f8d3187e-afa5-4887-8f27-ca234160ba4a.tmp
| MD5 | 5058f1af8388633f609cadb75a75dc9d |
| SHA1 | 3a52ce780950d4d969792a2559cd519d7ee8c727 |
| SHA256 | cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8 |
| SHA512 | 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
| MD5 | 99914b932bd37a50b983c5e7c90ae93b |
| SHA1 | bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f |
| SHA256 | 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a |
| SHA512 | 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd |
C:\Users\Admin\AppData\Local\Temp\scoped_dir6724_526119310\426f3567-85b4-45cc-b209-b118ca593d14.tmp
| MD5 | f8e609603d53c701422bbc4e026740c8 |
| SHA1 | 5d08ba917111a8fce835be950477156720e57437 |
| SHA256 | aea99c066addc7157626d59326d8e5589402f6aac551a0560b92710ba68ded8a |
| SHA512 | 5cbdfc06d076665752b4a1aefd697f8af7dd2f673c2a65d363dde5e27e97451bbf6d6097c0b9003cccc886b1ec0cc3cd66be58c57076c181d2749249395462bc |
C:\Users\Admin\AppData\Local\Temp\ytoaly.exe
| MD5 | c249d5324c19769443136eca7c0f5551 |
| SHA1 | 0bf9b432f1308db8194ed60e0befb91b7e3cddb0 |
| SHA256 | e766bc3bd8513eadc0d54e511049f1d35bc5c503aeef6cd38aa500d39d66da11 |
| SHA512 | 5a6d602aef885c1c601a20ea1f76f7becc6f85e81480130ea85b4298f447253192b70b2490d80ab9f045b776433896648e038f7da8e10c4e81ad6ac048c726fd |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
| MD5 | 8e6a4dfbc8f5f7c12f014cb69efe2738 |
| SHA1 | 41473a27fb27c0cf8ec7ab856b636c1ecafe9fef |
| SHA256 | 6b80dc0723853e4b790889d1a2a45f1c4cd0cdabdeb13818d94499e3c6c6edbe |
| SHA512 | 665e14cc9412558b7ba7b6cc3d988e6c6ed5e5f57b00599688891cd40f319c9c46ffa3386011d6414779fceb713d99b185503a50bff6a94196b69b732ddf8688 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
| MD5 | 82685e2fcf9ba9b1e59d114e18f1d8d1 |
| SHA1 | 1983aa172428fb22e4826fde7c09a283bc53b8e1 |
| SHA256 | 6422d07834a131ed81395600c1f823933b31467854d421a5043b311905581b04 |
| SHA512 | cbbd6e82b1f0cda8c5d1a62f82c1f14defd57627c16e9dddd912579e83d114dd5550265d841a0bf9add4cf046ec554c1de8dea7e5caea154339e9810b52e2476 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
| MD5 | 20d4b8fa017a12a108c87f540836e250 |
| SHA1 | 1ac617fac131262b6d3ce1f52f5907e31d5f6f00 |
| SHA256 | 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d |
| SHA512 | 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
| MD5 | a0dfb601913acea95a20cc4cdb264b46 |
| SHA1 | 2f6ad34930c4b2fe885c80272e8672d51a86f78c |
| SHA256 | 7a91e3cde05ce9c902f05ddd703767d968fecd40b63437b7235a5672e1adc1f5 |
| SHA512 | e04125db8267c98de4f8dcf8f7ccecd69030a23c4e995d1ec0c67796db2226269ee06066cdcee02862bc291a18d9e8842c568c4d6cbe9ce47ea6b1e23e8c4559 |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
| MD5 | 0e25722ba2136b2e01171dee9ff3c98f |
| SHA1 | ebb8a47609c324b63239c8d1e21e009742086df4 |
| SHA256 | e6b82e6b62753ce3650c6c2da78abcd4cb80f82656cd23237b895093e76c79ff |
| SHA512 | 358f1af99b98be46750e2e24000dda6a3dfd0c6a6e7b0557280410601053bbf6c8cd2d2d5b901d750ee34d8b3f039d6aedc5aadd1a756a86f352a788d3b34912 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
| MD5 | e4f619f665316f800c24ddf799615977 |
| SHA1 | c769ba4329fcf833b8d780d3fc744f60b330e5e4 |
| SHA256 | 8a5ee514d7b71bed2be83c47f119c8df7098546c65725057cc2e559ef1e080c4 |
| SHA512 | 3bfa738a7247e68f9793dc15bf978f80fcd0b8bf9cca1c0525a686b6452bc702c0bac87c1d3c684db0f7d9466e7be9c27c778bb42870f1d5f7a8ce0859444f1f |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
| MD5 | 276601c862b7db805a987a5bd1ae60fb |
| SHA1 | 0ba121f59e406aecc86b3d9e246a1ad5d88aac9a |
| SHA256 | 752735b10eb305136d6f8fbce492935931a59daf5a6a12c19d9aa690c449149a |
| SHA512 | 9b373d37c52322cf2ed05aebd94f329d17e345d0aa352d009a147c870f250a0816529059f3448326618b2d2afca7ef3b5b353c3279eb93c27b1e1ea64fe548e0 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
| MD5 | 5385db4107c003d331b6550ee6c99586 |
| SHA1 | fdd88999453404d157c54c59e9867def844bceab |
| SHA256 | 99a1db84ca16c5ab57f2036725fb4edfe750e6459405cc9627d88764c2aea81d |
| SHA512 | c5d9974fd032ab096e0239f5d56e636e8a63768d04b910493fb6f1383bb77e575f600dbf64e8d48dd8e6d545dde629334da179b4e2c03af9cccebd7407af5e42 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
| MD5 | 8593c743fd8078156a57ae4f08780380 |
| SHA1 | 0d991c8b77c89360c632121ceee97861a4d3bb6a |
| SHA256 | fda4393ec32d807d2fc2c1d4258f9ce54c9407f5e8778505e1b13ccb014bce3d |
| SHA512 | 56b7dd57e29e18c919cc340acac90d26d22752922f5e554463c08d87e0f7454f9b99382ccccd78f0a4de56ac3d221c6ac53224231f761442a229ca8d3827656c |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity
| MD5 | 24f14130bbc98016ccc103d7f16865df |
| SHA1 | 480d1b0d1f4f473d23b9f36b15508c181af4f5f8 |
| SHA256 | 4d852094aceb62a02a9e45d8e9fc34ab5647c4afbe44fb1da7d91cf2926cc4b1 |
| SHA512 | 9b90557ab8e95da84b9f92cbdc892eb26d7b1af282a3ba485861243ec2a968960be5fa4835b06183dd3b140c8089519dce12a7999f976a4f4f4f707add2dadc2 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
| MD5 | 300453ea5df58d5fc831fc97eba70f7b |
| SHA1 | 9c53d3c56c8137748f802d7537a1dab915947e0b |
| SHA256 | b1bdb027f9fb9e9e282a98d488187fef05122d00fcc5690da2a119a8fc79c3c0 |
| SHA512 | 442d479b0efde33f7240d005120b5489b930bdf3c8d6b053a48ae82a8e1b7da28925521fd2e7dbe86412e6feb9ded2b492622f18ec7741b0978d1750d9fa7ac5 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
| MD5 | 367c87d00ecf99283c40e460b28f3d56 |
| SHA1 | d420aed0c119c7566a3585f3f01c81cb81aabd80 |
| SHA256 | b661c9a4c6da5b3eae97e9194bd01a0a944ec9d120517668575c94967efecba5 |
| SHA512 | 7ec625ca7f10198f2f98d7dc9d41eb1dd1da9f07cd1afa8c3d5d9693e977c0690192df6c4ae2041fe19c3919a1c864fb90bc2eb2d4980c7f4bc3892335937d56 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
| MD5 | 35942a7e1ab463364749df50a483c5fc |
| SHA1 | 6b4f8da8bdb7b4f887aca539a27751a4b561ec95 |
| SHA256 | 1e885847d3ccdeda8d2887b6872cdb11ff4374a1ef63f7f73c4b1f93ac75a420 |
| SHA512 | af23d542af857361709e25604c633e89583ed03231121febafeb4570e3feeeeca408203804fd6aa9e0d79ca10d3ad29948538e4078f32349db24c3d84144249b |
C:\Users\Admin\AppData\Local\Temp\Log.tmp
| MD5 | 14223a69a9bc994992021cabc77117dd |
| SHA1 | 818923d3af126897b2285f9dd4c95b8e240cf2ff |
| SHA256 | ac37bb367f3689946220a2332014e2d44e214e3d2c77986c8e79681e39af9578 |
| SHA512 | 0eb3bb6c120dd061b619a5bf62ce07a301c3266dcd5f763e1409d2b3f2096b2afb7c54f79036cc92f416cfd40c8f8d4ad2b94f1d6dcb39cc8255a2cb1dde6f9f |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
| MD5 | 16046289a6d90c9fc275db33a2e44d0d |
| SHA1 | 562534c837742c84a71c3169701bb152bc97313c |
| SHA256 | 693a0b32436ced38a600b960933a4986253693c96e374ad3d1b1739b6c5de8d7 |
| SHA512 | dd71653aacafe905f48a80c5da3a13955ed3c368586b481a654478a7a6d06cade9110a334a2a0d098528eb8afbad110d4cfb4ed1ed0004f5ab23f33ccb05af66 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
| MD5 | 6b2970f01267b5104cfadb572776adbf |
| SHA1 | 911a5df03ec841c1e660dfffbf7591251715fedf |
| SHA256 | 53f62638e3b422490b47da7f078754d05f756e2b2d59017faed42f32ee1a2bd7 |
| SHA512 | 75e20adf02de4de0874f474f59615b72bbfc5c891daa7f82e30c4a89a127951ba5731f6831954077c0a9b13d911fa102519222db48d248c305beca767479cd27 |
C:\Users\Admin\AppData\Local\Temp\Log.tmp
| MD5 | e58f3052561063691350d3a7c5c5eb41 |
| SHA1 | 4d7e44c71a122aed0aec3873f4be063a19e8c030 |
| SHA256 | 540bbb2833c2506d3b22767cecacdaa6f83e89b0d8389c9497141fe812b2a6de |
| SHA512 | 2298cf5086bd4ec356c35e083c9ea5f8ce45049f14889187cca9da281e2b6e9aa39a37ba827428301362a2e5e296676b16e98a57a5020c2c77e0ef1a33b9bd82 |
C:\Users\Admin\AppData\Local\Temp\Log.tmp
| MD5 | 1f0924dc27b4855a4f66717d67740dbd |
| SHA1 | f6cff15ca5cf44b320050674ec44c426c84e85b7 |
| SHA256 | d69727bc0b58a10610b428724a687b1210dd3f4db707f71ad7c2ecfc4af8830b |
| SHA512 | 35b9696f3dfb03cd7e20a238e27bf4d8e96bb247c19b9049c7626270c4e064be2fa3d0658592fa299dae04e3ff8eb51309c4829ddb258c48f762998759c2922f |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
| MD5 | bae2b4b80e1569701becd0d061e9aa3b |
| SHA1 | 29fe0e5d273b94d2ad9663f21404a8b244707bf4 |
| SHA256 | 7328bbb7fc1796509ee4a38725a6f6521e027d931c3713f81b9602cbce553471 |
| SHA512 | c742267065ef21d3badc0ad5e442a5b12a2914b32c3aefe6ce32256f49d9058945cb01711143d713dac83c79331481f93f70ae2ee1d61029bd70f1af941c150d |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
| MD5 | c9f6e20f9e758a847cabe842ed4c1700 |
| SHA1 | aa9f3ce35e28104a3165df477db5696b43ff4891 |
| SHA256 | 97f35b5df17108c5d62dbedfe3d0b8aba8facee33ee2f598d131d314ee9b26e3 |
| SHA512 | 759090199607e4934dad1d551f45f0e3dfa3f0bc7374a3a9c0e3e8b594f11a2106f372c9eff8badcf2e6342794993e0006e80601db3a686036daf32523220143 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
| MD5 | c5f8c505948b7cca676958a943d4552d |
| SHA1 | 09894d4694656bc61a84831f1361d7d2f4310872 |
| SHA256 | 9f280caa4cf75abea69f19e12e899a156b4142d6317c98814f108a3662531d2b |
| SHA512 | 9d0a1fc353f27670fbcd133eea62353ee3c4de4c3cdb539442901b445b553863924b4f04b8e6ba543c94c8800d649cc134535e3322a77be9577bac060fd5b255 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
| MD5 | d8f05ea5182468df5c130426931d0a8b |
| SHA1 | 7ed92511e58b611c812edb4a661b5a4a0f7894b9 |
| SHA256 | 6e2835b18f0cbcbc8165718ade739cb07e84ed9d769b4845a04ff1c52de5dce0 |
| SHA512 | c77f94a1503c170e8db868623c88f0e039ebbc88b7104f26ce2252778aed2578c28855876daa36bcd746ed715be653cffd88ff67944f061f8a8ed8c53294f3c1 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
| MD5 | 5f3b81c7d30d894476300ba32709cddc |
| SHA1 | 1c5bf1e4e62b068356981efd4752e42c333fa29b |
| SHA256 | b11291c66a7d2966cd851debebbe4921494173932e446f979c7f757fe4d3e6d2 |
| SHA512 | 65b8866be852259a93116f2c07f1185cb39d11039e8938ff458c8d9166af2946390c3fc09d3ed0d1c08b250a0bb267f330dbc294c1c5683fa8c19f333afa6577 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
| MD5 | d3cd8799b010bc775d37cf42f30bef80 |
| SHA1 | 436f96dbf77e900af198e789b06186af365a4b29 |
| SHA256 | 7127c72e292bab3939876cf9146fc4558e522b710c511c7a69d0000e0449e242 |
| SHA512 | 50f9b6ce6feb6f4c04ff0f7792dda3da127a4a6a577883ba2a09e51b9a4d47613d938d18a851fa3760a41ff42ddaf45910fb258bcea85f441423e64ba6e2b8cf |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
| MD5 | 2c1b44ea01981b255794f6dd6e93e427 |
| SHA1 | f0ad7fa5ed821e057e0c125b51d6b38c926e3dcc |
| SHA256 | 113791fa6bbaee78927b052160825e54511c71fcd359228500376bb5da5e5a8a |
| SHA512 | 6f27227a50e73c37f73871a2827b9f60d015697fafe08ff9457bdb9f9d384a8ea8c2ece6514b724855f1382f6a08071802ad23e81211337514d9e400d80eea43 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\data_1
| MD5 | 87347659da395274a05a6b98c20737b1 |
| SHA1 | c32c6d29af7648b5211e38bd0cd70a8c885ea2b8 |
| SHA256 | 10fb5a12bf4138f160d7e083cf9ded9265075d33e2a5ac30e71f229e18b54d17 |
| SHA512 | 8bd7d5c5b4eed458384191c86ba766a6c4249f72b43c5ccf071ea31df8599c06177022dd055e34192d6bf70b0412679b64da503abd871aea6bbdbcff9691aab6 |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
| MD5 | 52b6f75ce28fa46c97e947b7dd84e112 |
| SHA1 | b78c17c623d7e79adb220b4ffc4c534f1123d550 |
| SHA256 | 47abc333e0cb5337c4a51401fbf7d447b18e605725f1cc016d13889746e464b5 |
| SHA512 | 1c3cd55278423c4ac85a6303708bc1574e96f1f63eacf0c0a86806c10543392770735b6f3d0f8dee4751f09e769615cd24f2c7af74ae3dd6c42274a362593f31 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
| MD5 | a976c3d309d95d65abc9d05d73e1b04b |
| SHA1 | a712024bf2aa56c8f6a6134016b3e407887a5698 |
| SHA256 | 26cffd04a3bcc5681a0777c0e00238920fd1e89bbbb8db1e70a0c09657f82967 |
| SHA512 | 85bfe135ebe5036a5617471ab3d25993c6cc3f78a079928becad4090a11a52ce7d0e091ee9ce215424e4e93d302e9508bbf07a137d14aa440a7dd5b08423c4ff |